console

package
v0.0.0-...-e6b51b8 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Mar 27, 2026 License: Apache-2.0 Imports: 22 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	ErrTenantNotFound           = errors.New("tenant not found")
	ErrAgentNotFound            = errors.New("agent not found")
	ErrAgentIntegrationNotFound = errors.New("agent integration not found")
	ErrAPIKeyNotFound           = errors.New("api key not found")
	ErrAPIKeyAlreadyRevoked     = errors.New("api key already revoked")
	ErrAlertRuleNotFound        = errors.New("alert rule not found")
	ErrSessionTenantRequired    = errors.New("tenant_id required for ambiguous session_id")
	ErrInviteTokenInvalid       = errors.New("invalid or expired invite token")
	ErrResetTokenInvalid        = errors.New("invalid or expired password reset token")
	ErrResetUserNotFound        = errors.New("password reset token email does not map to a user")
)

Functions

func GenerateToken 

func GenerateToken(cfg JWTConfig, claims JWTClaims) (string, error)

GenerateToken creates a new HS256 JWT token.

func SessionTenantCandidates 

func SessionTenantCandidates(err error) []string

Types

type APIKey 

type APIKey struct {
	ID         string     `json:"id"`
	TenantID   string     `json:"tenant_id"`
	Name       string     `json:"name"`
	KeyPrefix  string     `json:"key_prefix"`
	Status     string     `json:"status"`
	CreatedAt  time.Time  `json:"created_at"`
	ExpiresAt  *time.Time `json:"expires_at,omitempty"`
	IsPrimary  bool       `json:"is_primary"`
	RevokedAt  *time.Time `json:"revoked_at,omitempty"`
	LastUsedAt *time.Time `json:"last_used_at,omitempty"`
}

type APIKeyCreateResult 

type APIKeyCreateResult struct {
	APIKey
	RawKey string `json:"raw_key"`
}

type Agent 

type Agent struct {
	ID        string          `json:"id"`
	TenantID  string          `json:"tenant_id"`
	Name      string          `json:"name"`
	Status    string          `json:"status"`
	Labels    json.RawMessage `json:"-"` // internal-only generic metadata; not part of the operator-facing agent contract
	CreatedAt time.Time       `json:"created_at"`
}

type AgentBreakdownRow 

type AgentBreakdownRow struct {
	AgentID      string `json:"agent_id"`
	AllowCount   int64  `json:"allow_count"`
	DenyCount    int64  `json:"deny_count"`
	ApproveCount int64  `json:"approve_count"`
	Total        int64  `json:"total"`
}

type AgentIntegration 

type AgentIntegration struct {
	ID               string                 `json:"id"`
	TenantID         string                 `json:"tenant_id"`
	AgentID          string                 `json:"agent_id"`
	Runtime          string                 `json:"runtime"`
	EnvironmentLabel string                 `json:"environment_label,omitempty"`
	OwnerName        string                 `json:"owner_name,omitempty"`
	Description      string                 `json:"description,omitempty"`
	ApprovalPosture  string                 `json:"approval_posture,omitempty"`
	Tools            []AgentIntegrationTool `json:"tools,omitempty"`
	CreatedAt        time.Time              `json:"created_at"`
	UpdatedAt        time.Time              `json:"updated_at"`
}

type AgentIntegrationRevision 

type AgentIntegrationRevision struct {
	ID               string                 `json:"id"`
	IntegrationID    string                 `json:"integration_id"`
	TenantID         string                 `json:"tenant_id"`
	AgentID          string                 `json:"agent_id"`
	Mode             string                 `json:"mode"`
	Runtime          string                 `json:"runtime"`
	EnvironmentLabel string                 `json:"environment_label,omitempty"`
	OwnerName        string                 `json:"owner_name,omitempty"`
	Description      string                 `json:"description,omitempty"`
	ApprovalPosture  string                 `json:"approval_posture,omitempty"`
	Tools            []AgentIntegrationTool `json:"tools,omitempty"`
	CreatedAt        time.Time              `json:"created_at"`
}

type AgentIntegrationTool 

type AgentIntegrationTool struct {
	Tool   string `json:"tool"`
	Action string `json:"action"`
}

type AgentIntegrationUpsertInput 

type AgentIntegrationUpsertInput struct {
	TenantID         string
	AgentID          string
	Mode             string
	Runtime          string
	EnvironmentLabel string
	OwnerName        string
	Description      string
	ApprovalPosture  string
	Tools            []AgentIntegrationTool
}

type AlertEvent 

type AlertEvent struct {
	ID            string          `json:"id"`
	RuleID        string          `json:"rule_id"`
	TenantID      string          `json:"tenant_id"`
	Severity      string          `json:"severity"`
	Message       string          `json:"message"`
	ContextJSON   json.RawMessage `json:"context_json,omitempty"`
	Status        string          `json:"status"`
	DeliveredAt   *time.Time      `json:"delivered_at,omitempty"`
	AttemptCount  int             `json:"attempt_count"`
	NextAttemptAt time.Time       `json:"next_attempt_at,omitempty"`
	LastError     string          `json:"last_error,omitempty"`
	CreatedAt     time.Time       `json:"created_at"`
}

type AlertRule 

type AlertRule struct {
	ID        string          `json:"id"`
	TenantID  string          `json:"tenant_id"`
	Name      string          `json:"name"`
	RuleType  string          `json:"rule_type"`
	Config    json.RawMessage `json:"config"`
	Enabled   bool            `json:"enabled"`
	CreatedAt time.Time       `json:"created_at"`
	UpdatedAt time.Time       `json:"updated_at"`
}

type AnalyticsOverview 

type AnalyticsOverview struct {
	TotalEvents      int64 `json:"total_events"`
	AllowCount       int64 `json:"allow_count"`
	DenyCount        int64 `json:"deny_count"`
	ApproveCount     int64 `json:"approve_count"`
	PendingApprovals int64 `json:"pending_approvals"`
	ActiveTenants    int64 `json:"active_tenants"`
	ActiveAgents     int64 `json:"active_agents"`
}

type AuthSession 

type AuthSession struct {
	ID         string     `json:"id"`
	UserID     string     `json:"user_id"`
	Email      string     `json:"email"`
	Name       string     `json:"name"`
	TenantID   string     `json:"tenant_id,omitempty"`
	Roles      []string   `json:"roles"`
	UserAgent  string     `json:"user_agent,omitempty"`
	ClientIP   string     `json:"client_ip,omitempty"`
	CreatedAt  time.Time  `json:"created_at"`
	LastSeenAt time.Time  `json:"last_seen_at"`
	ExpiresAt  time.Time  `json:"expires_at"`
	RevokedAt  *time.Time `json:"revoked_at,omitempty"`
	RevokedBy  string     `json:"revoked_by,omitempty"`
}

type AuthSessionCreateInput 

type AuthSessionCreateInput struct {
	UserID    string
	Email     string
	Name      string
	TenantID  string
	Roles     []string
	UserAgent string
	ClientIP  string
	ExpiresAt time.Time
}

type DecisionTotals 

type DecisionTotals struct {
	TotalEvents  int64 `json:"total_events"`
	AllowCount   int64 `json:"allow_count"`
	DenyCount    int64 `json:"deny_count"`
	ApproveCount int64 `json:"approve_count"`
}

type DecisionTrendBucket 

type DecisionTrendBucket struct {
	Bucket       time.Time `json:"bucket"`
	Total        int64     `json:"total"`
	AllowCount   int64     `json:"allow_count"`
	DenyCount    int64     `json:"deny_count"`
	ApproveCount int64     `json:"approve_count"`
}

type EventDetail 

type EventDetail struct {
	EventListItem
	PayloadJSON  json.RawMessage `json:"payload_json"`
	PolicyResult json.RawMessage `json:"policy_result,omitempty"`
	Hash         string          `json:"hash"`
	PrevHash     string          `json:"prev_hash"`
	Result       *EventResult    `json:"result,omitempty"`
}

type EventListFilters 

type EventListFilters struct {
	TenantID  string
	AgentID   string
	UserID    string
	TraceID   string
	Tool      string
	Action    string
	Decision  string
	SessionID string
	RiskMin   *int
	RiskMax   *int
	Since     *time.Time
	Until     *time.Time
	Limit     int
	Offset    int
}

type EventListItem 

type EventListItem struct {
	EventID    string    `json:"event_id"`
	TenantID   string    `json:"tenant_id"`
	AgentID    string    `json:"agent_id"`
	UserID     string    `json:"user_id,omitempty"`
	UserName   string    `json:"user_name,omitempty"`
	UserEmail  string    `json:"user_email,omitempty"`
	Tool       string    `json:"tool"`
	Action     string    `json:"action"`
	Resource   string    `json:"resource"`
	RiskScore  int       `json:"risk_score"`
	Decision   string    `json:"decision"`
	Reason     string    `json:"reason,omitempty"`
	SessionID  string    `json:"session_id"`
	TraceID    string    `json:"trace_id"`
	ReceivedAt time.Time `json:"received_at"`
}

type EventResult 

type EventResult struct {
	Status     string          `json:"status"`
	OutputJSON json.RawMessage `json:"output_json,omitempty"`
	ErrorMsg   string          `json:"error_msg,omitempty"`
	DurationMS int64           `json:"duration_ms"`
}

type Invite 

type Invite struct {
	Token       string     `json:"token,omitempty"`
	Email       string     `json:"email"`
	TenantID    string     `json:"tenant_id"`
	Role        string     `json:"role"`
	Name        string     `json:"name"`
	CreatedAt   time.Time  `json:"created_at"`
	ExpiresAt   time.Time  `json:"expires_at"`
	EmailStatus string     `json:"email_status,omitempty"`
	EmailSentAt *time.Time `json:"email_sent_at,omitempty"`
	EmailError  string     `json:"email_error,omitempty"`
}

type InviteAcceptResult 

type InviteAcceptResult struct {
	User     *User  `json:"user"`
	TenantID string `json:"tenant_id"`
	Role     string `json:"role"`
}

InviteAcceptResult is the structured response payload for the invite acceptance flow. It includes the created/updated user plus the assigned tenant-scoped role metadata.

type JWTClaims 

type JWTClaims struct {
	Sub    string   `json:"sub"`
	SID    string   `json:"sid,omitempty"`
	Email  string   `json:"email"`
	Name   string   `json:"name"`
	Roles  []string `json:"roles"`
	Tenant string   `json:"tenant,omitempty"`
	Iss    string   `json:"iss"`
	Iat    int64    `json:"iat"`
	Exp    int64    `json:"exp"`
}

JWTClaims represents the claims in a JWT token.

func ValidateToken 

func ValidateToken(cfg JWTConfig, tokenStr string) (*JWTClaims, error)

ValidateToken parses and validates a JWT token.

type JWTConfig 

type JWTConfig struct {
	Secret      string
	Issuer      string
	ExpiryHours int
}

JWTConfig holds JWT signing configuration.

type OnboardingChecklist 

type OnboardingChecklist struct {
	HasAPIKey    bool `json:"has_api_key"`
	HasApprover  bool `json:"has_approver"`
	HasToolcall  bool `json:"has_toolcall"`
	HasApproval  bool `json:"has_approval"`
	HasExecution bool `json:"has_execution"`
}

type OnboardingCreateStateInput 

type OnboardingCreateStateInput struct {
	ExistingTenantID string
	NewTenantName    string
	AgentName        string
	APIKeyName       string
	APIKeyExpiresAt  *time.Time
	PolicyConfig     *TenantPolicyConfig
	Integration      AgentIntegrationUpsertInput
}

type OnboardingCreateStateResult 

type OnboardingCreateStateResult struct {
	Tenant        *Tenant
	CreatedTenant bool
	Agent         *Agent
	APIKey        *APIKeyCreateResult
	Integration   *AgentIntegration
}

type PilotAction 

type PilotAction struct {
	ID          string `json:"id"`
	Title       string `json:"title"`
	Description string `json:"description"`
	Path        string `json:"path,omitempty"`
	Severity    string `json:"severity,omitempty"`
}

type PilotApprovalSummary 

type PilotApprovalSummary struct {
	RequestID  string     `json:"request_id"`
	EventID    string     `json:"event_id"`
	Tool       string     `json:"tool"`
	Action     string     `json:"action"`
	Status     string     `json:"status"`
	CreatedAt  time.Time  `json:"created_at"`
	ResolvedAt *time.Time `json:"resolved_at,omitempty"`
	LatencyMS  *int64     `json:"latency_ms,omitempty"`
}

type PilotConnectorFailure 

type PilotConnectorFailure struct {
	Tool         string    `json:"tool"`
	Action       string    `json:"action"`
	Status       string    `json:"status"`
	ErrorMessage string    `json:"error_message"`
	Count        int64     `json:"count"`
	LastSeenAt   time.Time `json:"last_seen_at"`
}

type PilotDenyReason 

type PilotDenyReason struct {
	Reason     string    `json:"reason"`
	Count      int64     `json:"count"`
	LastSeenAt time.Time `json:"last_seen_at"`
}

type PilotEventSummary 

type PilotEventSummary struct {
	EventID    string    `json:"event_id"`
	AgentID    string    `json:"agent_id"`
	Tool       string    `json:"tool"`
	Action     string    `json:"action"`
	Decision   string    `json:"decision"`
	SessionID  string    `json:"session_id"`
	TraceID    string    `json:"trace_id"`
	ReceivedAt time.Time `json:"received_at"`
}

type PilotHealthSummary 

type PilotHealthSummary struct {
	Status                  string                  `json:"status"`
	StatusReason            string                  `json:"status_reason"`
	LastEvent               *PilotEventSummary      `json:"last_event,omitempty"`
	LastSession             *PilotSessionSummary    `json:"last_session,omitempty"`
	LastApproval            *PilotApprovalSummary   `json:"last_approval,omitempty"`
	PendingApprovals        int64                   `json:"pending_approvals"`
	OldestPendingApprovalAt *time.Time              `json:"oldest_pending_approval_at,omitempty"`
	ExecutionSuccessCount   int64                   `json:"execution_success_count"`
	ExecutionTotal          int64                   `json:"execution_total"`
	ExecutionSuccessRate    float64                 `json:"execution_success_rate"`
	MissingSessionCount     int64                   `json:"missing_session_count"`
	MissingTraceCount       int64                   `json:"missing_trace_count"`
	MissingSessionRate      float64                 `json:"missing_session_rate"`
	MissingTraceRate        float64                 `json:"missing_trace_rate"`
	TopConnectorFailures    []PilotConnectorFailure `json:"top_connector_failures"`
	TopDenyReasons          []PilotDenyReason       `json:"top_deny_reasons"`
	NextActions             []PilotAction           `json:"next_actions"`
}

type PilotSessionSummary 

type PilotSessionSummary struct {
	SessionID   string    `json:"session_id"`
	AgentID     string    `json:"agent_id"`
	LastEventID string    `json:"last_event_id"`
	LastEventAt time.Time `json:"last_event_at"`
}

type PolicyVersion 

type PolicyVersion struct {
	ID         int64           `json:"id"`
	TenantID   *string         `json:"tenant_id,omitempty"`
	BundleHash string          `json:"bundle_hash"`
	Version    string          `json:"version"`
	PolicyData json.RawMessage `json:"policy_data,omitempty"`
	DeployedBy string          `json:"deployed_by,omitempty"`
	DeployedAt time.Time       `json:"deployed_at"`
	Notes      string          `json:"notes,omitempty"`
}

type RiskHeatmapRow 

type RiskHeatmapRow struct {
	RiskScore    int   `json:"risk_score"`
	AllowCount   int64 `json:"allow_count"`
	DenyCount    int64 `json:"deny_count"`
	ApproveCount int64 `json:"approve_count"`
	Total        int64 `json:"total"`
}

type Session 

type Session struct {
	ID            string     `json:"id"`
	TenantID      string     `json:"tenant_id"`
	AgentID       string     `json:"agent_id"`
	UserID        string     `json:"user_id,omitempty"`
	UserName      string     `json:"user_name,omitempty"`
	UserEmail     string     `json:"user_email,omitempty"`
	TraceID       string     `json:"trace_id,omitempty"`
	StartedAt     time.Time  `json:"started_at"`
	LastEventAt   time.Time  `json:"last_event_at"`
	EndedAt       *time.Time `json:"ended_at,omitempty"`
	EventCount    int64      `json:"event_count"`
	AllowCount    int64      `json:"allow_count"`
	DenyCount     int64      `json:"deny_count"`
	ApproveCount  int64      `json:"approve_count"`
	LastEventID   string     `json:"last_event_id,omitempty"`
	LastTool      string     `json:"last_tool,omitempty"`
	LastAction    string     `json:"last_action,omitempty"`
	LastDecision  string     `json:"last_decision,omitempty"`
	LastResource  string     `json:"last_resource,omitempty"`
	LastRiskScore int        `json:"last_risk_score,omitempty"`
}

type SessionApprovalSummary 

type SessionApprovalSummary struct {
	ID         string    `json:"id"`
	Status     string    `json:"status"`
	Reason     string    `json:"reason,omitempty"`
	DenyReason string    `json:"deny_reason,omitempty"`
	CreatedAt  time.Time `json:"created_at"`
	ExpiresAt  time.Time `json:"expires_at"`
}

type SessionExecutionSummary 

type SessionExecutionSummary struct {
	EventID      string          `json:"event_id"`
	ReceivedAt   time.Time       `json:"received_at"`
	Status       string          `json:"status"`
	OutputJSON   json.RawMessage `json:"output_json,omitempty"`
	ErrorMsg     string          `json:"error_msg,omitempty"`
	DurationMS   int64           `json:"duration_ms"`
	PolicyReason string          `json:"policy_reason,omitempty"`
}

type SessionFilters 

type SessionFilters struct {
	TenantID  string
	SessionID string
	AgentID   string
	UserID    string
	TraceID   string
	Tool      string
	Action    string
	Decision  string
	RiskMin   *int
	RiskMax   *int
	Since     *time.Time
	Until     *time.Time
	Limit     int
	Offset    int
}

type SessionTenantAmbiguityError 

type SessionTenantAmbiguityError struct {
	Candidates []string
}

func (*SessionTenantAmbiguityError) Error 

func (e *SessionTenantAmbiguityError) Error() string

func (*SessionTenantAmbiguityError) Is 

func (e *SessionTenantAmbiguityError) Is(target error) bool

type SessionTimelineEvent 

type SessionTimelineEvent struct {
	EventListItem
	PolicyReason string                   `json:"policy_reason,omitempty"`
	RiskFactors  []string                 `json:"risk_factors,omitempty"`
	Approval     *SessionApprovalSummary  `json:"approval,omitempty"`
	Execution    *SessionExecutionSummary `json:"execution,omitempty"`
	Explain      string                   `json:"explain"`
}

type Store 

type Store struct {
	// contains filtered or unexported fields
}

func NewStore 

func NewStore(pool *pgxpool.Pool) *Store

func (*Store) AlertEventExistsInWindow 

func (s *Store) AlertEventExistsInWindow(ctx context.Context, tenantID, ruleID string, since time.Time) (bool, error)

func (*Store) AssignTenantRole 

func (s *Store) AssignTenantRole(ctx context.Context, userID, tenantID, role string) error

AssignTenantRole inserts a role assignment into user_roles.

func (*Store) AssignUserRole 

func (s *Store) AssignUserRole(ctx context.Context, userID string, tenantID *string, role string) error

AssignUserRole assigns a user role for a tenant. For role='platform_admin', tenantID must be nil.

func (*Store) AuthenticateUser 

func (s *Store) AuthenticateUser(ctx context.Context, email, password string) (*User, []UserRole, error)

func (*Store) ClaimPendingAlertEventsDue 

func (s *Store) ClaimPendingAlertEventsDue(ctx context.Context, limit int) ([]AlertEvent, error)

func (*Store) ConsumeInviteAccept 

func (s *Store) ConsumeInviteAccept(ctx context.Context, token, password, name string) (*InviteAcceptResult, error)

func (*Store) ConsumePasswordReset 

func (s *Store) ConsumePasswordReset(ctx context.Context, token, password string) error

func (*Store) CountDenyToolEventsInWindow 

func (s *Store) CountDenyToolEventsInWindow(ctx context.Context, tenantID string, since time.Time) (int, error)

func (*Store) CountEventsInRange 

func (s *Store) CountEventsInRange(ctx context.Context, tenantID string, since, until time.Time) (int, error)

ListEventsInRange returns events for a tenant within a time range (for exports/bundles).

func (*Store) CreateAPIKey 

func (s *Store) CreateAPIKey(ctx context.Context, tenantID, name string, expiresAt *time.Time) (*APIKeyCreateResult, error)

func (*Store) CreateAgent 

func (s *Store) CreateAgent(ctx context.Context, tenantID, name string) (*Agent, error)

func (*Store) CreateAgentWithLabels 

func (s *Store) CreateAgentWithLabels(ctx context.Context, tenantID, name string, labels json.RawMessage) (*Agent, error)

func (*Store) CreateAlertEvent 

func (s *Store) CreateAlertEvent(ctx context.Context, ruleID, tenantID, severity, message string, contextJSON json.RawMessage) (*AlertEvent, error)

func (*Store) CreateAlertRule 

func (s *Store) CreateAlertRule(ctx context.Context, rule AlertRule) (*AlertRule, error)

func (*Store) CreateAuthSession 

func (s *Store) CreateAuthSession(ctx context.Context, in AuthSessionCreateInput) (*AuthSession, error)

func (*Store) CreateInvite 

func (s *Store) CreateInvite(ctx context.Context, token, email, tenantID, role, name string, expiresAt time.Time) error

func (*Store) CreateOnboardingState 

func (s *Store) CreateOnboardingState(ctx context.Context, in OnboardingCreateStateInput) (*OnboardingCreateStateResult, error)

func (*Store) CreatePasswordReset 

func (s *Store) CreatePasswordReset(ctx context.Context, token, email string, expiresAt time.Time) error

func (*Store) CreatePolicyVersion 

func (s *Store) CreatePolicyVersion(ctx context.Context, tenantID *string, version, bundleHash, deployedBy, notes string, policyData json.RawMessage) (*PolicyVersion, error)

func (*Store) CreateTenant 

func (s *Store) CreateTenant(ctx context.Context, name string, config json.RawMessage) (*Tenant, error)

func (*Store) CreateUser 

func (s *Store) CreateUser(ctx context.Context, email, password, name, role string, tenantID *string, slackUserID *string) (*User, error)

func (*Store) CreateUserBare 

func (s *Store) CreateUserBare(ctx context.Context, email string, password *string, name string, slackUserID *string) (*User, error)

CreateUserBare creates a user record without assigning any roles. password may be nil to create a user without credentials (invite/reset flow).

func (*Store) DeleteAlertRule 

func (s *Store) DeleteAlertRule(ctx context.Context, tenantID, ruleID string) error

func (*Store) ExportEventsCSV 

func (s *Store) ExportEventsCSV(ctx context.Context, tenantID string, since, until time.Time, w io.Writer) error

func (*Store) ExportSessionCSV 

func (s *Store) ExportSessionCSV(ctx context.Context, sessionID, tenantScope, tenantHint string, w io.Writer) error

func (*Store) GetAgentByTenantID 

func (s *Store) GetAgentByTenantID(ctx context.Context, tenantID, agentID string) (*Agent, error)

func (*Store) GetAgentIntegration 

func (s *Store) GetAgentIntegration(ctx context.Context, tenantID, agentID string) (*AgentIntegration, error)

func (*Store) GetAlertRule 

func (s *Store) GetAlertRule(ctx context.Context, tenantID, ruleID string) (*AlertRule, error)

func (*Store) GetAnalyticsOverview 

func (s *Store) GetAnalyticsOverview(ctx context.Context, tenantID string, since time.Time) (*AnalyticsOverview, error)

func (*Store) GetDecisionTimeseries 

func (s *Store) GetDecisionTimeseries(ctx context.Context, tenantID string, since time.Time, bucketMinutes int) ([]map[string]any, error)

func (*Store) GetEventDetail 

func (s *Store) GetEventDetail(ctx context.Context, eventID string) (*EventDetail, error)

func (*Store) GetInvite 

func (s *Store) GetInvite(ctx context.Context, token string) (*Invite, error)

func (*Store) GetPolicyVersion 

func (s *Store) GetPolicyVersion(ctx context.Context, id int64) (*PolicyVersion, error)

func (*Store) GetSession 

func (s *Store) GetSession(ctx context.Context, sessionID, tenantScope, tenantHint string) (*Session, error)

func (*Store) GetSessionTimeline 

func (s *Store) GetSessionTimeline(ctx context.Context, sessionID, tenantScope, tenantHint string) ([]SessionTimelineEvent, error)

func (*Store) GetTenant 

func (s *Store) GetTenant(ctx context.Context, id string) (*Tenant, error)

func (*Store) GetTenantAnalyticsSummary 

func (s *Store) GetTenantAnalyticsSummary(ctx context.Context, tenantID string, since time.Time, bucketMinutes int, topAgents int) (*TenantAnalyticsSummary, error)

func (*Store) GetTenantNotificationConfig 

func (s *Store) GetTenantNotificationConfig(ctx context.Context, tenantID string) (*TenantNotificationConfig, bool, error)

func (*Store) GetTenantPolicyConfig 

func (s *Store) GetTenantPolicyConfig(ctx context.Context, tenantID string) (*TenantPolicyConfig, bool, error)

func (*Store) GetUsageCounters 

func (s *Store) GetUsageCounters(ctx context.Context, tenantID string, since time.Time) ([]UsageCounter, error)

GetUsageCounters returns daily usage counters for a tenant since the given timestamp, ordered by date ascending.

func (*Store) GetUser 

func (s *Store) GetUser(ctx context.Context, id string) (*User, error)

func (*Store) GetUserByEmail 

func (s *Store) GetUserByEmail(ctx context.Context, email string) (*User, error)

GetUserByEmail returns the user for an email (case-insensitive).

func (*Store) GetUserBySlackUserID 

func (s *Store) GetUserBySlackUserID(ctx context.Context, slackUserID string) (*User, error)

GetUserBySlackUserID returns the user linked to a Slack user id.

func (*Store) GetUserRoleByID 

func (s *Store) GetUserRoleByID(ctx context.Context, userID, roleAssignmentID string) (*UserRole, error)

GetUserRoleByID fetches a specific user_roles row by its assignment id.

func (*Store) GetUserRoles 

func (s *Store) GetUserRoles(ctx context.Context, userID string) ([]UserRole, error)

func (*Store) IncrementUsageCounter 

func (s *Store) IncrementUsageCounter(ctx context.Context, tenantID string, field string) error

IncrementUsageCounter atomically increments a daily usage counter for the given tenant. Field must be one of: requests, approvals, executions, connector_calls.

func (*Store) ListAPIKeys 

func (s *Store) ListAPIKeys(ctx context.Context, tenantID string) ([]APIKey, error)

func (*Store) ListActiveAuthSessionCounts 

func (s *Store) ListActiveAuthSessionCounts(ctx context.Context, tenantID string) (map[string]int64, error)

func (*Store) ListAgentIntegrationRevisions 

func (s *Store) ListAgentIntegrationRevisions(ctx context.Context, tenantID, agentID string, limit int) ([]AgentIntegrationRevision, error)

func (*Store) ListAgents 

func (s *Store) ListAgents(ctx context.Context, tenantID string, limit, offset int) ([]Agent, error)

func (*Store) ListAgentsFiltered 

func (s *Store) ListAgentsFiltered(ctx context.Context, tenantID string, includeDisabled bool, limit, offset int) ([]Agent, error)

func (*Store) ListAlertEvents 

func (s *Store) ListAlertEvents(ctx context.Context, tenantID string, limit, offset int) ([]AlertEvent, error)

func (*Store) ListAlertEventsSince 

func (s *Store) ListAlertEventsSince(ctx context.Context, tenantID string, since time.Time, limit int) ([]AlertEvent, error)

func (*Store) ListAlertRules 

func (s *Store) ListAlertRules(ctx context.Context, tenantID string) ([]AlertRule, error)

func (*Store) ListAuthSessions 

func (s *Store) ListAuthSessions(ctx context.Context, tenantID, userID string, limit, offset int) ([]AuthSession, error)

func (*Store) ListConnectors 

func (s *Store) ListConnectors(ctx context.Context) ([]map[string]any, error)

func (*Store) ListEnabledDenySpikeRules 

func (s *Store) ListEnabledDenySpikeRules(ctx context.Context) ([]AlertRule, error)

func (*Store) ListEventDetailsInRange 

func (s *Store) ListEventDetailsInRange(ctx context.Context, tenantID string, since, until time.Time, limit int) ([]EventDetail, error)

func (*Store) ListEvents 

func (s *Store) ListEvents(ctx context.Context, filters EventListFilters) ([]EventListItem, error)

func (*Store) ListEventsInRange 

func (s *Store) ListEventsInRange(ctx context.Context, tenantID string, since, until time.Time, limit int) ([]EventListItem, error)

ListEventsInRange returns events for a tenant within a time range (for exports/bundles).

func (*Store) ListInvites 

func (s *Store) ListInvites(ctx context.Context, tenantID *string, limit, offset int) ([]Invite, error)

func (*Store) ListPolicyVersions 

func (s *Store) ListPolicyVersions(ctx context.Context, tenantID string, limit int) ([]PolicyVersion, error)

func (*Store) ListSessionTenantCandidates 

func (s *Store) ListSessionTenantCandidates(ctx context.Context, sessionID string, limit int) ([]string, error)

func (*Store) ListSessions 

func (s *Store) ListSessions(ctx context.Context, filters SessionFilters) ([]Session, error)

func (*Store) ListTenantApprovers 

func (s *Store) ListTenantApprovers(ctx context.Context, tenantID string) ([]User, error)

ListTenantApprovers lists all users with role='approver' scoped to a tenant.

func (*Store) ListTenants 

func (s *Store) ListTenants(ctx context.Context, limit, offset int) ([]Tenant, error)

func (*Store) ListUsers 

func (s *Store) ListUsers(ctx context.Context, tenantID *string, emailQuery string, limit, offset int) ([]User, error)

func (*Store) LookupAPIKey 

func (s *Store) LookupAPIKey(ctx context.Context, rawKey string) (tenantID string, keyID string, err error)

func (*Store) MarkAlertEventPendingRetry 

func (s *Store) MarkAlertEventPendingRetry(ctx context.Context, eventID string, attempts int, next time.Time, lastErr string) error

func (*Store) MarkAlertEventSent 

func (s *Store) MarkAlertEventSent(ctx context.Context, eventID string) error

func (*Store) PersistOnboardingIntegration 

func (s *Store) PersistOnboardingIntegration(ctx context.Context, tenantID, agentID string, integration AgentIntegrationUpsertInput) (*AgentIntegration, error)

func (*Store) Pool 

func (s *Store) Pool() *pgxpool.Pool

Pool exposes the underlying connection pool for ad-hoc queries (e.g., approval grant creation in the console-api).

func (*Store) RemoveTenantRole 

func (s *Store) RemoveTenantRole(ctx context.Context, userID, tenantID, role string) (bool, error)

RemoveTenantRole removes a role assignment from user_roles.

func (*Store) RemoveUserRoleByID 

func (s *Store) RemoveUserRoleByID(ctx context.Context, userID, roleAssignmentID string) (bool, error)

RemoveUserRoleByID removes a user role assignment by its role assignment id.

func (*Store) RevokeAPIKeyForTenant 

func (s *Store) RevokeAPIKeyForTenant(ctx context.Context, tenantID, keyID string) error

func (*Store) RevokeAuthSession 

func (s *Store) RevokeAuthSession(ctx context.Context, sessionID, tenantID, revokedBy string, now time.Time) (bool, error)

func (*Store) RotateAPIKeys 

func (s *Store) RotateAPIKeys(ctx context.Context, tenantID string) (*APIKeyCreateResult, error)

func (*Store) RotateAPIKeysPrimary 

func (s *Store) RotateAPIKeysPrimary(
	ctx context.Context,
	tenantID, name string,
	expiresAt *time.Time,
	makePrimary bool,
	revokeOldPrimary bool,
) (*APIKeyCreateResult, error)

RotateAPIKeysPrimary implements the UX workflow: create new key -> (optionally) mark it as primary -> (optionally) revoke the previous active primary key.

func (*Store) SetTenantNotificationConfig 

func (s *Store) SetTenantNotificationConfig(ctx context.Context, tenantID string, cfg TenantNotificationConfig) error

func (*Store) SetTenantPolicyConfig 

func (s *Store) SetTenantPolicyConfig(ctx context.Context, tenantID string, cfg TenantPolicyConfig) error

func (*Store) SetUserPassword 

func (s *Store) SetUserPassword(ctx context.Context, userID string, password string) error

SetUserPassword updates the user's password (hashed) and ensures status is active.

func (*Store) SetUserSlackUserIDIfEmpty 

func (s *Store) SetUserSlackUserIDIfEmpty(ctx context.Context, userID string, slackUserID string) (bool, error)

SetUserSlackUserIDIfEmpty links a user to a Slack user id only if slack_user_id is currently NULL.

func (*Store) TouchAuthSession 

func (s *Store) TouchAuthSession(ctx context.Context, sessionID, userID string, seenAt time.Time) (bool, error)

func (*Store) UpdateAgentLabelsForTenant 

func (s *Store) UpdateAgentLabelsForTenant(ctx context.Context, tenantID, agentID string, labels json.RawMessage) error

func (*Store) UpdateAgentStatus 

func (s *Store) UpdateAgentStatus(ctx context.Context, id, status string) error

func (*Store) UpdateAgentStatusForTenant 

func (s *Store) UpdateAgentStatusForTenant(ctx context.Context, tenantID, agentID, status string) error

func (*Store) UpdateAlertRule 

func (s *Store) UpdateAlertRule(ctx context.Context, tenantID, id string, name string, ruleType string, config json.RawMessage, enabled bool) error

func (*Store) UpdateInviteEmailStatus 

func (s *Store) UpdateInviteEmailStatus(ctx context.Context, token, status string, sentAt *time.Time, emailError string) error

func (*Store) UpdateTenantStatus 

func (s *Store) UpdateTenantStatus(ctx context.Context, id, status string) error

func (*Store) UpsertAgentIntegration 

func (s *Store) UpsertAgentIntegration(ctx context.Context, in AgentIntegrationUpsertInput) (*AgentIntegration, error)

type Tenant 

type Tenant struct {
	ID        string          `json:"id"`
	Name      string          `json:"name"`
	Status    string          `json:"status"`
	Config    json.RawMessage `json:"config"`
	CreatedAt time.Time       `json:"created_at"`
}

type TenantAnalyticsSummary 

type TenantAnalyticsSummary struct {
	RangeStart          time.Time             `json:"range_start"`
	RangeEnd            time.Time             `json:"range_end"`
	Totals              DecisionTotals        `json:"totals"`
	Trend               []DecisionTrendBucket `json:"trend"`
	RiskHeatmap         []RiskHeatmapRow      `json:"risk_heatmap"`
	PerAgent            []AgentBreakdownRow   `json:"per_agent"`
	OnboardingChecklist OnboardingChecklist   `json:"onboarding_checklist"`
	PilotHealth         PilotHealthSummary    `json:"pilot_health"`
}

type TenantNotificationConfig 

type TenantNotificationConfig struct {
	ApproverGroup string               `json:"approver_group,omitempty"`
	Notify        []types.PolicyNotify `json:"notify,omitempty"`
}

TenantNotificationConfig is the DB-persisted per-tenant routing config used to build approval notification outbox entries.

Stored inside tenants.config under `notification_config`.

type TenantPolicyConfig 

type TenantPolicyConfig struct {
	MaxRiskAutoApprove         int      `json:"max_risk_auto_approve"`
	ReadActions                []string `json:"read_actions,omitempty"`
	WriteActions               []string `json:"write_actions,omitempty"`
	DestructiveActions         []string `json:"destructive_actions,omitempty"`
	RequireDestructiveApproval bool     `json:"require_destructive_approval"`
}

func (TenantPolicyConfig) ToPolicyInputMap 

func (c TenantPolicyConfig) ToPolicyInputMap() map[string]string

type UsageCounter 

type UsageCounter struct {
	TenantID       string `json:"tenant_id"`
	CounterDate    string `json:"counter_date"`
	Requests       int64  `json:"requests"`
	Approvals      int64  `json:"approvals"`
	Executions     int64  `json:"executions"`
	ConnectorCalls int64  `json:"connector_calls"`
}

type User 

type User struct {
	ID          string    `json:"id"`
	Email       string    `json:"email"`
	Name        string    `json:"name"`
	SlackUserID *string   `json:"slack_user_id,omitempty"`
	Status      string    `json:"status"`
	CreatedAt   time.Time `json:"created_at"`
}

type UserRole 

type UserRole struct {
	ID       string  `json:"id"`
	UserID   string  `json:"user_id"`
	TenantID *string `json:"tenant_id,omitempty"`
	Role     string  `json:"role"`
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.