api

package
v1.0.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: May 23, 2026 License: Apache-2.0 Imports: 64 Imported by: 0

Documentation

Index

Constants

View Source 
const SAMLDefaultClockSkew = 60 * time.Second

SAMLDefaultClockSkew is the asserted-NotOnOrAfter tolerance applied to incoming SAML responses. Matches the de-facto Okta/Azure AD default and is large enough to absorb modest server-to-server clock drift without opening a meaningful replay window.

Variables

View Source 
var (
	ErrKubernetesConnectorTokenInvalid      = errors.New("invalid kubernetes connector token")
	ErrKubernetesConnectorTokenExpired      = errors.New("expired kubernetes connector token")
	ErrKubernetesConnectorTokenUsed         = errors.New("used kubernetes connector token")
	ErrKubernetesConnectorCredentialDenied  = errors.New("invalid kubernetes connector credential")
	ErrKubernetesConnectorSecretUnavailable = errors.New("kubernetes connector secret unavailable")
)
View Source 
var (
	// ErrInvalidOnboardingRequest indicates a malformed onboarding transition.
	ErrInvalidOnboardingRequest        = errors.New("invalid onboarding request")
	ErrOnboardingWorkspaceAccessDenied = errors.New("onboarding workspace access denied")
)
View Source 
var (
	ErrAuthIdentityConflict = errors.New("auth identity conflicts with existing user")
	ErrAuthAccountNotFound  = errors.New("auth account not found")
)
View Source 
var ErrAWSConnectionNotFound = errors.New("aws connection not found")

ErrAWSConnectionNotFound indicates one scoped project AWS connection does not exist.

View Source 
var ErrAWSConnectionValidatorUnavailable = errors.New("aws connection validator unavailable")

ErrAWSConnectionValidatorUnavailable indicates live AWS validation is not configured.

View Source 
var ErrAWSConnectorConfigUnavailable = errors.New("aws connector config unavailable")

ErrAWSConnectorConfigUnavailable indicates the CloudFormation setup flow is not configured.

View Source 
var ErrAuthInvalidManualLogin = errors.New("manual login requires tenant and workspace")
View Source 
var ErrGitHubAppConfigUnavailable = errors.New("github app config unavailable")

ErrGitHubAppConfigUnavailable indicates the hosted GitHub App flow is not configured.

View Source 
var ErrGitHubConnectStateNotFound = errors.New("github connect state not found")

ErrGitHubConnectStateNotFound indicates an expired or unknown connect state token.

View Source 
var ErrGitHubConnectionNotFound = errors.New("github connection not found")

ErrGitHubConnectionNotFound indicates one scoped project GitHub connection does not exist.

View Source 
var ErrGitHubConnectorSecretUnavailable = errors.New("github connector secret unavailable")

ErrGitHubConnectorSecretUnavailable indicates connector secret crypto failed.

View Source 
var ErrGitHubPATValidatorUnavailable = errors.New("github pat validator unavailable")

ErrGitHubPATValidatorUnavailable indicates PAT validation is not configured.

View Source 
var ErrGitHubRepositoryListUnavailable = errors.New("github repository list unavailable")

ErrGitHubRepositoryListUnavailable indicates the GitHub App repository list could not be loaded.

View Source 
var ErrGitHubRepositoryPostureUnavailable = errors.New("github repository posture unavailable")

ErrGitHubRepositoryPostureUnavailable indicates repository posture could not be collected.

View Source 
var ErrGitHubWebhookSignatureInvalid = errors.New("github webhook signature invalid")

ErrGitHubWebhookSignatureInvalid indicates a webhook signature mismatch.

View Source 
var ErrInvalidAWSConnectionRequest = errors.New("invalid aws connection request")

ErrInvalidAWSConnectionRequest indicates invalid AWS connector input.

View Source 
var ErrInvalidFindingBaselineRequest = errors.New("invalid finding baseline request")

ErrInvalidFindingBaselineRequest indicates invalid baseline export/import input.

View Source 
var ErrInvalidFindingTriageRequest = errors.New("invalid finding triage request")

ErrInvalidFindingTriageRequest indicates invalid triage payload or state transition.

View Source 
var ErrInvalidGitHubConnectionRequest = errors.New("invalid github connection request")

ErrInvalidGitHubConnectionRequest indicates invalid GitHub connect request input.

View Source 
var ErrInvalidGitHubWebhookPayload = errors.New("invalid github webhook payload")

ErrInvalidGitHubWebhookPayload indicates an invalid webhook payload.

View Source 
var ErrInvalidKubernetesConnectionRequest = errors.New("invalid kubernetes connection request")

ErrInvalidKubernetesConnectionRequest indicates invalid Kubernetes connector input.

View Source 
var ErrInvalidRepoRemediationRequest = errors.New("invalid repo remediation request")

ErrInvalidRepoRemediationRequest indicates stale source content or invalid preview inputs.

View Source 
var ErrInvalidRepoScanRequest = errors.New("invalid repo scan request")

ErrInvalidRepoScanRequest indicates invalid repository scan request input.

View Source 
var ErrInvalidScanDiffBaseline = errors.New("invalid scan diff baseline")

ErrInvalidScanDiffBaseline is returned when previous_scan_id is incompatible.

View Source 
var ErrInvalidScanPolicyRequest = errors.New("invalid scan policy request")

ErrInvalidScanPolicyRequest indicates invalid scan policy API input.

View Source 
var ErrInvalidTenancyRequest = errors.New("invalid tenancy request")

ErrInvalidTenancyRequest indicates invalid tenancy write payload.

View Source 
var ErrKubernetesPreflightUnavailable = errors.New("kubernetes preflight unavailable")

ErrKubernetesPreflightUnavailable indicates live Kubernetes preflight is not configured.

View Source 
var ErrRepoScanAlreadyCurrent = errors.New("repo scan already current")

ErrRepoScanAlreadyCurrent indicates a delta scan target already matches the stored cursor.

View Source 
var ErrRepoScanCancelUnavailable = errors.New("repo scan cancel is unavailable")

ErrRepoScanCancelUnavailable is returned when a repository scan is already terminal.

View Source 
var ErrRepoScanDisabled = errors.New("repo scan is disabled")

ErrRepoScanDisabled is returned when repository exposure scanning is disabled.

View Source 
var ErrRepoScanInProgress = errors.New("repo scan already in progress")

ErrRepoScanInProgress is returned when the same repository scan target is already running.

View Source 
var ErrRepoScanQueueFull = errors.New("repo scan queue is full")

ErrRepoScanQueueFull is returned when queued repo scan requests exceed configured capacity.

View Source 
var ErrRepoTargetNotAllowed = errors.New("repo target is not allowed")

ErrRepoTargetNotAllowed is returned when repository target is outside configured allowlist.

View Source 
var ErrSAMLUnprovisionedUser = errors.New("saml asserted user is not provisioned and connection has JIT disabled")

ErrSAMLUnprovisionedUser is returned when a SAML assertion arrives for a user that has no matching identity and the connection has not opted into JIT provisioning. The ACS handler maps it to a 403 so the admin knows to either pre-provision via SCIM or enable JIT on the connection.

View Source 
var ErrScanInProgress = errors.New("scan already in progress")

ErrScanInProgress is returned when a scan for the same provider is already running.

View Source 
var ErrScanPolicyStoreUnavailable = errors.New("scan policy store unavailable")

ErrScanPolicyStoreUnavailable indicates the configured store does not support scan policies.

View Source 
var ErrScanQueueFull = errors.New("scan queue is full")

ErrScanQueueFull is returned when queued scan requests exceed configured capacity.

View Source 
var ErrScanReplayUnavailable = errors.New("scan replay is unavailable")

ErrScanReplayUnavailable is returned when a scan cannot be replayed into the queue.

View Source 
var ErrUnsupportedRepoRemediation = errors.New("unsupported repo remediation")

ErrUnsupportedRepoRemediation indicates no safe remediation workflow is registered.

View Source 
var ErrWorkspaceAccessDenied = errors.New("workspace access denied")

ErrWorkspaceAccessDenied indicates the caller cannot switch to target workspace.

Functions

func FetchSAMLMetadataXML 

func FetchSAMLMetadataXML(ctx context.Context, client *http.Client, metadataURL string) ([]byte, error)

FetchSAMLMetadataXML retrieves an IdP metadata document over HTTPS. The caller is expected to validate the returned draft via ParseSAMLMetadataXML. A 10-second timeout and a 256 KiB response cap keep an untrusted URL from stalling or overwhelming the API server. The host is resolved up-front and any address resolving to loopback, link-local, multicast, broadcast, unspecified, or RFC1918/RFC4193 private ranges is refused — without that guard, an enterprise-write caller could turn this endpoint into an SSRF primitive against the API server's internal network.

func HashSCIMBearerToken 

func HashSCIMBearerToken(token string) string

func NewRouter 

func NewRouter(logger *zap.Logger, metrics *telemetry.Metrics, svc *Service, opts RouterOptions) *gin.Engine

NewRouter builds the REST surface area and observability endpoints.

func NewSCIMBearerToken 

func NewSCIMBearerToken() (plain string, hash string, err error)

NewSCIMBearerToken generates a fresh per-connection SCIM bearer token and returns both the plain token (returned once to the admin) and the SHA-256 hex hash (persisted on the identity_connections row).

Types

type AWSConnectionDiagnostic 

type AWSConnectionDiagnostic struct {
	Code        string `json:"code"`
	Message     string `json:"message"`
	Remediation string `json:"remediation,omitempty"`
}

AWSConnectionDiagnostic explains one validation outcome and how to remediate it.

type AWSConnectionPermissionCheck 

type AWSConnectionPermissionCheck struct {
	Name        string `json:"name"`
	Passed      bool   `json:"passed"`
	Message     string `json:"message"`
	Remediation string `json:"remediation,omitempty"`
}

AWSConnectionPermissionCheck captures one connector permission sanity check.

type AWSConnectionStatus 

type AWSConnectionStatus struct {
	Provider             string                         `json:"provider"`
	Connected            bool                           `json:"connected"`
	ConnectorID          string                         `json:"connector_id,omitempty"`
	DisplayName          string                         `json:"display_name,omitempty"`
	Status               domain.ConnectorStatus         `json:"status"`
	HealthStatus         string                         `json:"health_status"`
	RoleARN              string                         `json:"role_arn,omitempty"`
	ExternalIDConfigured bool                           `json:"external_id_configured"`
	AccountID            string                         `json:"account_id,omitempty"`
	PrincipalARN         string                         `json:"principal_arn,omitempty"`
	UserID               string                         `json:"user_id,omitempty"`
	Region               string                         `json:"region,omitempty"`
	ExternalID           string                         `json:"-"`
	PermissionChecks     []AWSConnectionPermissionCheck `json:"permission_checks"`
	Diagnostics          []AWSConnectionDiagnostic      `json:"diagnostics"`
	RemediationMessage   string                         `json:"remediation_message,omitempty"`
	LaunchURL            string                         `json:"launch_url,omitempty"`
	TemplateURL          string                         `json:"template_url,omitempty"`
	PolicyHash           string                         `json:"policy_hash,omitempty"`
	CreatedAt            *time.Time                     `json:"created_at,omitempty"`
	UpdatedAt            *time.Time                     `json:"updated_at,omitempty"`
	LastValidatedAt      *time.Time                     `json:"last_validated_at,omitempty"`
}

AWSConnectionStatus describes current AWS connector state for one project.

type AWSConnectionUpsertRequest 

type AWSConnectionUpsertRequest struct {
	ConnectorID string `json:"connector_id,omitempty"`
	DisplayName string `json:"display_name,omitempty"`
	RoleARN     string `json:"role_arn"`
	ExternalID  string `json:"external_id,omitempty"`
	Region      string `json:"region,omitempty"`
	SessionName string `json:"session_name,omitempty"`
}

AWSConnectionUpsertRequest captures one project AWS connector onboarding request.

type AWSConnectionValidationRequest 

type AWSConnectionValidationRequest struct {
	RoleARN     string
	ExternalID  string
	Region      string
	SessionName string
}

AWSConnectionValidationRequest is passed to the provider validator.

type AWSConnectionValidationResult 

type AWSConnectionValidationResult struct {
	AccountID        string                         `json:"account_id,omitempty"`
	PrincipalARN     string                         `json:"principal_arn,omitempty"`
	UserID           string                         `json:"user_id,omitempty"`
	RoleARN          string                         `json:"role_arn,omitempty"`
	Region           string                         `json:"region,omitempty"`
	PermissionChecks []AWSConnectionPermissionCheck `json:"permission_checks"`
	Diagnostics      []AWSConnectionDiagnostic      `json:"diagnostics"`
}

AWSConnectionValidationResult contains the live AWS metadata and diagnostics.

type AWSConnectorPolicyResponse 

type AWSConnectorPolicyResponse struct {
	PolicyHash        string                               `json:"policy_hash"`
	PolicyDocument    json.RawMessage                      `json:"policy_document"`
	PermissionPreview []awsconnector.PermissionPreviewItem `json:"permission_preview"`
}

AWSConnectorPolicyResponse exposes the expected read-only policy for review.

type AWSConnectorPollRequest 

type AWSConnectorPollRequest struct {
	WorkspaceID string `form:"workspace_id" json:"workspace_id,omitempty"`
	ProjectID   string `form:"project_id" json:"project_id,omitempty"`
}

AWSConnectorPollRequest resolves project scope for the flat connector poll API.

type AWSConnectorStartRequest 

type AWSConnectorStartRequest struct {
	WorkspaceID string `json:"workspace_id,omitempty"`
	ProjectID   string `json:"project_id,omitempty"`
	ConnectorID string `json:"connector_id,omitempty"`
	DisplayName string `json:"display_name,omitempty"`
	Region      string `json:"region,omitempty"`
	RoleName    string `json:"role_name,omitempty"`
	StackName   string `json:"stack_name,omitempty"`
}

AWSConnectorStartRequest starts the CloudFormation-based AWS connector flow.

type AWSConnectorStartResponse 

type AWSConnectorStartResponse struct {
	Connection        AWSConnectionStatus                  `json:"connection"`
	ConnectorID       string                               `json:"connector_id"`
	ExternalID        string                               `json:"external_id"`
	LaunchURL         string                               `json:"launch_url"`
	TemplateURL       string                               `json:"template_url"`
	RoleName          string                               `json:"role_name"`
	StackName         string                               `json:"stack_name"`
	PolicyHash        string                               `json:"policy_hash"`
	PermissionPreview []awsconnector.PermissionPreviewItem `json:"permission_preview"`
}

AWSConnectorStartResponse returns launch data for the one-click AWS setup flow.

type AWSConnectorValidateRequest 

type AWSConnectorValidateRequest struct {
	WorkspaceID string `json:"workspace_id,omitempty"`
	ProjectID   string `json:"project_id,omitempty"`
	RoleARN     string `json:"role_arn"`
	ExternalID  string `json:"external_id,omitempty"`
	Region      string `json:"region,omitempty"`
	SessionName string `json:"session_name,omitempty"`
}

AWSConnectorValidateRequest validates a CloudFormation-created AWS connector role.

type AWSConnectorValidator 

type AWSConnectorValidator interface {
	ValidateAWSConnection(ctx context.Context, request AWSConnectionValidationRequest) (AWSConnectionValidationResult, error)
}

AWSConnectorValidator validates one AWS read-only connector setup.

type AWSScannerFactory 

type AWSScannerFactory func(ctx context.Context, connection AWSConnectionStatus) (ScannerRunner, error)

AWSScannerFactory creates a scanner bound to one persisted AWS connector.

type AlertFinding 

type AlertFinding struct {
	ID           string                 `json:"id"`
	Type         domain.FindingType     `json:"type"`
	Severity     domain.FindingSeverity `json:"severity"`
	Title        string                 `json:"title"`
	HumanSummary string                 `json:"human_summary"`
	Remediation  string                 `json:"remediation"`
	Path         []string               `json:"path,omitempty"`
}

AlertFinding keeps alert payloads concise and operator-focused.

type AlertPayload 

type AlertPayload struct {
	Version         string         `json:"version"`
	Provider        string         `json:"provider"`
	ScanID          string         `json:"scan_id"`
	Status          string         `json:"status"`
	StartedAt       time.Time      `json:"started_at"`
	FinishedAt      *time.Time     `json:"finished_at,omitempty"`
	TotalFindings   int            `json:"total_findings"`
	MatchedFindings int            `json:"matched_findings"`
	MinSeverity     string         `json:"min_severity"`
	Findings        []AlertFinding `json:"findings"`
}

AlertPayload is the external webhook contract for scan alerts.

type AuthenticatedRepoScannerFactory 

type AuthenticatedRepoScannerFactory func(historyLimit int, maxFindings int, credential repoexposure.HTTPSCloneCredential) RepoScanExecutor

AuthenticatedRepoScannerFactory creates a repository scanner with a short-lived clone credential.

type CurrentUserContext 

type CurrentUserContext struct {
	User         db.User                 `json:"user"`
	OrgID        string                  `json:"org_id,omitempty"`
	WorkspaceID  string                  `json:"workspace_id,omitempty"`
	ProjectID    string                  `json:"project_id,omitempty"`
	Role         string                  `json:"role,omitempty"`
	Organization *db.TenancyOrganization `json:"organization,omitempty"`
	Workspace    *db.TenancyWorkspace    `json:"workspace,omitempty"`
	Project      *db.TenancyProject      `json:"project,omitempty"`
}

CurrentUserContext is the response model for GET /v1/me.

type FindingAlerter 

type FindingAlerter interface {
	NotifyScan(ctx context.Context, provider string, scan db.ScanRecord, findings []domain.Finding) error
}

FindingAlerter emits structured scan alerts to external systems.

type FindingBaseline 

type FindingBaseline struct {
	SchemaVersion string                 `json:"schema_version"`
	MatchMode     string                 `json:"match_mode"`
	ExportedAt    time.Time              `json:"exported_at"`
	SourceScanID  string                 `json:"source_scan_id,omitempty"`
	Items         []FindingBaselineEntry `json:"items"`
}

FindingBaseline captures one portable false-positive suppression baseline.

type FindingBaselineEntry 

type FindingBaselineEntry struct {
	FindingID            string                 `json:"finding_id"`
	Type                 domain.FindingType     `json:"type"`
	Severity             domain.FindingSeverity `json:"severity"`
	ConfidenceScore      float64                `json:"confidence_score,omitempty"`
	Title                string                 `json:"title"`
	HumanSummary         string                 `json:"human_summary"`
	Path                 []string               `json:"path,omitempty"`
	Repository           string                 `json:"repository,omitempty"`
	FilePath             string                 `json:"file_path,omitempty"`
	Detector             string                 `json:"detector,omitempty"`
	MatchFingerprint     string                 `json:"match_fingerprint"`
	SuppressionExpiresAt *time.Time             `json:"suppression_expires_at,omitempty"`
	Assignee             string                 `json:"assignee,omitempty"`
}

FindingBaselineEntry stores one exact finding match target plus suppression metadata.

type FindingBaselineImportItem 

type FindingBaselineImportItem struct {
	BaselineFindingID    string     `json:"baseline_finding_id"`
	FindingID            string     `json:"finding_id,omitempty"`
	MatchConfidenceScore float64    `json:"match_confidence_score,omitempty"`
	Status               string     `json:"status"`
	Reason               string     `json:"reason,omitempty"`
	SuppressionExpiresAt *time.Time `json:"suppression_expires_at,omitempty"`
}

FindingBaselineImportItem reports one entry application decision.

type FindingBaselineImportRequest 

type FindingBaselineImportRequest struct {
	ScanID   string          `json:"scan_id,omitempty"`
	Baseline FindingBaseline `json:"baseline"`
	Comment  string          `json:"comment,omitempty"`
}

FindingBaselineImportRequest captures one baseline application request.

type FindingBaselineImportResult 

type FindingBaselineImportResult struct {
	ScanID       string                      `json:"scan_id"`
	ImportedAt   time.Time                   `json:"imported_at"`
	AppliedCount int                         `json:"applied_count"`
	SkippedCount int                         `json:"skipped_count"`
	Items        []FindingBaselineImportItem `json:"items"`
}

FindingBaselineImportResult returns baseline import outcomes per entry.

type FindingExports 

type FindingExports struct {
	OCSF map[string]any `json:"ocsf"`
	ASFF map[string]any `json:"asff"`
}

FindingExports returns standards-aligned payloads for one finding.

type FindingTriageRequest 

type FindingTriageRequest struct {
	Status               *string `json:"status,omitempty"`
	Assignee             *string `json:"assignee,omitempty"`
	SuppressionExpiresAt *string `json:"suppression_expires_at,omitempty"`
	Comment              string  `json:"comment,omitempty"`
}

FindingTriageRequest captures one triage mutation request for a finding.

type FindingsFilter 

type FindingsFilter struct {
	FindingID       string
	ScanID          string
	Severity        string
	Type            string
	LifecycleStatus string
	Assignee        string
	SortBy          string
	SortDesc        bool
	Offset          int
}

FindingsFilter narrows findings list queries without changing API response schema.

type FindingsPage 

type FindingsPage struct {
	Items      []domain.Finding
	NextCursor string
}

FindingsPage captures one paginated findings response.

type FindingsSummary 

type FindingsSummary struct {
	Total      int            `json:"total"`
	BySeverity map[string]int `json:"by_severity"`
	ByType     map[string]int `json:"by_type"`
}

FindingsSummary returns quick aggregation counters for dashboards/alerts.

type GitHubCodeScanningAlertCollector 

type GitHubCodeScanningAlertCollector interface {
	ListCodeScanningAlerts(ctx context.Context, installationID int64, repository string) ([]githubconnector.CodeScanningAlert, error)
}

GitHubCodeScanningAlertCollector lists code-scanning alerts visible to one GitHub App installation.

type GitHubConnectionCompleteRequest 

type GitHubConnectionCompleteRequest struct {
	State                  string   `json:"state"`
	InstallationID         int64    `json:"installation_id"`
	AccountLogin           string   `json:"account_login"`
	TokenReference         string   `json:"token_reference"`
	WebhookSecret          string   `json:"webhook_secret"`
	WebhookSecretReference string   `json:"webhook_secret_reference"`
	SelectedRepositories   []string `json:"selected_repositories"`
}

GitHubConnectionCompleteRequest captures one connect completion payload.

type GitHubConnectionRepositorySelectionRequest 

type GitHubConnectionRepositorySelectionRequest struct {
	Repositories []string `json:"repositories"`
}

GitHubConnectionRepositorySelectionRequest updates selected repositories for one project.

type GitHubConnectionSecretRotationRequest 

type GitHubConnectionSecretRotationRequest struct {
	WebhookSecret          string `json:"webhook_secret"`
	WebhookSecretReference string `json:"webhook_secret_reference"`
}

GitHubConnectionSecretRotationRequest captures one webhook secret rotation.

type GitHubConnectionStartRequest 

type GitHubConnectionStartRequest struct {
	AppSlug     string `json:"app_slug,omitempty"`
	RedirectURI string `json:"redirect_uri,omitempty"`
}

GitHubConnectionStartRequest captures one project-scoped connection bootstrap request.

type GitHubConnectionStartResponse 

type GitHubConnectionStartResponse struct {
	State      string    `json:"state"`
	ConnectURL string    `json:"connect_url"`
	ExpiresAt  time.Time `json:"expires_at"`
}

GitHubConnectionStartResponse returns state and install URL used to complete setup.

type GitHubConnectionStatus 

type GitHubConnectionStatus struct {
	Provider                      string                 `json:"provider"`
	Connected                     bool                   `json:"connected"`
	ConnectorID                   string                 `json:"connector_id,omitempty"`
	DisplayName                   string                 `json:"display_name,omitempty"`
	Status                        domain.ConnectorStatus `json:"status,omitempty"`
	HealthStatus                  string                 `json:"health_status,omitempty"`
	AccountLogin                  string                 `json:"account_login,omitempty"`
	InstallationID                int64                  `json:"installation_id,omitempty"`
	BaseURL                       string                 `json:"base_url,omitempty"`
	Scopes                        []string               `json:"scopes,omitempty"`
	TokenReference                string                 `json:"token_reference,omitempty"`
	WebhookSecretReference        string                 `json:"webhook_secret_reference,omitempty"`
	WebhookSecretKeyVersion       string                 `json:"webhook_secret_key_version,omitempty"`
	WebhookSecretAlgorithm        string                 `json:"webhook_secret_algorithm,omitempty"`
	WebhookSecretRotatedAt        *time.Time             `json:"webhook_secret_rotated_at,omitempty"`
	WebhookSecretRotationDueAt    *time.Time             `json:"webhook_secret_rotation_due_at,omitempty"`
	WebhookSecretRotationRequired bool                   `json:"webhook_secret_rotation_required"`
	SelectedRepositories          []string               `json:"selected_repositories"`
	CreatedAt                     *time.Time             `json:"created_at,omitempty"`
	UpdatedAt                     *time.Time             `json:"updated_at,omitempty"`
	LastWebhookEventType          string                 `json:"last_webhook_event_type,omitempty"`
	LastWebhookDeliveryID         string                 `json:"last_webhook_delivery_id,omitempty"`
	LastWebhookEventAt            *time.Time             `json:"last_webhook_event_at,omitempty"`
}

GitHubConnectionStatus describes current GitHub integration state for one project.

type GitHubConnectorCompleteRequest 

type GitHubConnectorCompleteRequest struct {
	State          string `json:"state"`
	InstallationID int64  `json:"installation_id"`
	SetupAction    string `json:"setup_action,omitempty"`
	AccountLogin   string `json:"account_login,omitempty"`
}

GitHubConnectorCompleteRequest captures the GitHub App installation callback payload.

type GitHubConnectorCompleteResponse 

type GitHubConnectorCompleteResponse struct {
	Connection   GitHubConnectionStatus `json:"connection"`
	TenantID     string                 `json:"tenant_id"`
	WorkspaceID  string                 `json:"workspace_id"`
	ProjectID    string                 `json:"project_id"`
	RedirectPath string                 `json:"redirect_path"`
}

GitHubConnectorCompleteResponse returns the activated connector and app redirect target.

type GitHubConnectorStartRequest 

type GitHubConnectorStartRequest struct {
	WorkspaceID string `json:"workspace_id,omitempty"`
	ProjectID   string `json:"project_id,omitempty"`
	ConnectorID string `json:"connector_id,omitempty"`
	DisplayName string `json:"display_name,omitempty"`
	RedirectURI string `json:"redirect_uri,omitempty"`
}

GitHubConnectorStartRequest captures the flat connector GitHub App bootstrap request.

type GitHubConnectorStartResponse 

type GitHubConnectorStartResponse struct {
	Connection  GitHubConnectionStatus `json:"connection"`
	ConnectorID string                 `json:"connector_id"`
	State       string                 `json:"state"`
	InstallURL  string                 `json:"install_url"`
	WebhookURL  string                 `json:"webhook_url,omitempty"`
	ExpiresAt   time.Time              `json:"expires_at"`
}

GitHubConnectorStartResponse returns the hosted GitHub App installation flow.

type GitHubInstallationTokenMinter 

type GitHubInstallationTokenMinter interface {
	Mint(ctx context.Context, installationID int64) (githubconnector.InstallationToken, error)
}

GitHubInstallationTokenMinter mints short-lived GitHub App installation tokens.

type GitHubPATConnectorRequest 

type GitHubPATConnectorRequest struct {
	WorkspaceID          string   `json:"workspace_id,omitempty"`
	ProjectID            string   `json:"project_id,omitempty"`
	ConnectorID          string   `json:"connector_id,omitempty"`
	DisplayName          string   `json:"display_name,omitempty"`
	BaseURL              string   `json:"base_url,omitempty"`
	Token                string   `json:"token"`
	SelectedRepositories []string `json:"selected_repositories,omitempty"`
}

GitHubPATConnectorRequest captures the self-hosted GitHub Enterprise fallback flow.

type GitHubPATValidator 

type GitHubPATValidator interface {
	ValidateGitHubPAT(ctx context.Context, baseURL string, token string) (githubconnector.PATValidationResult, error)
}

GitHubPATValidator validates a GitHub.com or GHES personal access token.

type GitHubRepositoryListResponse 

type GitHubRepositoryListResponse struct {
	ConnectorID  string                   `json:"connector_id"`
	Provider     string                   `json:"provider"`
	Repositories []GitHubRepositoryStatus `json:"repositories"`
}

GitHubRepositoryListResponse lists stored or provider-visible repositories.

type GitHubRepositoryLister 

type GitHubRepositoryLister interface {
	ListInstallationRepositories(ctx context.Context, installationID int64) ([]githubconnector.Repository, error)
}

GitHubRepositoryLister lists repositories available to a GitHub App installation.

type GitHubRepositoryPostureCollector 

type GitHubRepositoryPostureCollector interface {
	CollectRepositoryPosture(ctx context.Context, installationID int64, repository string) (githubconnector.RepositoryPosture, error)
}

GitHubRepositoryPostureCollector collects GitHub repository posture through an installation token.

type GitHubRepositoryPostureResponse 

type GitHubRepositoryPostureResponse struct {
	ConnectorID string                            `json:"connector_id"`
	Provider    string                            `json:"provider"`
	Posture     githubconnector.RepositoryPosture `json:"posture"`
}

GitHubRepositoryPostureResponse returns normalized posture for one selected repository.

type GitHubRepositoryStatus 

type GitHubRepositoryStatus struct {
	FullName string `json:"full_name"`
	Private  bool   `json:"private,omitempty"`
}

GitHubRepositoryStatus is returned by the flat connector repository list.

type GitHubWebhookResult 

type GitHubWebhookResult struct {
	EventType       string `json:"event_type"`
	Repository      string `json:"repository,omitempty"`
	MatchedProjects int    `json:"matched_projects"`
	QueuedScans     int    `json:"queued_scans"`
	SkippedScans    int    `json:"skipped_scans"`
}

GitHubWebhookResult summarizes how one webhook event was processed.

type KubernetesAgentEnrollResponse 

type KubernetesAgentEnrollResponse struct {
	ConnectorID  string    `json:"connector_id"`
	AgentID      string    `json:"agent_id"`
	AgentToken   string    `json:"agent_token"`
	HeartbeatURL string    `json:"heartbeat_url"`
	ExpiresAt    time.Time `json:"expires_at"`
}

type KubernetesAgentHeartbeatResponse 

type KubernetesAgentHeartbeatResponse struct {
	Connection KubernetesConnectionStatus `json:"connection"`
	DegradedAt time.Time                  `json:"degraded_at"`
}

type KubernetesConnectionStatus 

type KubernetesConnectionStatus struct {
	Provider            string                                        `json:"provider"`
	Connected           bool                                          `json:"connected"`
	ConnectorID         string                                        `json:"connector_id,omitempty"`
	DisplayName         string                                        `json:"display_name,omitempty"`
	Status              domain.ConnectorStatus                        `json:"status"`
	HealthStatus        string                                        `json:"health_status"`
	Context             string                                        `json:"context,omitempty"`
	Cluster             string                                        `json:"cluster,omitempty"`
	Server              string                                        `json:"server,omitempty"`
	GitVersion          string                                        `json:"git_version,omitempty"`
	Platform            string                                        `json:"platform,omitempty"`
	ConnectionMode      string                                        `json:"connection_mode,omitempty"`
	AgentID             string                                        `json:"agent_id,omitempty"`
	PermissionChecks    []k8sprovider.KubernetesPermissionCheckResult `json:"permission_checks"`
	Diagnostics         []k8sprovider.KubernetesPreflightDiagnostic   `json:"diagnostics"`
	RemediationMessage  string                                        `json:"remediation_message,omitempty"`
	CreatedAt           *time.Time                                    `json:"created_at,omitempty"`
	UpdatedAt           *time.Time                                    `json:"updated_at,omitempty"`
	LastValidatedAt     *time.Time                                    `json:"last_validated_at,omitempty"`
	LastHeartbeatAt     *time.Time                                    `json:"last_heartbeat_at,omitempty"`
	EnrollmentExpiresAt *time.Time                                    `json:"enrollment_expires_at,omitempty"`
}

KubernetesConnectionStatus describes current Kubernetes connector state for one project.

type KubernetesConnectionUpsertRequest 

type KubernetesConnectionUpsertRequest struct {
	ConnectorID string `json:"connector_id,omitempty"`
	DisplayName string `json:"display_name,omitempty"`
	Context     string `json:"context,omitempty"`
}

KubernetesConnectionUpsertRequest captures one project Kubernetes connector onboarding request.

type KubernetesConnectorKubeconfigRequest 

type KubernetesConnectorKubeconfigRequest struct {
	WorkspaceID string `json:"workspace_id,omitempty"`
	ProjectID   string `json:"project_id,omitempty"`
	ConnectorID string `json:"connector_id,omitempty"`
	DisplayName string `json:"display_name,omitempty"`
	Kubeconfig  string `json:"kubeconfig"`
	Context     string `json:"context,omitempty"`
}

type KubernetesConnectorPreflightFactory 

type KubernetesConnectorPreflightFactory func(contextName string) KubernetesConnectorPreflightRunner

KubernetesConnectorPreflightFactory builds preflight runners for project-scoped contexts.

type KubernetesConnectorPreflightRunner 

type KubernetesConnectorPreflightRunner interface {
	Preflight(ctx context.Context) k8sprovider.KubernetesPreflightResult
}

KubernetesConnectorPreflightRunner performs one Kubernetes connector preflight.

type KubernetesConnectorStartRequest 

type KubernetesConnectorStartRequest struct {
	WorkspaceID string `json:"workspace_id,omitempty"`
	ProjectID   string `json:"project_id,omitempty"`
	ConnectorID string `json:"connector_id,omitempty"`
	DisplayName string `json:"display_name,omitempty"`
	APIURL      string `json:"api_url,omitempty"`
}

type KubernetesConnectorStartResponse 

type KubernetesConnectorStartResponse struct {
	Connection          KubernetesConnectionStatus `json:"connection"`
	EnrollmentToken     string                     `json:"enrollment_token"`
	EnrollmentExpiresAt time.Time                  `json:"enrollment_expires_at"`
	HelmCommand         string                     `json:"helm_command"`
}

type ManualLoginInput 

type ManualLoginInput struct {
	TenantID    string
	WorkspaceID string
	ProjectID   string
	Email       string
	DisplayName string
}

type ManualLoginResult 

type ManualLoginResult struct {
	User               db.User
	CurrentOrgID       string
	CurrentWorkspaceID string
	CurrentProjectID   string
	RedirectPath       string
}

type NopFindingAlerter 

type NopFindingAlerter struct{}

NopFindingAlerter is used when alerting is not configured.

func (NopFindingAlerter) NotifyScan 

func (NopFindingAlerter) NotifyScan(context.Context, string, db.ScanRecord, []domain.Finding) error

type OIDCTokenVerifier 

type OIDCTokenVerifier struct {
	// contains filtered or unexported fields
}

OIDCTokenVerifier validates OIDC bearer tokens using issuer discovery and JWKS verification.

func NewOIDCTokenVerifier 

func NewOIDCTokenVerifier(
	ctx context.Context,
	issuerURL string,
	audience string,
	tenantClaim string,
	workspaceClaim string,
	groupsClaim string,
	rolesClaim string,
) (*OIDCTokenVerifier, error)

NewOIDCTokenVerifier constructs a verifier from issuer URL and expected audience.

func (*OIDCTokenVerifier) VerifyToken 

func (v *OIDCTokenVerifier) VerifyToken(ctx context.Context, rawToken string) (VerifiedToken, error)

VerifyToken verifies one raw bearer token and extracts normalized claims.

type OnboardingStateResponse 

type OnboardingStateResponse struct {
	State        db.OnboardingState `json:"state"`
	RedirectPath string             `json:"redirect_path,omitempty"`
}

OnboardingStateResponse is the API-shaped state wrapper used by the wizard.

type OnboardingStateUpdateRequest 

type OnboardingStateUpdateRequest struct {
	CurrentStep            string `json:"current_step,omitempty"`
	OrgName                string `json:"org_name,omitempty"`
	OrgSlug                string `json:"org_slug,omitempty"`
	WorkspaceName          string `json:"workspace_name,omitempty"`
	WorkspaceSlug          string `json:"workspace_slug,omitempty"`
	ProjectName            string `json:"project_name,omitempty"`
	ProjectID              string `json:"project_id,omitempty"`
	ConnectorID            string `json:"connector_id,omitempty"`
	ConnectorType          string `json:"connector_type,omitempty"`
	ConnectorSkipped       *bool  `json:"connector_skipped,omitempty"`
	ScanSkipped            *bool  `json:"scan_skipped,omitempty"`
	DashboardTourDismissed *bool  `json:"dashboard_tour_dismissed,omitempty"`
}

OnboardingStateUpdateRequest captures one resumable setup transition.

type OrganizationUpsertRequest 

type OrganizationUpsertRequest struct {
	DisplayName string `json:"display_name"`
	Slug        string `json:"slug"`
}

OrganizationUpsertRequest captures one tenancy organization write payload.

type OwnershipFilter 

type OwnershipFilter struct {
	ScanID string
}

OwnershipFilter narrows ownership-signal query scope.

type PolicyContext 

type PolicyContext struct {
	RequestPath   string
	RequestMethod string
	Now           time.Time
	Attributes    map[string]string
}

PolicyContext captures request-time facts used in policy evaluation.

type PolicyDecision 

type PolicyDecision struct {
	Allowed bool
	Stage   PolicyStage
	Reason  string
}

PolicyDecision is the normalized authorization outcome.

type PolicyEngine 

type PolicyEngine struct {
	TenantIsolationEvaluator PolicyEvaluator
	RBACEvaluator            PolicyEvaluator
	ABACEvaluator            PolicyEvaluator
	ReBACEvaluator           PolicyEvaluator
}

PolicyEngine evaluates authorization in strict order: tenant isolation -> RBAC -> ABAC -> ReBAC -> default deny.

func NewPolicyEngine 

func NewPolicyEngine(tenantIsolation PolicyEvaluator, rbac PolicyEvaluator, abac PolicyEvaluator, rebac PolicyEvaluator) *PolicyEngine

NewPolicyEngine creates one centralized authorization engine.

func (*PolicyEngine) Decide 

func (p *PolicyEngine) Decide(ctx context.Context, input PolicyInput) (PolicyDecision, error)

Decide evaluates authorization policies and returns one normalized decision.

func (*PolicyEngine) DecideWithTrace 

func (p *PolicyEngine) DecideWithTrace(ctx context.Context, input PolicyInput) (PolicyDecision, []PolicyTraceStep, error)

DecideWithTrace evaluates authorization and returns a full stage-by-stage trace.

type PolicyEvaluator 

type PolicyEvaluator interface {
	Evaluate(ctx context.Context, input PolicyInput) (PolicyOutcome, string, error)
}

PolicyEvaluator evaluates one authorization layer.

type PolicyInput 

type PolicyInput struct {
	Subject  PolicySubject
	Action   string
	Resource PolicyResource
	Context  PolicyContext
}

PolicyInput is the single input model for centralized authorization.

type PolicyOutcome 

type PolicyOutcome string

PolicyOutcome captures one evaluator result. 

const (
	PolicyOutcomeNoOpinion PolicyOutcome = "no_op"
	PolicyOutcomeAllow     PolicyOutcome = "allow"
	PolicyOutcomeDeny      PolicyOutcome = "deny"
	PolicyOutcomeSkipped   PolicyOutcome = "skipped"
)

type PolicyResource 

type PolicyResource struct {
	Type        string
	ID          string
	TenantID    string
	WorkspaceID string
	Attributes  map[string]string
}

PolicyResource identifies the target object.

type PolicyStage 

type PolicyStage string

PolicyStage identifies one authorization layer in the centralized decision pipeline. 

const (
	PolicyStageTenantIsolation PolicyStage = "tenant_isolation"
	PolicyStageRBAC            PolicyStage = "rbac"
	PolicyStageABAC            PolicyStage = "abac"
	PolicyStageReBAC           PolicyStage = "rebac"
	PolicyStageDefaultDeny     PolicyStage = "default_deny"
)

type PolicySubject 

type PolicySubject struct {
	Type        string
	ID          string
	TenantID    string
	WorkspaceID string
	Groups      []string
	Roles       []string
	Attributes  map[string]string
}

PolicySubject is the actor for one authorization decision.

type PolicyTraceStep 

type PolicyTraceStep struct {
	Stage   PolicyStage   `json:"stage"`
	Outcome PolicyOutcome `json:"outcome"`
	Reason  string        `json:"reason"`
}

PolicyTraceStep captures one stage-level evaluator outcome for explainability.

type ProjectUpsertRequest 

type ProjectUpsertRequest struct {
	ProjectID   string  `json:"project_id"`
	Name        string  `json:"name"`
	Slug        string  `json:"slug"`
	Description string  `json:"description,omitempty"`
	ArchivedAt  *string `json:"archived_at,omitempty"`
}

ProjectUpsertRequest captures one workspace project write payload.

type RepoFindingClusterFilter 

type RepoFindingClusterFilter struct {
	RepoScanID string
	Severity   string
	Type       string
	SortBy     string
	SortDesc   bool
	Offset     int
}

RepoFindingClusterFilter narrows repository finding cluster list queries.

type RepoFindingRemediationPreview 

type RepoFindingRemediationPreview struct {
	Finding     domain.Finding                    `json:"finding"`
	Remediation standards.RepoExposureRemediation `json:"remediation"`
	FixPRPlan   *fixpr.FixPRPlan                  `json:"fix_pr_plan,omitempty"`
}

RepoFindingRemediationPreview is the API-facing preview for one repo finding remediation workflow.

type RepoFindingRemediationPreviewRequest 

type RepoFindingRemediationPreviewRequest struct {
	RepoScanID     string `json:"repo_scan_id,omitempty"`
	SourceContent  string `json:"source_content,omitempty"`
	BaseBranch     string `json:"base_branch,omitempty"`
	BranchPrefix   string `json:"branch_prefix,omitempty"`
	FindingURL     string `json:"finding_url,omitempty"`
	RequireFixPlan bool   `json:"require_fix_plan,omitempty"`
}

RepoFindingRemediationPreviewRequest captures a request to preview safe remediation for one repository finding. SourceContent is optional; when present and the detector has a deterministic patch, the response also includes the exact fix-PR plan.

type RepoFindingsSummary 

type RepoFindingsSummary struct {
	TotalOpen                int            `json:"total_open"`
	FixedCount               int            `json:"fixed_count"`
	ReopenedCount            int            `json:"reopened_count"`
	SuppressedCount          int            `json:"suppressed_count"`
	SLAAgedCount             int            `json:"sla_aged_count"`
	MTTRReadyResolvedCount   int            `json:"mttr_ready_resolved_count"`
	MeanTimeToResolveSeconds *float64       `json:"mean_time_to_resolve_seconds,omitempty"`
	OldestOpenFirstSeenAt    *time.Time     `json:"oldest_open_first_seen_at,omitempty"`
	ByOwner                  map[string]int `json:"by_owner"`
	ByDetector               map[string]int `json:"by_detector"`
	BySeverity               map[string]int `json:"by_severity"`
}

RepoFindingsSummary exposes lifecycle intelligence for repository findings.

type RepoRiskGraphFilter 

type RepoRiskGraphFilter struct {
	RepoScanID    string
	Repository    string
	Severity      string
	Type          string
	DefaultBranch string
}

RepoRiskGraphFilter narrows the repository findings used to build a risk graph.

type RepoScanExecutor 

type RepoScanExecutor interface {
	ScanRepository(ctx context.Context, target string) (repoexposure.ScanResult, error)
}

RepoScanExecutor defines repository exposure scanning behavior.

type RepoScanExecutorWithOptions 

type RepoScanExecutorWithOptions interface {
	ScanRepositoryWithOptions(ctx context.Context, target string, options repoexposure.ScanOptions) (repoexposure.ScanResult, error)
}

RepoScanExecutorWithOptions supports incremental repository scan execution.

type RepoScanQueueEvent 

type RepoScanQueueEvent struct {
	Kind       string
	RepoScanID string
	Repository string
	Status     string
	Reason     string
	Count      int
}

RepoScanQueueEvent reports visible lifecycle transitions for repository scans drained by the worker API queue.

type RepoScanRequest 

type RepoScanRequest struct {
	Repository   string   `json:"repository"`
	ProjectID    string   `json:"project_id,omitempty"`
	ConnectorID  string   `json:"connector_id,omitempty"`
	ScanMode     string   `json:"scan_mode,omitempty"`
	BaseRevision string   `json:"base_revision,omitempty"`
	HeadRevision string   `json:"head_revision,omitempty"`
	ChangedPaths []string `json:"changed_paths,omitempty"`
	HistoryLimit int      `json:"history_limit"`
	MaxFindings  int      `json:"max_findings"`
}

RepoScanRequest captures one repository exposure scan request.

type RepoScannerFactory 

type RepoScannerFactory func(historyLimit int, maxFindings int) RepoScanExecutor

RepoScannerFactory creates a repository scanner with bounded scan parameters.

type RouterOptions 

type RouterOptions struct {
	APIKeys                   []string
	WriteAPIKeys              []string
	APIKeyScopes              map[string][]string
	APIKeyScopeBindings       map[string]db.Scope
	OIDCTokenVerifier         TokenVerifier
	OIDCWriteScopes           []string
	RateLimitRPM              int
	RateLimitBurst            int
	AuditSink                 audit.AuditSink
	AuditFingerprinter        *audit.Fingerprinter
	TrustedProxies            []string
	CORSAllowedOrigins        []string
	DefaultTenantID           string
	DefaultWorkspaceID        string
	RequireExplicitScope      bool
	FeatureNewAuth            bool
	FeatureWorkOSLogin        bool
	FeatureConnectorAWS       bool
	FeatureConnectorGitHubV2  bool
	FeatureConnectorK8S       bool
	FeatureOnboardingWizard   bool
	FeatureNativeSSO          bool
	PublicBaseURL             string
	SessionKey                string
	SessionKeyPrevious        string
	AuthManualMode            bool
	AuthManualModeAllowUnsafe bool
	WorkOSClientID            string
	WorkOSAPIKey              string
	WorkOSWebhookSecret       string
	WorkOSAuthClient          sessionauth.WorkOSClient
}

RouterOptions controls API middleware behavior.

type RunRepoScanResult 

type RunRepoScanResult struct {
	RepoScan db.RepoScanRecord       `json:"repo_scan"`
	Result   repoexposure.ScanResult `json:"result"`
}

RunRepoScanResult is returned after repo scan API trigger.

type RunScanResult 

type RunScanResult struct {
	Scan             db.ScanRecord `json:"scan"`
	Assets           int           `json:"assets"`
	FindingCount     int           `json:"finding_count"`
	PartialSourceRun bool          `json:"partial_source_run"`
}

RunScanResult is returned after a scan API trigger.

type SAMLAssertedProfile 

type SAMLAssertedProfile struct {
	ConnectionID string
	OrgID        string
	NameID       string
	Email        string
	DisplayName  string
	Groups       []string
	RawAssertion []byte
}

SAMLAssertedProfile is the subset of a SAML assertion Identrail consumes to resolve or provision a user. The connection id is captured so the persisted identity is scoped to the originating IdP — two tenants federating with the same NameID cannot collide because the provider value is connection-specific.

type SAMLLoginResult 

type SAMLLoginResult struct {
	User             db.User
	Identity         db.UserIdentity
	NewUser          bool
	CurrentOrgID     string
	CurrentWorkspace string
	RedirectPath     string
}

SAMLLoginResult mirrors WorkOSLoginResult so the ACS handler can reuse the same session-issuance plumbing as the WorkOS callback path.

type SAMLMetadataDraft 

type SAMLMetadataDraft struct {
	EntityID       string `json:"entity_id"`
	SSOURL         string `json:"sso_url"`
	CertificatePEM string `json:"certificate_pem"`
}

SAMLMetadataDraft is the validated, normalized output of metadata import. The handler returns this so the admin can review the auto-filled values before persisting via POST /identity-connections/saml.

func ParseSAMLMetadataXML 

func ParseSAMLMetadataXML(raw []byte) (SAMLMetadataDraft, error)

ParseSAMLMetadataXML decodes one IdP metadata XML document and returns the fields Identrail needs. Errors are descriptive so an admin pasting the wrong document (e.g., an SP metadata file instead of an IdP one) gets a clear message about what went wrong.

type ScanDiff 

type ScanDiff struct {
	ScanID          string           `json:"scan_id"`
	PreviousScanID  string           `json:"previous_scan_id,omitempty"`
	AddedCount      int              `json:"added_count"`
	ResolvedCount   int              `json:"resolved_count"`
	PersistingCount int              `json:"persisting_count"`
	Added           []domain.Finding `json:"added"`
	Resolved        []domain.Finding `json:"resolved"`
	Persisting      []domain.Finding `json:"persisting"`
}

ScanDiff captures delta between one scan and its previous scan for same provider.

type ScanPolicyListFilter 

type ScanPolicyListFilter struct {
	TriggerMode string
	Enabled     *bool
	SortBy      string
	SortDesc    bool
	Limit       int
}

ScanPolicyListFilter narrows scan policy list queries.

type ScanPolicyScheduleResult 

type ScanPolicyScheduleResult struct {
	PoliciesChecked int `json:"policies_checked"`
	PoliciesDue     int `json:"policies_due"`
	PoliciesClaimed int `json:"policies_claimed"`
	QueuedScans     int `json:"queued_scans"`
	SkippedScans    int `json:"skipped_scans"`
}

ScanPolicyScheduleResult summarizes one scheduler pass.

type ScanPolicyUpsertRequest 

type ScanPolicyUpsertRequest struct {
	PolicyID           string `json:"policy_id"`
	Name               string `json:"name"`
	Enabled            *bool  `json:"enabled,omitempty"`
	TriggerMode        string `json:"trigger_mode,omitempty"`
	Cron               string `json:"cron,omitempty"`
	MaxConcurrentScans int    `json:"max_concurrent_scans,omitempty"`
	HistoryLimit       int    `json:"history_limit,omitempty"`
	MaxFindings        int    `json:"max_findings,omitempty"`
}

ScanPolicyUpsertRequest captures one project scan policy write payload.

type ScannerRunner 

type ScannerRunner interface {
	Run(ctx context.Context) (app.ScanResult, error)
}

ScannerRunner is the scan execution dependency required by API service.

type Service 

type Service struct {
	Store                db.Store
	Scanner              ScannerRunner
	Provider             string
	DefaultScope         db.Scope
	Now                  func() time.Time
	Locker               scheduler.Locker
	LockNamespace        string
	Alerter              FindingAlerter
	OnAlertError         func(error)
	OnRepoScanQueueEvent func(RepoScanQueueEvent)
	ReadinessCheck       func(context.Context) error
	Metrics              *telemetry.Metrics
	// Repo scan controls are intentionally separate from cloud identity scan flow.
	RepoScanEnabled                  bool
	RepoScanDefaultHistoryLimit      int
	RepoScanDefaultMaxFindings       int
	RepoScanMaxHistoryLimit          int
	RepoScanMaxFindingsLimit         int
	RepoScanAllowedTargets           []string
	ScanQueueMaxPending              int
	RepoQueueMaxPending              int
	RepoScannerFactory               RepoScannerFactory
	AuthenticatedRepoScannerFactory  AuthenticatedRepoScannerFactory
	ConnectorSecretManager           *secretstore.Manager
	KubernetesPreflightFactory       KubernetesConnectorPreflightFactory
	AWSConnectorValidator            AWSConnectorValidator
	AWSScannerFactory                AWSScannerFactory
	AWSCloudFormationTemplateURL     string
	AWSAccountID                     string
	WorkflowRouter                   *workflow.Router
	GitHubAppID                      int64
	GitHubAppName                    string
	GitHubAppPrivateKey              string
	GitHubAppWebhookSecret           string
	GitHubPATValidator               GitHubPATValidator
	GitHubRepositoryLister           GitHubRepositoryLister
	GitHubRepositoryPostureCollector GitHubRepositoryPostureCollector
	GitHubInstallationTokenMinter    GitHubInstallationTokenMinter
	GitHubCodeScanningAlertCollector GitHubCodeScanningAlertCollector
	GitHubWebhookReplayWindow        time.Duration
	GitHubWebhookBurstWindow         time.Duration
	// contains filtered or unexported fields
}

Service orchestrates scan execution and persistence.

func NewService 

func NewService(store db.Store, scanner ScannerRunner, provider string) *Service

NewService creates an API service with defaults.

func (*Service) AWSConnectorPolicy 

func (s *Service) AWSConnectorPolicy(ctx context.Context, connectorID string, request AWSConnectorPollRequest) (AWSConnectorPolicyResponse, error)

func (*Service) CancelRepoScan 

func (s *Service) CancelRepoScan(ctx context.Context, repoScanID string) (db.RepoScanRecord, error)

CancelRepoScan marks an active repository scan terminal so the target can be retried.

func (*Service) CheckReadiness 

func (s *Service) CheckReadiness(ctx context.Context) error

CheckReadiness validates critical runtime dependencies for readiness checks.

func (*Service) CompleteGitHubConnection 

func (s *Service) CompleteGitHubConnection(ctx context.Context, workspaceID string, projectID string, request GitHubConnectionCompleteRequest) (GitHubConnectionStatus, error)

func (*Service) CompleteGitHubConnector 

func (s *Service) CompleteGitHubConnector(ctx context.Context, request GitHubConnectorCompleteRequest) (GitHubConnectorCompleteResponse, error)

func (*Service) CompleteOnboarding 

func (s *Service) CompleteOnboarding(ctx context.Context, current sessionauth.CurrentSession) (OnboardingStateResponse, error)

CompleteOnboarding marks the wizard complete and returns the dashboard target.

func (*Service) DeactivateWorkOSUser 

func (s *Service) DeactivateWorkOSUser(ctx context.Context, subject string) (int, error)

func (*Service) DeleteProject 

func (s *Service) DeleteProject(ctx context.Context, workspaceID string, projectID string) error

DeleteProject removes one scoped project.

func (*Service) DeleteScanPolicy 

func (s *Service) DeleteScanPolicy(ctx context.Context, workspaceID string, projectID string, policyID string) error

DeleteScanPolicy removes one project-scoped scan policy by id.

func (*Service) DeleteWorkspace 

func (s *Service) DeleteWorkspace(ctx context.Context, workspaceID string) error

DeleteWorkspace removes one workspace.

func (*Service) DeleteWorkspaceMember 

func (s *Service) DeleteWorkspaceMember(ctx context.Context, workspaceID string, memberID string) error

DeleteWorkspaceMember removes one scoped workspace member.

func (*Service) EnqueueDueScanPolicies 

func (s *Service) EnqueueDueScanPolicies(ctx context.Context) (ScanPolicyScheduleResult, error)

EnqueueDueScanPolicies finds due scheduled scan policies and enqueues repo scans.

func (*Service) EnqueueDueScanPoliciesAt 

func (s *Service) EnqueueDueScanPoliciesAt(ctx context.Context, now time.Time) (ScanPolicyScheduleResult, error)

EnqueueDueScanPoliciesAt is the deterministic variant used by tests.

func (*Service) EnqueueRepoScan 

func (s *Service) EnqueueRepoScan(ctx context.Context, request RepoScanRequest) (db.RepoScanRecord, error)

EnqueueRepoScan stores one queued repository scan request for asynchronous worker execution.

func (*Service) EnqueueScan 

func (s *Service) EnqueueScan(ctx context.Context) (db.ScanRecord, error)

EnqueueScan stores one queued scan request for asynchronous worker execution.

func (*Service) EnrollKubernetesAgent 

func (s *Service) EnrollKubernetesAgent(ctx context.Context, request k8sconnector.AgentEnrollRequest, apiBaseURL string) (KubernetesAgentEnrollResponse, error)

func (*Service) ExportFindingBaseline 

func (s *Service) ExportFindingBaseline(ctx context.Context, scanID string, limit int) (FindingBaseline, error)

func (*Service) GetAWSConnection 

func (s *Service) GetAWSConnection(ctx context.Context, workspaceID string, projectID string) (AWSConnectionStatus, error)

func (*Service) GetCurrentUserContext 

func (s *Service) GetCurrentUserContext(ctx context.Context, current sessionauth.CurrentSession) (CurrentUserContext, error)

GetCurrentUserContext resolves the current session into user and tenancy context.

func (*Service) GetFinding 

func (s *Service) GetFinding(ctx context.Context, findingID string, scanID string) (domain.Finding, error)

GetFinding returns one finding by id, optionally scoped to one scan.

func (*Service) GetFindingExports 

func (s *Service) GetFindingExports(ctx context.Context, findingID string, scanID string) (FindingExports, error)

GetFindingExports returns OCSF-aligned and ASFF payloads for one finding.

func (*Service) GetFindingsSummary 

func (s *Service) GetFindingsSummary(ctx context.Context, limit int) (FindingsSummary, error)

GetFindingsSummary returns grouped counts by severity and type.

func (*Service) GetFindingsTrend 

func (s *Service) GetFindingsTrend(ctx context.Context, points int) ([]TrendPoint, error)

GetFindingsTrend returns findings totals by severity across recent scans.

func (*Service) GetFindingsTrendFiltered 

func (s *Service) GetFindingsTrendFiltered(ctx context.Context, points int, severity string, findingType string) ([]TrendPoint, error)

GetFindingsTrendFiltered returns findings trend with optional severity/type filters.

func (*Service) GetGitHubConnection 

func (s *Service) GetGitHubConnection(ctx context.Context, workspaceID string, projectID string) (GitHubConnectionStatus, error)

func (*Service) GetGitHubConnectorRepositories 

func (s *Service) GetGitHubConnectorRepositories(ctx context.Context, connectorID string, workspaceID string, projectID string) (GitHubRepositoryListResponse, error)

func (*Service) GetGitHubConnectorRepositoryPosture 

func (s *Service) GetGitHubConnectorRepositoryPosture(ctx context.Context, connectorID string, workspaceID string, projectID string, repository string) (GitHubRepositoryPostureResponse, error)

func (*Service) GetGitHubConnectorStatus 

func (s *Service) GetGitHubConnectorStatus(ctx context.Context, workspaceID string, projectID string) (GitHubConnectionStatus, error)

func (*Service) GetKubernetesConnection 

func (s *Service) GetKubernetesConnection(ctx context.Context, workspaceID string, projectID string) (KubernetesConnectionStatus, error)

GetKubernetesConnection returns one project Kubernetes connector state.

func (*Service) GetKubernetesConnectorStatus 

func (s *Service) GetKubernetesConnectorStatus(ctx context.Context, workspaceID string, projectID string) (KubernetesConnectionStatus, error)

func (*Service) GetOnboardingState 

func (s *Service) GetOnboardingState(ctx context.Context, current sessionauth.CurrentSession) (OnboardingStateResponse, error)

GetOnboardingState returns current progress without mutating it.

func (*Service) GetOrganization 

func (s *Service) GetOrganization(ctx context.Context) (db.TenancyOrganization, error)

GetOrganization returns the current scoped organization record.

func (*Service) GetProject 

func (s *Service) GetProject(ctx context.Context, workspaceID string, projectID string) (db.TenancyProject, error)

GetProject returns one scoped project by id.

func (*Service) GetRepoFindingsSummary 

func (s *Service) GetRepoFindingsSummary(ctx context.Context, filter db.RepoFindingFilter) (RepoFindingsSummary, error)

GetRepoFindingsSummary returns lifecycle and ownership rollups for the repository finding list using the same filters as the list endpoint.

func (*Service) GetRepoFindingsTrend 

func (s *Service) GetRepoFindingsTrend(ctx context.Context, points int) ([]TrendPoint, error)

GetRepoFindingsTrend returns repository finding trend totals by repo scan.

func (*Service) GetRepoFindingsTrendFiltered 

func (s *Service) GetRepoFindingsTrendFiltered(ctx context.Context, points int, severity string, findingType string) ([]TrendPoint, error)

GetRepoFindingsTrendFiltered returns repository finding trend with optional severity/type filters.

func (*Service) GetRepoRiskGraph 

func (s *Service) GetRepoRiskGraph(ctx context.Context, filter RepoRiskGraphFilter) (domain.RepoRiskGraph, error)

GetRepoRiskGraph returns the graph-backed machine-identity blast radius for repository findings.

func (*Service) GetRepoScan 

func (s *Service) GetRepoScan(ctx context.Context, repoScanID string) (db.RepoScanRecord, error)

GetRepoScan returns one repository scan by id.

func (*Service) GetScanDiff 

func (s *Service) GetScanDiff(ctx context.Context, scanID string, limit int) (ScanDiff, error)

GetScanDiff compares findings between this scan and previous scan of same provider.

func (*Service) GetScanDiffAgainst 

func (s *Service) GetScanDiffAgainst(ctx context.Context, scanID string, previousScanID string, limit int) (ScanDiff, error)

GetScanDiffAgainst compares findings between one scan and an optional baseline scan.

func (*Service) GetScanPolicy 

func (s *Service) GetScanPolicy(ctx context.Context, workspaceID string, projectID string, policyID string) (db.TenancyScanPolicy, error)

GetScanPolicy returns one project-scoped scan policy by id.

func (*Service) GetWorkspace 

func (s *Service) GetWorkspace(ctx context.Context, workspaceID string) (db.TenancyWorkspace, error)

GetWorkspace returns one workspace by id.

func (*Service) GetWorkspaceMember 

func (s *Service) GetWorkspaceMember(ctx context.Context, workspaceID string, memberID string) (db.TenancyWorkspaceMember, error)

GetWorkspaceMember returns one scoped workspace member.

func (*Service) HandleGitHubAppWebhook 

func (s *Service) HandleGitHubAppWebhook(ctx context.Context, eventType string, deliveryID string, signature string, payload []byte) (GitHubWebhookResult, error)

func (*Service) HandleGitHubWebhook 

func (s *Service) HandleGitHubWebhook(ctx context.Context, eventType string, deliveryID string, signature string, payload []byte) (GitHubWebhookResult, error)

func (*Service) HeartbeatKubernetesAgent 

func (s *Service) HeartbeatKubernetesAgent(ctx context.Context, request k8sconnector.AgentHeartbeatRequest, bearerToken string) (KubernetesAgentHeartbeatResponse, error)

func (*Service) ImportFindingBaseline 

func (s *Service) ImportFindingBaseline(ctx context.Context, request FindingBaselineImportRequest, actor string) (FindingBaselineImportResult, error)

func (*Service) ListCurrentUserSessions 

func (s *Service) ListCurrentUserSessions(ctx context.Context, current sessionauth.CurrentSession) ([]SessionListItem, error)

ListCurrentUserSessions returns active sessions scoped to the current user.

func (*Service) ListFindingTriageHistory 

func (s *Service) ListFindingTriageHistory(ctx context.Context, findingID string, scanID string, limit int) ([]db.FindingTriageEvent, error)

ListFindingTriageHistory returns triage actions newest-first for one finding.

func (*Service) ListFindings 

func (s *Service) ListFindings(ctx context.Context, limit int) ([]domain.Finding, error)

ListFindings returns persisted findings.

func (*Service) ListFindingsFiltered 

func (s *Service) ListFindingsFiltered(ctx context.Context, limit int, filter FindingsFilter) ([]domain.Finding, error)

ListFindingsFiltered returns findings with optional scan/type/severity filters.

func (*Service) ListIdentities 

func (s *Service) ListIdentities(ctx context.Context, scanID string, provider string, identityType string, namePrefix string, limit int) ([]domain.Identity, error)

ListIdentities returns identities for given filters, defaulting scan_id to latest scan.

func (*Service) ListOwnershipSignals 

func (s *Service) ListOwnershipSignals(ctx context.Context, limit int, filter OwnershipFilter) ([]domain.OwnershipSignal, error)

ListOwnershipSignals returns inferred ownership hints for identities in one scan.

func (*Service) ListProjects 

func (s *Service) ListProjects(ctx context.Context, workspaceID string, includeArchived bool, limit int) ([]db.TenancyProject, error)

ListProjects returns projects for one scoped workspace.

func (*Service) ListRelationships 

func (s *Service) ListRelationships(ctx context.Context, scanID string, relationshipType string, fromNodeID string, toNodeID string, limit int) ([]domain.Relationship, error)

ListRelationships returns relationships for given filters, defaulting scan_id to latest scan.

func (*Service) ListRepoFindingClusters 

func (s *Service) ListRepoFindingClusters(ctx context.Context, limit int, filter RepoFindingClusterFilter) ([]domain.RepoFindingCluster, error)

ListRepoFindingClusters returns duplicate-aware repository finding clusters.

func (*Service) ListRepoFindings 

func (s *Service) ListRepoFindings(ctx context.Context, limit int, filter db.RepoFindingFilter) ([]domain.Finding, error)

ListRepoFindings returns repository findings using optional filters.

func (*Service) ListRepoScans 

func (s *Service) ListRepoScans(ctx context.Context, limit int) ([]db.RepoScanRecord, error)

ListRepoScans returns persisted repository scans.

func (*Service) ListScanEvents 

func (s *Service) ListScanEvents(ctx context.Context, scanID string, limit int) ([]db.ScanEvent, error)

ListScanEvents returns recent scan events for one scan id.

func (*Service) ListScanEventsFiltered 

func (s *Service) ListScanEventsFiltered(ctx context.Context, scanID string, level string, limit int) ([]db.ScanEvent, error)

ListScanEventsFiltered returns recent scan events with optional level filtering.

func (*Service) ListScanPolicies 

func (s *Service) ListScanPolicies(ctx context.Context, workspaceID string, projectID string, filter ScanPolicyListFilter) ([]db.TenancyScanPolicy, error)

ListScanPolicies lists project-scoped scan policies.

func (*Service) ListScans 

func (s *Service) ListScans(ctx context.Context, limit int) ([]db.ScanRecord, error)

ListScans returns persisted scans.

func (*Service) ListWorkspaceMembers 

func (s *Service) ListWorkspaceMembers(
	ctx context.Context,
	workspaceID string,
	role string,
	status string,
	limit int,
) ([]db.TenancyWorkspaceMember, error)

ListWorkspaceMembers returns members for one scoped workspace with optional role/status filters.

func (*Service) ListWorkspaces 

func (s *Service) ListWorkspaces(ctx context.Context, limit int) ([]db.TenancyWorkspace, error)

ListWorkspaces returns tenant-scoped workspaces.

func (*Service) PollAWSConnector 

func (s *Service) PollAWSConnector(ctx context.Context, connectorID string, request AWSConnectorPollRequest) (AWSConnectionStatus, error)

func (*Service) PreviewRepoFindingRemediation 

func (s *Service) PreviewRepoFindingRemediation(ctx context.Context, findingID string, request RepoFindingRemediationPreviewRequest) (RepoFindingRemediationPreview, error)

PreviewRepoFindingRemediation returns rule-specific remediation guidance for one repository finding. When source content is provided for a deterministic patchable detector, the response includes the exact fix-PR plan without publishing anything.

func (*Service) ProcessNextQueuedRepoScan 

func (s *Service) ProcessNextQueuedRepoScan(ctx context.Context) (bool, error)

ProcessNextQueuedRepoScan claims and executes one queued repository scan. It returns false when no job is available.

func (*Service) ProcessNextQueuedScan 

func (s *Service) ProcessNextQueuedScan(ctx context.Context) (bool, error)

ProcessNextQueuedScan claims and executes one queued scan. It returns false when no job is available.

func (*Service) ReplayScan 

func (s *Service) ReplayScan(ctx context.Context, scanID string) (db.ScanRecord, error)

ReplayScan re-enqueues one failed or dead-lettered scan as a fresh queued scan.

func (*Service) ResolveActiveWorkspace 

func (s *Service) ResolveActiveWorkspace(ctx context.Context, subject string, workspaceID string) (WorkspaceContext, error)

ResolveActiveWorkspace validates access and returns the requested active workspace context.

func (*Service) ResolveWhoAmIContext 

func (s *Service) ResolveWhoAmIContext(ctx context.Context, subject string) (WhoAmIContext, error)

ResolveWhoAmIContext returns scoped workspace context and caller membership details.

func (*Service) RotateGitHubConnectionSecret 

func (s *Service) RotateGitHubConnectionSecret(ctx context.Context, workspaceID string, projectID string, request GitHubConnectionSecretRotationRequest) (GitHubConnectionStatus, error)

func (*Service) RunRepoScan 

func (s *Service) RunRepoScan(ctx context.Context, request RepoScanRequest) (repoexposure.ScanResult, error)

RunRepoScan performs one repository exposure scan with configured guardrails.

func (*Service) RunRepoScanPersisted 

func (s *Service) RunRepoScanPersisted(ctx context.Context, request RepoScanRequest) (RunRepoScanResult, error)

RunRepoScanPersisted runs one repository scan and persists repo scan metadata + findings.

func (*Service) RunScan 

func (s *Service) RunScan(ctx context.Context) (RunScanResult, error)

RunScan executes one scan and persists metadata + findings.

func (*Service) StartAWSConnector 

func (s *Service) StartAWSConnector(ctx context.Context, request AWSConnectorStartRequest) (AWSConnectorStartResponse, error)

func (*Service) StartGitHubConnection 

func (s *Service) StartGitHubConnection(ctx context.Context, workspaceID string, projectID string, request GitHubConnectionStartRequest) (GitHubConnectionStartResponse, error)

func (*Service) StartGitHubConnector 

func (s *Service) StartGitHubConnector(ctx context.Context, request GitHubConnectorStartRequest) (GitHubConnectorStartResponse, error)

func (*Service) StartKubernetesConnector 

func (s *Service) StartKubernetesConnector(ctx context.Context, request KubernetesConnectorStartRequest) (KubernetesConnectorStartResponse, error)

func (*Service) StartOnboarding 

func (s *Service) StartOnboarding(ctx context.Context, current sessionauth.CurrentSession) (OnboardingStateResponse, error)

StartOnboarding creates or returns the current user's onboarding progress.

func (*Service) TriageFinding 

func (s *Service) TriageFinding(ctx context.Context, findingID string, scanID string, request FindingTriageRequest, actor string) (domain.Finding, error)

TriageFinding applies one workflow mutation and records audit history.

func (*Service) UpdateGitHubConnectionRepositories 

func (s *Service) UpdateGitHubConnectionRepositories(ctx context.Context, workspaceID string, projectID string, request GitHubConnectionRepositorySelectionRequest) (GitHubConnectionStatus, error)

func (*Service) UpdateOnboardingState 

func (s *Service) UpdateOnboardingState(ctx context.Context, current sessionauth.CurrentSession, request OnboardingStateUpdateRequest) (OnboardingStateResponse, error)

UpdateOnboardingState applies one wizard step and persists it server-side.

func (*Service) UpdateWorkOSUserEmail 

func (s *Service) UpdateWorkOSUserEmail(ctx context.Context, subject string, email string) error

func (*Service) UpsertAWSConnection 

func (s *Service) UpsertAWSConnection(ctx context.Context, workspaceID string, projectID string, request AWSConnectionUpsertRequest) (AWSConnectionStatus, error)

func (*Service) UpsertGitHubPATConnector 

func (s *Service) UpsertGitHubPATConnector(ctx context.Context, request GitHubPATConnectorRequest) (GitHubConnectionStatus, error)

func (*Service) UpsertKubernetesConnection 

func (s *Service) UpsertKubernetesConnection(ctx context.Context, workspaceID string, projectID string, request KubernetesConnectionUpsertRequest) (KubernetesConnectionStatus, error)

UpsertKubernetesConnection runs preflight and records the project Kubernetes connector state.

func (*Service) UpsertKubernetesKubeconfigConnector 

func (s *Service) UpsertKubernetesKubeconfigConnector(ctx context.Context, request KubernetesConnectorKubeconfigRequest) (KubernetesConnectionStatus, error)

func (*Service) UpsertManualUserSessionContext 

func (s *Service) UpsertManualUserSessionContext(ctx context.Context, input ManualLoginInput) (ManualLoginResult, error)

UpsertManualUserSessionContext creates the local user and tenancy context used by dev-only manual mode.

func (*Service) UpsertOrganization 

func (s *Service) UpsertOrganization(ctx context.Context, request OrganizationUpsertRequest) (db.TenancyOrganization, error)

UpsertOrganization creates or updates the current scoped organization.

func (*Service) UpsertProject 

func (s *Service) UpsertProject(ctx context.Context, workspaceID string, request ProjectUpsertRequest) (db.TenancyProject, error)

UpsertProject creates or updates one scoped project.

func (*Service) UpsertSAMLAssertedUser 

func (s *Service) UpsertSAMLAssertedUser(ctx context.Context, conn db.IdentityConnection, profile SAMLAssertedProfile) (SAMLLoginResult, error)

UpsertSAMLAssertedUser resolves or provisions an Identrail user from a SAML assertion. Lookup order:

  1. user_identities row with provider = "saml:<connection_id>" and the asserted NameID — the canonical mapping once a user has logged in once.
  2. user_identities row with provider = "scim:<connection_id>" and the asserted NameID, then the email — covers users pre-provisioned via SCIM before their first SAML login.
  3. users row with primary_email == asserted email — falls back to email when JIT-enabled connections need to attach a new IdP identity to an existing manually-created Identrail user.

If no match is found and the connection has JIT disabled, returns ErrSAMLUnprovisionedUser without creating any row.

func (*Service) UpsertScanPolicy 

func (s *Service) UpsertScanPolicy(ctx context.Context, workspaceID string, projectID string, request ScanPolicyUpsertRequest) (db.TenancyScanPolicy, error)

UpsertScanPolicy creates or updates one project-scoped scan policy.

func (*Service) UpsertWorkOSUser 

func (s *Service) UpsertWorkOSUser(ctx context.Context, profile sessionauth.WorkOSProfile) (WorkOSLoginResult, error)

UpsertWorkOSUser safely maps a WorkOS AuthKit profile into Identrail's local account model.

func (*Service) UpsertWorkOSUserForIntent 

func (s *Service) UpsertWorkOSUserForIntent(ctx context.Context, profile sessionauth.WorkOSProfile, intent string) (WorkOSLoginResult, error)

UpsertWorkOSUserForIntent safely maps a WorkOS AuthKit profile into Identrail's local account model while preserving the user's entry point. Login only resolves existing identities; signup can create or reactivate.

func (*Service) UpsertWorkspace 

func (s *Service) UpsertWorkspace(ctx context.Context, request WorkspaceUpsertRequest) (db.TenancyWorkspace, error)

UpsertWorkspace creates or updates one scoped workspace.

func (*Service) UpsertWorkspaceMember 

func (s *Service) UpsertWorkspaceMember(
	ctx context.Context,
	workspaceID string,
	request WorkspaceMemberUpsertRequest,
) (db.TenancyWorkspaceMember, error)

UpsertWorkspaceMember creates or updates one scoped workspace member.

func (*Service) ValidateAWSConnector 

func (s *Service) ValidateAWSConnector(ctx context.Context, connectorID string, request AWSConnectorValidateRequest) (AWSConnectionStatus, error)

type SessionListItem 

type SessionListItem struct {
	ID            string    `json:"id"`
	IP            string    `json:"ip,omitempty"`
	UserAgent     string    `json:"user_agent,omitempty"`
	AuthMethod    string    `json:"auth_method"`
	CreatedAt     time.Time `json:"created_at"`
	LastSeenAt    time.Time `json:"last_seen_at"`
	IdleExpiresAt time.Time `json:"idle_expires_at"`
	Current       bool      `json:"current"`
}

SessionListItem is the safe account/security representation of a session.

type TokenVerifier 

type TokenVerifier interface {
	VerifyToken(ctx context.Context, rawToken string) (VerifiedToken, error)
}

TokenVerifier validates bearer tokens and returns normalized claims.

type TrendPoint 

type TrendPoint struct {
	ScanID     string         `json:"scan_id"`
	StartedAt  time.Time      `json:"started_at"`
	Total      int            `json:"total"`
	BySeverity map[string]int `json:"by_severity"`
}

TrendPoint gives one scan-level snapshot used by dashboard trend charts.

type VerifiedToken 

type VerifiedToken struct {
	Subject     string
	Issuer      string
	Audiences   []string
	TenantID    string
	WorkspaceID string
	Groups      []string
	Roles       []string
	Scopes      []string
}

VerifiedToken contains normalized claims extracted from a validated OIDC token.

type WebhookAlerter 

type WebhookAlerter struct {
	// contains filtered or unexported fields
}

WebhookAlerter posts high-signal findings to one webhook endpoint.

func NewWebhookAlerter 

func NewWebhookAlerter(
	webhookURL string,
	timeout time.Duration,
	minSeverity string,
	hmacSecret string,
	maxFindings int,
	maxRetries int,
	retryBackoff time.Duration,
) (*WebhookAlerter, error)

NewWebhookAlerter creates a webhook notifier with URL safety checks.

func (*WebhookAlerter) NotifyScan 

func (a *WebhookAlerter) NotifyScan(ctx context.Context, provider string, scan db.ScanRecord, findings []domain.Finding) error

type WhoAmIContext 

type WhoAmIContext struct {
	Scope           db.Scope           `json:"scope"`
	ActiveWorkspace *WorkspaceContext  `json:"active_workspace,omitempty"`
	Workspaces      []WorkspaceContext `json:"workspaces"`
}

WhoAmIContext captures identity-adjacent tenancy context for frontend bootstrapping.

type WorkOSLoginResult 

type WorkOSLoginResult struct {
	User             db.User
	Identity         db.UserIdentity
	NewUser          bool
	CurrentOrgID     string
	CurrentWorkspace string
	RedirectPath     string
}

type WorkspaceContext 

type WorkspaceContext struct {
	Workspace db.TenancyWorkspace        `json:"workspace"`
	Member    *db.TenancyWorkspaceMember `json:"member,omitempty"`
	IsActive  bool                       `json:"is_active"`
}

WorkspaceContext captures one workspace plus caller membership context.

type WorkspaceMemberUpsertRequest 

type WorkspaceMemberUpsertRequest struct {
	MemberID string `json:"member_id"`
	UserID   string `json:"user_id"`
	Email    string `json:"email,omitempty"`
	Role     string `json:"role"`
	Status   string `json:"status"`
}

WorkspaceMemberUpsertRequest captures one workspace member write payload.

type WorkspaceUpsertRequest 

type WorkspaceUpsertRequest struct {
	WorkspaceID string `json:"workspace_id"`
	DisplayName string `json:"display_name"`
	Slug        string `json:"slug"`
}

WorkspaceUpsertRequest captures one workspace write payload.

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.