mirror of
https://github.com/Dvorinka/Containr.git
synced 2026-10-28 15:51:26 +00:00
refactor(db): port auth and security handlers to sqlc
- auth.sql: user lookups, counts, register/mirror inserts, profile update - security.sql: access EXISTS, vulnerability list/metrics/status, framework list, latest scan/report, project-id guards - NULL description/service_id rows stay filtered, matching the original scan-error-and-skip behavior - auth_users probe and filtered audit-log queries stay raw: one is a Better Auth table outside the schema, the other is dynamically built - TestSecurityLiveInvariants covers the access predicate, severity ordering, upsert conflict path, and latest-row lookups against live Postgres Authored By: TDvorak <[email protected]>
This commit is contained in:
Tomas Dvorak committed
1 parent
6bcbc1369e
commit
549790c611
10 files changed
+1169
-155
No files matched your search
@@ -0,0 +1,318 @@
|
||||
// Code generated by sqlc. DO NOT EDIT.
|
||||
// versions:
|
||||
// sqlc v1.31.1
|
||||
// source: security.sql
|
||||
|
||||
package sqlcdb
|
||||
|
||||
import (
|
||||
"context"
|
||||
"database/sql"
|
||||
"time"
|
||||
|
||||
"github.com/google/uuid"
|
||||
)
|
||||
|
||||
const checkSecurityProjectAccess = `-- name: CheckSecurityProjectAccess :one
|
||||
SELECT EXISTS (
|
||||
SELECT 1
|
||||
FROM projects p
|
||||
WHERE p.id = $1
|
||||
AND (p.is_approved
|
||||
OR $3::bool
|
||||
OR p.owner_id = $2 OR EXISTS (
|
||||
SELECT 1 FROM project_members pm
|
||||
WHERE pm.project_id = p.id AND pm.user_id = $2
|
||||
))
|
||||
)
|
||||
`
|
||||
|
||||
type CheckSecurityProjectAccessParams struct {
|
||||
ID uuid.UUID `json:"id"`
|
||||
OwnerID uuid.UUID `json:"owner_id"`
|
||||
Column3 bool `json:"column_3"`
|
||||
}
|
||||
|
||||
func (q *Queries) CheckSecurityProjectAccess(ctx context.Context, arg CheckSecurityProjectAccessParams) (bool, error) {
|
||||
row := q.db.QueryRowContext(ctx, checkSecurityProjectAccess, arg.ID, arg.OwnerID, arg.Column3)
|
||||
var exists bool
|
||||
err := row.Scan(&exists)
|
||||
return exists, err
|
||||
}
|
||||
|
||||
const complianceFrameworkExists = `-- name: ComplianceFrameworkExists :one
|
||||
SELECT EXISTS(SELECT 1 FROM compliance_frameworks WHERE id = $1)
|
||||
`
|
||||
|
||||
func (q *Queries) ComplianceFrameworkExists(ctx context.Context, id uuid.UUID) (bool, error) {
|
||||
row := q.db.QueryRowContext(ctx, complianceFrameworkExists, id)
|
||||
var exists bool
|
||||
err := row.Scan(&exists)
|
||||
return exists, err
|
||||
}
|
||||
|
||||
const getComplianceReportProjectID = `-- name: GetComplianceReportProjectID :one
|
||||
SELECT project_id FROM compliance_reports WHERE id = $1
|
||||
`
|
||||
|
||||
func (q *Queries) GetComplianceReportProjectID(ctx context.Context, id uuid.UUID) (uuid.UUID, error) {
|
||||
row := q.db.QueryRowContext(ctx, getComplianceReportProjectID, id)
|
||||
var project_id uuid.UUID
|
||||
err := row.Scan(&project_id)
|
||||
return project_id, err
|
||||
}
|
||||
|
||||
const getLatestComplianceReport = `-- name: GetLatestComplianceReport :one
|
||||
SELECT overall_status, score, assessment_date
|
||||
FROM compliance_reports
|
||||
WHERE project_id = $1
|
||||
ORDER BY assessment_date DESC
|
||||
LIMIT 1
|
||||
`
|
||||
|
||||
type GetLatestComplianceReportRow struct {
|
||||
OverallStatus string `json:"overall_status"`
|
||||
Score int32 `json:"score"`
|
||||
AssessmentDate time.Time `json:"assessment_date"`
|
||||
}
|
||||
|
||||
func (q *Queries) GetLatestComplianceReport(ctx context.Context, projectID uuid.UUID) (GetLatestComplianceReportRow, error) {
|
||||
row := q.db.QueryRowContext(ctx, getLatestComplianceReport, projectID)
|
||||
var i GetLatestComplianceReportRow
|
||||
err := row.Scan(&i.OverallStatus, &i.Score, &i.AssessmentDate)
|
||||
return i, err
|
||||
}
|
||||
|
||||
const getLatestSecurityScan = `-- name: GetLatestSecurityScan :one
|
||||
SELECT id, COALESCE((summary->>'score')::int, 0)::int AS score, started_at AS scanned_at, status
|
||||
FROM security_scans
|
||||
WHERE project_id = $1
|
||||
ORDER BY started_at DESC
|
||||
LIMIT 1
|
||||
`
|
||||
|
||||
type GetLatestSecurityScanRow struct {
|
||||
ID uuid.UUID `json:"id"`
|
||||
Score int32 `json:"score"`
|
||||
ScannedAt time.Time `json:"scanned_at"`
|
||||
Status string `json:"status"`
|
||||
}
|
||||
|
||||
func (q *Queries) GetLatestSecurityScan(ctx context.Context, projectID uuid.UUID) (GetLatestSecurityScanRow, error) {
|
||||
row := q.db.QueryRowContext(ctx, getLatestSecurityScan, projectID)
|
||||
var i GetLatestSecurityScanRow
|
||||
err := row.Scan(
|
||||
&i.ID,
|
||||
&i.Score,
|
||||
&i.ScannedAt,
|
||||
&i.Status,
|
||||
)
|
||||
return i, err
|
||||
}
|
||||
|
||||
const getProjectOwnerText = `-- name: GetProjectOwnerText :one
|
||||
SELECT owner_id::text FROM projects WHERE id = $1
|
||||
`
|
||||
|
||||
func (q *Queries) GetProjectOwnerText(ctx context.Context, id uuid.UUID) (string, error) {
|
||||
row := q.db.QueryRowContext(ctx, getProjectOwnerText, id)
|
||||
var owner_id string
|
||||
err := row.Scan(&owner_id)
|
||||
return owner_id, err
|
||||
}
|
||||
|
||||
const getSecurityScanProjectID = `-- name: GetSecurityScanProjectID :one
|
||||
SELECT project_id FROM security_scans WHERE id = $1
|
||||
`
|
||||
|
||||
func (q *Queries) GetSecurityScanProjectID(ctx context.Context, id uuid.UUID) (uuid.UUID, error) {
|
||||
row := q.db.QueryRowContext(ctx, getSecurityScanProjectID, id)
|
||||
var project_id uuid.UUID
|
||||
err := row.Scan(&project_id)
|
||||
return project_id, err
|
||||
}
|
||||
|
||||
const getVulnerabilityMetrics = `-- name: GetVulnerabilityMetrics :one
|
||||
SELECT
|
||||
COUNT(*) AS total,
|
||||
COUNT(*) FILTER (WHERE severity = 'critical') AS critical,
|
||||
COUNT(*) FILTER (WHERE severity = 'high') AS high,
|
||||
COUNT(*) FILTER (WHERE severity = 'medium') AS medium,
|
||||
COUNT(*) FILTER (WHERE severity = 'low') AS low,
|
||||
COUNT(*) FILTER (WHERE status = 'open') AS open,
|
||||
COUNT(*) FILTER (WHERE status = 'resolved') AS resolved
|
||||
FROM vulnerabilities
|
||||
WHERE project_id = $1
|
||||
`
|
||||
|
||||
type GetVulnerabilityMetricsRow struct {
|
||||
Total int64 `json:"total"`
|
||||
Critical int64 `json:"critical"`
|
||||
High int64 `json:"high"`
|
||||
Medium int64 `json:"medium"`
|
||||
Low int64 `json:"low"`
|
||||
Open int64 `json:"open"`
|
||||
Resolved int64 `json:"resolved"`
|
||||
}
|
||||
|
||||
func (q *Queries) GetVulnerabilityMetrics(ctx context.Context, projectID uuid.UUID) (GetVulnerabilityMetricsRow, error) {
|
||||
row := q.db.QueryRowContext(ctx, getVulnerabilityMetrics, projectID)
|
||||
var i GetVulnerabilityMetricsRow
|
||||
err := row.Scan(
|
||||
&i.Total,
|
||||
&i.Critical,
|
||||
&i.High,
|
||||
&i.Medium,
|
||||
&i.Low,
|
||||
&i.Open,
|
||||
&i.Resolved,
|
||||
)
|
||||
return i, err
|
||||
}
|
||||
|
||||
const getVulnerabilityProjectID = `-- name: GetVulnerabilityProjectID :one
|
||||
SELECT project_id FROM vulnerabilities WHERE id = $1
|
||||
`
|
||||
|
||||
func (q *Queries) GetVulnerabilityProjectID(ctx context.Context, id uuid.UUID) (uuid.UUID, error) {
|
||||
row := q.db.QueryRowContext(ctx, getVulnerabilityProjectID, id)
|
||||
var project_id uuid.UUID
|
||||
err := row.Scan(&project_id)
|
||||
return project_id, err
|
||||
}
|
||||
|
||||
const listComplianceFrameworks = `-- name: ListComplianceFrameworks :many
|
||||
SELECT id, name, description, version, enabled, created_at
|
||||
FROM compliance_frameworks
|
||||
WHERE enabled = true
|
||||
ORDER BY name
|
||||
`
|
||||
|
||||
type ListComplianceFrameworksRow struct {
|
||||
ID uuid.UUID `json:"id"`
|
||||
Name string `json:"name"`
|
||||
Description sql.NullString `json:"description"`
|
||||
Version string `json:"version"`
|
||||
Enabled bool `json:"enabled"`
|
||||
CreatedAt time.Time `json:"created_at"`
|
||||
}
|
||||
|
||||
func (q *Queries) ListComplianceFrameworks(ctx context.Context) ([]ListComplianceFrameworksRow, error) {
|
||||
rows, err := q.db.QueryContext(ctx, listComplianceFrameworks)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer rows.Close()
|
||||
items := []ListComplianceFrameworksRow{}
|
||||
for rows.Next() {
|
||||
var i ListComplianceFrameworksRow
|
||||
if err := rows.Scan(
|
||||
&i.ID,
|
||||
&i.Name,
|
||||
&i.Description,
|
||||
&i.Version,
|
||||
&i.Enabled,
|
||||
&i.CreatedAt,
|
||||
); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
items = append(items, i)
|
||||
}
|
||||
if err := rows.Close(); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if err := rows.Err(); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return items, nil
|
||||
}
|
||||
|
||||
const listVulnerabilities = `-- name: ListVulnerabilities :many
|
||||
SELECT id, type, severity, title, description, service_id, status, found_at, resolved_at
|
||||
FROM vulnerabilities
|
||||
WHERE project_id = $1
|
||||
ORDER BY
|
||||
CASE severity
|
||||
WHEN 'critical' THEN 1
|
||||
WHEN 'high' THEN 2
|
||||
WHEN 'medium' THEN 3
|
||||
WHEN 'low' THEN 4
|
||||
END,
|
||||
found_at DESC
|
||||
`
|
||||
|
||||
type ListVulnerabilitiesRow struct {
|
||||
ID uuid.UUID `json:"id"`
|
||||
Type string `json:"type"`
|
||||
Severity string `json:"severity"`
|
||||
Title string `json:"title"`
|
||||
Description sql.NullString `json:"description"`
|
||||
ServiceID uuid.NullUUID `json:"service_id"`
|
||||
Status string `json:"status"`
|
||||
FoundAt time.Time `json:"found_at"`
|
||||
ResolvedAt sql.NullTime `json:"resolved_at"`
|
||||
}
|
||||
|
||||
func (q *Queries) ListVulnerabilities(ctx context.Context, projectID uuid.UUID) ([]ListVulnerabilitiesRow, error) {
|
||||
rows, err := q.db.QueryContext(ctx, listVulnerabilities, projectID)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer rows.Close()
|
||||
items := []ListVulnerabilitiesRow{}
|
||||
for rows.Next() {
|
||||
var i ListVulnerabilitiesRow
|
||||
if err := rows.Scan(
|
||||
&i.ID,
|
||||
&i.Type,
|
||||
&i.Severity,
|
||||
&i.Title,
|
||||
&i.Description,
|
||||
&i.ServiceID,
|
||||
&i.Status,
|
||||
&i.FoundAt,
|
||||
&i.ResolvedAt,
|
||||
); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
items = append(items, i)
|
||||
}
|
||||
if err := rows.Close(); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if err := rows.Err(); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return items, nil
|
||||
}
|
||||
|
||||
const serviceExistsInProject = `-- name: ServiceExistsInProject :one
|
||||
SELECT EXISTS(SELECT 1 FROM services WHERE id = $1 AND project_id = $2)
|
||||
`
|
||||
|
||||
type ServiceExistsInProjectParams struct {
|
||||
ID uuid.UUID `json:"id"`
|
||||
ProjectID uuid.UUID `json:"project_id"`
|
||||
}
|
||||
|
||||
func (q *Queries) ServiceExistsInProject(ctx context.Context, arg ServiceExistsInProjectParams) (bool, error) {
|
||||
row := q.db.QueryRowContext(ctx, serviceExistsInProject, arg.ID, arg.ProjectID)
|
||||
var exists bool
|
||||
err := row.Scan(&exists)
|
||||
return exists, err
|
||||
}
|
||||
|
||||
const updateVulnerabilityStatus = `-- name: UpdateVulnerabilityStatus :exec
|
||||
UPDATE vulnerabilities SET status = $1, resolved_at = $2 WHERE id = $3
|
||||
`
|
||||
|
||||
type UpdateVulnerabilityStatusParams struct {
|
||||
Status string `json:"status"`
|
||||
ResolvedAt sql.NullTime `json:"resolved_at"`
|
||||
ID uuid.UUID `json:"id"`
|
||||
}
|
||||
|
||||
func (q *Queries) UpdateVulnerabilityStatus(ctx context.Context, arg UpdateVulnerabilityStatusParams) error {
|
||||
_, err := q.db.ExecContext(ctx, updateVulnerabilityStatus, arg.Status, arg.ResolvedAt, arg.ID)
|
||||
return err
|
||||
}
|
||||
Reference in new issue
Block a user