v3

type Advisory struct {
	ID   string
	Link string
}

type Cvss struct {
	// VendorMetadata captures non-standard CVSS fields that vendors can sometimes
	// include when providing CVSS information.  This vendor-specific metadata type
	// allows to capture that data for persisting into the database
	VendorMetadata interface{}
	Metrics        CvssMetrics
	Vector         string // A textual representation of the metric values used to determine the score
	Version        string // The version of the CVSS spec, for example 2.0, 3.0, or 3.1
}

type CvssMetrics struct {
	// BaseScore ranges from 0 - 10 and defines qualities intrinsic to the severity of a vulnerability.
	BaseScore float64
	// ExploitabilityScore is a pointer to avoid having a 0 value by default.
	// It is an indicator of how easy it may be for an attacker to exploit
	// a vulnerability
	ExploitabilityScore *float64
	// ImpactScore represents the effects of an exploited vulnerability
	// relative to compromise in confidentiality, integrity, and availability.
	// It is an optional parameter, so that is why it is a pointer instead of
	// a regular field
	ImpactScore *float64
}

type Fix struct {
	Versions []string // The version(s) which this particular vulnerability was fixed in
	State    FixState
}

type FixState string

type ID struct {
	// BuildTimestamp is the timestamp used to define the age of the DB, ideally including the age of the data
	// contained in the DB, not just when the DB file was created.
	BuildTimestamp time.Time
	SchemaVersion  int
}

type IDReader interface {
	GetID() (*ID, error)
}

type IDWriter interface {
	SetID(ID) error
}

type NamerByPackage func(p pkg.Package) []string

type Vulnerability struct {
	ID                     string                   // The identifier of the vulnerability or advisory
	PackageName            string                   // The name of the package that is vulnerable
	Namespace              string                   // The ecosystem where the package resides
	VersionConstraint      string                   // The version range which the given package is vulnerable
	VersionFormat          string                   // The format which all version fields should be interpreted as
	CPEs                   []string                 // The CPEs which are considered vulnerable
	RelatedVulnerabilities []VulnerabilityReference // Other Vulnerabilities that are related to this one (e.g. GHSA relate to CVEs, or how distro CVE relates to NVD record)
	Fix                    Fix                      // All information about fixed versions
	Advisories             []Advisory               // Any vendor advisories about fixes or other notifications about this vulnerability
}

type VulnerabilityMetadata struct {
	ID           string   // The identifier of the vulnerability or advisory
	Namespace    string   // Where this entry is valid within
	DataSource   string   // A URL where the data was sourced from
	RecordSource string   // The source of the vulnerability information (relative to the immediate upstream in the enterprise feedgroup)
	Severity     string   // How severe the vulnerability is (valid values are defined by upstream sources currently)
	URLs         []string // URLs to get more information about the vulnerability or advisory
	Description  string   // Description of the vulnerability
	Cvss         []Cvss   // Common Vulnerability Scoring System values
}

type VulnerabilityMetadataStore interface {
	VulnerabilityMetadataStoreReader
	VulnerabilityMetadataStoreWriter
}

type VulnerabilityMetadataStoreReader interface {
	GetVulnerabilityMetadata(id, namespace string) (*VulnerabilityMetadata, error)
}

type VulnerabilityMetadataStoreWriter interface {
	AddVulnerabilityMetadata(metadata ...VulnerabilityMetadata) error
}

type VulnerabilityReference struct {
	ID        string
	Namespace string
}

type VulnerabilityStore interface {
	VulnerabilityStoreReader
	VulnerabilityStoreWriter
}

type VulnerabilityStoreReader interface {
	// GetVulnerability retrieves vulnerabilities associated with a namespace and a package name
	GetVulnerability(namespace, name string) ([]Vulnerability, error)
}

type VulnerabilityStoreWriter interface {
	// AddVulnerability inserts a new record of a vulnerability into the store
	AddVulnerability(vulnerabilities ...Vulnerability) error
}