biz

type APIToken struct {
	ID          uuid.UUID
	Name        string
	Description string
	// This is the JWT value returned only during creation
	JWT string
	// Tokens are scoped to organizations
	OrganizationID   uuid.UUID
	OrganizationName string
	CreatedAt        *time.Time
	// When the token expires
	ExpiresAt *time.Time
	// When the token was manually revoked
	RevokedAt  *time.Time
	LastUsedAt *time.Time
	// If the token is scoped to a project
	ProjectID   *uuid.UUID
	ProjectName *string
}

type APITokenCreateOpt func(*apiTokenOptions)

type APITokenJWTConfig struct {
	SymmetricHmacKey string
}

type APITokenListFilters struct {
	// FilterByProjects is used to filter the result by a project list
	// If it's empty, no filter will be applied
	FilterByProjects []uuid.UUID
	// IncludeRevoked is used to include revoked tokens in the result
	IncludeRevoked bool
	// FilterByScope is used to filter the result by the scope of the token
	FilterByScope APITokenScope
}

type APITokenListOpt func(*APITokenListFilters)

type APITokenRepo interface {
	Create(ctx context.Context, name string, description *string, expiresAt *time.Time, organizationID uuid.UUID, projectID *uuid.UUID) (*APIToken, error)
	List(ctx context.Context, orgID *uuid.UUID, filters *APITokenListFilters) ([]*APIToken, error)
	Revoke(ctx context.Context, orgID, ID uuid.UUID) error
	UpdateExpiration(ctx context.Context, ID uuid.UUID, expiresAt time.Time) error
	UpdateLastUsedAt(ctx context.Context, ID uuid.UUID, lastUsedAt time.Time) error
	FindByID(ctx context.Context, ID uuid.UUID) (*APIToken, error)
	FindByIDInOrg(ctx context.Context, orgID uuid.UUID, id uuid.UUID) (*APIToken, error)
	FindByNameInOrg(ctx context.Context, orgID uuid.UUID, name string) (*APIToken, error)
}

type APITokenScope string

type APITokenSyncerUseCase struct {
	// contains filtered or unexported fields
}

type APITokenUseCase struct {
	DefaultAuthzPolicies []*authz.Policy
	// contains filtered or unexported fields
}

type AddMemberToGroupOpts struct {
	*IdentityReference
	// UserEmail is the email of the user to add to the group.
	UserEmail string
	// RequesterID is the ID of the user who is requesting to add the member. Optional.
	// If provided, the requester must be a maintainer or admin.
	RequesterID uuid.UUID
	// Maintainer indicates if the new member should be a maintainer.
	Maintainer bool
}

type AddMemberToGroupResult struct {
	// Membership is the membership that was created or found.
	Membership *GroupMembership
	// InvitationSent indicates if an invitation was sent instead of creating a membership directly.
	InvitationSent bool
}

type AddMemberToProjectOpts struct {
	// ProjectReference is the reference to the project.
	ProjectReference *IdentityReference
	// UserEmail is the email of the user to add to the project.
	UserEmail string
	// GroupReference is the reference to the group to add to the project.
	GroupReference *IdentityReference
	// RequesterID is the ID of the user who is requesting to add the member.
	RequesterID uuid.UUID
	// Role represents the role to assign to the user in the project.
	Role authz.Role
}

type AddMemberToProjectResult struct {
	// Membership is the membership that was created or found.
	Membership *ProjectMembership
	// InvitationSent indicates if an invitation was sent instead of creating a membership directly.
	InvitationSent bool
}

type AttachOpts struct {
	IntegrationID, WorkflowID, OrgID string
	// The integration that is being attached
	FanOutIntegration sdk.FanOut
	// The attachment configuration
	AttachmentConfig *structpb.Struct
}

type Attestation struct {
	Envelope *dsse.Envelope
	Bundle   []byte
	Digest   string
}

type AttestationState struct {
	State *v1.CraftingState
	// Digest will be used for optimistic concurrency control
	Digest string
}

type AttestationStateRepo interface {
	Initialized(ctx context.Context, workflowRunID uuid.UUID) (bool, error)
	Save(ctx context.Context, workflowRunID uuid.UUID, state []byte, baseDigest string) error
	Read(ctx context.Context, workflowRunID uuid.UUID) ([]byte, string, error)
	Reset(ctx context.Context, workflowRunID uuid.UUID) error
}

type AttestationStateSaveOpts struct {
	BaseDigest string
}

type AttestationStateUseCase struct {
	// contains filtered or unexported fields
}

type AttestationUseCase struct {
	CASClient
	// contains filtered or unexported fields
}

type AuditorUseCase struct {
	// contains filtered or unexported fields
}

type ByStatusCount struct {
	Status string
	Count  int32
}

type CASBackend struct {
	ID                                uuid.UUID
	Name                              string
	Location, Description, SecretName string
	CreatedAt, ValidatedAt            *time.Time
	OrganizationID                    uuid.UUID
	ValidationStatus                  CASBackendValidationStatus
	// OCI, S3, ...
	Provider CASBackendProvider
	// Whether this is the default cas backend for the organization
	Default bool
	// it's a inline backend, the artifacts are embedded in the attestation
	Inline bool
	// It's a fallback backend, it cannot be deleted
	Fallback bool

	Limits *CASBackendLimits
}

type CASBackendCreateOpts struct {
	*CASBackendOpts
	Name     string
	Fallback bool
	MaxBytes int64
}

type CASBackendLimits struct {
	// Max number of bytes allowed to be stored in this backend per blob
	MaxBytes int64
}

type CASBackendOpts struct {
	OrgID                             uuid.UUID
	Location, SecretName, Description string
	Provider                          CASBackendProvider
	Default                           bool
}

type CASBackendProvider string

type CASBackendReader interface {
	FindDefaultBackend(ctx context.Context, orgID string) (*CASBackend, error)
	FindByIDInOrg(ctx context.Context, OrgID, ID string) (*CASBackend, error)
	PerformValidation(ctx context.Context, ID string) error
}

type CASBackendRepo interface {
	FindDefaultBackend(ctx context.Context, orgID uuid.UUID) (*CASBackend, error)
	FindFallbackBackend(ctx context.Context, orgID uuid.UUID) (*CASBackend, error)
	FindByID(ctx context.Context, ID uuid.UUID) (*CASBackend, error)
	FindByIDInOrg(ctx context.Context, OrgID, ID uuid.UUID) (*CASBackend, error)
	FindByNameInOrg(ctx context.Context, OrgID uuid.UUID, name string) (*CASBackend, error)
	List(ctx context.Context, orgID uuid.UUID) ([]*CASBackend, error)
	UpdateValidationStatus(ctx context.Context, ID uuid.UUID, status CASBackendValidationStatus) error
	Create(context.Context, *CASBackendCreateOpts) (*CASBackend, error)
	Update(context.Context, *CASBackendUpdateOpts) (*CASBackend, error)
	Delete(ctx context.Context, ID uuid.UUID) error
	SoftDelete(ctx context.Context, ID uuid.UUID) error
}

type CASBackendUpdateOpts struct {
	*CASBackendOpts
	ID uuid.UUID
}

type CASBackendUseCase struct {
	MaxBytesDefault int64
	// contains filtered or unexported fields
}

type CASBackendValidationStatus string

type CASClient interface {
	CASUploader
	CASDownloader
}

type CASClientFactory func(conf *conf.Bootstrap_CASServer, token string) (casclient.DownloaderUploader, func(), error)

type CASClientOpts func(u *CASClientUseCase)

type CASClientUseCase struct {
	// contains filtered or unexported fields
}

type CASCredentialsUseCase struct {
	// contains filtered or unexported fields
}

type CASCredsOpts struct {
	BackendType string // i.e OCI, S3
	SecretPath  string // path to for example the OCI secret in the vault
	Role        robotaccount.Role
	MaxBytes    int64
}

type CASDownloader interface {
	Download(ctx context.Context, backendType, secretID string, w io.Writer, digest string) error
}

type CASMapping struct {
	ID, OrgID, WorkflowRunID uuid.UUID
	CASBackend               *CASBackend
	Digest                   string
	CreatedAt                *time.Time
	// A public mapping means that the material/attestation can be downloaded by anyone
	Public    bool
	ProjectID uuid.UUID
}

type CASMappingCreateOpts struct {
	WorkflowRunID *uuid.UUID
	ProjectID     *uuid.UUID
}

type CASMappingFindOptions struct {
	Orgs       []uuid.UUID
	ProjectIDs []uuid.UUID
}

type CASMappingLookupRef struct {
	Name, Digest string
}

type CASMappingRepo interface {
	// Create a mapping with an optional workflow run id
	Create(ctx context.Context, digest string, casBackendID uuid.UUID, opts *CASMappingCreateOpts) (*CASMapping, error)
	// List all the CAS mappings for the given digest
	FindByDigest(ctx context.Context, digest string) ([]*CASMapping, error)
}

type CASMappingUseCase struct {
	// contains filtered or unexported fields
}

type CASServerDefaultOpts struct {
	DefaultEntryMaxSize string
}

type CASUploader interface {
	Upload(ctx context.Context, backendType, secretID string, content io.Reader, filename, digest string) error
}

type Contract struct {
	// Raw representation of the contract in yaml, json, or cue
	// it maintain the format provided by the user
	Raw []byte
	// Detected format as provided by the user
	Format unmarshal.RawFormat
	// marhalled proto contract
	Schema *schemav1.CraftingSchema
}

type ContractCreateOpts struct {
	Name        string
	OrgID       uuid.UUID
	Description *string
	// raw representation of the contract in whatever original format it was (json, yaml, ...)
	Contract *Contract
	// ProjectID indicates the project to be scoped to
	ProjectID *uuid.UUID
}

type ContractQueryOpt func(opts *ContractQueryOpts)

type ContractQueryOpts struct {
	// SkipGetReferences will skip the get references subquery
	// The references are composed by the project name and workflow name
	SkipGetReferences bool
}

type ContractScope string

type ContractUpdateOpts struct {
	Description *string
	// raw representation of the contract in whatever original format it was (json, yaml, ...)
	Contract *Contract
}

type CreateGroupOpts struct {
	// Name is the name of the group.
	Name string
	// The description is a brief description of the group.
	Description string
	// UserID is the ID of the user who owns the group.
	UserID *uuid.UUID
}

type CreateOpt func(*createOptions)

type DayRunsCount struct {
	Date   time.Time
	Totals []*ByStatusCount
}

type ErrAlreadyExists struct {
	// contains filtered or unexported fields
}

type ErrAmbiguousReferrer struct {
	// contains filtered or unexported fields
}

type ErrAttestationStateConflict struct {
	// contains filtered or unexported fields
}

type ErrInvalidTimeWindow struct {
	// contains filtered or unexported fields
}

type ErrInvalidUUID struct {
	// contains filtered or unexported fields
}

type ErrNotFound struct {
	// contains filtered or unexported fields
}

type ErrNotImplemented struct {
	// contains filtered or unexported fields
}

type ErrUnauthorized struct {
	// contains filtered or unexported fields
}

type ErrValidation struct {
	// contains filtered or unexported fields
}

type GetFromRootFilter func(*GetFromRootFilters)

type GetFromRootFilters struct {
	// RootKind is the kind of the root referrer, i.e ATTESTATION
	RootKind *string
	// Wether to filter by visibility or not
	Public *bool
	// ProjectIDs stores visible projects by org for the requesting user.
	// If an org entry doesn't exist, it means that RBAC is not applied, hence all projects in that org are visible
	ProjectIDs map[OrgID][]ProjectID
}

type Group struct {
	// ID is the unique identifier for the group.
	ID uuid.UUID
	// Name is the name of the group.
	Name string
	// The Description is a brief description of the group.
	Description string
	// Members is a list of group memberships, which includes the users who are members of the group.
	Members []*GroupMembership
	// MemberCount is the total number of members in the group.
	MemberCount int
	// Organization is the organization to which the group belongs.
	Organization *Organization
	// CreatedAt is the timestamp when the group was created.
	CreatedAt *time.Time
	// UpdatedAt is the timestamp when the group was last updated.
	UpdatedAt *time.Time
	// DeletedAt is the timestamp when the group was deleted, if applicable.
	DeletedAt *time.Time
}

type GroupMembership struct {
	// User is the user who is a member of the group.
	User *User
	// Maintainer indicates if the user is a maintainer of the group.
	Maintainer bool
	// CreatedAt is the timestamp when the user was added to the group.
	CreatedAt *time.Time
	// UpdatedAt is the timestamp when the membership was last updated.
	UpdatedAt *time.Time
	// DeletedAt is the timestamp when the membership was deleted, if applicable.
	DeletedAt *time.Time
}

type GroupProjectInfo struct {
	// ID is the unique identifier of the project
	ID uuid.UUID
	// Name is the name of the project
	Name string
	// Description is the description of the project
	Description string
	// Role represents the role of the group in the project (admin or viewer)
	Role authz.Role
	// LatestVersionID is the ID of the latest version of the project, if available
	LatestVersionID *uuid.UUID
	// CreatedAt is the timestamp when the membership was created
	CreatedAt *time.Time
}

type GroupRepo interface {
	// List retrieves a list of groups in the organization, optionally filtered by name, description, and owner.
	List(ctx context.Context, orgID uuid.UUID, filterOpts *ListGroupOpts, paginationOpts *pagination.OffsetPaginationOpts) ([]*Group, int, error)
	// Create creates a new group.
	Create(ctx context.Context, orgID uuid.UUID, opts *CreateGroupOpts) (*Group, error)
	// Update updates an existing group.
	Update(ctx context.Context, orgID uuid.UUID, groupID uuid.UUID, opts *UpdateGroupOpts) (*Group, error)
	// FindByOrgAndID finds a group by its organization ID and group ID.
	FindByOrgAndID(ctx context.Context, orgID uuid.UUID, groupID uuid.UUID) (*Group, error)
	// FindByOrgAndName finds a group by its organization ID and group name.
	FindByOrgAndName(ctx context.Context, orgID uuid.UUID, name string) (*Group, error)
	// FindGroupMembershipByGroupAndID finds a group membership by group ID and user ID.
	FindGroupMembershipByGroupAndID(ctx context.Context, groupID uuid.UUID, userID uuid.UUID) (*GroupMembership, error)
	// SoftDelete soft-deletes a group by marking it as deleted.
	SoftDelete(ctx context.Context, orgID uuid.UUID, groupID uuid.UUID) error
	// ListMembers retrieves a list of members in a group, optionally filtered by maintainer status.
	ListMembers(ctx context.Context, orgID uuid.UUID, groupID uuid.UUID, opts *ListMembersOpts, paginationOpts *pagination.OffsetPaginationOpts) ([]*GroupMembership, int, error)
	// AddMemberToGroup adds a user to a group, optionally specifying if they are a maintainer.
	AddMemberToGroup(ctx context.Context, orgID uuid.UUID, groupID uuid.UUID, userID uuid.UUID, maintainer bool) (*GroupMembership, error)
	// RemoveMemberFromGroup removes a user from a group.
	RemoveMemberFromGroup(ctx context.Context, orgID uuid.UUID, groupID uuid.UUID, userID uuid.UUID) error
	// UpdateMemberMaintainerStatus updates the maintainer status of a group member.
	UpdateMemberMaintainerStatus(ctx context.Context, orgID uuid.UUID, groupID uuid.UUID, userID uuid.UUID, isMaintainer bool) error
	// ListPendingInvitationsByGroup retrieves a list of pending invitations for a group
	ListPendingInvitationsByGroup(ctx context.Context, orgID uuid.UUID, groupID uuid.UUID, paginationOpts *pagination.OffsetPaginationOpts) ([]*OrgInvitation, int, error)
	// ListProjectsByGroup retrieves a list of projects that a group is a member of with pagination.
	ListProjectsByGroup(ctx context.Context, orgID uuid.UUID, groupID uuid.UUID, visibleProjectIDs []uuid.UUID, paginationOpts *pagination.OffsetPaginationOpts) ([]*GroupProjectInfo, int, error)
	// UpdateGroupMemberCount updates the member count of a group.
	UpdateGroupMemberCount(ctx context.Context, groupID uuid.UUID) error
}

type GroupUseCase struct {
	// contains filtered or unexported fields
}

type IdentityReference struct {
	// ID is the unique identifier of the identity
	ID *uuid.UUID
	// Name is the name of the identity
	Name *string
}

type Integration struct {
	ID uuid.UUID
	// Kind is the type of the integration, it matches the registered plugin ID
	Kind string
	// Name is a unique identifier for the integration registration
	Name string
	// Description is a human readable description of the integration registration
	// It helps to differentiate different instances of the same kind
	Description string
	// Registration Configuration, usually JSON marshalled
	Config []byte
	// Identifier to the external provider where any secret information is stored
	SecretName string
	CreatedAt  *time.Time
}

type IntegrationAndAttachment struct {
	*Integration
	*IntegrationAttachment
}

type IntegrationAttachment struct {
	ID                        uuid.UUID
	CreatedAt                 *time.Time
	Config                    []byte
	WorkflowID, IntegrationID uuid.UUID
}

type IntegrationAttachmentRepo interface {
	Create(ctx context.Context, integrationID, workflowID uuid.UUID, config []byte) (*IntegrationAttachment, error)
	List(ctx context.Context, orgID uuid.UUID, opts *ListAttachmentsOpts) ([]*IntegrationAndAttachment, error)
	FindByIDInOrg(ctx context.Context, orgID, ID uuid.UUID) (*IntegrationAttachment, error)
	SoftDelete(ctx context.Context, ID uuid.UUID) error
}

type IntegrationCreateOpts struct {
	// Unique name of the registration
	// used to declaratively reference the integration
	Name                          string
	Kind, Description, SecretName string
	OrgID                         uuid.UUID
	Config                        []byte
}

type IntegrationRepo interface {
	Create(ctx context.Context, opts *IntegrationCreateOpts) (*Integration, error)
	List(ctx context.Context, orgID uuid.UUID) ([]*Integration, error)
	FindByIDInOrg(ctx context.Context, orgID, ID uuid.UUID) (*Integration, error)
	FindByNameInOrg(ctx context.Context, orgID uuid.UUID, ID string) (*Integration, error)
	SoftDelete(ctx context.Context, ID uuid.UUID) error
}

type IntegrationUseCase struct {
	// contains filtered or unexported fields
}

type InvitationCreateOpt func(*invitationCreateOpts)

type ListAttachmentsOpts struct {
	// limit search for a particular workflow
	WorkflowID *uuid.UUID
	// limit search in a list of projects. Note that `nil` is no filter
	ProjectIDs []uuid.UUID
}

type ListByOrgOpts struct {
	// MembershipID the ID of the membership to filter by
	MembershipID *uuid.UUID
	// Name the name of the user to filter memberships by
	Name *string
	// Email the email of the user to filter memberships by
	Email *string
	// Role the role of the user to filter memberships by
	Role *authz.Role
}

type ListGroupOpts struct {
	// Name is the name of the group to filter by.
	Name string
	// Description is the description of the group to filter by.
	Description string
	// MemberEmail is the email of the member to filter by.
	MemberEmail string
	// UserID is the ID of the user to filter by.
	UserID *uuid.UUID
}

type ListMembersOpts struct {
	*IdentityReference
	// Maintainers indicate whether to filter the members by their maintainer status.
	Maintainers *bool
	// MemberEmail is the email of the member to filter by.
	MemberEmail *string
	// RequesterID is the ID of the user who is requesting to list mmebers. Optional.
	// If provided, the requester must be a maintainer or admin.
	RequesterID uuid.UUID
}

type ListProjectsByGroupOpts struct {
	// Group reference
	*IdentityReference
	// FilterByProject is a list of project IDs to filter the results by.
	FilterByProject []uuid.UUID
}

type Membership struct {
	ID, OrganizationID   uuid.UUID
	Current              bool
	CreatedAt, UpdatedAt *time.Time
	Org                  *Organization
	User                 *User
	Role                 authz.Role
	// polymorphic membership
	MembershipType authz.MembershipType
	MemberID       uuid.UUID
	ResourceType   authz.ResourceType
	ResourceID     uuid.UUID
	ParentID       *uuid.UUID
}

type MembershipCreateOpt func(*membershipCreateOpts)

type MembershipRepo interface {
	FindByUser(ctx context.Context, userID uuid.UUID) ([]*Membership, error)
	FindByOrgIDAndUserEmail(ctx context.Context, orgID uuid.UUID, userEmail string) (*Membership, error)
	FindByUserAndResourceID(ctx context.Context, userID, resourceID uuid.UUID) (*Membership, error)
	FindByOrg(ctx context.Context, orgID uuid.UUID, opts *ListByOrgOpts, paginationOpts *pagination.OffsetPaginationOpts) ([]*Membership, int, error)
	FindByIDInUser(ctx context.Context, userID, ID uuid.UUID) (*Membership, error)
	FindByIDInOrg(ctx context.Context, orgID, ID uuid.UUID) (*Membership, error)
	FindByOrgAndUser(ctx context.Context, orgID, userID uuid.UUID) (*Membership, error)
	FindByOrgNameAndUser(ctx context.Context, orgName string, userID uuid.UUID) (*Membership, error)
	SetCurrent(ctx context.Context, ID uuid.UUID) (*Membership, error)
	SetRole(ctx context.Context, ID uuid.UUID, role authz.Role) (*Membership, error)
	Create(ctx context.Context, orgID, userID uuid.UUID, current bool, role authz.Role) (*Membership, error)
	Delete(ctx context.Context, ID uuid.UUID) error

	ListAllByUser(ctx context.Context, userID uuid.UUID) ([]*Membership, error)
	// ListGroupMembershipsByUser returns all memberships of the users inherited from groups
	ListGroupMembershipsByUser(ctx context.Context, userID uuid.UUID) ([]*Membership, error)
	ListAllByResource(ctx context.Context, rt authz.ResourceType, id uuid.UUID) ([]*Membership, error)
	AddResourceRole(ctx context.Context, orgID uuid.UUID, resourceType authz.ResourceType, resID uuid.UUID, mType authz.MembershipType, memberID uuid.UUID, role authz.Role, parentID *uuid.UUID) error
}

type MembershipUseCase struct {
	// contains filtered or unexported fields
}

type MembershipsRBAC interface {
	ListAllMembershipsForUser(ctx context.Context, userID uuid.UUID) ([]*Membership, error)
}

type NewIntegrationUseCaseOpts struct {
	IRepo   IntegrationRepo
	IaRepo  IntegrationAttachmentRepo
	WfRepo  WorkflowRepo
	CredsRW credentials.ReaderWriter
	Logger  log.Logger
}

type NewUserUseCaseParams struct {
	UserRepo            UserRepo
	MembershipUseCase   *MembershipUseCase
	OrganizationUseCase *OrganizationUseCase
	OnboardingConfig    []*config.OnboardingSpec
	Logger              log.Logger
	AuditorUseCase      *AuditorUseCase
	UserAccessSyncer    *UserAccessSyncerUseCase
}

type OrgID = uuid.UUID

type OrgInvitation struct {
	ID            uuid.UUID
	Org           *Organization
	Sender        *User
	ReceiverEmail string
	CreatedAt     *time.Time
	Status        OrgInvitationStatus
	Role          authz.Role
	// Context is a JSON field that can be used to store additional information
	Context *OrgInvitationContext
}

type OrgInvitationContext struct {
	// GroupIDToJoin is the ID of the group to join when accepting the invitation
	GroupIDToJoin *uuid.UUID `json:"group_id_to_join,omitempty"`
	// GroupMaintainer indicates if the user should be added as a maintainer of the group
	GroupMaintainer bool `json:"group_maintainer,omitempty"`
	// ProjectIDToJoin is the ID of the project to join when accepting the invitation
	ProjectIDToJoin *uuid.UUID `json:"project_id_to_join,omitempty"`
	// ProjectRole is the role to assign to the user in the project
	ProjectRole authz.Role `json:"project_role,omitempty"`
	// ExternalMetadata can be used to store additional information
	ExternalMetadata json.RawMessage `json:"external_metadata,omitempty"`
}

type OrgInvitationRepo interface {
	Create(ctx context.Context, orgID, senderID uuid.UUID, receiverEmail string, role authz.Role, invCtx *OrgInvitationContext) (*OrgInvitation, error)
	FindByID(ctx context.Context, ID uuid.UUID) (*OrgInvitation, error)
	PendingInvitation(ctx context.Context, orgID uuid.UUID, receiverEmail string) (*OrgInvitation, error)
	PendingInvitations(ctx context.Context, receiverEmail string) ([]*OrgInvitation, error)
	SoftDelete(ctx context.Context, id uuid.UUID) error
	ListByOrg(ctx context.Context, org uuid.UUID) ([]*OrgInvitation, error)
	ChangeStatus(ctx context.Context, ID uuid.UUID, status OrgInvitationStatus) error
}

type OrgInvitationStatus string

type OrgInvitationUseCase struct {
	// contains filtered or unexported fields
}

type OrgMetricsRepo interface {
	// Total number of runs within the provided time window (from now)
	RunsTotal(ctx context.Context, orgID uuid.UUID, timeWindow *TimeWindow, projectIDs []uuid.UUID) (int32, error)
	// Total number by run status
	RunsByStatusTotal(ctx context.Context, orgID uuid.UUID, timeWindow *TimeWindow, projectIDs []uuid.UUID) (map[string]int32, error)
	RunsByRunnerTypeTotal(ctx context.Context, orgID uuid.UUID, timeWindow *TimeWindow, projectIDs []uuid.UUID) (map[string]int32, error)
	TopWorkflowsByRunsCount(ctx context.Context, orgID uuid.UUID, numWorkflows int, timeWindow *TimeWindow, projectIDs []uuid.UUID) ([]*TopWorkflowsByRunsCountItem, error)
	DailyRunsCount(ctx context.Context, orgID, workflowID uuid.UUID, timeWindow *TimeWindow, projectIDs []uuid.UUID) ([]*DayRunsCount, error)
}

type OrgMetricsUseCase struct {
	// contains filtered or unexported fields
}

type Organization struct {
	ID, Name  string
	CreatedAt *time.Time
	UpdatedAt *time.Time
	// BlockOnPolicyViolation blocks the workflow run if policy evaluation fails
	BlockOnPolicyViolation bool
	// PoliciesAllowedHostnames is an array of hostnames that are allowed to be used in the policies
	PoliciesAllowedHostnames []string
}

type OrganizationRepo interface {
	FindByID(ctx context.Context, orgID uuid.UUID) (*Organization, error)
	FindByName(ctx context.Context, name string) (*Organization, error)
	Create(ctx context.Context, name string) (*Organization, error)
	Update(ctx context.Context, id uuid.UUID, blockOnPolicyViolation *bool, policiesAllowedHostnames []string) (*Organization, error)
	Delete(ctx context.Context, ID uuid.UUID) error
}

type OrganizationUseCase struct {
	// contains filtered or unexported fields
}

type Project struct {
	// ID is the unique identifier of the project
	ID uuid.UUID
	// Name is the name of the project
	Name string
	// OrgID is the organization that this project belongs to
	OrgID uuid.UUID
	// CreatedAt is the time when the project was created
	CreatedAt *time.Time
	// UpdatedAt is the time when the project was last updated
	UpdatedAt *time.Time
}

type ProjectID = uuid.UUID

type ProjectMembership struct {
	// User is the user who is a member of the project (nil for group memberships).
	User *User
	// Group is the group that is a member of the project (nil for user memberships).
	Group *Group
	// MembershipType indicates if this is a user or group membership.
	MembershipType authz.MembershipType
	// Role represents the role of the user/group in the project (admin or viewer).
	Role authz.Role
	// LatestProjectVersionID is the ID of the latest project version this membership is associated with.
	LatestProjectVersionID *uuid.UUID
	// CreatedAt is the timestamp when the user/group was added to the project.
	CreatedAt *time.Time
	// UpdatedAt is the timestamp when the membership was last updated.
	UpdatedAt *time.Time
	// ParentID is the parent membership object used for nested memberships, if applicable
	ParentID *uuid.UUID
	// ParentResourceID identifies the parent resource of this membership, if applicable
	ParentResourceID *uuid.UUID
}

type ProjectUseCase struct {
	// contains filtered or unexported fields
}

type ProjectVersion struct {
	// ID is the UUID of the project version.
	ID uuid.UUID
	// Version is the version of the project.
	Version string
	// Prerelease indicates whether the version is a prerelease.
	Prerelease bool
	// TotalWorkflowRuns is the total number of workflow runs for this version.
	TotalWorkflowRuns int
	// CreatedAt is the time when the project version was created.
	CreatedAt *time.Time
	// ReleasedAt is the time when the version was released.
	ReleasedAt *time.Time
	ProjectID  uuid.UUID
}

type ProjectVersionRepo interface {
	FindByProjectAndVersion(ctx context.Context, projectID uuid.UUID, version string) (*ProjectVersion, error)
	Update(ctx context.Context, versionID uuid.UUID, updates *ProjectVersionUpdateOpts) (*ProjectVersion, error)
	Create(ctx context.Context, projectID uuid.UUID, version string, prerelease bool) (*ProjectVersion, error)
}

type ProjectVersionUpdateOpts struct {
	Prerelease *bool
}

type ProjectVersionUseCase struct {
	// contains filtered or unexported fields
}

type ProjectsRepo interface {
	FindProjectByOrgIDAndName(ctx context.Context, orgID uuid.UUID, projectName string) (*Project, error)
	FindProjectByOrgIDAndID(ctx context.Context, orgID uuid.UUID, projectID uuid.UUID) (*Project, error)
	Create(ctx context.Context, orgID uuid.UUID, name string) (*Project, error)
	ListProjectsByOrgID(ctx context.Context, orgID uuid.UUID) ([]*Project, error)
	// ListMembers retrieves a list of members in a project, optionally filtered by admin status.
	ListMembers(ctx context.Context, orgID uuid.UUID, projectID uuid.UUID, paginationOpts *pagination.OffsetPaginationOpts) ([]*ProjectMembership, int, error)
	// AddMemberToProject adds a user or group to a project with a specific role.
	AddMemberToProject(ctx context.Context, orgID uuid.UUID, projectID uuid.UUID, memberID uuid.UUID, membershipType authz.MembershipType, role authz.Role) (*ProjectMembership, error)
	// RemoveMemberFromProject removes a user or group from a project.
	RemoveMemberFromProject(ctx context.Context, orgID uuid.UUID, projectID uuid.UUID, memberID uuid.UUID, membershipType authz.MembershipType) error
	// UpdateMemberRoleInProject updates the role of a user or group in a project.
	UpdateMemberRoleInProject(ctx context.Context, orgID uuid.UUID, projectID uuid.UUID, memberID uuid.UUID, membershipType authz.MembershipType, newRole authz.Role) (*ProjectMembership, error)
	// FindProjectMembershipByProjectAndID finds a project membership by project ID and member ID (user or group).
	FindProjectMembershipByProjectAndID(ctx context.Context, orgID uuid.UUID, projectID uuid.UUID, memberID uuid.UUID, membershipType authz.MembershipType) (*ProjectMembership, error)
	// ListPendingInvitationsByProject retrieves a list of pending invitations for a project.
	ListPendingInvitationsByProject(ctx context.Context, orgID uuid.UUID, projectID uuid.UUID, paginationOpts *pagination.OffsetPaginationOpts) ([]*OrgInvitation, int, error)
}

type PromObservable interface {
	ObserveAttestationIfNeeded(ctx context.Context, run *WorkflowRun, status WorkflowRunStatus) bool
}

type PrometheusUseCase struct {
	// contains filtered or unexported fields
}

type Referrer struct {
	Digest string
	Kind   string
	// Wether the item is downloadable from CAS or not
	Downloadable bool
	// If this referrer is part of a public workflow
	InPublicWorkflow bool
	References       []*Referrer

	Metadata, Annotations map[string]string
}

type ReferrerRepo interface {
	Save(ctx context.Context, input []*Referrer, workflowID uuid.UUID) error
	// GetFromRoot returns the referrer identified by the provided content digest, including its first-level references
	// For example if sha:deadbeef represents an attestation, the result will contain the attestation + materials associated to it
	// OrgIDs represent an allowList of organizations where the referrers should be looked for
	GetFromRoot(ctx context.Context, digest string, orgIDs []uuid.UUID, filters ...GetFromRootFilter) (*StoredReferrer, error)
	// Exist Checks if a given referrer by digest exist.
	// The query can be scoped further down if needed by providing the kind or visibility status
	Exist(ctx context.Context, digest string, filters ...GetFromRootFilter) (bool, error)
}

type ReferrerUseCase struct {
	// contains filtered or unexported fields
}

type RemotePolicy struct {
	ProviderRef *policies.PolicyReference
	Policy      *schemav1.Policy
}

type RemotePolicyGroup struct {
	ProviderRef *policies.PolicyReference
	PolicyGroup *schemav1.PolicyGroup
}

type RemoveMemberFromGroupOpts struct {
	*IdentityReference
	// UserEmail is the email of the user to remove from the group.
	UserEmail string
	// RequesterID is the ID of the user who is requesting to remove the member. Optional.
	// If provided, the requester must be a maintainer or admin.
	RequesterID uuid.UUID
}

type RemoveMemberFromProjectOpts struct {
	// ProjectReference is the reference to the project.
	ProjectReference *IdentityReference
	// UserEmail is the email of the user to remove from the project.
	UserEmail string
	// GroupReference is the reference to the group to remove from the project.
	GroupReference *IdentityReference
	// RequesterID is the ID of the user who is requesting to remove the member.
	RequesterID uuid.UUID
}

type RobotAccount struct {
	Name                 string
	ID                   uuid.UUID
	JWT                  string
	WorkflowID           uuid.UUID
	CreatedAt, RevokedAt *time.Time
}

type RobotAccountRepo interface {
	Create(ctx context.Context, name string, workflowID uuid.UUID) (*RobotAccount, error)
	List(ctx context.Context, workflowID uuid.UUID, includeRevoked bool) ([]*RobotAccount, error)
	FindByID(ctx context.Context, ID uuid.UUID) (*RobotAccount, error)
	Revoke(ctx context.Context, orgID, ID uuid.UUID) error
}

type RobotAccountUseCase struct {
	// contains filtered or unexported fields
}

type RunListFilters struct {
	WorkflowID *uuid.UUID
	VersionID  *uuid.UUID
	Status     WorkflowRunStatus
	ProjectIDs []uuid.UUID
}

type SaveOption func(*AttestationStateSaveOpts)

type ScopedEntity struct {
	// Type is the type of the scoped entity i.e project or org
	Type string
	// ID is the id of the scoped entity
	ID uuid.UUID
	// Name is the name of the scoped entity
	Name string
}

type SigningUseCase struct {
	CAs                  *ca.CertificateAuthorities
	TimestampAuthorities []*TimestampAuthority
	// contains filtered or unexported fields
}

type StoredReferrer struct {
	*Referrer
	ID        uuid.UUID
	CreatedAt *time.Time
	// Fully expanded list of 1-level off references
	References                      []*StoredReferrer
	OrgIDs, WorkflowIDs, ProjectIDs []uuid.UUID
}

type TimeWindow struct {
	From time.Time
	To   time.Time
}

type TimestampAuthority struct {
	Issuer    bool
	URL       *url.URL
	CertChain []*x509.Certificate
}

type TopWorkflowsByRunsCountItem struct {
	Workflow *Workflow
	ByStatus map[string]int32
	Total    int32
}

type TrustedRoot struct {
	// map of keyID and PEM encoded certificates
	Keys map[string][]string
	// Timestamp Authorities
	TimestampAuthorities map[string][]string
}

type UpdateGroupOpts struct {
	// NewDescription is the new description of the group.
	NewDescription *string
	// NewName is the new name of the group.
	NewName *string
}

type UpdateMemberMaintainerStatusOpts struct {
	// Group reference
	*IdentityReference
	// UserReference is used to identify the user whose maintainer status is to be updated
	UserReference *IdentityReference
	// RequesterID is the ID of the user who is requesting to update the maintainer status. Optional.
	// If provided, the requester must be a maintainer or admin.
	RequesterID uuid.UUID
	// IsMaintainer is the new maintainer status for the user.
	IsMaintainer bool
}

type UpdateMemberRoleOpts struct {
	// ProjectReference is the reference to the project.
	ProjectReference *IdentityReference
	// UserEmail is the email of the user whose role to update.
	UserEmail string
	// GroupReference is the reference to the group whose role to update.
	GroupReference *IdentityReference
	// RequesterID is the ID of the user who is requesting to update the role.
	RequesterID uuid.UUID
	// NewRole represents the new role to assign to the member in the project.
	NewRole authz.Role
}

type UpsertByEmailOpts struct {
	// DisableAutoOnboarding, if set to true, will skip the auto-onboarding process
	DisableAutoOnboarding *bool
	FirstName             *string
	LastName              *string
	SSOGroups             []string
}

type User struct {
	ID                  string
	FirstName           string
	LastName            string
	Email               string
	CreatedAt           *time.Time
	UpdatedAt           *time.Time
	HasRestrictedAccess *bool
}

type UserAccessSyncerUseCase struct {
	// contains filtered or unexported fields
}

type UserOrgFinder interface {
	FindByID(ctx context.Context, userID string) (*User, error)
	CurrentMembership(ctx context.Context, userID string) (*Membership, error)
	MembershipInOrg(ctx context.Context, userID string, orgName string) (*Membership, error)
}

type UserRepo interface {
	CreateByEmail(ctx context.Context, email string, firstName, lastName *string) (*User, error)
	FindByEmail(ctx context.Context, email string) (*User, error)
	FindByID(ctx context.Context, userID uuid.UUID) (*User, error)
	Delete(ctx context.Context, userID uuid.UUID) error
	FindAll(ctx context.Context, pagination *pagination.OffsetPaginationOpts) ([]*User, int, error)
	UpdateAccess(ctx context.Context, userID uuid.UUID, isAccessRestricted bool) (*User, error)
	UpdateNameAndLastName(ctx context.Context, userID uuid.UUID, firstName, lastName *string) (*User, error)
	HasUsersWithAccessPropertyNotSet(ctx context.Context) (bool, error)
	FindUsersWithAccessPropertyNotSet(ctx context.Context) ([]*User, error)
}

type UserUseCase struct {
	// contains filtered or unexported fields
}

type VerificationResult struct {
	Result        bool
	FailureReason string
}

type Workflow struct {
	Name, Description, Team, Project string
	CreatedAt                        *time.Time
	RunsCounter                      int
	LastRun                          *WorkflowRun
	ID, ContractID, OrgID            uuid.UUID
	ContractName                     string
	// Latest available contract revision
	ContractRevisionLatest int
	// Public means that the associated workflow runs, attestations and materials
	// are reachable by other users, regardless of their organization
	// This field is also used to calculate if an user can download attestations/materials from the CAS
	Public    bool
	ProjectID uuid.UUID
}

type WorkflowContract struct {
	ID                      uuid.UUID
	Name                    string
	Description             string
	LatestRevision          int
	LatestRevisionCreatedAt *time.Time
	CreatedAt               *time.Time
	UpdatedAt               *time.Time
	// WorkflowRefs is the list of workflows associated with this contract
	WorkflowRefs []*WorkflowRef
	// entity the contract is scoped to, if not set it's scoped to the organization
	ScopedEntity *ScopedEntity
}

type WorkflowContractCreateOpts struct {
	OrgID, Name string
	RawSchema   []byte
	Description *string
	ProjectID   *uuid.UUID
	// Make sure that the name is unique in the organization
	AddUniquePrefix bool
}

type WorkflowContractListFilters struct {
	// FilterByProjects is used to filter the result by a project list
	// If it's empty, no filter will be applied
	FilterByProjects []uuid.UUID
}

type WorkflowContractRepo interface {
	Create(ctx context.Context, opts *ContractCreateOpts) (*WorkflowContract, error)
	List(ctx context.Context, orgID uuid.UUID, filter *WorkflowContractListFilters) ([]*WorkflowContract, error)
	FindByIDInOrg(ctx context.Context, orgID, ID uuid.UUID) (*WorkflowContract, error)
	FindByNameInOrg(ctx context.Context, orgID uuid.UUID, name string) (*WorkflowContract, error)
	Describe(ctx context.Context, orgID, contractID uuid.UUID, revision int, opts ...ContractQueryOpt) (*WorkflowContractWithVersion, error)
	FindVersionByID(ctx context.Context, versionID uuid.UUID) (*WorkflowContractWithVersion, error)
	Update(ctx context.Context, orgID uuid.UUID, name string, opts *ContractUpdateOpts) (*WorkflowContractWithVersion, error)
	SoftDelete(ctx context.Context, contractID uuid.UUID) error
}

type WorkflowContractUpdateOpts struct {
	RawSchema   []byte
	Description *string
}

type WorkflowContractUseCase struct {
	// contains filtered or unexported fields
}

type WorkflowContractVersion struct {
	ID        uuid.UUID
	Revision  int
	CreatedAt *time.Time
	Schema    *Contract
}

type WorkflowContractWithVersion struct {
	Contract *WorkflowContract
	Version  *WorkflowContractVersion
}

type WorkflowCreateOpts struct {
	Name, OrgID, Project, Team, ContractName, Description string
	ContractID                                            string
	// ContractBytes is the raw contract bytes that can be used to create or update the contract
	ContractBytes []byte
	// DetectedContract is the detected contract from the contract bytes
	DetectedContract *Contract
	// Public means that the associated workflow runs, attestations and materials
	// are reachable by other users, regardless of their organization
	Public bool

	// Owner identifies the user to be marked as owner of the project
	Owner *uuid.UUID
}

type WorkflowListOpt func(opts *WorkflowContractListFilters)

type WorkflowListOpts struct {
	// WorkflowName is the name of the workflow
	WorkflowName string
	// WorkflowDescription is the description of the workflow
	WorkflowDescription string
	// WorkflowTeam is the team of the workflow
	WorkflowTeam string
	// WorkflowProjectNames is the project name of the workflow
	WorkflowProjectNames []string
	// WorkflowPublic is the flag to filter public workflows
	WorkflowPublic *bool
	// WorkflowActiveWindow is the active window of the workflow
	WorkflowRunRunnerType string
	// WorkflowActiveWindow is the active window of the workflow
	WorkflowActiveWindow *TimeWindow
	// WorkflowRunStatus is the status of the workflow runs to return
	WorkflowRunLastStatus WorkflowRunStatus
	// JSONFilters is the filters to apply to the JSON fields
	JSONFilters []*jsonfilter.JSONFilter
	// ProjectIDs is used to filter the result by a project list
	// Note that a `nil` value means "no filter", and an empty slice will cause an empty result
	ProjectIDs []uuid.UUID
}

type WorkflowRef struct {
	ID          uuid.UUID
	Name        string
	ProjectName string
}

type WorkflowRepo interface {
	Create(ctx context.Context, opts *WorkflowCreateOpts) (*Workflow, error)
	Update(ctx context.Context, id uuid.UUID, opts *WorkflowUpdateOpts) (*Workflow, error)
	List(ctx context.Context, orgID uuid.UUID, filter *WorkflowListOpts, pagination *pagination.OffsetPaginationOpts) ([]*Workflow, int, error)
	GetOrgScoped(ctx context.Context, orgID, workflowID uuid.UUID) (*Workflow, error)
	GetOrgScopedByProjectAndName(ctx context.Context, orgID uuid.UUID, projectName, workflowName string) (*Workflow, error)
	IncRunsCounter(ctx context.Context, workflowID uuid.UUID) error
	FindByID(ctx context.Context, workflowID uuid.UUID) (*Workflow, error)
	SoftDelete(ctx context.Context, workflowID uuid.UUID) error
}