// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
// SPDX-License-Identifier: GPL-3.0-or-later

package v1_27

import (
	"xorm.io/xorm"
)

// AddSecurityScanningTables creates security_alert and security_scanner_config tables.
func AddSecurityScanningTables(x *xorm.Engine) error {
	type SecurityAlert struct {
		ID          int64  `xorm:"pk autoincr"`
		RepoID      int64  `xorm:"INDEX NOT NULL 'repo_id'"`
		Scanner     string `xorm:"VARCHAR(20) NOT NULL 'scanner'"`
		Severity    string `xorm:"VARCHAR(10) NOT NULL 'severity'"`
		Status      string `xorm:"VARCHAR(10) NOT NULL DEFAULT 'active' 'status'"`
		RuleID      string `xorm:"VARCHAR(100) NOT NULL 'rule_id'"`
		Title       string `xorm:"TEXT NOT NULL 'title'"`
		Description string `xorm:"TEXT 'description'"`
		FilePath    string `xorm:"TEXT 'file_path'"`
		LineNumber  int    `xorm:"'line_number'"`
		CommitSHA   string `xorm:"VARCHAR(64) 'commit_sha'"`
		Fingerprint string `xorm:"VARCHAR(64) INDEX 'fingerprint'"`
		Metadata    string `xorm:"TEXT 'metadata'"`
		ResolvedBy  int64  `xorm:"'resolved_by'"`
		CreatedUnix int64  `xorm:"INDEX CREATED 'created_unix'"`
		UpdatedUnix int64  `xorm:"UPDATED 'updated_unix'"`
	}
	if err := x.Sync(new(SecurityAlert)); err != nil {
		return err
	}

	type SecurityScannerConfig struct {
		ID             int64  `xorm:"pk autoincr"`
		RepoID         int64  `xorm:"UNIQUE INDEX NOT NULL 'repo_id'"`
		Enabled        bool   `xorm:"NOT NULL DEFAULT true 'enabled'"`
		BlockOnPush    bool   `xorm:"NOT NULL DEFAULT false 'block_on_push'"`
		SecretScanner  bool   `xorm:"NOT NULL DEFAULT true 'secret_scanner'"`
		DependScanner  bool   `xorm:"NOT NULL DEFAULT true 'depend_scanner'"`
		CodeScanner    bool   `xorm:"NOT NULL DEFAULT false 'code_scanner'"`
		ConfigScanner  bool   `xorm:"NOT NULL DEFAULT false 'config_scanner'"`
		LicenseScanner bool   `xorm:"NOT NULL DEFAULT false 'license_scanner'"`
		CustomPatterns string `xorm:"TEXT 'custom_patterns'"`
		CreatedUnix    int64  `xorm:"INDEX CREATED 'created_unix'"`
		UpdatedUnix    int64  `xorm:"UPDATED 'updated_unix'"`
	}
	return x.Sync(new(SecurityScannerConfig))
}
