v5

type Advisory struct {
	ID   string `json:"id"`
	Link string `json:"link"`
}

type Cvss struct {
	// VendorMetadata captures non-standard CVSS fields that vendors can sometimes
	// include when providing CVSS information.  This vendor-specific metadata type
	// allows to capture that data for persisting into the database
	VendorMetadata interface{} `json:"vendor_metadata"`
	Metrics        CvssMetrics `json:"metrics"`
	Vector         string      `json:"vector"`  // A textual representation of the metric values used to determine the score
	Version        string      `json:"version"` // The version of the CVSS spec, for example 2.0, 3.0, or 3.1
	Source         string      `json:"source"`  // Identifies the organization that provided the score
	Type           string      `json:"type"`    // Whether the source is a `primary` or `secondary` source
}

type CvssMetrics struct {
	// BaseScore ranges from 0 - 10 and defines qualities intrinsic to the severity of a vulnerability.
	BaseScore float64 `json:"base_score"`
	// ExploitabilityScore is a pointer to avoid having a 0 value by default.
	// It is an indicator of how easy it may be for an attacker to exploit
	// a vulnerability
	ExploitabilityScore *float64 `json:"exploitability_score"`
	// ImpactScore represents the effects of an exploited vulnerability
	// relative to compromise in confidentiality, integrity, and availability.
	// It is an optional parameter, so that is why it is a pointer instead of
	// a regular field
	ImpactScore *float64 `json:"impact_score"`
}

type DBCloser interface {
	Close()
}

type Diff struct {
	Reason    DiffReason `json:"reason"`
	ID        string     `json:"id"`
	Namespace string     `json:"namespace"`
	Packages  []string   `json:"packages"`
}

type DiffReader interface {
	DiffStore(s StoreReader) (*[]Diff, error)
}

type DiffReason = string

type Fix struct {
	Versions []string `json:"versions"` // The version(s) which this particular vulnerability was fixed in
	State    FixState `json:"state"`
}

type FixState string

type ID struct {
	// BuildTimestamp is the timestamp used to define the age of the DB, ideally including the age of the data
	// contained in the DB, not just when the DB file was created.
	BuildTimestamp time.Time `json:"build_timestamp"`
	SchemaVersion  int       `json:"schema_version"`
}

type IDReader interface {
	GetID() (*ID, error)
}

type IDWriter interface {
	SetID(ID) error
}

type PackageExclusionConstraint struct {
	Name        string                 `json:"name,omitempty"`     // Package name
	Language    string                 `json:"language,omitempty"` // The language ecosystem for a package
	Type        string                 `json:"type,omitempty"`     // Package type
	Version     string                 `json:"version,omitempty"`  // Package version
	Location    string                 `json:"location,omitempty"` // Package location
	ExtraFields map[string]interface{} `json:"-"`
}

type Store interface {
	StoreReader
	StoreWriter
	DBCloser
}

type StoreReader interface {
	IDReader
	DiffReader
	VulnerabilityStoreReader
	VulnerabilityMetadataStoreReader
	VulnerabilityMatchExclusionStoreReader
}

type StoreWriter interface {
	IDWriter
	VulnerabilityStoreWriter
	VulnerabilityMetadataStoreWriter
	VulnerabilityMatchExclusionStoreWriter
}

type Vulnerability struct {
	ID                     string                   `json:"id"`                      // The identifier of the vulnerability or advisory
	PackageName            string                   `json:"package_name"`            // The name of the package that is vulnerable
	Namespace              string                   `json:"namespace"`               // The ecosystem where the package resides
	PackageQualifiers      []qualifier.Qualifier    `json:"package_qualifiers"`      // The qualifiers for determining if a package is vulnerable
	VersionConstraint      string                   `json:"version_constraint"`      // The version range which the given package is vulnerable
	VersionFormat          string                   `json:"version_format"`          // The format which all version fields should be interpreted as
	CPEs                   []string                 `json:"cpes"`                    // The CPEs which are considered vulnerable
	RelatedVulnerabilities []VulnerabilityReference `json:"related_vulnerabilities"` // Other Vulnerabilities that are related to this one (e.g. GHSA relate to CVEs, or how distro CVE relates to NVD record)
	Fix                    Fix                      `json:"fix"`                     // All information about fixed versions
	Advisories             []Advisory               `json:"advisories"`              // Any vendor advisories about fixes or other notifications about this vulnerability
}

type VulnerabilityExclusionConstraint struct {
	Namespace   string                 `json:"namespace,omitempty"` // Vulnerability namespace
	FixState    FixState               `json:"fix_state,omitempty"` // Vulnerability fix state
	ExtraFields map[string]interface{} `json:"-"`
}

type VulnerabilityMatchExclusion struct {
	ID            string                                  `json:"id"`                    // The identifier of the vulnerability or advisory
	Constraints   []VulnerabilityMatchExclusionConstraint `json:"constraints,omitempty"` // The constraints under which the exclusion applies
	Justification string                                  `json:"justification"`         // Justification for the exclusion
}

type VulnerabilityMatchExclusionConstraint struct {
	Vulnerability VulnerabilityExclusionConstraint `json:"vulnerability,omitempty"` // Vulnerability exclusion criteria
	Package       PackageExclusionConstraint       `json:"package,omitempty"`       // Package exclusion criteria
	ExtraFields   map[string]interface{}           `json:"-"`
}

type VulnerabilityMatchExclusionStore interface {
	VulnerabilityMatchExclusionStoreReader
	VulnerabilityMatchExclusionStoreWriter
}

type VulnerabilityMatchExclusionStoreReader interface {
	GetVulnerabilityMatchExclusion(id string) ([]VulnerabilityMatchExclusion, error)
}

type VulnerabilityMatchExclusionStoreWriter interface {
	AddVulnerabilityMatchExclusion(exclusion ...VulnerabilityMatchExclusion) error
}

type VulnerabilityMetadata struct {
	ID           string   `json:"id"`            // The identifier of the vulnerability or advisory
	Namespace    string   `json:"namespace"`     // Where this entry is valid within
	DataSource   string   `json:"data_source"`   // A URL where the data was sourced from
	RecordSource string   `json:"record_source"` // The source of the vulnerability information (relative to the immediate upstream in the enterprise feedgroup)
	Severity     string   `json:"severity"`      // How severe the vulnerability is (valid values are defined by upstream sources currently)
	URLs         []string `json:"urls"`          // URLs to get more information about the vulnerability or advisory
	Description  string   `json:"description"`   // Description of the vulnerability
	Cvss         []Cvss   `json:"cvss"`          // Common Vulnerability Scoring System values
}

type VulnerabilityMetadataStore interface {
	VulnerabilityMetadataStoreReader
	VulnerabilityMetadataStoreWriter
}

type VulnerabilityMetadataStoreReader interface {
	GetVulnerabilityMetadata(id, namespace string) (*VulnerabilityMetadata, error)
	GetAllVulnerabilityMetadata() (*[]VulnerabilityMetadata, error)
}

type VulnerabilityMetadataStoreWriter interface {
	AddVulnerabilityMetadata(metadata ...VulnerabilityMetadata) error
}

type VulnerabilityReference struct {
	ID        string `json:"id"`
	Namespace string `json:"namespace"`
}

type VulnerabilityStore interface {
	VulnerabilityStoreReader
	VulnerabilityStoreWriter
}

type VulnerabilityStoreReader interface {
	// GetVulnerabilityNamespaces retrieves unique list of vulnerability namespaces
	GetVulnerabilityNamespaces() ([]string, error)
	// GetVulnerability retrieves vulnerabilities by namespace and id
	GetVulnerability(namespace, id string) ([]Vulnerability, error)
	// SearchForVulnerabilities retrieves vulnerabilities by namespace and package
	SearchForVulnerabilities(namespace, packageName string) ([]Vulnerability, error)
	GetAllVulnerabilities() (*[]Vulnerability, error)
}

type VulnerabilityStoreWriter interface {
	// AddVulnerability inserts a new record of a vulnerability into the store
	AddVulnerability(vulnerabilities ...Vulnerability) error
}