neiam /gitgud

defmodule GitGud.Repo.Migrations.CreateSecurityAlerts do
  use Ecto.Migration

  def change do
    # Dependency alerts are off until an org — or a personal repository's
    # owner — turns them on.
    alter table(:organizations) do
      add :advisories_enabled, :boolean, null: false, default: false
    end

    alter table(:repositories) do
      add :advisories_enabled, :boolean, null: false, default: false
      # What the last scan read: a digest of the lockfiles' blob ids at the
      # head it scanned, so an unchanged push doesn't scan again.
      add :advisories_digest, :string
      add :advisories_scanned_at, :utc_datetime
    end

    create table(:security_alerts) do
      add :repository_id, references(:repositories, on_delete: :delete_all), null: false
      add :advisory_id, :string, null: false
      add :aliases, {:array, :string}, null: false, default: []
      add :summary, :string
      add :ecosystem, :string, null: false
      add :package, :string, null: false
      add :version, :string, null: false
      add :fixed_versions, {:array, :string}, null: false, default: []
      add :severity, :float
      add :manifest_path, :string, null: false
      add :state, :string, null: false, default: "open"
      add :dismissed_reason, :string
      add :dismissed_by_id, references(:users, on_delete: :nilify_all)
      add :first_seen_at, :utc_datetime, null: false
      add :fixed_at, :utc_datetime

      timestamps(type: :utc_datetime)
    end

    # One alert per advisory per package version per lockfile.
    create unique_index(:security_alerts, [
             :repository_id,
             :manifest_path,
             :ecosystem,
             :package,
             :version,
             :advisory_id
           ])

    create index(:security_alerts, [:repository_id, :state])
  end
end