-- 064_discovery_connectors.sql — Connettori di discovery (mappatura rete/cloud) per-org.
-- Più connettori per organizzazione; l'agente esterno autentica con una api_key dedicata
-- (scope ingest:assets) e auto-popola Inventario + dipendenze + flussi di rete (ID.AM-03).
-- Apply idempotente: application/cli/migrate_064_discovery_connectors.php
-- Additiva, non distruttiva.

CREATE TABLE IF NOT EXISTS discovery_connectors (
    id               INT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
    organization_id  INT NOT NULL,
    name             VARCHAR(120) NOT NULL,                 -- es. "Rete sede Modena", "AWS prod"
    connector_type   ENUM('network','aws','azure','gcp','cmdb','agent','custom') NOT NULL DEFAULT 'network',
    config           JSON NULL,                             -- CIDR target, account/region cloud, opzioni
    api_key_id       INT UNSIGNED NULL,                     -- chiave usata dall'agente (api_keys.id)
    status           ENUM('active','paused','error') NOT NULL DEFAULT 'active',
    schedule         ENUM('manual','hourly','daily','weekly') NOT NULL DEFAULT 'manual',
    last_run_at      TIMESTAMP NULL,
    last_status      VARCHAR(20) NULL,                      -- ok|error|running
    last_discovered  INT NULL,                              -- n. asset scoperti all'ultimo run
    last_message     VARCHAR(255) NULL,
    created_by       INT NULL,
    created_at       TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    updated_at       TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
    UNIQUE KEY uq_dc_org_name (organization_id, name),
    INDEX idx_dc_org (organization_id),
    INDEX idx_dc_key (api_key_id)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

CREATE TABLE IF NOT EXISTS discovery_runs (
    id                 INT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
    connector_id       INT UNSIGNED NOT NULL,
    organization_id    INT NOT NULL,
    started_at         TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    finished_at        TIMESTAMP NULL,
    status             ENUM('running','ok','error') NOT NULL DEFAULT 'ok',
    discovered_assets  INT NOT NULL DEFAULT 0,
    discovered_flows   INT NOT NULL DEFAULT 0,
    message            VARCHAR(255) NULL,
    INDEX idx_dr_conn (connector_id),
    INDEX idx_dr_org (organization_id)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

-- Flussi di rete (ID.AM-03): inventario dei flussi tra sistemi e verso l'esterno.
CREATE TABLE IF NOT EXISTS network_flows (
    id               INT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
    organization_id  INT NOT NULL,
    src              VARCHAR(190) NOT NULL,                 -- host/asset sorgente (ip o nome)
    dst              VARCHAR(190) NOT NULL,                 -- host/asset destinazione (ip o nome)
    port             INT NULL,
    protocol         VARCHAR(12) NULL,                      -- tcp|udp|icmp
    direction        ENUM('internal','inbound','outbound') NOT NULL DEFAULT 'internal',
    discovery_source VARCHAR(40) NOT NULL DEFAULT 'manual', -- network/aws/...; manual
    external_ref     VARCHAR(190) NULL,                     -- chiave dedup dal sorgente
    last_seen_at     TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    created_at       TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    UNIQUE KEY uq_flow (organization_id, external_ref),
    INDEX idx_flow_org (organization_id)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;