- overview: &2912 - parent issue: #233020 - [context](https://gitlab.com/gitlab-org/gitlab/-/issues/233020#note_402142087) # Summary create new model called `dast_site_token`. ``` Column | Type | Collation | Nullable | Default | Storage | Stats target | Description ----------------+--------------------------+-----------+----------+----------------------------------------+----------+--------------+------------- id | bigint | | not null | nextval('dast_sites_id_seq'::regclass) | plain | | project_id | bigint | | not null | | plain | | token | text | | not null | | extended | | url | text | | not null | | extended | | expired_at | timestamp with time zone | | not null | | plain | | created_at | timestamp with time zone | | not null | | plain | | updated_at | timestamp with time zone | | not null | | plain | | ``` - `token` is a `uuidv4` and will have a uniqueness constraint - `expired_at` is timestamp indicating when the token was used - `url` is th eurl to be validated <hr/> create new model called `dast_site_validation`: ``` Column | Type | Collation | Nullable | Default | Storage | Stats target | Description -----------------------------+--------------------------+-----------+----------+----------------------------------------+----------+--------------+------------- id | bigint | | not null | nextval('dast_sites_id_seq'::regclass) | plain | | project_id | bigint | | not null | | plain | | dast_site_token_id | bigint | | not null | | plain | | domain | text | | not null | | extended | | validation_strategy | text | | not null | | extended | | validation_started_at | timestamp with time zone | | | | plain | | validation_passed_at | timestamp with time zone | | | | plain | | validation_failed_at | timestamp with time zone | | | | plain | | validation_last_retried_at | timestamp with time zone | | | | plain | | created_at | timestamp with time zone | | not null | | plain | | updated_at | timestamp with time zone | | not null | | plain | | ``` - `status` will be computed based on result of values of `validation_started_at`, `validation_passed_at` and `validation_failed_at` - `domain` is the hostname that has been confirmed as being owned - `validation_strategy` will determine how a `dast_site` is validated (e.g. `metadata`, `file`, `headers`, etc) and may use a different representation other than `text` e.g. `int` via `enum` <hr/> extend `dast_site` to include `nullable` `dast_site_validation_id`: ```patch Column | Type | Collation | Nullable | Default | Storage | Stats target | Description -------------------------+--------------------------+-----------+----------+----------------------------------------+----------+--------------+------------- id | bigint | | not null | nextval('dast_sites_id_seq'::regclass) | plain | | project_id | bigint | | not null | | plain | | + dast_site_validation_id | bigint | | | | plain | | created_at | timestamp with time zone | | not null | | plain | | updated_at | timestamp with time zone | | not null | | plain | | url | text | | not null | | extended | | ``` - `dast_site_validation_id` is `nullable` to indicate that validation is not always necessary (e.g. `passive` scan case) # Implementation Plan - [x] create `dast_site_token` - [x] create `dast_site_validation` - [x] extend `dast_site` to have `dast_site_validation_id` (+ associations) - [x] add computed `status` to `dast_site_validation`