murshid_backend/app/models/query_template.py

"""
QueryTemplate entity — ER Diagram §3.2.6
Attributes: Template_ID, Purpose, wql_query, Note
Linked to Technique. Admin can add/update/disable (Use Case 7, §3.2.7).
"""

from sqlalchemy import Boolean, ForeignKey, String, Text
from sqlalchemy.orm import Mapped, mapped_column, relationship

from app.db.base import Base


class QueryTemplate(Base):
    __tablename__ = "query_templates"

    template_id: Mapped[int] = mapped_column(primary_key=True, autoincrement=True)
    technique_id: Mapped[str] = mapped_column(
        String(20), ForeignKey("techniques.technique_id"), nullable=False
    )
    purpose: Mapped[str | None] = mapped_column(String(255), nullable=True)
    # WQL with placeholders: ${HOST}, ${USER}, ${IP}
    wql_query: Mapped[str] = mapped_column(Text, nullable=False)
    note: Mapped[str | None] = mapped_column(Text, nullable=True)
    # Admin can disable without deleting — Use Case 7
    is_active: Mapped[bool] = mapped_column(Boolean, default=True, nullable=False)

    technique: Mapped["Technique"] = relationship(back_populates="query_templates")