""" QueryTemplate entity — ER Diagram §3.2.6 Attributes: Template_ID, Purpose, wql_query, Note Linked to Technique. Admin can add/update/disable (Use Case 7, §3.2.7). """ from sqlalchemy import Boolean, ForeignKey, String, Text from sqlalchemy.orm import Mapped, mapped_column, relationship from app.db.base import Base class QueryTemplate(Base): __tablename__ = "query_templates" template_id: Mapped[int] = mapped_column(primary_key=True, autoincrement=True) technique_id: Mapped[str] = mapped_column( String(20), ForeignKey("techniques.technique_id"), nullable=False ) purpose: Mapped[str | None] = mapped_column(String(255), nullable=True) # WQL with placeholders: ${HOST}, ${USER}, ${IP} wql_query: Mapped[str] = mapped_column(Text, nullable=False) note: Mapped[str | None] = mapped_column(Text, nullable=True) # Admin can disable without deleting — Use Case 7 is_active: Mapped[bool] = mapped_column(Boolean, default=True, nullable=False) technique: Mapped["Technique"] = relationship(back_populates="query_templates")