UpdateAgentProtection writes the full protection posture for an agent owned by userID in a single statement, validating first. It writes the sensitivity columns (the API source of truth) AND the derived scan toggle + float thresholds the piguard engine reads, so the two never diverge and the engine
(ctx context.Context, agentID, userID string, c ProtectionConfig)
| 111 | // thresholds the piguard engine reads, so the two never diverge and the engine |
| 112 | // needs no change. Returns an error if the agent isn't found or not owned. |
| 113 | func (s *Store) UpdateAgentProtection(ctx context.Context, agentID, userID string, c ProtectionConfig) error { |
| 114 | if err := ValidateProtectionConfig(c); err != nil { |
| 115 | return err |
| 116 | } |
| 117 | inB := sensitivityBands[c.InboundScanSensitivity] |
| 118 | outB := sensitivityBands[c.OutboundScanSensitivity] |
| 119 | |
| 120 | // Normalize nil allowlists to empty slices so the column is [] not NULL. |
| 121 | inAllow := c.InboundAllowlist |
| 122 | if inAllow == nil { |
| 123 | inAllow = []string{} |
| 124 | } |
| 125 | outAllow := c.OutboundAllowlist |
| 126 | if outAllow == nil { |
| 127 | outAllow = []string{} |
| 128 | } |
| 129 | |
| 130 | tag, err := s.pool.Exec(ctx, |
| 131 | `UPDATE agent_identities SET |
| 132 | inbound_policy = $3, inbound_allowlist = $4, inbound_policy_action = $5, |
| 133 | inbound_scan = $6, inbound_scan_review_threshold = $7, inbound_scan_block_threshold = $8, |
| 134 | inbound_scan_sensitivity = $9, |
| 135 | outbound_policy = $10, outbound_allowlist = $11, outbound_policy_action = $12, |
| 136 | outbound_scan = $13, outbound_scan_review_threshold = $14, outbound_scan_block_threshold = $15, |
| 137 | outbound_scan_sensitivity = $16, |
| 138 | hitl_ttl_seconds = $17, hitl_expiration_action = $18 |
| 139 | WHERE id = $1 AND user_id = $2`, |
| 140 | agentID, userID, |
| 141 | c.InboundGatePolicy, inAllow, c.InboundGateAction, |
| 142 | inB.scan, inB.review, inB.block, |
| 143 | c.InboundScanSensitivity, |
| 144 | c.OutboundGatePolicy, outAllow, c.OutboundGateAction, |
| 145 | outB.scan, outB.review, outB.block, |
| 146 | c.OutboundScanSensitivity, |
| 147 | c.HITLTTLSeconds, c.HITLExpirationAction, |
| 148 | ) |
| 149 | if err != nil { |
| 150 | return err |
| 151 | } |
| 152 | if tag.RowsAffected() == 0 { |
| 153 | return fmt.Errorf("agent not found or not owned by user") |
| 154 | } |
| 155 | return nil |
| 156 | } |