breakpilot-compliance/ai-compliance-sdk/internal/ucca/tom_control_loader.go

package ucca

import (
	"encoding/json"
	"fmt"
	"os"
	"path/filepath"
	"runtime"
)

// TOMControl represents a single TOM control from the control library
type TOMControl struct {
	ID                     string            `json:"id"`
	Title                  string            `json:"title"`
	Description            string            `json:"description"`
	Type                   string            `json:"type"` // ORGANIZATIONAL, TECHNICAL
	ImplementationGuidance string            `json:"implementation_guidance,omitempty"`
	Evidence               []string          `json:"evidence,omitempty"`
	AppliesIf              *TOMAppliesIf     `json:"applies_if,omitempty"`
	RiskTier               string            `json:"risk_tier"` // BASELINE, ENHANCED, ADVANCED
	Mappings               TOMControlMapping `json:"mappings,omitempty"`
	ReviewFrequency        string            `json:"review_frequency,omitempty"`
	Priority               string            `json:"priority"` // CRITICAL, HIGH, MEDIUM, LOW
	Complexity             string            `json:"complexity,omitempty"`
	DomainID               string            `json:"domain_id,omitempty"` // set during loading
}

// TOMAppliesIf defines when a control applies
type TOMAppliesIf struct {
	Field    string      `json:"field"`
	Operator string      `json:"operator"`
	Value    interface{} `json:"value"`
}

// TOMControlMapping maps a control to various standards
type TOMControlMapping struct {
	GDPR    []string `json:"gdpr,omitempty"`
	ISO27001 []string `json:"iso27001,omitempty"`
	BSI     []string `json:"bsi,omitempty"`
	SDM     []string `json:"sdm,omitempty"`
	NIS2    []string `json:"nis2,omitempty"`
}

// TOMControlDomain represents a domain of controls
type TOMControlDomain struct {
	ID        string       `json:"id"`
	Name      string       `json:"name"`
	Objective string       `json:"objective"`
	Controls  []TOMControl `json:"controls"`
}

// TOMControlLibrary is the top-level structure of the control library
type TOMControlLibrary struct {
	Schema  string             `json:"schema"`
	Version string             `json:"version"`
	Domains []TOMControlDomain `json:"domains"`
}

// TOMControlIndex provides fast lookup of controls
type TOMControlIndex struct {
	ByID          map[string]*TOMControl
	ByDomain      map[string][]*TOMControl
	ByGDPRArticle map[string][]*TOMControl
	AllControls   []*TOMControl
}

// LoadTOMControls loads the TOM control library from JSON
func LoadTOMControls() (*TOMControlIndex, error) {
	data, err := readTOMControlsFile()
	if err != nil {
		return nil, err
	}

	var library TOMControlLibrary
	if err := json.Unmarshal(data, &library); err != nil {
		return nil, fmt.Errorf("failed to parse TOM controls: %w", err)
	}

	return buildTOMIndex(&library), nil
}

func readTOMControlsFile() ([]byte, error) {
	// Try multiple candidate paths
	candidates := []string{
		"policies/tom_controls_v1.json",
		"../policies/tom_controls_v1.json",
		"../../policies/tom_controls_v1.json",
	}

	// Also try relative to source file
	_, filename, _, ok := runtime.Caller(0)
	if ok {
		srcDir := filepath.Dir(filename)
		candidates = append(candidates,
			filepath.Join(srcDir, "../../policies/tom_controls_v1.json"),
		)
	}

	for _, p := range candidates {
		abs, err := filepath.Abs(p)
		if err != nil {
			continue
		}
		data, err := os.ReadFile(abs)
		if err == nil {
			return data, nil
		}
	}

	return nil, fmt.Errorf("tom_controls_v1.json not found in any candidate path")
}

func buildTOMIndex(library *TOMControlLibrary) *TOMControlIndex {
	idx := &TOMControlIndex{
		ByID:          make(map[string]*TOMControl),
		ByDomain:      make(map[string][]*TOMControl),
		ByGDPRArticle: make(map[string][]*TOMControl),
	}

	for i := range library.Domains {
		domain := &library.Domains[i]
		for j := range domain.Controls {
			ctrl := &domain.Controls[j]
			ctrl.DomainID = domain.ID

			idx.ByID[ctrl.ID] = ctrl
			idx.ByDomain[domain.ID] = append(idx.ByDomain[domain.ID], ctrl)
			idx.AllControls = append(idx.AllControls, ctrl)

			// Index by GDPR article
			for _, article := range ctrl.Mappings.GDPR {
				idx.ByGDPRArticle[article] = append(idx.ByGDPRArticle[article], ctrl)
			}
		}
	}

	return idx
}

// GetControl returns a control by ID
func (idx *TOMControlIndex) GetControl(id string) (*TOMControl, bool) {
	ctrl, ok := idx.ByID[id]
	return ctrl, ok
}

// GetControlsByDomain returns all controls for a domain
func (idx *TOMControlIndex) GetControlsByDomain(domain string) []*TOMControl {
	return idx.ByDomain[domain]
}

// GetControlsByGDPRArticle returns controls mapped to a GDPR article
func (idx *TOMControlIndex) GetControlsByGDPRArticle(article string) []*TOMControl {
	return idx.ByGDPRArticle[article]
}

// ValidateControlID checks if a control ID exists
func (idx *TOMControlIndex) ValidateControlID(id string) bool {
	_, ok := idx.ByID[id]
	return ok
}