Files
breakpilot-compliance/backend-compliance/compliance/api/quality_routes.py
Sharang Parnerkar 3320ef94fc refactor: phase 0 guardrails + phase 1 step 2 (models.py split)
Squash of branch refactor/phase0-guardrails-and-models-split — 4 commits,
81 files, 173/173 pytest green, OpenAPI contract preserved (360 paths /
484 operations).

## Phase 0 — Architecture guardrails

Three defense-in-depth layers to keep the architecture rules enforced
regardless of who opens Claude Code in this repo:

  1. .claude/settings.json PreToolUse hook on Write/Edit blocks any file
     that would exceed the 500-line hard cap. Auto-loads in every Claude
     session in this repo.
  2. scripts/githooks/pre-commit (install via scripts/install-hooks.sh)
     enforces the LOC cap locally, freezes migrations/ without
     [migration-approved], and protects guardrail files without
     [guardrail-change].
  3. .gitea/workflows/ci.yaml gains loc-budget + guardrail-integrity +
     sbom-scan (syft+grype) jobs, adds mypy --strict for the new Python
     packages (compliance/{services,repositories,domain,schemas}), and
     tsc --noEmit for admin-compliance + developer-portal.

Per-language conventions documented in AGENTS.python.md, AGENTS.go.md,
AGENTS.typescript.md at the repo root — layering, tooling, and explicit
"what you may NOT do" lists. Root CLAUDE.md is prepended with the six
non-negotiable rules. Each of the 10 services gets a README.md.

scripts/check-loc.sh enforces soft 300 / hard 500 and surfaces the
current baseline of 205 hard + 161 soft violations so Phases 1-4 can
drain it incrementally. CI gates only CHANGED files in PRs so the
legacy baseline does not block unrelated work.

## Deprecation sweep

47 files. Pydantic V1 regex= -> pattern= (2 sites), class Config ->
ConfigDict in source_policy_router.py (schemas.py intentionally skipped;
it is the Phase 1 Step 3 split target). datetime.utcnow() ->
datetime.now(timezone.utc) everywhere including SQLAlchemy default=
callables. All DB columns already declare timezone=True, so this is a
latent-bug fix at the Python side, not a schema change.

DeprecationWarning count dropped from 158 to 35.

## Phase 1 Step 1 — Contract test harness

tests/contracts/test_openapi_baseline.py diffs the live FastAPI /openapi.json
against tests/contracts/openapi.baseline.json on every test run. Fails on
removed paths, removed status codes, or new required request body fields.
Regenerate only via tests/contracts/regenerate_baseline.py after a
consumer-updated contract change. This is the safety harness for all
subsequent refactor commits.

## Phase 1 Step 2 — models.py split (1466 -> 85 LOC shim)

compliance/db/models.py is decomposed into seven sibling aggregate modules
following the existing repo pattern (dsr_models.py, vvt_models.py, ...):

  regulation_models.py       (134) — Regulation, Requirement
  control_models.py          (279) — Control, Mapping, Evidence, Risk
  ai_system_models.py        (141) — AISystem, AuditExport
  service_module_models.py   (176) — ServiceModule, ModuleRegulation, ModuleRisk
  audit_session_models.py    (177) — AuditSession, AuditSignOff
  isms_governance_models.py  (323) — ISMSScope, Context, Policy, Objective, SoA
  isms_audit_models.py       (468) — Finding, CAPA, MgmtReview, InternalAudit,
                                     AuditTrail, Readiness

models.py becomes an 85-line re-export shim in dependency order so
existing imports continue to work unchanged. Schema is byte-identical:
__tablename__, column definitions, relationship strings, back_populates,
cascade directives all preserved.

All new sibling files are under the 500-line hard cap; largest is
isms_audit_models.py at 468. No file in compliance/db/ now exceeds
the hard cap.

## Phase 1 Step 3 — infrastructure only

backend-compliance/compliance/{schemas,domain,repositories}/ packages
are created as landing zones with docstrings. compliance/domain/
exports DomainError / NotFoundError / ConflictError / ValidationError /
PermissionError — the base classes services will use to raise
domain-level errors instead of HTTPException.

PHASE1_RUNBOOK.md at backend-compliance/PHASE1_RUNBOOK.md documents
the nine-step execution plan for Phase 1: snapshot baseline,
characterization tests, split models.py (this commit), split schemas.py
(next), extract services, extract repositories, mypy --strict, coverage.

## Verification

  backend-compliance/.venv-phase1: uv python install 3.12 + pip -r requirements.txt
  PYTHONPATH=. pytest compliance/tests/ tests/contracts/
  -> 173 passed, 0 failed, 35 warnings, OpenAPI 360/484 unchanged

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-07 13:18:29 +02:00

350 lines
11 KiB
Python

"""
FastAPI routes for AI Quality Metrics and Tests.
Endpoints:
GET/POST /quality/metrics — list/create metrics
PUT/DELETE /quality/metrics/{id} — update/delete metric
GET/POST /quality/tests — list/create tests
PUT/DELETE /quality/tests/{id} — update/delete test
GET /quality/stats — avgScore, metricsAboveThreshold, passed, failed
"""
import logging
from datetime import datetime, timezone
from typing import Optional, Any, Dict
from fastapi import APIRouter, Depends, HTTPException, Query
from pydantic import BaseModel
from sqlalchemy import text
from sqlalchemy.orm import Session
from classroom_engine.database import get_db
from .tenant_utils import get_tenant_id as _get_tenant_id
from .db_utils import row_to_dict as _row_to_dict
logger = logging.getLogger(__name__)
router = APIRouter(prefix="/quality", tags=["quality"])
# =============================================================================
# Pydantic Schemas
# =============================================================================
class MetricCreate(BaseModel):
name: str
category: str = "accuracy"
score: float = 0.0
threshold: float = 80.0
trend: str = "stable"
ai_system: Optional[str] = None
last_measured: Optional[datetime] = None
class MetricUpdate(BaseModel):
name: Optional[str] = None
category: Optional[str] = None
score: Optional[float] = None
threshold: Optional[float] = None
trend: Optional[str] = None
ai_system: Optional[str] = None
last_measured: Optional[datetime] = None
class TestCreate(BaseModel):
name: str
status: str = "pending"
duration: Optional[str] = None
ai_system: Optional[str] = None
details: Optional[str] = None
last_run: Optional[datetime] = None
class TestUpdate(BaseModel):
name: Optional[str] = None
status: Optional[str] = None
duration: Optional[str] = None
ai_system: Optional[str] = None
details: Optional[str] = None
last_run: Optional[datetime] = None
# =============================================================================
# Stats
# =============================================================================
@router.get("/stats")
async def get_quality_stats(
db: Session = Depends(get_db),
tenant_id: str = Depends(_get_tenant_id),
):
"""Return quality dashboard stats."""
metrics_row = db.execute(text("""
SELECT
COUNT(*) AS total_metrics,
COALESCE(AVG(score), 0) AS avg_score,
COUNT(*) FILTER (WHERE score >= threshold) AS metrics_above_threshold
FROM compliance_quality_metrics
WHERE tenant_id = :tenant_id
"""), {"tenant_id": tenant_id}).fetchone()
tests_row = db.execute(text("""
SELECT
COUNT(*) FILTER (WHERE status = 'passed') AS passed,
COUNT(*) FILTER (WHERE status = 'failed') AS failed,
COUNT(*) FILTER (WHERE status = 'warning') AS warning,
COUNT(*) AS total
FROM compliance_quality_tests
WHERE tenant_id = :tenant_id
"""), {"tenant_id": tenant_id}).fetchone()
return {
"total_metrics": int(metrics_row.total_metrics or 0),
"avg_score": round(float(metrics_row.avg_score or 0), 1),
"metrics_above_threshold": int(metrics_row.metrics_above_threshold or 0),
"passed": int(tests_row.passed or 0),
"failed": int(tests_row.failed or 0),
"warning": int(tests_row.warning or 0),
"total_tests": int(tests_row.total or 0),
}
# =============================================================================
# Metrics
# =============================================================================
@router.get("/metrics")
async def list_metrics(
category: Optional[str] = Query(None),
ai_system: Optional[str] = Query(None),
limit: int = Query(100, ge=1, le=500),
offset: int = Query(0, ge=0),
db: Session = Depends(get_db),
tenant_id: str = Depends(_get_tenant_id),
):
"""List quality metrics."""
where_clauses = ["tenant_id = :tenant_id"]
params: Dict[str, Any] = {"tenant_id": tenant_id, "limit": limit, "offset": offset}
if category:
where_clauses.append("category = :category")
params["category"] = category
if ai_system:
where_clauses.append("ai_system ILIKE :ai_system")
params["ai_system"] = f"%{ai_system}%"
where_sql = " AND ".join(where_clauses)
total_row = db.execute(
text(f"SELECT COUNT(*) FROM compliance_quality_metrics WHERE {where_sql}"), params
).fetchone()
total = total_row[0] if total_row else 0
rows = db.execute(
text(f"""
SELECT * FROM compliance_quality_metrics
WHERE {where_sql}
ORDER BY category, name
LIMIT :limit OFFSET :offset
"""),
params,
).fetchall()
return {"metrics": [_row_to_dict(r) for r in rows], "total": total}
@router.post("/metrics", status_code=201)
async def create_metric(
payload: MetricCreate,
db: Session = Depends(get_db),
tenant_id: str = Depends(_get_tenant_id),
):
"""Create a new quality metric."""
row = db.execute(text("""
INSERT INTO compliance_quality_metrics
(tenant_id, name, category, score, threshold, trend, ai_system, last_measured)
VALUES
(:tenant_id, :name, :category, :score, :threshold, :trend, :ai_system, :last_measured)
RETURNING *
"""), {
"tenant_id": tenant_id,
"name": payload.name,
"category": payload.category,
"score": payload.score,
"threshold": payload.threshold,
"trend": payload.trend,
"ai_system": payload.ai_system,
"last_measured": payload.last_measured or datetime.now(timezone.utc),
}).fetchone()
db.commit()
return _row_to_dict(row)
@router.put("/metrics/{metric_id}")
async def update_metric(
metric_id: str,
payload: MetricUpdate,
db: Session = Depends(get_db),
tenant_id: str = Depends(_get_tenant_id),
):
"""Update a quality metric."""
updates: Dict[str, Any] = {"id": metric_id, "tenant_id": tenant_id, "updated_at": datetime.now(timezone.utc)}
set_clauses = ["updated_at = :updated_at"]
for field, value in payload.model_dump(exclude_unset=True).items():
updates[field] = value
set_clauses.append(f"{field} = :{field}")
if len(set_clauses) == 1:
raise HTTPException(status_code=400, detail="No fields to update")
row = db.execute(text(f"""
UPDATE compliance_quality_metrics
SET {', '.join(set_clauses)}
WHERE id = :id AND tenant_id = :tenant_id
RETURNING *
"""), updates).fetchone()
db.commit()
if not row:
raise HTTPException(status_code=404, detail="Metric not found")
return _row_to_dict(row)
@router.delete("/metrics/{metric_id}", status_code=204)
async def delete_metric(
metric_id: str,
db: Session = Depends(get_db),
tenant_id: str = Depends(_get_tenant_id),
):
result = db.execute(text("""
DELETE FROM compliance_quality_metrics
WHERE id = :id AND tenant_id = :tenant_id
"""), {"id": metric_id, "tenant_id": tenant_id})
db.commit()
if result.rowcount == 0:
raise HTTPException(status_code=404, detail="Metric not found")
# =============================================================================
# Tests
# =============================================================================
@router.get("/tests")
async def list_tests(
status: Optional[str] = Query(None),
ai_system: Optional[str] = Query(None),
limit: int = Query(100, ge=1, le=500),
offset: int = Query(0, ge=0),
db: Session = Depends(get_db),
tenant_id: str = Depends(_get_tenant_id),
):
"""List quality tests."""
where_clauses = ["tenant_id = :tenant_id"]
params: Dict[str, Any] = {"tenant_id": tenant_id, "limit": limit, "offset": offset}
if status:
where_clauses.append("status = :status")
params["status"] = status
if ai_system:
where_clauses.append("ai_system ILIKE :ai_system")
params["ai_system"] = f"%{ai_system}%"
where_sql = " AND ".join(where_clauses)
total_row = db.execute(
text(f"SELECT COUNT(*) FROM compliance_quality_tests WHERE {where_sql}"), params
).fetchone()
total = total_row[0] if total_row else 0
rows = db.execute(
text(f"""
SELECT * FROM compliance_quality_tests
WHERE {where_sql}
ORDER BY last_run DESC NULLS LAST, created_at DESC
LIMIT :limit OFFSET :offset
"""),
params,
).fetchall()
return {"tests": [_row_to_dict(r) for r in rows], "total": total}
@router.post("/tests", status_code=201)
async def create_test(
payload: TestCreate,
db: Session = Depends(get_db),
tenant_id: str = Depends(_get_tenant_id),
):
"""Create a new quality test entry."""
row = db.execute(text("""
INSERT INTO compliance_quality_tests
(tenant_id, name, status, duration, ai_system, details, last_run)
VALUES
(:tenant_id, :name, :status, :duration, :ai_system, :details, :last_run)
RETURNING *
"""), {
"tenant_id": tenant_id,
"name": payload.name,
"status": payload.status,
"duration": payload.duration,
"ai_system": payload.ai_system,
"details": payload.details,
"last_run": payload.last_run or datetime.now(timezone.utc),
}).fetchone()
db.commit()
return _row_to_dict(row)
@router.put("/tests/{test_id}")
async def update_test(
test_id: str,
payload: TestUpdate,
db: Session = Depends(get_db),
tenant_id: str = Depends(_get_tenant_id),
):
"""Update a quality test."""
updates: Dict[str, Any] = {"id": test_id, "tenant_id": tenant_id, "updated_at": datetime.now(timezone.utc)}
set_clauses = ["updated_at = :updated_at"]
for field, value in payload.model_dump(exclude_unset=True).items():
updates[field] = value
set_clauses.append(f"{field} = :{field}")
if len(set_clauses) == 1:
raise HTTPException(status_code=400, detail="No fields to update")
row = db.execute(text(f"""
UPDATE compliance_quality_tests
SET {', '.join(set_clauses)}
WHERE id = :id AND tenant_id = :tenant_id
RETURNING *
"""), updates).fetchone()
db.commit()
if not row:
raise HTTPException(status_code=404, detail="Test not found")
return _row_to_dict(row)
@router.delete("/tests/{test_id}", status_code=204)
async def delete_test(
test_id: str,
db: Session = Depends(get_db),
tenant_id: str = Depends(_get_tenant_id),
):
result = db.execute(text("""
DELETE FROM compliance_quality_tests
WHERE id = :id AND tenant_id = :tenant_id
"""), {"id": test_id, "tenant_id": tenant_id})
db.commit()
if result.rowcount == 0:
raise HTTPException(status_code=404, detail="Test not found")