Fix: Remove broken getKlausurApiUrl and clean up empty lines

sed replacement left orphaned hostname references in story page
and empty lines in getApiBase functions.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

edu-search-service/internal/api/handlers/ai_extraction_handlers.go

@@ -278,267 +278,6 @@ func (h *AIExtractionHandlers) SubmitExtractedData(c *gin.Context) {
 	})
 }
 
-// SubmitBatchExtractedData saves multiple AI-extracted profile data items
-// POST /api/v1/ai/extraction/submit-batch
-func (h *AIExtractionHandlers) SubmitBatchExtractedData(c *gin.Context) {
-	var batch struct {
-		Items []ExtractedProfileData `json:"items" binding:"required"`
-	}
-
-	if err := c.ShouldBindJSON(&batch); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid request: " + err.Error()})
-		return
-	}
-
-	results := make([]gin.H, 0, len(batch.Items))
-	successCount := 0
-	errorCount := 0
-
-	for _, item := range batch.Items {
-		// Get existing staff record
-		staff, err := h.repo.GetStaff(c.Request.Context(), item.StaffID)
-		if err != nil {
-			results = append(results, gin.H{
-				"staff_id": item.StaffID,
-				"status":   "error",
-				"error":    "Staff not found",
-			})
-			errorCount++
-			continue
-		}
-
-		// Apply updates (same logic as single submit)
-		updated := false
-
-		if item.Email != "" && (staff.Email == nil || *staff.Email == "") {
-			staff.Email = &item.Email
-			updated = true
-		}
-		if item.Phone != "" && (staff.Phone == nil || *staff.Phone == "") {
-			staff.Phone = &item.Phone
-			updated = true
-		}
-		if item.Office != "" && (staff.Office == nil || *staff.Office == "") {
-			staff.Office = &item.Office
-			updated = true
-		}
-		if item.Position != "" && (staff.Position == nil || *staff.Position == "") {
-			staff.Position = &item.Position
-			updated = true
-		}
-		if item.PositionType != "" && (staff.PositionType == nil || *staff.PositionType == "") {
-			staff.PositionType = &item.PositionType
-			updated = true
-		}
-		if item.TeamRole != "" && (staff.TeamRole == nil || *staff.TeamRole == "") {
-			staff.TeamRole = &item.TeamRole
-			updated = true
-		}
-		if len(item.ResearchInterests) > 0 && len(staff.ResearchInterests) == 0 {
-			staff.ResearchInterests = item.ResearchInterests
-			updated = true
-		}
-		if item.ORCID != "" && (staff.ORCID == nil || *staff.ORCID == "") {
-			staff.ORCID = &item.ORCID
-			updated = true
-		}
-
-		// Update last verified
-		now := time.Now()
-		staff.LastVerified = &now
-
-		if updated {
-			err = h.repo.CreateStaff(c.Request.Context(), staff)
-			if err != nil {
-				results = append(results, gin.H{
-					"staff_id": item.StaffID,
-					"status":   "error",
-					"error":    err.Error(),
-				})
-				errorCount++
-				continue
-			}
-		}
-
-		results = append(results, gin.H{
-			"staff_id": item.StaffID,
-			"status":   "success",
-			"updated":  updated,
-		})
-		successCount++
-	}
-
-	c.JSON(http.StatusOK, gin.H{
-		"results":       results,
-		"success_count": successCount,
-		"error_count":   errorCount,
-		"total":         len(batch.Items),
-	})
-}
-
-// InstituteHierarchyTask represents an institute page to crawl for hierarchy
-type InstituteHierarchyTask struct {
-	InstituteURL  string    `json:"institute_url"`
-	InstituteName string    `json:"institute_name,omitempty"`
-	UniversityID  uuid.UUID `json:"university_id"`
-}
-
-// GetInstitutePages returns institute pages that need hierarchy crawling
-// GET /api/v1/ai/extraction/institutes?university_id=...
-func (h *AIExtractionHandlers) GetInstitutePages(c *gin.Context) {
-	var universityID *uuid.UUID
-	if uniIDStr := c.Query("university_id"); uniIDStr != "" {
-		id, err := uuid.Parse(uniIDStr)
-		if err == nil {
-			universityID = &id
-		}
-	}
-
-	// Get unique institute/department URLs from staff profiles
-	params := database.StaffSearchParams{
-		UniversityID: universityID,
-		Limit:        1000,
-	}
-
-	result, err := h.repo.SearchStaff(c.Request.Context(), params)
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
-		return
-	}
-
-	// Collect unique source URLs (these are typically department pages)
-	urlSet := make(map[string]bool)
-	var tasks []InstituteHierarchyTask
-
-	for _, staff := range result.Staff {
-		if staff.SourceURL != nil && *staff.SourceURL != "" {
-			url := *staff.SourceURL
-			if !urlSet[url] {
-				urlSet[url] = true
-				tasks = append(tasks, InstituteHierarchyTask{
-					InstituteURL: url,
-					UniversityID: staff.UniversityID,
-				})
-			}
-		}
-	}
-
-	c.JSON(http.StatusOK, gin.H{
-		"institutes": tasks,
-		"total":      len(tasks),
-	})
-}
-
-// InstituteHierarchyData represents hierarchy data extracted from an institute page
-type InstituteHierarchyData struct {
-	InstituteURL  string    `json:"institute_url" binding:"required"`
-	UniversityID  uuid.UUID `json:"university_id" binding:"required"`
-	InstituteName string    `json:"institute_name,omitempty"`
-
-	// Leadership
-	LeaderName  string `json:"leader_name,omitempty"`
-	LeaderTitle string `json:"leader_title,omitempty"` // e.g., "Professor", "Lehrstuhlinhaber"
-
-	// Staff organization
-	StaffGroups []struct {
-		Role    string   `json:"role"`     // e.g., "Leitung", "Wissenschaftliche Mitarbeiter", "Sekretariat"
-		Members []string `json:"members"`  // Names of people in this group
-	} `json:"staff_groups,omitempty"`
-
-	// Teaching info (Lehrveranstaltungen)
-	TeachingCourses []struct {
-		Title   string `json:"title"`
-		Teacher string `json:"teacher,omitempty"`
-	} `json:"teaching_courses,omitempty"`
-}
-
-// SubmitInstituteHierarchy saves hierarchy data from an institute page
-// POST /api/v1/ai/extraction/institutes/submit
-func (h *AIExtractionHandlers) SubmitInstituteHierarchy(c *gin.Context) {
-	var data InstituteHierarchyData
-	if err := c.ShouldBindJSON(&data); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid request: " + err.Error()})
-		return
-	}
-
-	// Find or create department
-	dept := &database.Department{
-		UniversityID: data.UniversityID,
-		Name:         data.InstituteName,
-	}
-	if data.InstituteURL != "" {
-		dept.URL = &data.InstituteURL
-	}
-
-	err := h.repo.CreateDepartment(c.Request.Context(), dept)
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create department: " + err.Error()})
-		return
-	}
-
-	// Find leader and set as supervisor for all staff in this institute
-	var leaderID *uuid.UUID
-	if data.LeaderName != "" {
-		// Search for leader
-		leaderParams := database.StaffSearchParams{
-			Query:        data.LeaderName,
-			UniversityID: &data.UniversityID,
-			Limit:        1,
-		}
-		result, err := h.repo.SearchStaff(c.Request.Context(), leaderParams)
-		if err == nil && len(result.Staff) > 0 {
-			leaderID = &result.Staff[0].ID
-
-			// Update leader with department and role
-			leader := &result.Staff[0]
-			leader.DepartmentID = &dept.ID
-			roleLeitung := "leitung"
-			leader.TeamRole = &roleLeitung
-			leader.IsProfessor = true
-			if data.LeaderTitle != "" {
-				leader.AcademicTitle = &data.LeaderTitle
-			}
-			h.repo.CreateStaff(c.Request.Context(), leader)
-		}
-	}
-
-	// Process staff groups
-	updatedCount := 0
-	for _, group := range data.StaffGroups {
-		for _, memberName := range group.Members {
-			// Find staff member
-			memberParams := database.StaffSearchParams{
-				Query:        memberName,
-				UniversityID: &data.UniversityID,
-				Limit:        1,
-			}
-			result, err := h.repo.SearchStaff(c.Request.Context(), memberParams)
-			if err != nil || len(result.Staff) == 0 {
-				continue
-			}
-
-			member := &result.Staff[0]
-			member.DepartmentID = &dept.ID
-			member.TeamRole = &group.Role
-
-			// Set supervisor if leader was found and this is not the leader
-			if leaderID != nil && member.ID != *leaderID {
-				member.SupervisorID = leaderID
-			}
-
-			h.repo.CreateStaff(c.Request.Context(), member)
-			updatedCount++
-		}
-	}
-
-	c.JSON(http.StatusOK, gin.H{
-		"status":          "success",
-		"department_id":   dept.ID,
-		"leader_id":       leaderID,
-		"members_updated": updatedCount,
-	})
-}
-
 // RegisterAIExtractionRoutes registers AI extraction routes
 func (h *AIExtractionHandlers) RegisterRoutes(r *gin.RouterGroup) {
 	ai := r.Group("/ai/extraction")

edu-search-service/internal/api/handlers/ai_extraction_handlers_batch.go

@@ -0,0 +1,272 @@
+package handlers
+
+import (
+	"net/http"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+
+	"github.com/breakpilot/edu-search-service/internal/database"
+)
+
+// SubmitBatchExtractedData saves multiple AI-extracted profile data items
+// POST /api/v1/ai/extraction/submit-batch
+func (h *AIExtractionHandlers) SubmitBatchExtractedData(c *gin.Context) {
+	var batch struct {
+		Items []ExtractedProfileData `json:"items" binding:"required"`
+	}
+
+	if err := c.ShouldBindJSON(&batch); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid request: " + err.Error()})
+		return
+	}
+
+	results := make([]gin.H, 0, len(batch.Items))
+	successCount := 0
+	errorCount := 0
+
+	for _, item := range batch.Items {
+		// Get existing staff record
+		staff, err := h.repo.GetStaff(c.Request.Context(), item.StaffID)
+		if err != nil {
+			results = append(results, gin.H{
+				"staff_id": item.StaffID,
+				"status":   "error",
+				"error":    "Staff not found",
+			})
+			errorCount++
+			continue
+		}
+
+		// Apply updates (same logic as single submit)
+		updated := false
+
+		if item.Email != "" && (staff.Email == nil || *staff.Email == "") {
+			staff.Email = &item.Email
+			updated = true
+		}
+		if item.Phone != "" && (staff.Phone == nil || *staff.Phone == "") {
+			staff.Phone = &item.Phone
+			updated = true
+		}
+		if item.Office != "" && (staff.Office == nil || *staff.Office == "") {
+			staff.Office = &item.Office
+			updated = true
+		}
+		if item.Position != "" && (staff.Position == nil || *staff.Position == "") {
+			staff.Position = &item.Position
+			updated = true
+		}
+		if item.PositionType != "" && (staff.PositionType == nil || *staff.PositionType == "") {
+			staff.PositionType = &item.PositionType
+			updated = true
+		}
+		if item.TeamRole != "" && (staff.TeamRole == nil || *staff.TeamRole == "") {
+			staff.TeamRole = &item.TeamRole
+			updated = true
+		}
+		if len(item.ResearchInterests) > 0 && len(staff.ResearchInterests) == 0 {
+			staff.ResearchInterests = item.ResearchInterests
+			updated = true
+		}
+		if item.ORCID != "" && (staff.ORCID == nil || *staff.ORCID == "") {
+			staff.ORCID = &item.ORCID
+			updated = true
+		}
+
+		// Update last verified
+		now := time.Now()
+		staff.LastVerified = &now
+
+		if updated {
+			err = h.repo.CreateStaff(c.Request.Context(), staff)
+			if err != nil {
+				results = append(results, gin.H{
+					"staff_id": item.StaffID,
+					"status":   "error",
+					"error":    err.Error(),
+				})
+				errorCount++
+				continue
+			}
+		}
+
+		results = append(results, gin.H{
+			"staff_id": item.StaffID,
+			"status":   "success",
+			"updated":  updated,
+		})
+		successCount++
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"results":       results,
+		"success_count": successCount,
+		"error_count":   errorCount,
+		"total":         len(batch.Items),
+	})
+}
+
+// InstituteHierarchyTask represents an institute page to crawl for hierarchy
+type InstituteHierarchyTask struct {
+	InstituteURL  string    `json:"institute_url"`
+	InstituteName string    `json:"institute_name,omitempty"`
+	UniversityID  uuid.UUID `json:"university_id"`
+}
+
+// GetInstitutePages returns institute pages that need hierarchy crawling
+// GET /api/v1/ai/extraction/institutes?university_id=...
+func (h *AIExtractionHandlers) GetInstitutePages(c *gin.Context) {
+	var universityID *uuid.UUID
+	if uniIDStr := c.Query("university_id"); uniIDStr != "" {
+		id, err := uuid.Parse(uniIDStr)
+		if err == nil {
+			universityID = &id
+		}
+	}
+
+	// Get unique institute/department URLs from staff profiles
+	params := database.StaffSearchParams{
+		UniversityID: universityID,
+		Limit:        1000,
+	}
+
+	result, err := h.repo.SearchStaff(c.Request.Context(), params)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+
+	// Collect unique source URLs (these are typically department pages)
+	urlSet := make(map[string]bool)
+	var tasks []InstituteHierarchyTask
+
+	for _, staff := range result.Staff {
+		if staff.SourceURL != nil && *staff.SourceURL != "" {
+			url := *staff.SourceURL
+			if !urlSet[url] {
+				urlSet[url] = true
+				tasks = append(tasks, InstituteHierarchyTask{
+					InstituteURL: url,
+					UniversityID: staff.UniversityID,
+				})
+			}
+		}
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"institutes": tasks,
+		"total":      len(tasks),
+	})
+}
+
+// InstituteHierarchyData represents hierarchy data extracted from an institute page
+type InstituteHierarchyData struct {
+	InstituteURL  string    `json:"institute_url" binding:"required"`
+	UniversityID  uuid.UUID `json:"university_id" binding:"required"`
+	InstituteName string    `json:"institute_name,omitempty"`
+
+	// Leadership
+	LeaderName  string `json:"leader_name,omitempty"`
+	LeaderTitle string `json:"leader_title,omitempty"` // e.g., "Professor", "Lehrstuhlinhaber"
+
+	// Staff organization
+	StaffGroups []struct {
+		Role    string   `json:"role"`     // e.g., "Leitung", "Wissenschaftliche Mitarbeiter", "Sekretariat"
+		Members []string `json:"members"`  // Names of people in this group
+	} `json:"staff_groups,omitempty"`
+
+	// Teaching info (Lehrveranstaltungen)
+	TeachingCourses []struct {
+		Title   string `json:"title"`
+		Teacher string `json:"teacher,omitempty"`
+	} `json:"teaching_courses,omitempty"`
+}
+
+// SubmitInstituteHierarchy saves hierarchy data from an institute page
+// POST /api/v1/ai/extraction/institutes/submit
+func (h *AIExtractionHandlers) SubmitInstituteHierarchy(c *gin.Context) {
+	var data InstituteHierarchyData
+	if err := c.ShouldBindJSON(&data); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid request: " + err.Error()})
+		return
+	}
+
+	// Find or create department
+	dept := &database.Department{
+		UniversityID: data.UniversityID,
+		Name:         data.InstituteName,
+	}
+	if data.InstituteURL != "" {
+		dept.URL = &data.InstituteURL
+	}
+
+	err := h.repo.CreateDepartment(c.Request.Context(), dept)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create department: " + err.Error()})
+		return
+	}
+
+	// Find leader and set as supervisor for all staff in this institute
+	var leaderID *uuid.UUID
+	if data.LeaderName != "" {
+		// Search for leader
+		leaderParams := database.StaffSearchParams{
+			Query:        data.LeaderName,
+			UniversityID: &data.UniversityID,
+			Limit:        1,
+		}
+		result, err := h.repo.SearchStaff(c.Request.Context(), leaderParams)
+		if err == nil && len(result.Staff) > 0 {
+			leaderID = &result.Staff[0].ID
+
+			// Update leader with department and role
+			leader := &result.Staff[0]
+			leader.DepartmentID = &dept.ID
+			roleLeitung := "leitung"
+			leader.TeamRole = &roleLeitung
+			leader.IsProfessor = true
+			if data.LeaderTitle != "" {
+				leader.AcademicTitle = &data.LeaderTitle
+			}
+			h.repo.CreateStaff(c.Request.Context(), leader)
+		}
+	}
+
+	// Process staff groups
+	updatedCount := 0
+	for _, group := range data.StaffGroups {
+		for _, memberName := range group.Members {
+			// Find staff member
+			memberParams := database.StaffSearchParams{
+				Query:        memberName,
+				UniversityID: &data.UniversityID,
+				Limit:        1,
+			}
+			result, err := h.repo.SearchStaff(c.Request.Context(), memberParams)
+			if err != nil || len(result.Staff) == 0 {
+				continue
+			}
+
+			member := &result.Staff[0]
+			member.DepartmentID = &dept.ID
+			member.TeamRole = &group.Role
+
+			// Set supervisor if leader was found and this is not the leader
+			if leaderID != nil && member.ID != *leaderID {
+				member.SupervisorID = leaderID
+			}
+
+			h.repo.CreateStaff(c.Request.Context(), member)
+			updatedCount++
+		}
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"status":          "success",
+		"department_id":   dept.ID,
+		"leader_id":       leaderID,
+		"members_updated": updatedCount,
+	})
+}

edu-search-service/internal/api/handlers/policy_handlers.go

@@ -2,7 +2,6 @@ package handlers
 
 import (
 	"net/http"
-	"time"
 
 	"github.com/breakpilot/edu-search-service/internal/policy"
 	"github.com/gin-gonic/gin"
@@ -349,289 +348,6 @@ func (h *PolicyHandler) UpdateOperationPermission(c *gin.Context) {
 	c.JSON(http.StatusOK, op)
 }
 
-// =============================================================================
-// PII RULES
-// =============================================================================
-
-// ListPIIRules returns all PII detection rules.
-func (h *PolicyHandler) ListPIIRules(c *gin.Context) {
-	activeOnly := c.Query("active_only") == "true"
-
-	rules, err := h.store.ListPIIRules(c.Request.Context(), activeOnly)
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to list PII rules", "details": err.Error()})
-		return
-	}
-
-	c.JSON(http.StatusOK, gin.H{
-		"rules": rules,
-		"total": len(rules),
-	})
-}
-
-// GetPIIRule returns a single PII rule by ID.
-func (h *PolicyHandler) GetPIIRule(c *gin.Context) {
-	id, err := uuid.Parse(c.Param("id"))
-	if err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid PII rule ID"})
-		return
-	}
-
-	rule, err := h.store.GetPIIRule(c.Request.Context(), id)
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to get PII rule", "details": err.Error()})
-		return
-	}
-	if rule == nil {
-		c.JSON(http.StatusNotFound, gin.H{"error": "PII rule not found"})
-		return
-	}
-
-	c.JSON(http.StatusOK, rule)
-}
-
-// CreatePIIRule creates a new PII detection rule.
-func (h *PolicyHandler) CreatePIIRule(c *gin.Context) {
-	var req policy.CreatePIIRuleRequest
-	if err := c.ShouldBindJSON(&req); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid request body", "details": err.Error()})
-		return
-	}
-
-	rule, err := h.store.CreatePIIRule(c.Request.Context(), &req)
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create PII rule", "details": err.Error()})
-		return
-	}
-
-	// Log audit
-	userEmail := getUserEmail(c)
-	h.enforcer.LogChange(c.Request.Context(), policy.AuditActionCreate, policy.AuditEntityPIIRule, &rule.ID, nil, rule, userEmail)
-
-	c.JSON(http.StatusCreated, rule)
-}
-
-// UpdatePIIRule updates an existing PII rule.
-func (h *PolicyHandler) UpdatePIIRule(c *gin.Context) {
-	id, err := uuid.Parse(c.Param("id"))
-	if err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid PII rule ID"})
-		return
-	}
-
-	// Get old value for audit
-	oldRule, err := h.store.GetPIIRule(c.Request.Context(), id)
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to get PII rule", "details": err.Error()})
-		return
-	}
-	if oldRule == nil {
-		c.JSON(http.StatusNotFound, gin.H{"error": "PII rule not found"})
-		return
-	}
-
-	var req policy.UpdatePIIRuleRequest
-	if err := c.ShouldBindJSON(&req); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid request body", "details": err.Error()})
-		return
-	}
-
-	rule, err := h.store.UpdatePIIRule(c.Request.Context(), id, &req)
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update PII rule", "details": err.Error()})
-		return
-	}
-
-	// Log audit
-	userEmail := getUserEmail(c)
-	h.enforcer.LogChange(c.Request.Context(), policy.AuditActionUpdate, policy.AuditEntityPIIRule, &rule.ID, oldRule, rule, userEmail)
-
-	c.JSON(http.StatusOK, rule)
-}
-
-// DeletePIIRule deletes a PII rule.
-func (h *PolicyHandler) DeletePIIRule(c *gin.Context) {
-	id, err := uuid.Parse(c.Param("id"))
-	if err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid PII rule ID"})
-		return
-	}
-
-	// Get rule for audit before deletion
-	rule, err := h.store.GetPIIRule(c.Request.Context(), id)
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to get PII rule", "details": err.Error()})
-		return
-	}
-	if rule == nil {
-		c.JSON(http.StatusNotFound, gin.H{"error": "PII rule not found"})
-		return
-	}
-
-	if err := h.store.DeletePIIRule(c.Request.Context(), id); err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to delete PII rule", "details": err.Error()})
-		return
-	}
-
-	// Log audit
-	userEmail := getUserEmail(c)
-	h.enforcer.LogChange(c.Request.Context(), policy.AuditActionDelete, policy.AuditEntityPIIRule, &id, rule, nil, userEmail)
-
-	c.JSON(http.StatusOK, gin.H{"deleted": true, "id": id})
-}
-
-// TestPIIRules tests PII detection against sample text.
-func (h *PolicyHandler) TestPIIRules(c *gin.Context) {
-	var req policy.PIITestRequest
-	if err := c.ShouldBindJSON(&req); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid request body", "details": err.Error()})
-		return
-	}
-
-	response, err := h.enforcer.DetectPII(c.Request.Context(), req.Text)
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to test PII detection", "details": err.Error()})
-		return
-	}
-
-	c.JSON(http.StatusOK, response)
-}
-
-// =============================================================================
-// AUDIT & COMPLIANCE
-// =============================================================================
-
-// ListAuditLogs returns audit log entries.
-func (h *PolicyHandler) ListAuditLogs(c *gin.Context) {
-	var filter policy.AuditLogFilter
-	if err := c.ShouldBindQuery(&filter); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid query parameters", "details": err.Error()})
-		return
-	}
-
-	// Set defaults
-	if filter.Limit <= 0 || filter.Limit > 500 {
-		filter.Limit = 100
-	}
-
-	logs, total, err := h.store.ListAuditLogs(c.Request.Context(), &filter)
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to list audit logs", "details": err.Error()})
-		return
-	}
-
-	c.JSON(http.StatusOK, gin.H{
-		"logs":   logs,
-		"total":  total,
-		"limit":  filter.Limit,
-		"offset": filter.Offset,
-	})
-}
-
-// ListBlockedContent returns blocked content log entries.
-func (h *PolicyHandler) ListBlockedContent(c *gin.Context) {
-	var filter policy.BlockedContentFilter
-	if err := c.ShouldBindQuery(&filter); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid query parameters", "details": err.Error()})
-		return
-	}
-
-	// Set defaults
-	if filter.Limit <= 0 || filter.Limit > 500 {
-		filter.Limit = 100
-	}
-
-	logs, total, err := h.store.ListBlockedContent(c.Request.Context(), &filter)
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to list blocked content", "details": err.Error()})
-		return
-	}
-
-	c.JSON(http.StatusOK, gin.H{
-		"blocked": logs,
-		"total":   total,
-		"limit":   filter.Limit,
-		"offset":  filter.Offset,
-	})
-}
-
-// CheckCompliance performs a compliance check for a URL.
-func (h *PolicyHandler) CheckCompliance(c *gin.Context) {
-	var req policy.CheckComplianceRequest
-	if err := c.ShouldBindJSON(&req); err != nil {
-		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid request body", "details": err.Error()})
-		return
-	}
-
-	response, err := h.enforcer.CheckCompliance(c.Request.Context(), &req)
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to check compliance", "details": err.Error()})
-		return
-	}
-
-	c.JSON(http.StatusOK, response)
-}
-
-// GetPolicyStats returns aggregated statistics.
-func (h *PolicyHandler) GetPolicyStats(c *gin.Context) {
-	stats, err := h.store.GetStats(c.Request.Context())
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to get stats", "details": err.Error()})
-		return
-	}
-
-	c.JSON(http.StatusOK, stats)
-}
-
-// GenerateComplianceReport generates an audit report.
-func (h *PolicyHandler) GenerateComplianceReport(c *gin.Context) {
-	var auditFilter policy.AuditLogFilter
-	var blockedFilter policy.BlockedContentFilter
-
-	// Parse date filters
-	fromStr := c.Query("from")
-	toStr := c.Query("to")
-
-	if fromStr != "" {
-		from, err := time.Parse("2006-01-02", fromStr)
-		if err == nil {
-			auditFilter.FromDate = &from
-			blockedFilter.FromDate = &from
-		}
-	}
-
-	if toStr != "" {
-		to, err := time.Parse("2006-01-02", toStr)
-		if err == nil {
-			// Add 1 day to include the end date
-			to = to.Add(24 * time.Hour)
-			auditFilter.ToDate = &to
-			blockedFilter.ToDate = &to
-		}
-	}
-
-	// No limit for report
-	auditFilter.Limit = 10000
-	blockedFilter.Limit = 10000
-
-	auditor := policy.NewAuditor(h.store)
-	report, err := auditor.GenerateAuditReport(c.Request.Context(), &auditFilter, &blockedFilter)
-	if err != nil {
-		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to generate report", "details": err.Error()})
-		return
-	}
-
-	// Set filename for download
-	format := c.Query("format")
-	if format == "download" {
-		filename := "compliance-report-" + time.Now().Format("2006-01-02") + ".json"
-		c.Header("Content-Disposition", "attachment; filename="+filename)
-		c.Header("Content-Type", "application/json")
-	}
-
-	c.JSON(http.StatusOK, report)
-}
-
 // =============================================================================
 // HELPERS
 // =============================================================================

edu-search-service/internal/api/handlers/policy_handlers_rules.go

@@ -0,0 +1,293 @@
+package handlers
+
+import (
+	"net/http"
+	"time"
+
+	"github.com/breakpilot/edu-search-service/internal/policy"
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+)
+
+// =============================================================================
+// PII RULES
+// =============================================================================
+
+// ListPIIRules returns all PII detection rules.
+func (h *PolicyHandler) ListPIIRules(c *gin.Context) {
+	activeOnly := c.Query("active_only") == "true"
+
+	rules, err := h.store.ListPIIRules(c.Request.Context(), activeOnly)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to list PII rules", "details": err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"rules": rules,
+		"total": len(rules),
+	})
+}
+
+// GetPIIRule returns a single PII rule by ID.
+func (h *PolicyHandler) GetPIIRule(c *gin.Context) {
+	id, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid PII rule ID"})
+		return
+	}
+
+	rule, err := h.store.GetPIIRule(c.Request.Context(), id)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to get PII rule", "details": err.Error()})
+		return
+	}
+	if rule == nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "PII rule not found"})
+		return
+	}
+
+	c.JSON(http.StatusOK, rule)
+}
+
+// CreatePIIRule creates a new PII detection rule.
+func (h *PolicyHandler) CreatePIIRule(c *gin.Context) {
+	var req policy.CreatePIIRuleRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid request body", "details": err.Error()})
+		return
+	}
+
+	rule, err := h.store.CreatePIIRule(c.Request.Context(), &req)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create PII rule", "details": err.Error()})
+		return
+	}
+
+	// Log audit
+	userEmail := getUserEmail(c)
+	h.enforcer.LogChange(c.Request.Context(), policy.AuditActionCreate, policy.AuditEntityPIIRule, &rule.ID, nil, rule, userEmail)
+
+	c.JSON(http.StatusCreated, rule)
+}
+
+// UpdatePIIRule updates an existing PII rule.
+func (h *PolicyHandler) UpdatePIIRule(c *gin.Context) {
+	id, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid PII rule ID"})
+		return
+	}
+
+	// Get old value for audit
+	oldRule, err := h.store.GetPIIRule(c.Request.Context(), id)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to get PII rule", "details": err.Error()})
+		return
+	}
+	if oldRule == nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "PII rule not found"})
+		return
+	}
+
+	var req policy.UpdatePIIRuleRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid request body", "details": err.Error()})
+		return
+	}
+
+	rule, err := h.store.UpdatePIIRule(c.Request.Context(), id, &req)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update PII rule", "details": err.Error()})
+		return
+	}
+
+	// Log audit
+	userEmail := getUserEmail(c)
+	h.enforcer.LogChange(c.Request.Context(), policy.AuditActionUpdate, policy.AuditEntityPIIRule, &rule.ID, oldRule, rule, userEmail)
+
+	c.JSON(http.StatusOK, rule)
+}
+
+// DeletePIIRule deletes a PII rule.
+func (h *PolicyHandler) DeletePIIRule(c *gin.Context) {
+	id, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid PII rule ID"})
+		return
+	}
+
+	// Get rule for audit before deletion
+	rule, err := h.store.GetPIIRule(c.Request.Context(), id)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to get PII rule", "details": err.Error()})
+		return
+	}
+	if rule == nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "PII rule not found"})
+		return
+	}
+
+	if err := h.store.DeletePIIRule(c.Request.Context(), id); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to delete PII rule", "details": err.Error()})
+		return
+	}
+
+	// Log audit
+	userEmail := getUserEmail(c)
+	h.enforcer.LogChange(c.Request.Context(), policy.AuditActionDelete, policy.AuditEntityPIIRule, &id, rule, nil, userEmail)
+
+	c.JSON(http.StatusOK, gin.H{"deleted": true, "id": id})
+}
+
+// TestPIIRules tests PII detection against sample text.
+func (h *PolicyHandler) TestPIIRules(c *gin.Context) {
+	var req policy.PIITestRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid request body", "details": err.Error()})
+		return
+	}
+
+	response, err := h.enforcer.DetectPII(c.Request.Context(), req.Text)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to test PII detection", "details": err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusOK, response)
+}
+
+// =============================================================================
+// AUDIT & COMPLIANCE
+// =============================================================================
+
+// ListAuditLogs returns audit log entries.
+func (h *PolicyHandler) ListAuditLogs(c *gin.Context) {
+	var filter policy.AuditLogFilter
+	if err := c.ShouldBindQuery(&filter); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid query parameters", "details": err.Error()})
+		return
+	}
+
+	// Set defaults
+	if filter.Limit <= 0 || filter.Limit > 500 {
+		filter.Limit = 100
+	}
+
+	logs, total, err := h.store.ListAuditLogs(c.Request.Context(), &filter)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to list audit logs", "details": err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"logs":   logs,
+		"total":  total,
+		"limit":  filter.Limit,
+		"offset": filter.Offset,
+	})
+}
+
+// ListBlockedContent returns blocked content log entries.
+func (h *PolicyHandler) ListBlockedContent(c *gin.Context) {
+	var filter policy.BlockedContentFilter
+	if err := c.ShouldBindQuery(&filter); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid query parameters", "details": err.Error()})
+		return
+	}
+
+	// Set defaults
+	if filter.Limit <= 0 || filter.Limit > 500 {
+		filter.Limit = 100
+	}
+
+	logs, total, err := h.store.ListBlockedContent(c.Request.Context(), &filter)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to list blocked content", "details": err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"blocked": logs,
+		"total":   total,
+		"limit":   filter.Limit,
+		"offset":  filter.Offset,
+	})
+}
+
+// CheckCompliance performs a compliance check for a URL.
+func (h *PolicyHandler) CheckCompliance(c *gin.Context) {
+	var req policy.CheckComplianceRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid request body", "details": err.Error()})
+		return
+	}
+
+	response, err := h.enforcer.CheckCompliance(c.Request.Context(), &req)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to check compliance", "details": err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusOK, response)
+}
+
+// GetPolicyStats returns aggregated statistics.
+func (h *PolicyHandler) GetPolicyStats(c *gin.Context) {
+	stats, err := h.store.GetStats(c.Request.Context())
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to get stats", "details": err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusOK, stats)
+}
+
+// GenerateComplianceReport generates an audit report.
+func (h *PolicyHandler) GenerateComplianceReport(c *gin.Context) {
+	var auditFilter policy.AuditLogFilter
+	var blockedFilter policy.BlockedContentFilter
+
+	// Parse date filters
+	fromStr := c.Query("from")
+	toStr := c.Query("to")
+
+	if fromStr != "" {
+		from, err := time.Parse("2006-01-02", fromStr)
+		if err == nil {
+			auditFilter.FromDate = &from
+			blockedFilter.FromDate = &from
+		}
+	}
+
+	if toStr != "" {
+		to, err := time.Parse("2006-01-02", toStr)
+		if err == nil {
+			// Add 1 day to include the end date
+			to = to.Add(24 * time.Hour)
+			auditFilter.ToDate = &to
+			blockedFilter.ToDate = &to
+		}
+	}
+
+	// No limit for report
+	auditFilter.Limit = 10000
+	blockedFilter.Limit = 10000
+
+	auditor := policy.NewAuditor(h.store)
+	report, err := auditor.GenerateAuditReport(c.Request.Context(), &auditFilter, &blockedFilter)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to generate report", "details": err.Error()})
+		return
+	}
+
+	// Set filename for download
+	format := c.Query("format")
+	if format == "download" {
+		filename := "compliance-report-" + time.Now().Format("2006-01-02") + ".json"
+		c.Header("Content-Disposition", "attachment; filename="+filename)
+		c.Header("Content-Type", "application/json")
+	}
+
+	c.JSON(http.StatusOK, report)
+}