414e0f5ec0
All checks were successful
CI / go-lint (push) Has been skipped
CI / python-lint (push) Has been skipped
CI / nodejs-lint (push) Has been skipped
CI / test-go-school (push) Successful in 28s
CI / test-go-edu-search (push) Successful in 27s
CI / test-python-klausur (push) Successful in 1m45s
CI / test-python-agent-core (push) Successful in 16s
CI / test-nodejs-website (push) Successful in 21s
- edu-search-service von breakpilot-pwa nach breakpilot-lehrer kopiert (ohne vendor) - opensearch + edu-search-service in docker-compose.yml hinzugefuegt - voice-service aus docker-compose.yml entfernt (jetzt in breakpilot-core) - geo-service aus docker-compose.yml entfernt (nicht mehr benoetigt) - CI/CD: edu-search-service zu Gitea Actions und Woodpecker hinzugefuegt (Go lint, test mit go mod download, build, SBOM) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1169 lines
33 KiB
Go
1169 lines
33 KiB
Go
package policy
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"fmt"
|
|
"time"
|
|
|
|
"github.com/google/uuid"
|
|
"github.com/jackc/pgx/v5"
|
|
"github.com/jackc/pgx/v5/pgxpool"
|
|
)
|
|
|
|
// Store provides database operations for the policy system.
|
|
type Store struct {
|
|
pool *pgxpool.Pool
|
|
}
|
|
|
|
// NewStore creates a new Store instance.
|
|
func NewStore(pool *pgxpool.Pool) *Store {
|
|
return &Store{pool: pool}
|
|
}
|
|
|
|
// =============================================================================
|
|
// SOURCE POLICIES
|
|
// =============================================================================
|
|
|
|
// CreatePolicy creates a new source policy.
|
|
func (s *Store) CreatePolicy(ctx context.Context, req *CreateSourcePolicyRequest) (*SourcePolicy, error) {
|
|
policy := &SourcePolicy{
|
|
ID: uuid.New(),
|
|
Version: 1,
|
|
Name: req.Name,
|
|
Description: req.Description,
|
|
Bundesland: req.Bundesland,
|
|
IsActive: true,
|
|
CreatedAt: time.Now(),
|
|
UpdatedAt: time.Now(),
|
|
}
|
|
|
|
query := `
|
|
INSERT INTO source_policies (id, version, name, description, bundesland, is_active, created_at, updated_at)
|
|
VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
|
|
RETURNING id, version, name, description, bundesland, is_active, created_at, updated_at`
|
|
|
|
err := s.pool.QueryRow(ctx, query,
|
|
policy.ID, policy.Version, policy.Name, policy.Description,
|
|
policy.Bundesland, policy.IsActive, policy.CreatedAt, policy.UpdatedAt,
|
|
).Scan(
|
|
&policy.ID, &policy.Version, &policy.Name, &policy.Description,
|
|
&policy.Bundesland, &policy.IsActive, &policy.CreatedAt, &policy.UpdatedAt,
|
|
)
|
|
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to create policy: %w", err)
|
|
}
|
|
|
|
return policy, nil
|
|
}
|
|
|
|
// GetPolicy retrieves a policy by ID.
|
|
func (s *Store) GetPolicy(ctx context.Context, id uuid.UUID) (*SourcePolicy, error) {
|
|
query := `
|
|
SELECT id, version, name, description, bundesland, is_active,
|
|
created_at, updated_at, approved_by, approved_at
|
|
FROM source_policies
|
|
WHERE id = $1`
|
|
|
|
policy := &SourcePolicy{}
|
|
err := s.pool.QueryRow(ctx, query, id).Scan(
|
|
&policy.ID, &policy.Version, &policy.Name, &policy.Description,
|
|
&policy.Bundesland, &policy.IsActive, &policy.CreatedAt, &policy.UpdatedAt,
|
|
&policy.ApprovedBy, &policy.ApprovedAt,
|
|
)
|
|
|
|
if err == pgx.ErrNoRows {
|
|
return nil, nil
|
|
}
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to get policy: %w", err)
|
|
}
|
|
|
|
return policy, nil
|
|
}
|
|
|
|
// ListPolicies retrieves policies with optional filters.
|
|
func (s *Store) ListPolicies(ctx context.Context, filter *PolicyListFilter) ([]SourcePolicy, int, error) {
|
|
baseQuery := `FROM source_policies WHERE 1=1`
|
|
args := []interface{}{}
|
|
argCount := 0
|
|
|
|
if filter.Bundesland != nil {
|
|
argCount++
|
|
baseQuery += fmt.Sprintf(" AND bundesland = $%d", argCount)
|
|
args = append(args, *filter.Bundesland)
|
|
}
|
|
|
|
if filter.IsActive != nil {
|
|
argCount++
|
|
baseQuery += fmt.Sprintf(" AND is_active = $%d", argCount)
|
|
args = append(args, *filter.IsActive)
|
|
}
|
|
|
|
// Count query
|
|
var total int
|
|
countQuery := "SELECT COUNT(*) " + baseQuery
|
|
err := s.pool.QueryRow(ctx, countQuery, args...).Scan(&total)
|
|
if err != nil {
|
|
return nil, 0, fmt.Errorf("failed to count policies: %w", err)
|
|
}
|
|
|
|
// Data query with pagination
|
|
dataQuery := `SELECT id, version, name, description, bundesland, is_active,
|
|
created_at, updated_at, approved_by, approved_at ` + baseQuery +
|
|
` ORDER BY created_at DESC`
|
|
|
|
if filter.Limit > 0 {
|
|
argCount++
|
|
dataQuery += fmt.Sprintf(" LIMIT $%d", argCount)
|
|
args = append(args, filter.Limit)
|
|
}
|
|
if filter.Offset > 0 {
|
|
argCount++
|
|
dataQuery += fmt.Sprintf(" OFFSET $%d", argCount)
|
|
args = append(args, filter.Offset)
|
|
}
|
|
|
|
rows, err := s.pool.Query(ctx, dataQuery, args...)
|
|
if err != nil {
|
|
return nil, 0, fmt.Errorf("failed to list policies: %w", err)
|
|
}
|
|
defer rows.Close()
|
|
|
|
policies := []SourcePolicy{}
|
|
for rows.Next() {
|
|
var p SourcePolicy
|
|
err := rows.Scan(
|
|
&p.ID, &p.Version, &p.Name, &p.Description,
|
|
&p.Bundesland, &p.IsActive, &p.CreatedAt, &p.UpdatedAt,
|
|
&p.ApprovedBy, &p.ApprovedAt,
|
|
)
|
|
if err != nil {
|
|
return nil, 0, fmt.Errorf("failed to scan policy: %w", err)
|
|
}
|
|
policies = append(policies, p)
|
|
}
|
|
|
|
return policies, total, nil
|
|
}
|
|
|
|
// UpdatePolicy updates an existing policy.
|
|
func (s *Store) UpdatePolicy(ctx context.Context, id uuid.UUID, req *UpdateSourcePolicyRequest) (*SourcePolicy, error) {
|
|
policy, err := s.GetPolicy(ctx, id)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if policy == nil {
|
|
return nil, fmt.Errorf("policy not found")
|
|
}
|
|
|
|
if req.Name != nil {
|
|
policy.Name = *req.Name
|
|
}
|
|
if req.Description != nil {
|
|
policy.Description = req.Description
|
|
}
|
|
if req.Bundesland != nil {
|
|
policy.Bundesland = req.Bundesland
|
|
}
|
|
if req.IsActive != nil {
|
|
policy.IsActive = *req.IsActive
|
|
}
|
|
policy.Version++
|
|
policy.UpdatedAt = time.Now()
|
|
|
|
query := `
|
|
UPDATE source_policies
|
|
SET version = $2, name = $3, description = $4, bundesland = $5,
|
|
is_active = $6, updated_at = $7
|
|
WHERE id = $1
|
|
RETURNING id, version, name, description, bundesland, is_active, created_at, updated_at`
|
|
|
|
err = s.pool.QueryRow(ctx, query,
|
|
id, policy.Version, policy.Name, policy.Description,
|
|
policy.Bundesland, policy.IsActive, policy.UpdatedAt,
|
|
).Scan(
|
|
&policy.ID, &policy.Version, &policy.Name, &policy.Description,
|
|
&policy.Bundesland, &policy.IsActive, &policy.CreatedAt, &policy.UpdatedAt,
|
|
)
|
|
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to update policy: %w", err)
|
|
}
|
|
|
|
return policy, nil
|
|
}
|
|
|
|
// DeletePolicy deletes a policy by ID (soft delete via is_active = false).
|
|
func (s *Store) DeletePolicy(ctx context.Context, id uuid.UUID) error {
|
|
query := `UPDATE source_policies SET is_active = false, updated_at = $2 WHERE id = $1`
|
|
_, err := s.pool.Exec(ctx, query, id, time.Now())
|
|
if err != nil {
|
|
return fmt.Errorf("failed to delete policy: %w", err)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// =============================================================================
|
|
// ALLOWED SOURCES
|
|
// =============================================================================
|
|
|
|
// CreateSource creates a new allowed source.
|
|
func (s *Store) CreateSource(ctx context.Context, req *CreateAllowedSourceRequest) (*AllowedSource, error) {
|
|
trustBoost := 0.5
|
|
if req.TrustBoost != nil {
|
|
trustBoost = *req.TrustBoost
|
|
}
|
|
|
|
source := &AllowedSource{
|
|
ID: uuid.New(),
|
|
PolicyID: req.PolicyID,
|
|
Domain: req.Domain,
|
|
Name: req.Name,
|
|
Description: req.Description,
|
|
License: req.License,
|
|
LegalBasis: req.LegalBasis,
|
|
CitationTemplate: req.CitationTemplate,
|
|
TrustBoost: trustBoost,
|
|
IsActive: true,
|
|
CreatedAt: time.Now(),
|
|
UpdatedAt: time.Now(),
|
|
}
|
|
|
|
query := `
|
|
INSERT INTO allowed_sources (id, policy_id, domain, name, description, license,
|
|
legal_basis, citation_template, trust_boost, is_active,
|
|
created_at, updated_at)
|
|
VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)
|
|
RETURNING id`
|
|
|
|
err := s.pool.QueryRow(ctx, query,
|
|
source.ID, source.PolicyID, source.Domain, source.Name, source.Description,
|
|
source.License, source.LegalBasis, source.CitationTemplate, source.TrustBoost,
|
|
source.IsActive, source.CreatedAt, source.UpdatedAt,
|
|
).Scan(&source.ID)
|
|
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to create source: %w", err)
|
|
}
|
|
|
|
// Create default operation permissions
|
|
err = s.createDefaultOperations(ctx, source.ID)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to create default operations: %w", err)
|
|
}
|
|
|
|
return source, nil
|
|
}
|
|
|
|
// createDefaultOperations creates default operation permissions for a source.
|
|
func (s *Store) createDefaultOperations(ctx context.Context, sourceID uuid.UUID) error {
|
|
defaults := []struct {
|
|
op Operation
|
|
allowed bool
|
|
citation bool
|
|
}{
|
|
{OperationLookup, true, true},
|
|
{OperationRAG, true, true},
|
|
{OperationTraining, false, false}, // VERBOTEN by default
|
|
{OperationExport, true, true},
|
|
}
|
|
|
|
for _, d := range defaults {
|
|
query := `
|
|
INSERT INTO operation_permissions (id, source_id, operation, is_allowed, requires_citation, created_at, updated_at)
|
|
VALUES ($1, $2, $3, $4, $5, $6, $7)`
|
|
_, err := s.pool.Exec(ctx, query, uuid.New(), sourceID, d.op, d.allowed, d.citation, time.Now(), time.Now())
|
|
if err != nil {
|
|
return err
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// GetSource retrieves a source by ID.
|
|
func (s *Store) GetSource(ctx context.Context, id uuid.UUID) (*AllowedSource, error) {
|
|
query := `
|
|
SELECT als.id, als.policy_id, als.domain, als.name, als.description, als.license,
|
|
als.legal_basis, als.citation_template, als.trust_boost, als.is_active,
|
|
als.created_at, als.updated_at, sp.name as policy_name
|
|
FROM allowed_sources als
|
|
JOIN source_policies sp ON als.policy_id = sp.id
|
|
WHERE als.id = $1`
|
|
|
|
source := &AllowedSource{}
|
|
err := s.pool.QueryRow(ctx, query, id).Scan(
|
|
&source.ID, &source.PolicyID, &source.Domain, &source.Name, &source.Description,
|
|
&source.License, &source.LegalBasis, &source.CitationTemplate, &source.TrustBoost,
|
|
&source.IsActive, &source.CreatedAt, &source.UpdatedAt, &source.PolicyName,
|
|
)
|
|
|
|
if err == pgx.ErrNoRows {
|
|
return nil, nil
|
|
}
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to get source: %w", err)
|
|
}
|
|
|
|
// Load operations
|
|
ops, err := s.GetOperationsBySourceID(ctx, source.ID)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
source.Operations = ops
|
|
|
|
return source, nil
|
|
}
|
|
|
|
// GetSourceByDomain retrieves a source by domain with optional bundesland filter.
|
|
func (s *Store) GetSourceByDomain(ctx context.Context, domain string, bundesland *Bundesland) (*AllowedSource, error) {
|
|
query := `
|
|
SELECT als.id, als.policy_id, als.domain, als.name, als.description, als.license,
|
|
als.legal_basis, als.citation_template, als.trust_boost, als.is_active,
|
|
als.created_at, als.updated_at
|
|
FROM allowed_sources als
|
|
JOIN source_policies sp ON als.policy_id = sp.id
|
|
WHERE als.is_active = true
|
|
AND sp.is_active = true
|
|
AND (als.domain = $1 OR $1 LIKE '%.' || als.domain)
|
|
AND (sp.bundesland IS NULL OR sp.bundesland = $2)
|
|
LIMIT 1`
|
|
|
|
source := &AllowedSource{}
|
|
err := s.pool.QueryRow(ctx, query, domain, bundesland).Scan(
|
|
&source.ID, &source.PolicyID, &source.Domain, &source.Name, &source.Description,
|
|
&source.License, &source.LegalBasis, &source.CitationTemplate, &source.TrustBoost,
|
|
&source.IsActive, &source.CreatedAt, &source.UpdatedAt,
|
|
)
|
|
|
|
if err == pgx.ErrNoRows {
|
|
return nil, nil
|
|
}
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to get source by domain: %w", err)
|
|
}
|
|
|
|
// Load operations
|
|
ops, err := s.GetOperationsBySourceID(ctx, source.ID)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
source.Operations = ops
|
|
|
|
return source, nil
|
|
}
|
|
|
|
// ListSources retrieves sources with optional filters.
|
|
func (s *Store) ListSources(ctx context.Context, filter *SourceListFilter) ([]AllowedSource, int, error) {
|
|
baseQuery := `FROM allowed_sources als JOIN source_policies sp ON als.policy_id = sp.id WHERE 1=1`
|
|
args := []interface{}{}
|
|
argCount := 0
|
|
|
|
if filter.PolicyID != nil {
|
|
argCount++
|
|
baseQuery += fmt.Sprintf(" AND als.policy_id = $%d", argCount)
|
|
args = append(args, *filter.PolicyID)
|
|
}
|
|
|
|
if filter.Domain != nil {
|
|
argCount++
|
|
baseQuery += fmt.Sprintf(" AND als.domain ILIKE $%d", argCount)
|
|
args = append(args, "%"+*filter.Domain+"%")
|
|
}
|
|
|
|
if filter.License != nil {
|
|
argCount++
|
|
baseQuery += fmt.Sprintf(" AND als.license = $%d", argCount)
|
|
args = append(args, *filter.License)
|
|
}
|
|
|
|
if filter.IsActive != nil {
|
|
argCount++
|
|
baseQuery += fmt.Sprintf(" AND als.is_active = $%d", argCount)
|
|
args = append(args, *filter.IsActive)
|
|
}
|
|
|
|
// Count query
|
|
var total int
|
|
countQuery := "SELECT COUNT(*) " + baseQuery
|
|
err := s.pool.QueryRow(ctx, countQuery, args...).Scan(&total)
|
|
if err != nil {
|
|
return nil, 0, fmt.Errorf("failed to count sources: %w", err)
|
|
}
|
|
|
|
// Data query
|
|
dataQuery := `SELECT als.id, als.policy_id, als.domain, als.name, als.description, als.license,
|
|
als.legal_basis, als.citation_template, als.trust_boost, als.is_active,
|
|
als.created_at, als.updated_at, sp.name as policy_name ` + baseQuery +
|
|
` ORDER BY als.created_at DESC`
|
|
|
|
if filter.Limit > 0 {
|
|
argCount++
|
|
dataQuery += fmt.Sprintf(" LIMIT $%d", argCount)
|
|
args = append(args, filter.Limit)
|
|
}
|
|
if filter.Offset > 0 {
|
|
argCount++
|
|
dataQuery += fmt.Sprintf(" OFFSET $%d", argCount)
|
|
args = append(args, filter.Offset)
|
|
}
|
|
|
|
rows, err := s.pool.Query(ctx, dataQuery, args...)
|
|
if err != nil {
|
|
return nil, 0, fmt.Errorf("failed to list sources: %w", err)
|
|
}
|
|
defer rows.Close()
|
|
|
|
sources := []AllowedSource{}
|
|
for rows.Next() {
|
|
var src AllowedSource
|
|
err := rows.Scan(
|
|
&src.ID, &src.PolicyID, &src.Domain, &src.Name, &src.Description,
|
|
&src.License, &src.LegalBasis, &src.CitationTemplate, &src.TrustBoost,
|
|
&src.IsActive, &src.CreatedAt, &src.UpdatedAt, &src.PolicyName,
|
|
)
|
|
if err != nil {
|
|
return nil, 0, fmt.Errorf("failed to scan source: %w", err)
|
|
}
|
|
sources = append(sources, src)
|
|
}
|
|
|
|
return sources, total, nil
|
|
}
|
|
|
|
// UpdateSource updates an existing source.
|
|
func (s *Store) UpdateSource(ctx context.Context, id uuid.UUID, req *UpdateAllowedSourceRequest) (*AllowedSource, error) {
|
|
source, err := s.GetSource(ctx, id)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if source == nil {
|
|
return nil, fmt.Errorf("source not found")
|
|
}
|
|
|
|
if req.Domain != nil {
|
|
source.Domain = *req.Domain
|
|
}
|
|
if req.Name != nil {
|
|
source.Name = *req.Name
|
|
}
|
|
if req.Description != nil {
|
|
source.Description = req.Description
|
|
}
|
|
if req.License != nil {
|
|
source.License = *req.License
|
|
}
|
|
if req.LegalBasis != nil {
|
|
source.LegalBasis = req.LegalBasis
|
|
}
|
|
if req.CitationTemplate != nil {
|
|
source.CitationTemplate = req.CitationTemplate
|
|
}
|
|
if req.TrustBoost != nil {
|
|
source.TrustBoost = *req.TrustBoost
|
|
}
|
|
if req.IsActive != nil {
|
|
source.IsActive = *req.IsActive
|
|
}
|
|
source.UpdatedAt = time.Now()
|
|
|
|
query := `
|
|
UPDATE allowed_sources
|
|
SET domain = $2, name = $3, description = $4, license = $5, legal_basis = $6,
|
|
citation_template = $7, trust_boost = $8, is_active = $9, updated_at = $10
|
|
WHERE id = $1`
|
|
|
|
_, err = s.pool.Exec(ctx, query,
|
|
id, source.Domain, source.Name, source.Description, source.License,
|
|
source.LegalBasis, source.CitationTemplate, source.TrustBoost,
|
|
source.IsActive, source.UpdatedAt,
|
|
)
|
|
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to update source: %w", err)
|
|
}
|
|
|
|
return source, nil
|
|
}
|
|
|
|
// DeleteSource deletes a source by ID.
|
|
func (s *Store) DeleteSource(ctx context.Context, id uuid.UUID) error {
|
|
query := `DELETE FROM allowed_sources WHERE id = $1`
|
|
_, err := s.pool.Exec(ctx, query, id)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to delete source: %w", err)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// =============================================================================
|
|
// OPERATION PERMISSIONS
|
|
// =============================================================================
|
|
|
|
// GetOperationsBySourceID retrieves all operation permissions for a source.
|
|
func (s *Store) GetOperationsBySourceID(ctx context.Context, sourceID uuid.UUID) ([]OperationPermission, error) {
|
|
query := `
|
|
SELECT id, source_id, operation, is_allowed, requires_citation, notes, created_at, updated_at
|
|
FROM operation_permissions
|
|
WHERE source_id = $1
|
|
ORDER BY operation`
|
|
|
|
rows, err := s.pool.Query(ctx, query, sourceID)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to get operations: %w", err)
|
|
}
|
|
defer rows.Close()
|
|
|
|
ops := []OperationPermission{}
|
|
for rows.Next() {
|
|
var op OperationPermission
|
|
err := rows.Scan(
|
|
&op.ID, &op.SourceID, &op.Operation, &op.IsAllowed,
|
|
&op.RequiresCitation, &op.Notes, &op.CreatedAt, &op.UpdatedAt,
|
|
)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to scan operation: %w", err)
|
|
}
|
|
ops = append(ops, op)
|
|
}
|
|
|
|
return ops, nil
|
|
}
|
|
|
|
// UpdateOperationPermission updates an operation permission.
|
|
func (s *Store) UpdateOperationPermission(ctx context.Context, id uuid.UUID, req *UpdateOperationPermissionRequest) (*OperationPermission, error) {
|
|
query := `SELECT id, source_id, operation, is_allowed, requires_citation, notes, created_at, updated_at
|
|
FROM operation_permissions WHERE id = $1`
|
|
|
|
op := &OperationPermission{}
|
|
err := s.pool.QueryRow(ctx, query, id).Scan(
|
|
&op.ID, &op.SourceID, &op.Operation, &op.IsAllowed,
|
|
&op.RequiresCitation, &op.Notes, &op.CreatedAt, &op.UpdatedAt,
|
|
)
|
|
if err == pgx.ErrNoRows {
|
|
return nil, fmt.Errorf("operation permission not found")
|
|
}
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to get operation: %w", err)
|
|
}
|
|
|
|
if req.IsAllowed != nil {
|
|
op.IsAllowed = *req.IsAllowed
|
|
}
|
|
if req.RequiresCitation != nil {
|
|
op.RequiresCitation = *req.RequiresCitation
|
|
}
|
|
if req.Notes != nil {
|
|
op.Notes = req.Notes
|
|
}
|
|
op.UpdatedAt = time.Now()
|
|
|
|
updateQuery := `
|
|
UPDATE operation_permissions
|
|
SET is_allowed = $2, requires_citation = $3, notes = $4, updated_at = $5
|
|
WHERE id = $1`
|
|
|
|
_, err = s.pool.Exec(ctx, updateQuery, id, op.IsAllowed, op.RequiresCitation, op.Notes, op.UpdatedAt)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to update operation: %w", err)
|
|
}
|
|
|
|
return op, nil
|
|
}
|
|
|
|
// GetOperationsMatrix retrieves all operation permissions grouped by source.
|
|
func (s *Store) GetOperationsMatrix(ctx context.Context) ([]AllowedSource, error) {
|
|
query := `
|
|
SELECT als.id, als.domain, als.name, als.license, als.is_active,
|
|
sp.name as policy_name, sp.bundesland
|
|
FROM allowed_sources als
|
|
JOIN source_policies sp ON als.policy_id = sp.id
|
|
WHERE als.is_active = true AND sp.is_active = true
|
|
ORDER BY sp.bundesland NULLS FIRST, als.name`
|
|
|
|
rows, err := s.pool.Query(ctx, query)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to get operations matrix: %w", err)
|
|
}
|
|
defer rows.Close()
|
|
|
|
sources := []AllowedSource{}
|
|
for rows.Next() {
|
|
var src AllowedSource
|
|
var bundesland *Bundesland
|
|
err := rows.Scan(
|
|
&src.ID, &src.Domain, &src.Name, &src.License, &src.IsActive,
|
|
&src.PolicyName, &bundesland,
|
|
)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to scan source: %w", err)
|
|
}
|
|
|
|
// Load operations for each source
|
|
ops, err := s.GetOperationsBySourceID(ctx, src.ID)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
src.Operations = ops
|
|
sources = append(sources, src)
|
|
}
|
|
|
|
return sources, nil
|
|
}
|
|
|
|
// =============================================================================
|
|
// PII RULES
|
|
// =============================================================================
|
|
|
|
// CreatePIIRule creates a new PII rule.
|
|
func (s *Store) CreatePIIRule(ctx context.Context, req *CreatePIIRuleRequest) (*PIIRule, error) {
|
|
severity := PIISeverityBlock
|
|
if req.Severity != "" {
|
|
severity = req.Severity
|
|
}
|
|
|
|
rule := &PIIRule{
|
|
ID: uuid.New(),
|
|
Name: req.Name,
|
|
Description: req.Description,
|
|
RuleType: req.RuleType,
|
|
Pattern: req.Pattern,
|
|
Severity: severity,
|
|
IsActive: true,
|
|
CreatedAt: time.Now(),
|
|
UpdatedAt: time.Now(),
|
|
}
|
|
|
|
query := `
|
|
INSERT INTO pii_rules (id, name, description, rule_type, pattern, severity, is_active, created_at, updated_at)
|
|
VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)
|
|
RETURNING id`
|
|
|
|
err := s.pool.QueryRow(ctx, query,
|
|
rule.ID, rule.Name, rule.Description, rule.RuleType, rule.Pattern,
|
|
rule.Severity, rule.IsActive, rule.CreatedAt, rule.UpdatedAt,
|
|
).Scan(&rule.ID)
|
|
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to create PII rule: %w", err)
|
|
}
|
|
|
|
return rule, nil
|
|
}
|
|
|
|
// GetPIIRule retrieves a PII rule by ID.
|
|
func (s *Store) GetPIIRule(ctx context.Context, id uuid.UUID) (*PIIRule, error) {
|
|
query := `
|
|
SELECT id, name, description, rule_type, pattern, severity, is_active, created_at, updated_at
|
|
FROM pii_rules
|
|
WHERE id = $1`
|
|
|
|
rule := &PIIRule{}
|
|
err := s.pool.QueryRow(ctx, query, id).Scan(
|
|
&rule.ID, &rule.Name, &rule.Description, &rule.RuleType, &rule.Pattern,
|
|
&rule.Severity, &rule.IsActive, &rule.CreatedAt, &rule.UpdatedAt,
|
|
)
|
|
|
|
if err == pgx.ErrNoRows {
|
|
return nil, nil
|
|
}
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to get PII rule: %w", err)
|
|
}
|
|
|
|
return rule, nil
|
|
}
|
|
|
|
// ListPIIRules retrieves all PII rules.
|
|
func (s *Store) ListPIIRules(ctx context.Context, activeOnly bool) ([]PIIRule, error) {
|
|
query := `
|
|
SELECT id, name, description, rule_type, pattern, severity, is_active, created_at, updated_at
|
|
FROM pii_rules`
|
|
|
|
if activeOnly {
|
|
query += ` WHERE is_active = true`
|
|
}
|
|
query += ` ORDER BY severity DESC, name`
|
|
|
|
rows, err := s.pool.Query(ctx, query)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to list PII rules: %w", err)
|
|
}
|
|
defer rows.Close()
|
|
|
|
rules := []PIIRule{}
|
|
for rows.Next() {
|
|
var r PIIRule
|
|
err := rows.Scan(
|
|
&r.ID, &r.Name, &r.Description, &r.RuleType, &r.Pattern,
|
|
&r.Severity, &r.IsActive, &r.CreatedAt, &r.UpdatedAt,
|
|
)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to scan PII rule: %w", err)
|
|
}
|
|
rules = append(rules, r)
|
|
}
|
|
|
|
return rules, nil
|
|
}
|
|
|
|
// UpdatePIIRule updates an existing PII rule.
|
|
func (s *Store) UpdatePIIRule(ctx context.Context, id uuid.UUID, req *UpdatePIIRuleRequest) (*PIIRule, error) {
|
|
rule, err := s.GetPIIRule(ctx, id)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if rule == nil {
|
|
return nil, fmt.Errorf("PII rule not found")
|
|
}
|
|
|
|
if req.Name != nil {
|
|
rule.Name = *req.Name
|
|
}
|
|
if req.Description != nil {
|
|
rule.Description = req.Description
|
|
}
|
|
if req.RuleType != nil {
|
|
rule.RuleType = *req.RuleType
|
|
}
|
|
if req.Pattern != nil {
|
|
rule.Pattern = *req.Pattern
|
|
}
|
|
if req.Severity != nil {
|
|
rule.Severity = *req.Severity
|
|
}
|
|
if req.IsActive != nil {
|
|
rule.IsActive = *req.IsActive
|
|
}
|
|
rule.UpdatedAt = time.Now()
|
|
|
|
query := `
|
|
UPDATE pii_rules
|
|
SET name = $2, description = $3, rule_type = $4, pattern = $5,
|
|
severity = $6, is_active = $7, updated_at = $8
|
|
WHERE id = $1`
|
|
|
|
_, err = s.pool.Exec(ctx, query,
|
|
id, rule.Name, rule.Description, rule.RuleType, rule.Pattern,
|
|
rule.Severity, rule.IsActive, rule.UpdatedAt,
|
|
)
|
|
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to update PII rule: %w", err)
|
|
}
|
|
|
|
return rule, nil
|
|
}
|
|
|
|
// DeletePIIRule deletes a PII rule by ID.
|
|
func (s *Store) DeletePIIRule(ctx context.Context, id uuid.UUID) error {
|
|
query := `DELETE FROM pii_rules WHERE id = $1`
|
|
_, err := s.pool.Exec(ctx, query, id)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to delete PII rule: %w", err)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// =============================================================================
|
|
// AUDIT LOG
|
|
// =============================================================================
|
|
|
|
// CreateAuditLog creates a new audit log entry.
|
|
func (s *Store) CreateAuditLog(ctx context.Context, entry *PolicyAuditLog) error {
|
|
entry.ID = uuid.New()
|
|
entry.CreatedAt = time.Now()
|
|
|
|
query := `
|
|
INSERT INTO policy_audit_log (id, action, entity_type, entity_id, old_value, new_value,
|
|
user_id, user_email, ip_address, user_agent, created_at)
|
|
VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)`
|
|
|
|
_, err := s.pool.Exec(ctx, query,
|
|
entry.ID, entry.Action, entry.EntityType, entry.EntityID,
|
|
entry.OldValue, entry.NewValue, entry.UserID, entry.UserEmail,
|
|
entry.IPAddress, entry.UserAgent, entry.CreatedAt,
|
|
)
|
|
|
|
if err != nil {
|
|
return fmt.Errorf("failed to create audit log: %w", err)
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
// ListAuditLogs retrieves audit logs with filters.
|
|
func (s *Store) ListAuditLogs(ctx context.Context, filter *AuditLogFilter) ([]PolicyAuditLog, int, error) {
|
|
baseQuery := `FROM policy_audit_log WHERE 1=1`
|
|
args := []interface{}{}
|
|
argCount := 0
|
|
|
|
if filter.EntityType != nil {
|
|
argCount++
|
|
baseQuery += fmt.Sprintf(" AND entity_type = $%d", argCount)
|
|
args = append(args, *filter.EntityType)
|
|
}
|
|
|
|
if filter.EntityID != nil {
|
|
argCount++
|
|
baseQuery += fmt.Sprintf(" AND entity_id = $%d", argCount)
|
|
args = append(args, *filter.EntityID)
|
|
}
|
|
|
|
if filter.Action != nil {
|
|
argCount++
|
|
baseQuery += fmt.Sprintf(" AND action = $%d", argCount)
|
|
args = append(args, *filter.Action)
|
|
}
|
|
|
|
if filter.UserEmail != nil {
|
|
argCount++
|
|
baseQuery += fmt.Sprintf(" AND user_email ILIKE $%d", argCount)
|
|
args = append(args, "%"+*filter.UserEmail+"%")
|
|
}
|
|
|
|
if filter.FromDate != nil {
|
|
argCount++
|
|
baseQuery += fmt.Sprintf(" AND created_at >= $%d", argCount)
|
|
args = append(args, *filter.FromDate)
|
|
}
|
|
|
|
if filter.ToDate != nil {
|
|
argCount++
|
|
baseQuery += fmt.Sprintf(" AND created_at <= $%d", argCount)
|
|
args = append(args, *filter.ToDate)
|
|
}
|
|
|
|
// Count query
|
|
var total int
|
|
countQuery := "SELECT COUNT(*) " + baseQuery
|
|
err := s.pool.QueryRow(ctx, countQuery, args...).Scan(&total)
|
|
if err != nil {
|
|
return nil, 0, fmt.Errorf("failed to count audit logs: %w", err)
|
|
}
|
|
|
|
// Data query
|
|
dataQuery := `SELECT id, action, entity_type, entity_id, old_value, new_value,
|
|
user_id, user_email, ip_address, user_agent, created_at ` + baseQuery +
|
|
` ORDER BY created_at DESC`
|
|
|
|
if filter.Limit > 0 {
|
|
argCount++
|
|
dataQuery += fmt.Sprintf(" LIMIT $%d", argCount)
|
|
args = append(args, filter.Limit)
|
|
}
|
|
if filter.Offset > 0 {
|
|
argCount++
|
|
dataQuery += fmt.Sprintf(" OFFSET $%d", argCount)
|
|
args = append(args, filter.Offset)
|
|
}
|
|
|
|
rows, err := s.pool.Query(ctx, dataQuery, args...)
|
|
if err != nil {
|
|
return nil, 0, fmt.Errorf("failed to list audit logs: %w", err)
|
|
}
|
|
defer rows.Close()
|
|
|
|
logs := []PolicyAuditLog{}
|
|
for rows.Next() {
|
|
var l PolicyAuditLog
|
|
err := rows.Scan(
|
|
&l.ID, &l.Action, &l.EntityType, &l.EntityID, &l.OldValue, &l.NewValue,
|
|
&l.UserID, &l.UserEmail, &l.IPAddress, &l.UserAgent, &l.CreatedAt,
|
|
)
|
|
if err != nil {
|
|
return nil, 0, fmt.Errorf("failed to scan audit log: %w", err)
|
|
}
|
|
logs = append(logs, l)
|
|
}
|
|
|
|
return logs, total, nil
|
|
}
|
|
|
|
// =============================================================================
|
|
// BLOCKED CONTENT LOG
|
|
// =============================================================================
|
|
|
|
// CreateBlockedContentLog creates a new blocked content log entry.
|
|
func (s *Store) CreateBlockedContentLog(ctx context.Context, entry *BlockedContentLog) error {
|
|
entry.ID = uuid.New()
|
|
entry.CreatedAt = time.Now()
|
|
|
|
query := `
|
|
INSERT INTO blocked_content_log (id, url, domain, block_reason, matched_rule_id, details, created_at)
|
|
VALUES ($1, $2, $3, $4, $5, $6, $7)`
|
|
|
|
_, err := s.pool.Exec(ctx, query,
|
|
entry.ID, entry.URL, entry.Domain, entry.BlockReason,
|
|
entry.MatchedRuleID, entry.Details, entry.CreatedAt,
|
|
)
|
|
|
|
if err != nil {
|
|
return fmt.Errorf("failed to create blocked content log: %w", err)
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
// ListBlockedContent retrieves blocked content logs with filters.
|
|
func (s *Store) ListBlockedContent(ctx context.Context, filter *BlockedContentFilter) ([]BlockedContentLog, int, error) {
|
|
baseQuery := `FROM blocked_content_log WHERE 1=1`
|
|
args := []interface{}{}
|
|
argCount := 0
|
|
|
|
if filter.Domain != nil {
|
|
argCount++
|
|
baseQuery += fmt.Sprintf(" AND domain ILIKE $%d", argCount)
|
|
args = append(args, "%"+*filter.Domain+"%")
|
|
}
|
|
|
|
if filter.BlockReason != nil {
|
|
argCount++
|
|
baseQuery += fmt.Sprintf(" AND block_reason = $%d", argCount)
|
|
args = append(args, *filter.BlockReason)
|
|
}
|
|
|
|
if filter.FromDate != nil {
|
|
argCount++
|
|
baseQuery += fmt.Sprintf(" AND created_at >= $%d", argCount)
|
|
args = append(args, *filter.FromDate)
|
|
}
|
|
|
|
if filter.ToDate != nil {
|
|
argCount++
|
|
baseQuery += fmt.Sprintf(" AND created_at <= $%d", argCount)
|
|
args = append(args, *filter.ToDate)
|
|
}
|
|
|
|
// Count query
|
|
var total int
|
|
countQuery := "SELECT COUNT(*) " + baseQuery
|
|
err := s.pool.QueryRow(ctx, countQuery, args...).Scan(&total)
|
|
if err != nil {
|
|
return nil, 0, fmt.Errorf("failed to count blocked content: %w", err)
|
|
}
|
|
|
|
// Data query
|
|
dataQuery := `SELECT id, url, domain, block_reason, matched_rule_id, details, created_at ` + baseQuery +
|
|
` ORDER BY created_at DESC`
|
|
|
|
if filter.Limit > 0 {
|
|
argCount++
|
|
dataQuery += fmt.Sprintf(" LIMIT $%d", argCount)
|
|
args = append(args, filter.Limit)
|
|
}
|
|
if filter.Offset > 0 {
|
|
argCount++
|
|
dataQuery += fmt.Sprintf(" OFFSET $%d", argCount)
|
|
args = append(args, filter.Offset)
|
|
}
|
|
|
|
rows, err := s.pool.Query(ctx, dataQuery, args...)
|
|
if err != nil {
|
|
return nil, 0, fmt.Errorf("failed to list blocked content: %w", err)
|
|
}
|
|
defer rows.Close()
|
|
|
|
logs := []BlockedContentLog{}
|
|
for rows.Next() {
|
|
var l BlockedContentLog
|
|
err := rows.Scan(
|
|
&l.ID, &l.URL, &l.Domain, &l.BlockReason,
|
|
&l.MatchedRuleID, &l.Details, &l.CreatedAt,
|
|
)
|
|
if err != nil {
|
|
return nil, 0, fmt.Errorf("failed to scan blocked content: %w", err)
|
|
}
|
|
logs = append(logs, l)
|
|
}
|
|
|
|
return logs, total, nil
|
|
}
|
|
|
|
// =============================================================================
|
|
// STATISTICS
|
|
// =============================================================================
|
|
|
|
// GetStats retrieves aggregated statistics for the policy system.
|
|
func (s *Store) GetStats(ctx context.Context) (*PolicyStats, error) {
|
|
stats := &PolicyStats{
|
|
SourcesByLicense: make(map[string]int),
|
|
BlocksByReason: make(map[string]int),
|
|
}
|
|
|
|
// Active policies
|
|
err := s.pool.QueryRow(ctx, `SELECT COUNT(*) FROM source_policies WHERE is_active = true`).Scan(&stats.ActivePolicies)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to count active policies: %w", err)
|
|
}
|
|
|
|
// Total sources
|
|
err = s.pool.QueryRow(ctx, `SELECT COUNT(*) FROM allowed_sources`).Scan(&stats.TotalSources)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to count total sources: %w", err)
|
|
}
|
|
|
|
// Active sources
|
|
err = s.pool.QueryRow(ctx, `SELECT COUNT(*) FROM allowed_sources WHERE is_active = true`).Scan(&stats.ActiveSources)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to count active sources: %w", err)
|
|
}
|
|
|
|
// Blocked today
|
|
err = s.pool.QueryRow(ctx, `SELECT COUNT(*) FROM blocked_content_log WHERE created_at >= CURRENT_DATE`).Scan(&stats.BlockedToday)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to count blocked today: %w", err)
|
|
}
|
|
|
|
// Blocked total
|
|
err = s.pool.QueryRow(ctx, `SELECT COUNT(*) FROM blocked_content_log`).Scan(&stats.BlockedTotal)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to count blocked total: %w", err)
|
|
}
|
|
|
|
// Active PII rules
|
|
err = s.pool.QueryRow(ctx, `SELECT COUNT(*) FROM pii_rules WHERE is_active = true`).Scan(&stats.PIIRulesActive)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to count active PII rules: %w", err)
|
|
}
|
|
|
|
// Sources by license
|
|
rows, err := s.pool.Query(ctx, `SELECT license, COUNT(*) FROM allowed_sources GROUP BY license`)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to count sources by license: %w", err)
|
|
}
|
|
defer rows.Close()
|
|
for rows.Next() {
|
|
var license string
|
|
var count int
|
|
if err := rows.Scan(&license, &count); err != nil {
|
|
return nil, err
|
|
}
|
|
stats.SourcesByLicense[license] = count
|
|
}
|
|
|
|
// Blocks by reason
|
|
rows, err = s.pool.Query(ctx, `SELECT block_reason, COUNT(*) FROM blocked_content_log GROUP BY block_reason`)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to count blocks by reason: %w", err)
|
|
}
|
|
defer rows.Close()
|
|
for rows.Next() {
|
|
var reason string
|
|
var count int
|
|
if err := rows.Scan(&reason, &count); err != nil {
|
|
return nil, err
|
|
}
|
|
stats.BlocksByReason[reason] = count
|
|
}
|
|
|
|
// Compliance score (simplified: active sources / total sources)
|
|
if stats.TotalSources > 0 {
|
|
stats.ComplianceScore = float64(stats.ActiveSources) / float64(stats.TotalSources) * 100
|
|
}
|
|
|
|
return stats, nil
|
|
}
|
|
|
|
// =============================================================================
|
|
// YAML LOADER
|
|
// =============================================================================
|
|
|
|
// LoadFromYAML loads initial policy data from YAML configuration.
|
|
func (s *Store) LoadFromYAML(ctx context.Context, config *BundeslaenderConfig) error {
|
|
// Load federal policy
|
|
if config.Federal.Name != "" {
|
|
err := s.loadPolicy(ctx, nil, &config.Federal, &config.DefaultOperations)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to load federal policy: %w", err)
|
|
}
|
|
}
|
|
|
|
// Load Bundesland policies
|
|
for code, policyConfig := range config.Bundeslaender {
|
|
if code == "federal" || code == "default_operations" || code == "pii_rules" {
|
|
continue
|
|
}
|
|
bl := Bundesland(code)
|
|
err := s.loadPolicy(ctx, &bl, &policyConfig, &config.DefaultOperations)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to load policy for %s: %w", code, err)
|
|
}
|
|
}
|
|
|
|
// Load PII rules
|
|
for _, ruleConfig := range config.PIIRules {
|
|
err := s.loadPIIRule(ctx, &ruleConfig)
|
|
if err != nil {
|
|
return fmt.Errorf("failed to load PII rule %s: %w", ruleConfig.Name, err)
|
|
}
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
func (s *Store) loadPolicy(ctx context.Context, bundesland *Bundesland, config *PolicyConfig, ops *OperationsConfig) error {
|
|
// Create policy
|
|
policy, err := s.CreatePolicy(ctx, &CreateSourcePolicyRequest{
|
|
Name: config.Name,
|
|
Bundesland: bundesland,
|
|
})
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
// Create sources
|
|
for _, srcConfig := range config.Sources {
|
|
trustBoost := 0.5
|
|
if srcConfig.TrustBoost > 0 {
|
|
trustBoost = srcConfig.TrustBoost
|
|
}
|
|
|
|
var legalBasis, citation *string
|
|
if srcConfig.LegalBasis != "" {
|
|
legalBasis = &srcConfig.LegalBasis
|
|
}
|
|
if srcConfig.CitationTemplate != "" {
|
|
citation = &srcConfig.CitationTemplate
|
|
}
|
|
|
|
_, err := s.CreateSource(ctx, &CreateAllowedSourceRequest{
|
|
PolicyID: policy.ID,
|
|
Domain: srcConfig.Domain,
|
|
Name: srcConfig.Name,
|
|
License: License(srcConfig.License),
|
|
LegalBasis: legalBasis,
|
|
CitationTemplate: citation,
|
|
TrustBoost: &trustBoost,
|
|
})
|
|
if err != nil {
|
|
return fmt.Errorf("failed to create source %s: %w", srcConfig.Domain, err)
|
|
}
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
func (s *Store) loadPIIRule(ctx context.Context, config *PIIRuleConfig) error {
|
|
severity := PIISeverityBlock
|
|
if config.Severity != "" {
|
|
severity = PIISeverity(config.Severity)
|
|
}
|
|
|
|
_, err := s.CreatePIIRule(ctx, &CreatePIIRuleRequest{
|
|
Name: config.Name,
|
|
RuleType: PIIRuleType(config.Type),
|
|
Pattern: config.Pattern,
|
|
Severity: severity,
|
|
})
|
|
|
|
return err
|
|
}
|
|
|
|
// ToJSON converts an entity to JSON for audit logging.
|
|
func ToJSON(v interface{}) json.RawMessage {
|
|
data, _ := json.Marshal(v)
|
|
return data
|
|
}
|