Initial curated ITWorx_MCP_Hub source from 368fba691ea8d23403b4d56b53b5ec670d7c5020

services/control_api/policy/__init__.py

@@ -0,0 +1,6 @@
+"""Policy simulation and restricted audit management boundary."""
+
+from .router import build_policy_router
+from .service import PolicyService
+
+__all__ = ["PolicyService", "build_policy_router"]

services/control_api/policy/router.py

@@ -0,0 +1,59 @@
+"""Authenticated, project-scoped policy simulation and audit read routes."""
+
+from __future__ import annotations
+
+from collections.abc import Callable
+from typing import Any
+
+from fastapi import APIRouter, Depends, HTTPException, Request, status
+
+from packages.hub_policy import InvocationContext
+
+from .service import PolicyService
+
+
+def _deny_by_default(_: Request) -> None:
+    raise HTTPException(
+        status_code=status.HTTP_403_FORBIDDEN, detail="policy authorization required"
+    )
+
+
+def build_policy_router(
+    service: PolicyService, *, authorize: Callable[[Request], Any] = _deny_by_default
+) -> APIRouter:
+    def authorized(request: Request) -> None:
+        authorize(request)
+
+    router = APIRouter(
+        prefix="/governance", tags=["governance"], dependencies=[Depends(authorized)]
+    )
+
+    @router.post("/simulate")
+    def simulate(context: InvocationContext) -> dict[str, Any]:
+        return service.simulate(context)
+
+    @router.get("/audit")
+    def audit(
+        request: Request, workspace: str, project: str, limit: int = 100, offset: int = 0
+    ) -> dict[str, Any]:
+        del request
+        try:
+            return service.audit_search(
+                workspace=workspace, project=project, limit=limit, offset=offset
+            )
+        except ValueError as exc:
+            raise HTTPException(status_code=422, detail=str(exc)) from exc
+
+    @router.get("/audit/export-metadata")
+    def export_metadata(workspace: str, project: str) -> dict[str, Any]:
+        return service.audit_export_metadata(workspace=workspace, project=project)
+
+    @router.put("/policies/{slug}")
+    def update_policy(slug: str, payload: dict[str, Any]) -> None:
+        del slug, payload
+        try:
+            service.update_policy()
+        except PermissionError as exc:
+            raise HTTPException(status_code=405, detail=str(exc)) from exc
+
+    return router

services/control_api/policy/service.py

@@ -0,0 +1,48 @@
+"""Control-plane service for policy simulation and policy-scoped audit reads."""
+
+from __future__ import annotations
+
+from collections.abc import Iterable
+from typing import Any
+from uuid import UUID
+
+from packages.hub_policy import AuditLog, InvocationContext, PolicyEngine, PolicySimulator
+
+
+class PolicyService:
+    def __init__(
+        self,
+        engine: PolicyEngine,
+        audit: AuditLog,
+        *,
+        known_projects: Iterable[str] = (),
+        known_clients: Iterable[UUID] = (),
+        known_tools: Iterable[str] = (),
+    ) -> None:
+        self.engine = engine
+        self.audit = audit
+        self.simulator = PolicySimulator(
+            engine,
+            known_projects=known_projects,
+            known_clients=known_clients,
+            known_tools=known_tools,
+        )
+
+    def simulate(self, context: InvocationContext) -> dict[str, Any]:
+        """Simulation is side-effect free and uses the exact runtime evaluator."""
+        return self.simulator.simulate(context).model_dump(mode="json")
+
+    def audit_search(
+        self, *, workspace: str, project: str, limit: int = 100, offset: int = 0
+    ) -> dict[str, Any]:
+        page = self.audit.search(workspace=workspace, project=project, limit=limit, offset=offset)
+        return {
+            "items": [item.model_dump(mode="json") for item in page.items],
+            "nextOffset": page.next_offset,
+        }
+
+    def audit_export_metadata(self, *, workspace: str, project: str) -> dict[str, Any]:
+        return self.audit.export_metadata(workspace=workspace, project=project)
+
+    def update_policy(self, *_: Any, **__: Any) -> None:
+        raise PermissionError("policies are catalog-managed; direct mutation is prohibited")