Initial curated ITWorx_MCP_Hub source from 368fba691ea8d23403b4d56b53b5ec670d7c5020

services/control_api/policy/service.py

@@ -0,0 +1,48 @@
+"""Control-plane service for policy simulation and policy-scoped audit reads."""
+
+from __future__ import annotations
+
+from collections.abc import Iterable
+from typing import Any
+from uuid import UUID
+
+from packages.hub_policy import AuditLog, InvocationContext, PolicyEngine, PolicySimulator
+
+
+class PolicyService:
+    def __init__(
+        self,
+        engine: PolicyEngine,
+        audit: AuditLog,
+        *,
+        known_projects: Iterable[str] = (),
+        known_clients: Iterable[UUID] = (),
+        known_tools: Iterable[str] = (),
+    ) -> None:
+        self.engine = engine
+        self.audit = audit
+        self.simulator = PolicySimulator(
+            engine,
+            known_projects=known_projects,
+            known_clients=known_clients,
+            known_tools=known_tools,
+        )
+
+    def simulate(self, context: InvocationContext) -> dict[str, Any]:
+        """Simulation is side-effect free and uses the exact runtime evaluator."""
+        return self.simulator.simulate(context).model_dump(mode="json")
+
+    def audit_search(
+        self, *, workspace: str, project: str, limit: int = 100, offset: int = 0
+    ) -> dict[str, Any]:
+        page = self.audit.search(workspace=workspace, project=project, limit=limit, offset=offset)
+        return {
+            "items": [item.model_dump(mode="json") for item in page.items],
+            "nextOffset": page.next_offset,
+        }
+
+    def audit_export_metadata(self, *, workspace: str, project: str) -> dict[str, Any]:
+        return self.audit.export_metadata(workspace=workspace, project=project)
+
+    def update_policy(self, *_: Any, **__: Any) -> None:
+        raise PermissionError("policies are catalog-managed; direct mutation is prohibited")