49 lines
1.7 KiB
Python
49 lines
1.7 KiB
Python
"""Control-plane service for policy simulation and policy-scoped audit reads."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from collections.abc import Iterable
|
|
from typing import Any
|
|
from uuid import UUID
|
|
|
|
from packages.hub_policy import AuditLog, InvocationContext, PolicyEngine, PolicySimulator
|
|
|
|
|
|
class PolicyService:
|
|
def __init__(
|
|
self,
|
|
engine: PolicyEngine,
|
|
audit: AuditLog,
|
|
*,
|
|
known_projects: Iterable[str] = (),
|
|
known_clients: Iterable[UUID] = (),
|
|
known_tools: Iterable[str] = (),
|
|
) -> None:
|
|
self.engine = engine
|
|
self.audit = audit
|
|
self.simulator = PolicySimulator(
|
|
engine,
|
|
known_projects=known_projects,
|
|
known_clients=known_clients,
|
|
known_tools=known_tools,
|
|
)
|
|
|
|
def simulate(self, context: InvocationContext) -> dict[str, Any]:
|
|
"""Simulation is side-effect free and uses the exact runtime evaluator."""
|
|
return self.simulator.simulate(context).model_dump(mode="json")
|
|
|
|
def audit_search(
|
|
self, *, workspace: str, project: str, limit: int = 100, offset: int = 0
|
|
) -> dict[str, Any]:
|
|
page = self.audit.search(workspace=workspace, project=project, limit=limit, offset=offset)
|
|
return {
|
|
"items": [item.model_dump(mode="json") for item in page.items],
|
|
"nextOffset": page.next_offset,
|
|
}
|
|
|
|
def audit_export_metadata(self, *, workspace: str, project: str) -> dict[str, Any]:
|
|
return self.audit.export_metadata(workspace=workspace, project=project)
|
|
|
|
def update_policy(self, *_: Any, **__: Any) -> None:
|
|
raise PermissionError("policies are catalog-managed; direct mutation is prohibited")
|