Add Rust evidence register bridge

Author: ewilhelm1979-netizen

Makefile

@@ -3,7 +3,7 @@ COMPOSE_STAGE=docker compose -f docker-compose.yml -f docker-compose.stage.yml
 COMPOSE_PROD=docker compose -f docker-compose.yml -f docker-compose.prod.yml
 COMPOSE_PROD_LLM=docker compose -f docker-compose.yml -f docker-compose.prod.yml -f docker-compose.llm.yml
 PYTHON_BIN=$(shell if [ -x .venv/bin/python ]; then echo .venv/bin/python; else echo python; fi)
-TEAM_TEST_ENV=GUIDANCE_SCORING_BACKEND=local RISK_SCORING_BACKEND=local REPORT_SUMMARY_BACKEND=local REPORT_SNAPSHOT_BACKEND=local DASHBOARD_SUMMARY_BACKEND=local ASSET_INVENTORY_BACKEND=local PROCESS_REGISTER_BACKEND=local RISK_REGISTER_BACKEND=local RUST_BACKEND_URL=
+TEAM_TEST_ENV=GUIDANCE_SCORING_BACKEND=local RISK_SCORING_BACKEND=local REPORT_SUMMARY_BACKEND=local REPORT_SNAPSHOT_BACKEND=local DASHBOARD_SUMMARY_BACKEND=local ASSET_INVENTORY_BACKEND=local PROCESS_REGISTER_BACKEND=local RISK_REGISTER_BACKEND=local EVIDENCE_REGISTER_BACKEND=local RUST_BACKEND_URL=
 
 .PHONY: dev-up dev-down stage-up stage-down prod-up prod-down prod-up-llm llm-download backup restore health handbook-pdf local-bootstrap local-check local-test team-test docker-check docker-smoke easy-start prod-readiness rust-build rust-test rust-run canary-daily rust-import-collection rust-sync-recent rust-canary-parity rust-canary-trend rust-canary-import
 
@@ -20,7 +20,7 @@ local-test:
 
 team-test:
 	$(TEAM_TEST_ENV) $(PYTHON_BIN) manage.py check
-	$(TEAM_TEST_ENV) $(PYTHON_BIN) manage.py test apps.core apps.reports apps.product_security apps.guidance apps.dashboard apps.assets_app apps.processes apps.risks apps.vulnerability_intelligence
+	$(TEAM_TEST_ENV) $(PYTHON_BIN) manage.py test apps.core apps.reports apps.product_security apps.guidance apps.dashboard apps.assets_app apps.processes apps.risks apps.evidence apps.vulnerability_intelligence
 
 docker-check:
 	$(COMPOSE_DEV) config >/dev/null

README.md

@@ -161,6 +161,7 @@ Der funktionierende Referenzpfad auf Ubuntu 24.04 ist:
 - `ASSET_INVENTORY_BACKEND=rust_service`
 - `PROCESS_REGISTER_BACKEND=rust_service`
 - `RISK_REGISTER_BACKEND=rust_service`
+- `EVIDENCE_REGISTER_BACKEND=rust_service`
 - `RUST_STRICT_MODE=True` (erzwingt Rust-Backends ohne Fallback)
 
 Danach kann weiter wie gewohnt gestartet werden:

apps/evidence/services.py

@@ -1,10 +1,357 @@
+import json
+from dataclasses import dataclass
+from datetime import datetime
+from urllib.parse import urlencode
+from urllib.request import Request, urlopen
+
 from django.conf import settings
 
 from apps.evidence.models import EvidenceItem, RequirementEvidenceNeed
 from apps.organizations.sector_catalog import get_sector_definition
 from apps.requirements_app.models import Requirement
 
 
+@dataclass(frozen=True)
+class EvidenceRelatedRef:
+    id: int | None
+    name: str
+
+    def __str__(self) -> str:
+        return self.name
+
+
+@dataclass(frozen=True)
+class EvidenceMappingVersionRef:
+    program_name: str
+    framework: str
+    version: str
+
+    def __str__(self) -> str:
+        return f'{self.program_name} {self.framework} {self.version}'
+
+
+@dataclass(frozen=True)
+class EvidenceRegulatorySourceRef:
+    authority: str
+    citation: str
+    title: str
+
+    def __str__(self) -> str:
+        return ' - '.join(part for part in [self.authority, self.citation or self.title] if part)
+
+
+@dataclass(frozen=True)
+class EvidenceRequirementRef:
+    id: int
+    framework: str
+    code: str
+    title: str
+    mapping_version: EvidenceMappingVersionRef | None
+    primary_source: EvidenceRegulatorySourceRef | None
+
+    def __str__(self) -> str:
+        return f'{self.framework} - {self.code}'
+
+
+@dataclass(frozen=True)
+class EvidenceItemBridgeItem:
+    id: int
+    tenant: object
+    tenant_id: int
+    session_id: int | None
+    domain_id: int | None
+    measure: EvidenceRelatedRef | None
+    measure_id: int | None
+    requirement: EvidenceRequirementRef | None
+    requirement_id: int | None
+    title: str
+    description: str
+    linked_requirement: str
+    file: str | None
+    status: str
+    status_label: str
+    owner: EvidenceRelatedRef | None
+    owner_id: int | None
+    review_notes: str
+    reviewed_by: EvidenceRelatedRef | None
+    reviewed_by_id: int | None
+    reviewed_at: datetime | None
+    created_at: datetime | None
+    updated_at: datetime | None
+
+    @property
+    def pk(self) -> int:
+        return self.id
+
+    @property
+    def requirement_display(self) -> str:
+        if self.requirement:
+            return f'{self.requirement.framework} {self.requirement.code} – {self.requirement.title}'
+        return self.linked_requirement
+
+    def get_status_display(self) -> str:
+        return self.status_label
+
+
+@dataclass(frozen=True)
+class RequirementEvidenceNeedBridgeItem:
+    id: int
+    tenant: object
+    tenant_id: int
+    session_id: int | None
+    requirement: EvidenceRequirementRef
+    requirement_id: int
+    title: str
+    description: str
+    is_mandatory: bool
+    status: str
+    status_label: str
+    rationale: str
+    covered_count: int
+    created_at: datetime | None
+    updated_at: datetime | None
+
+    @property
+    def pk(self) -> int:
+        return self.id
+
+    @property
+    def requirement_mapping_version(self) -> str:
+        requirement = self.requirement
+        if not requirement or not requirement.mapping_version:
+            return ''
+        return f'{requirement.mapping_version.program_name} {requirement.framework} v{requirement.mapping_version.version}'
+
+    @property
+    def requirement_source_citation(self) -> str:
+        requirement = self.requirement
+        if not requirement or not requirement.primary_source:
+            return ''
+        source = requirement.primary_source
+        parts = [source.authority, source.citation or source.title]
+        return ' - '.join(part for part in parts if part)
+
+    def get_status_display(self) -> str:
+        return self.status_label
+
+
+@dataclass(frozen=True)
+class EvidenceOverviewBridgeResult:
+    evidence_items: list[EvidenceItemBridgeItem]
+    evidence_needs: list[RequirementEvidenceNeedBridgeItem]
+    need_summary: dict[str, int]
+
+
+class EvidenceRustClient:
+    @staticmethod
+    def _base_url() -> str:
+        base = (getattr(settings, 'RUST_BACKEND_URL', '') or '').strip()
+        return base.rstrip('/')
+
+    @staticmethod
+    def fetch_overview(request, tenant, session_id: str | int | None = None, timeout: int = 8) -> EvidenceOverviewBridgeResult:
+        base = EvidenceRustClient._base_url()
+        if not base:
+            raise RuntimeError('RUST_BACKEND_URL ist nicht gesetzt.')
+
+        url = f'{base}/api/v1/evidence'
+        if session_id:
+            url = f'{url}?{urlencode({"session_id": int(session_id)})}'
+        rust_request = EvidenceRustClient._authenticated_request(request, tenant, url)
+        with urlopen(rust_request, timeout=timeout) as response:
+            payload = json.loads(response.read().decode('utf-8'))
+
+        tenant_id = EvidenceRustClient._int_field(payload, 'tenant_id')
+        if tenant_id != int(tenant.id):
+            raise RuntimeError('Rust-Evidenzliste gehoert nicht zum angefragten Tenant.')
+
+        return EvidenceOverviewBridgeResult(
+            evidence_items=[
+                EvidenceRustClient._evidence_item_from_payload(item, tenant)
+                for item in payload.get('evidence_items', [])
+                if isinstance(item, dict)
+            ],
+            evidence_needs=[
+                EvidenceRustClient._evidence_need_from_payload(item, tenant)
+                for item in payload.get('evidence_needs', [])
+                if isinstance(item, dict)
+            ],
+            need_summary=EvidenceRustClient._need_summary_from_payload(payload.get('need_summary') or {}),
+        )
+
+    @staticmethod
+    def _evidence_item_from_payload(item: dict, tenant) -> EvidenceItemBridgeItem:
+        measure_id = EvidenceRustClient._optional_int_field(item, 'measure_id')
+        measure_title = str(item.get('measure_title') or '').strip()
+        owner_id = EvidenceRustClient._optional_int_field(item, 'owner_id')
+        owner_display = str(item.get('owner_display') or '').strip()
+        reviewed_by_id = EvidenceRustClient._optional_int_field(item, 'reviewed_by_id')
+        reviewed_by_display = str(item.get('reviewed_by_display') or '').strip()
+        requirement = EvidenceRustClient._requirement_from_payload(item)
+        return EvidenceItemBridgeItem(
+            id=EvidenceRustClient._int_field(item, 'id'),
+            tenant=tenant,
+            tenant_id=EvidenceRustClient._int_field(item, 'tenant_id'),
+            session_id=EvidenceRustClient._optional_int_field(item, 'session_id'),
+            domain_id=EvidenceRustClient._optional_int_field(item, 'domain_id'),
+            measure=EvidenceRelatedRef(measure_id, measure_title) if measure_title else None,
+            measure_id=measure_id,
+            requirement=requirement,
+            requirement_id=EvidenceRustClient._optional_int_field(item, 'requirement_id'),
+            title=str(item.get('title') or ''),
+            description=str(item.get('description') or ''),
+            linked_requirement=str(item.get('linked_requirement') or ''),
+            file=EvidenceRustClient._optional_str_field(item, 'file_name'),
+            status=str(item.get('status') or EvidenceItem.Status.DRAFT),
+            status_label=str(item.get('status_label') or dict(EvidenceItem.Status.choices).get(item.get('status'), 'Entwurf')),
+            owner=EvidenceRelatedRef(owner_id, owner_display) if owner_display else None,
+            owner_id=owner_id,
+            review_notes=str(item.get('review_notes') or ''),
+            reviewed_by=EvidenceRelatedRef(reviewed_by_id, reviewed_by_display) if reviewed_by_display else None,
+            reviewed_by_id=reviewed_by_id,
+            reviewed_at=EvidenceRustClient._datetime_field(item, 'reviewed_at'),
+            created_at=EvidenceRustClient._datetime_field(item, 'created_at'),
+            updated_at=EvidenceRustClient._datetime_field(item, 'updated_at'),
+        )
+
+    @staticmethod
+    def _evidence_need_from_payload(item: dict, tenant) -> RequirementEvidenceNeedBridgeItem:
+        requirement = EvidenceRustClient._requirement_from_payload(item)
+        if requirement is None:
+            raise RuntimeError('Rust-Evidenzpflicht hat keine Requirement-Daten geliefert.')
+        return RequirementEvidenceNeedBridgeItem(
+            id=EvidenceRustClient._int_field(item, 'id'),
+            tenant=tenant,
+            tenant_id=EvidenceRustClient._int_field(item, 'tenant_id'),
+            session_id=EvidenceRustClient._optional_int_field(item, 'session_id'),
+            requirement=requirement,
+            requirement_id=EvidenceRustClient._int_field(item, 'requirement_id'),
+            title=str(item.get('title') or ''),
+            description=str(item.get('description') or ''),
+            is_mandatory=bool(item.get('is_mandatory')),
+            status=str(item.get('status') or RequirementEvidenceNeed.Status.OPEN),
+            status_label=str(item.get('status_label') or dict(RequirementEvidenceNeed.Status.choices).get(item.get('status'), 'Offen')),
+            rationale=str(item.get('rationale') or ''),
+            covered_count=EvidenceRustClient._int_field(item, 'covered_count'),
+            created_at=EvidenceRustClient._datetime_field(item, 'created_at'),
+            updated_at=EvidenceRustClient._datetime_field(item, 'updated_at'),
+        )
+
+    @staticmethod
+    def _requirement_from_payload(item: dict) -> EvidenceRequirementRef | None:
+        requirement_id = EvidenceRustClient._optional_int_field(item, 'requirement_id')
+        framework = str(item.get('requirement_framework') or '').strip()
+        code = str(item.get('requirement_code') or '').strip()
+        title = str(item.get('requirement_title') or '').strip()
+        if not requirement_id or not framework or not code:
+            return None
+
+        mapping_version = None
+        mapping_program_name = str(item.get('mapping_program_name') or '').strip()
+        mapping_version_value = str(item.get('mapping_version') or '').strip()
+        if mapping_program_name and mapping_version_value:
+            mapping_version = EvidenceMappingVersionRef(
+                program_name=mapping_program_name,
+                framework=framework,
+                version=mapping_version_value,
+            )
+
+        primary_source = None
+        source_authority = str(item.get('source_authority') or '').strip()
+        source_citation = str(item.get('source_citation') or '').strip()
+        source_title = str(item.get('source_title') or '').strip()
+        if source_authority or source_citation or source_title:
+            primary_source = EvidenceRegulatorySourceRef(
+                authority=source_authority,
+                citation=source_citation,
+                title=source_title,
+            )
+
+        return EvidenceRequirementRef(
+            id=requirement_id,
+            framework=framework,
+            code=code,
+            title=title,
+            mapping_version=mapping_version,
+            primary_source=primary_source,
+        )
+
+    @staticmethod
+    def _need_summary_from_payload(payload: dict) -> dict[str, int]:
+        return {
+            'open': int(payload.get('open') or 0),
+            'partial': int(payload.get('partial') or 0),
+            'covered': int(payload.get('covered') or 0),
+        }
+
+    @staticmethod
+    def _authenticated_request(request, tenant, url: str) -> Request:
+        user = getattr(request, 'user', None)
+        user_id = getattr(user, 'id', None)
+        if not user_id:
+            raise RuntimeError('Evidence-Rust-Bridge braucht einen authentifizierten User.')
+
+        rust_request = Request(url)
+        rust_request.add_header('Accept', 'application/json')
+        rust_request.add_header('X-ISCY-Tenant-ID', str(tenant.id))
+        rust_request.add_header('X-ISCY-User-ID', str(user_id))
+        user_email = (getattr(user, 'email', '') or '').strip()
+        if user_email:
+            rust_request.add_header('X-ISCY-User-Email', user_email)
+        return rust_request
+
+    @staticmethod
+    def _int_field(payload: dict, key: str) -> int:
+        return int(payload.get(key) or 0)
+
+    @staticmethod
+    def _optional_int_field(payload: dict, key: str) -> int | None:
+        value = payload.get(key)
+        if value in (None, ''):
+            return None
+        return int(value)
+
+    @staticmethod
+    def _optional_str_field(payload: dict, key: str) -> str | None:
+        value = str(payload.get(key) or '').strip()
+        return value or None
+
+    @staticmethod
+    def _datetime_field(payload: dict, key: str) -> datetime | None:
+        value = str(payload.get(key) or '').strip()
+        if not value:
+            return None
+        normalized = value.replace('Z', '+00:00')
+        return datetime.fromisoformat(normalized)
+
+
+class EvidenceRegisterBridge:
+    @staticmethod
+    def fetch_overview(request, tenant, session_id: str | int | None = None):
+        if tenant is None:
+            return None
+
+        backend = str(getattr(settings, 'EVIDENCE_REGISTER_BACKEND', 'rust_service') or '').strip().lower()
+        if backend != 'rust_service':
+            return None
+
+        if not EvidenceRustClient._base_url():
+            if EvidenceRegisterBridge._strict_rust_mode():
+                raise RuntimeError('Rust evidence register backend ist aktiv, aber RUST_BACKEND_URL ist nicht gesetzt.')
+            return None
+
+        try:
+            return EvidenceRustClient.fetch_overview(request, tenant, session_id=session_id)
+        except Exception as exc:
+            if EvidenceRegisterBridge._strict_rust_mode():
+                raise RuntimeError('Rust evidence register backend ist aktiv, aber nicht erreichbar.') from exc
+            return None
+
+    @staticmethod
+    def _strict_rust_mode() -> bool:
+        return bool(getattr(settings, 'RUST_STRICT_MODE', False))
+
+
 class EvidenceNeedService:
     DOMAIN_KEYWORDS = {
         'GOV': ['governance', 'scope', 'policy', 'roles', 'management'],