726 lines
27 KiB
Python
726 lines
27 KiB
Python
# ============================================================
|
||
# 治理规则域（moduleId: governance-rules, 可重生 ✅）
|
||
# R71.6：约束/自动化规则 CRUD + 启停 + 审计轨迹 + 审计统计。
|
||
# 复用 server.agent_core.automation 的 Rule/RuleExecutor/AutomationScheduler
|
||
# 与 server.agent_core.audit.write_audit；规则状态唯一事实源仍是
|
||
# AutomationScheduler（automation_state.json），审计走既有 auditEvents 链，
|
||
# 不新增与 tick 冲突的规则状态副本。
|
||
# ============================================================
|
||
from __future__ import annotations
|
||
|
||
import copy
|
||
import re
|
||
import uuid
|
||
from collections import Counter
|
||
from collections.abc import Callable, Sequence
|
||
from typing import Any
|
||
|
||
from server.agent_core.audit import write_audit
|
||
from server.agent_core.automation import AutomationScheduler, Rule
|
||
|
||
RULE_ID_PATTERN = re.compile(r"^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$")
|
||
GEAR_CODES = ("G0", "G1", "G2", "G3", "G4")
|
||
ACTION_NAMES = ("notify", "suggest", "re-plan", "commit", "reschedule")
|
||
TRIGGER_TYPES = ("event", "schedule", "threshold")
|
||
|
||
|
||
class GovernanceRuleError(RuntimeError):
|
||
"""治理规则域错误（API 层映射为明确 4xx）。"""
|
||
|
||
def __init__(self, code: str, message: str) -> None:
|
||
super().__init__(message)
|
||
self.code = code
|
||
|
||
|
||
def _time_tuple(value: Any) -> tuple[int, int, int, int, int] | None:
|
||
"""宽容解析 YYYY-MM-DD[ HH:MM]（含 ISO T 分隔符）为比较用元组。"""
|
||
text = str(value or "").strip()
|
||
match = re.match(r"^(\d{4})-(\d{2})-(\d{2})(?:[ T](\d{2})(?::(\d{2}))?)?", text)
|
||
if not match:
|
||
return None
|
||
year, month, day = int(match.group(1)), int(match.group(2)), int(match.group(3))
|
||
hour = int(match.group(4) or 0)
|
||
minute = int(match.group(5) or 0)
|
||
if not (1 <= month <= 12 and 1 <= day <= 31 and 0 <= hour <= 23 and 0 <= minute <= 59):
|
||
return None
|
||
return (year, month, day, hour, minute)
|
||
|
||
|
||
def _bucket_tuple(value: tuple[int, int, int, int, int], granularity: str) -> tuple[int, ...]:
|
||
if granularity == "hour":
|
||
return value[:4]
|
||
return value[:3]
|
||
|
||
|
||
def _bucket_text(value: tuple[int, ...], granularity: str) -> str:
|
||
if granularity == "hour":
|
||
return f"{value[0]:04d}-{value[1]:02d}-{value[2]:02d} {value[3]:02d}"
|
||
return f"{value[0]:04d}-{value[1]:02d}-{value[2]:02d}"
|
||
|
||
|
||
def _event_bucket_key(event: dict[str, Any], granularity: str) -> tuple[int, ...] | None:
|
||
parsed = _time_tuple(event.get("at") or event.get("ts"))
|
||
return _bucket_tuple(parsed, granularity) if parsed is not None else None
|
||
|
||
|
||
def _event_targets_rule(event: dict[str, Any], rule_id: str) -> bool:
|
||
"""审计事件是否作用于指定规则（target 或 rationale.rule）。"""
|
||
try:
|
||
target = event.get("target") or {}
|
||
if str(target.get("type") or "") == "RULE" and str(target.get("id") or "") == rule_id:
|
||
return True
|
||
rationale = event.get("rationale") or {}
|
||
rule_meta = rationale.get("rule") or {}
|
||
return str(rule_meta.get("id") or "") == rule_id
|
||
except (TypeError, AttributeError):
|
||
return False
|
||
|
||
|
||
def audit_stats(
|
||
events: Sequence[dict[str, Any]],
|
||
*,
|
||
start_time: str | None = None,
|
||
end_time: str | None = None,
|
||
module: str | None = None,
|
||
action: str | None = None,
|
||
result: str | None = None,
|
||
granularity: str = "day",
|
||
) -> dict[str, Any]:
|
||
"""审计量聚合：按模块(category)/动作/结果/时间窗口统计，供报表。"""
|
||
if granularity not in ("day", "hour"):
|
||
raise GovernanceRuleError(
|
||
"INVALID_GRANULARITY", f"granularity 必须是 day 或 hour，收到 {granularity!r}",
|
||
)
|
||
start_key = _time_tuple(start_time) if start_time else None
|
||
if start_time and start_key is None:
|
||
raise GovernanceRuleError("INVALID_TIME", f"startTime 无法解析: {start_time!r}")
|
||
end_key = _time_tuple(end_time) if end_time else None
|
||
if end_time and end_key is None:
|
||
raise GovernanceRuleError("INVALID_TIME", f"endTime 无法解析: {end_time!r}")
|
||
if start_key and end_key and _bucket_tuple(start_key, granularity) > _bucket_tuple(end_key, granularity):
|
||
raise GovernanceRuleError("INVALID_TIME_WINDOW", "startTime 不能晚于 endTime")
|
||
|
||
filtered: list[dict[str, Any]] = []
|
||
for event in events:
|
||
if not isinstance(event, dict):
|
||
continue
|
||
if module is not None and str(event.get("category") or "") != module:
|
||
continue
|
||
if action is not None and str(event.get("action") or "") != action:
|
||
continue
|
||
if result is not None and str(event.get("result") or "") != result:
|
||
continue
|
||
bucket = _event_bucket_key(event, granularity)
|
||
if start_key or end_key:
|
||
if bucket is None:
|
||
continue
|
||
if start_key and bucket < _bucket_tuple(start_key, granularity):
|
||
continue
|
||
if end_key and bucket > _bucket_tuple(end_key, granularity):
|
||
continue
|
||
filtered.append(event)
|
||
|
||
by_module = Counter(str(ev.get("category") or "UNKNOWN") for ev in filtered)
|
||
by_action = Counter(str(ev.get("action") or "UNKNOWN") for ev in filtered)
|
||
by_result = Counter(str(ev.get("result") or "UNKNOWN") for ev in filtered)
|
||
trend: Counter[str] = Counter()
|
||
rows: Counter[tuple[str, str, str]] = Counter()
|
||
for event in filtered:
|
||
bucket = _event_bucket_key(event, granularity)
|
||
if bucket is not None:
|
||
trend[_bucket_text(bucket, granularity)] += 1
|
||
rows[(
|
||
str(event.get("category") or "UNKNOWN"),
|
||
str(event.get("action") or "UNKNOWN"),
|
||
str(event.get("result") or "UNKNOWN"),
|
||
)] += 1
|
||
|
||
def _sorted(counter: Counter[str]) -> list[dict[str, Any]]:
|
||
return [
|
||
{"name": key, "count": count}
|
||
for key, count in sorted(counter.items(), key=lambda item: (-item[1], item[0]))
|
||
]
|
||
|
||
return {
|
||
"ok": True,
|
||
"total": len(events),
|
||
"filtered": len(filtered),
|
||
"window": {
|
||
"startTime": start_time,
|
||
"endTime": end_time,
|
||
"granularity": granularity,
|
||
},
|
||
"byModule": [
|
||
{"module": item["name"], "count": item["count"]} for item in _sorted(by_module)
|
||
],
|
||
"byAction": [
|
||
{"action": item["name"], "count": item["count"]} for item in _sorted(by_action)
|
||
],
|
||
"byResult": [
|
||
{"result": item["name"], "count": item["count"]} for item in _sorted(by_result)
|
||
],
|
||
"trend": [
|
||
{"bucket": bucket, "count": count}
|
||
for bucket, count in sorted(trend.items(), key=lambda item: item[0])
|
||
],
|
||
"rows": [
|
||
{"module": module_key, "action": action_key, "result": result_key, "count": count}
|
||
for (module_key, action_key, result_key), count in sorted(
|
||
rows.items(), key=lambda item: (-item[1], item[0]),
|
||
)
|
||
],
|
||
}
|
||
|
||
|
||
class GovernanceRuleService:
|
||
"""规则管理服务：复用现有 AutomationScheduler 单例，变更全程审计。"""
|
||
|
||
def __init__(
|
||
self,
|
||
*,
|
||
runtime_provider: Callable[[], Any] | None = None,
|
||
store_provider: Callable[[], Any] | None = None,
|
||
scheduler: AutomationScheduler | None = None,
|
||
state_path: str | None = None,
|
||
) -> None:
|
||
self._runtime_provider = runtime_provider
|
||
self._store_provider = store_provider
|
||
self._scheduler_instance = scheduler
|
||
self._state_path = state_path
|
||
|
||
# ---------------- 基础设施接入 ----------------
|
||
def _runtime(self) -> Any:
|
||
if self._runtime_provider is not None:
|
||
return self._runtime_provider()
|
||
from server.gateway.app import _get_automation_runtime
|
||
|
||
return _get_automation_runtime()
|
||
|
||
def _store(self) -> Any:
|
||
if self._store_provider is not None:
|
||
return self._store_provider()
|
||
from server.state.store import get_store
|
||
|
||
return get_store()
|
||
|
||
def _scheduler(self) -> AutomationScheduler:
|
||
if self._scheduler_instance is not None:
|
||
return self._scheduler_instance
|
||
return self._runtime().scheduler
|
||
|
||
def _state_path(self) -> str:
|
||
if self._state_path:
|
||
return self._state_path
|
||
return self._runtime().state_path
|
||
|
||
def _state_file(self) -> str:
|
||
return str(self._state_path or self._runtime().state_path)
|
||
|
||
def _persist(self, store: Any, scheduler: AutomationScheduler) -> None:
|
||
"""落盘世界审计和调度状态；任一失败均显式关闭。"""
|
||
try:
|
||
store.save()
|
||
scheduler.save_state(self._state_file())
|
||
except Exception as exc:
|
||
raise GovernanceRuleError(
|
||
"PERSISTENCE_FAILED", f"治理规则持久化失败: {exc}",
|
||
) from exc
|
||
|
||
@staticmethod
|
||
def _authenticated_actor(requested_actor: str = "") -> str:
|
||
from server.auth.context import get_identity
|
||
|
||
identity = get_identity(required=True)
|
||
return identity.username or str(identity.user_id)
|
||
|
||
# ---------------- 审计辅助 ----------------
|
||
def _audit_change(
|
||
self,
|
||
store: Any,
|
||
*,
|
||
actor: str,
|
||
action: str,
|
||
rule: Rule,
|
||
rationale: dict[str, Any] | None = None,
|
||
result: str = "SUCCESS",
|
||
before_snapshot: str | None = None,
|
||
evidence_refs: Sequence[str] = (),
|
||
) -> dict[str, Any]:
|
||
return write_audit(
|
||
store.data,
|
||
store.next_id,
|
||
actor=self._authenticated_actor(actor),
|
||
category="GOVERNANCE",
|
||
action=action,
|
||
target={"type": "RULE", "id": rule.rule_id, "roomId": rule.room_id},
|
||
power="P2",
|
||
rationale=rationale or {},
|
||
result=result,
|
||
before_snapshot=before_snapshot,
|
||
evidence_refs=evidence_refs,
|
||
)
|
||
|
||
def _audit_failure(
|
||
self,
|
||
store: Any,
|
||
scheduler: AutomationScheduler,
|
||
*,
|
||
actor: str,
|
||
action: str,
|
||
rule_id: str,
|
||
payload: dict[str, Any] | None,
|
||
code: str,
|
||
message: str,
|
||
) -> None:
|
||
world_before = copy.deepcopy(store.data)
|
||
try:
|
||
self._audit_change(
|
||
store,
|
||
actor=actor,
|
||
action=action,
|
||
rule=Rule(
|
||
rule_id=rule_id or "?",
|
||
room_id=str((payload or {}).get("roomId") or ""),
|
||
trigger={},
|
||
),
|
||
rationale={"code": code, "error": message, "payload": payload or {}},
|
||
result="DENIED",
|
||
)
|
||
self._persist(store, scheduler)
|
||
except Exception:
|
||
store.data.clear()
|
||
store.data.update(world_before)
|
||
raise
|
||
|
||
def _rollback_change(
|
||
self,
|
||
store: Any,
|
||
scheduler: AutomationScheduler,
|
||
*,
|
||
rule_id: str,
|
||
previous_rule: Rule | None,
|
||
was_paused: bool,
|
||
world_before: dict[str, Any],
|
||
) -> list[str]:
|
||
errors: list[str] = []
|
||
registry = scheduler.executor.registry
|
||
registry.unregister(rule_id)
|
||
if previous_rule is not None:
|
||
registry.register(previous_rule)
|
||
if was_paused:
|
||
scheduler.pause_rule(rule_id)
|
||
else:
|
||
scheduler.resume_rule(rule_id)
|
||
store.data.clear()
|
||
store.data.update(copy.deepcopy(world_before))
|
||
for name, persist in (
|
||
("world", store.save),
|
||
("scheduler", lambda: scheduler.save_state(self._state_file())),
|
||
):
|
||
try:
|
||
persist()
|
||
except Exception as exc: # noqa: BLE001 - collect compensation evidence
|
||
errors.append(f"{name}: {exc}")
|
||
return errors
|
||
|
||
def _commit_change(
|
||
self,
|
||
store: Any,
|
||
scheduler: AutomationScheduler,
|
||
*,
|
||
actor: str,
|
||
action: str,
|
||
rule_id: str,
|
||
mutation: Callable[[], tuple[dict[str, Any], Rule, dict[str, Any]]],
|
||
confirmation: dict[str, Any] | None = None,
|
||
) -> dict[str, Any]:
|
||
registry = scheduler.executor.registry
|
||
try:
|
||
previous_rule = registry.get(rule_id)
|
||
except KeyError:
|
||
previous_rule = None
|
||
was_paused = rule_id in scheduler.paused_rules()
|
||
world_before = copy.deepcopy(store.data)
|
||
try:
|
||
result, audit_rule, rationale = mutation()
|
||
confirmation = confirmation or {}
|
||
self._audit_change(
|
||
store,
|
||
actor=actor,
|
||
action=action,
|
||
rule=audit_rule,
|
||
rationale={
|
||
**rationale,
|
||
"confirmId": confirmation.get("confirmId"),
|
||
"approver": self._authenticated_actor(actor),
|
||
},
|
||
before_snapshot=confirmation.get("beforeSnapshot"),
|
||
evidence_refs=list(confirmation.get("evidenceRefs") or []),
|
||
)
|
||
self._persist(store, scheduler)
|
||
return result
|
||
except Exception as exc:
|
||
rollback_errors = self._rollback_change(
|
||
store,
|
||
scheduler,
|
||
rule_id=rule_id,
|
||
previous_rule=previous_rule,
|
||
was_paused=was_paused,
|
||
world_before=world_before,
|
||
)
|
||
if isinstance(exc, GovernanceRuleError) and exc.code != "PERSISTENCE_FAILED":
|
||
raise
|
||
detail = f"治理规则变更失败并已回滚: {exc}"
|
||
if rollback_errors:
|
||
detail += f"；补偿持久化异常: {'; '.join(rollback_errors)}"
|
||
raise GovernanceRuleError("PERSISTENCE_FAILED", detail) from exc
|
||
|
||
# ---------------- 规则 CRUD ----------------
|
||
def _build_rule(self, raw: dict[str, Any]) -> Rule:
|
||
rule = Rule.from_dict(raw)
|
||
rule.validate()
|
||
return rule
|
||
|
||
def _rule_view(self, rule: Rule, scheduler: AutomationScheduler) -> dict[str, Any]:
|
||
view = rule.as_dict()
|
||
view["paused"] = rule.rule_id in scheduler.paused_rules()
|
||
return view
|
||
|
||
def _require_rule(self, rule_id: str, scheduler: AutomationScheduler) -> Rule:
|
||
try:
|
||
return scheduler.executor.registry.get(rule_id)
|
||
except KeyError as exc:
|
||
raise GovernanceRuleError("RULE_NOT_FOUND", f"规则 {rule_id} 不存在") from exc
|
||
|
||
def list_rules(self, *, enabled: bool | None = None) -> list[dict[str, Any]]:
|
||
scheduler = self._scheduler()
|
||
return [
|
||
self._rule_view(rule, scheduler)
|
||
for rule in scheduler.executor.registry.list(enabled=enabled)
|
||
]
|
||
|
||
def get_rule(self, rule_id: str) -> dict[str, Any]:
|
||
scheduler = self._scheduler()
|
||
rule = self._require_rule(rule_id, scheduler)
|
||
return self._rule_view(rule, scheduler)
|
||
|
||
def stage_change(
|
||
self,
|
||
action: str,
|
||
payload: dict[str, Any],
|
||
*,
|
||
session_id: str,
|
||
) -> Any:
|
||
"""Validate and freeze a governance mutation without changing rule state."""
|
||
from server.agent_core import harness
|
||
|
||
scheduler = self._scheduler()
|
||
raw = dict(payload or {})
|
||
if action == "governance.rule.create":
|
||
rule_id = str(raw.get("ruleId") or "").strip()
|
||
if rule_id and not RULE_ID_PATTERN.fullmatch(rule_id):
|
||
raise GovernanceRuleError(
|
||
"INVALID_RULE_ID", "ruleId 只能是字母数字开头，长度 1-128 的标识符",
|
||
)
|
||
raw["ruleId"] = rule_id or f"r-{uuid.uuid4().hex[:12]}"
|
||
try:
|
||
rule = self._build_rule(raw)
|
||
except (KeyError, TypeError, ValueError) as exc:
|
||
raise GovernanceRuleError("INVALID_RULE", str(exc)) from exc
|
||
if any(item.rule_id == rule.rule_id for item in scheduler.executor.registry.list()):
|
||
raise GovernanceRuleError("RULE_EXISTS", f"规则 {rule.rule_id} 已存在")
|
||
params = {"rule": rule.as_dict()}
|
||
summary = [f"创建规则 {rule.rule_id}", f"房间 {rule.room_id}，档位 {rule.gear}"]
|
||
elif action == "governance.rule.update":
|
||
rule_id = str(raw.pop("ruleId", "") or "")
|
||
existing = self._require_rule(rule_id, scheduler)
|
||
patch = dict(raw.get("patch") or {})
|
||
provided_id = patch.get("ruleId")
|
||
if provided_id is not None and str(provided_id) != rule_id:
|
||
raise GovernanceRuleError("RULE_ID_MISMATCH", "请求体 ruleId 必须与路径规则一致")
|
||
merged = existing.as_dict()
|
||
merged.update({key: value for key, value in patch.items() if key != "ruleId"})
|
||
merged["ruleId"] = rule_id
|
||
try:
|
||
updated = self._build_rule(merged)
|
||
except (KeyError, TypeError, ValueError) as exc:
|
||
raise GovernanceRuleError("INVALID_RULE", str(exc)) from exc
|
||
params = {"ruleId": rule_id, "patch": patch}
|
||
summary = [f"更新规则 {rule_id}", f"档位 {existing.gear} → {updated.gear}"]
|
||
elif action in {
|
||
"governance.rule.delete",
|
||
"governance.rule.enable",
|
||
"governance.rule.disable",
|
||
}:
|
||
rule_id = str(raw.get("ruleId") or "")
|
||
existing = self._require_rule(rule_id, scheduler)
|
||
params = {"ruleId": rule_id}
|
||
verb = action.rsplit(".", 1)[-1]
|
||
summary = [f"{verb} 规则 {rule_id}", f"当前启用状态 {existing.enabled}"]
|
||
else:
|
||
raise GovernanceRuleError("UNSUPPORTED_ACTION", f"不支持的治理动作 {action}")
|
||
return harness.stage_confirmation(
|
||
session_id,
|
||
action,
|
||
params,
|
||
title=f"治理规则变更：{action.rsplit('.', 1)[-1]}",
|
||
summary_lines=summary,
|
||
)
|
||
|
||
def apply_confirmed_change(
|
||
self,
|
||
action: str,
|
||
params: dict[str, Any],
|
||
*,
|
||
actor: str,
|
||
confirm_id: str,
|
||
before_snapshot: str | None,
|
||
evidence_refs: Sequence[str] = (),
|
||
) -> dict[str, Any]:
|
||
confirmation = {
|
||
"confirmId": confirm_id,
|
||
"beforeSnapshot": before_snapshot,
|
||
"evidenceRefs": list(evidence_refs),
|
||
}
|
||
if action == "governance.rule.create":
|
||
return self.create_rule(dict(params.get("rule") or {}), actor=actor, confirmation=confirmation)
|
||
rule_id = str(params.get("ruleId") or "")
|
||
if action == "governance.rule.update":
|
||
return self.update_rule(
|
||
rule_id,
|
||
dict(params.get("patch") or {}),
|
||
actor=actor,
|
||
confirmation=confirmation,
|
||
)
|
||
if action == "governance.rule.delete":
|
||
return self.delete_rule(rule_id, actor=actor, confirmation=confirmation)
|
||
if action == "governance.rule.enable":
|
||
return self.set_enabled(rule_id, True, actor=actor, confirmation=confirmation)
|
||
if action == "governance.rule.disable":
|
||
return self.set_enabled(rule_id, False, actor=actor, confirmation=confirmation)
|
||
raise GovernanceRuleError("UNSUPPORTED_ACTION", f"不支持的治理动作 {action}")
|
||
|
||
def create_rule(
|
||
self,
|
||
payload: dict[str, Any],
|
||
*,
|
||
actor: str = "web",
|
||
confirmation: dict[str, Any] | None = None,
|
||
) -> dict[str, Any]:
|
||
scheduler = self._scheduler()
|
||
store = self._store()
|
||
raw = dict(payload or {})
|
||
rule_id = str(raw.get("ruleId") or "").strip()
|
||
if rule_id and not RULE_ID_PATTERN.fullmatch(rule_id):
|
||
self._audit_failure(
|
||
store, scheduler, actor=actor, action="governance.rule.create", rule_id=rule_id,
|
||
payload=raw, code="INVALID_RULE_ID",
|
||
message="ruleId 只能是字母数字开头，长度 1-128 的标识符",
|
||
)
|
||
raise GovernanceRuleError(
|
||
"INVALID_RULE_ID", "ruleId 只能是字母数字开头，长度 1-128 的标识符",
|
||
)
|
||
rule_id = rule_id or f"r-{uuid.uuid4().hex[:12]}"
|
||
raw["ruleId"] = rule_id
|
||
try:
|
||
rule = self._build_rule(raw)
|
||
if any(existing.rule_id == rule.rule_id for existing in scheduler.executor.registry.list()):
|
||
raise GovernanceRuleError("RULE_EXISTS", f"规则 {rule.rule_id} 已存在")
|
||
except GovernanceRuleError as exc:
|
||
self._audit_failure(
|
||
store, scheduler, actor=actor, action="governance.rule.create", rule_id=rule_id,
|
||
payload=raw, code=exc.code, message=str(exc),
|
||
)
|
||
raise
|
||
except (ValueError, TypeError, KeyError) as exc:
|
||
self._audit_failure(
|
||
store, scheduler, actor=actor, action="governance.rule.create", rule_id=rule_id,
|
||
payload=raw, code="INVALID_RULE", message=str(exc),
|
||
)
|
||
raise GovernanceRuleError("INVALID_RULE", str(exc)) from exc
|
||
def mutation() -> tuple[dict[str, Any], Rule, dict[str, Any]]:
|
||
try:
|
||
scheduler.executor.registry.register(rule)
|
||
except ValueError as exc:
|
||
raise GovernanceRuleError("RULE_EXISTS", f"规则 {rule.rule_id} 已存在") from exc
|
||
return self._rule_view(rule, scheduler), rule, {"rule": rule.as_dict()}
|
||
|
||
return self._commit_change(
|
||
store,
|
||
scheduler,
|
||
actor=actor,
|
||
action="governance.rule.create",
|
||
rule_id=rule.rule_id,
|
||
mutation=mutation,
|
||
confirmation=confirmation,
|
||
)
|
||
|
||
def update_rule(
|
||
self,
|
||
rule_id: str,
|
||
payload: dict[str, Any],
|
||
*,
|
||
actor: str = "web",
|
||
confirmation: dict[str, Any] | None = None,
|
||
) -> dict[str, Any]:
|
||
scheduler = self._scheduler()
|
||
store = self._store()
|
||
existing = self._require_rule(rule_id, scheduler)
|
||
raw = dict(payload or {})
|
||
provided_id = raw.get("ruleId")
|
||
if provided_id is not None and str(provided_id) != rule_id:
|
||
self._audit_failure(
|
||
store, scheduler, actor=actor, action="governance.rule.update", rule_id=rule_id,
|
||
payload=raw, code="RULE_ID_MISMATCH",
|
||
message="请求体 ruleId 必须与路径规则一致",
|
||
)
|
||
raise GovernanceRuleError("RULE_ID_MISMATCH", "请求体 ruleId 必须与路径规则一致")
|
||
merged = existing.as_dict()
|
||
merged.update({key: value for key, value in raw.items() if key != "ruleId"})
|
||
merged["ruleId"] = rule_id
|
||
try:
|
||
rule = self._build_rule(merged)
|
||
except (ValueError, TypeError, KeyError) as exc:
|
||
self._audit_failure(
|
||
store, scheduler, actor=actor, action="governance.rule.update", rule_id=rule_id,
|
||
payload=raw, code="INVALID_RULE", message=str(exc),
|
||
)
|
||
raise GovernanceRuleError("INVALID_RULE", str(exc)) from exc
|
||
def mutation() -> tuple[dict[str, Any], Rule, dict[str, Any]]:
|
||
scheduler.executor.registry.unregister(rule_id)
|
||
try:
|
||
scheduler.executor.registry.register(rule)
|
||
except (ValueError, TypeError) as exc:
|
||
raise GovernanceRuleError("RULE_CONFLICT", str(exc)) from exc
|
||
return (
|
||
self._rule_view(rule, scheduler),
|
||
rule,
|
||
{"before": existing.as_dict(), "after": rule.as_dict()},
|
||
)
|
||
|
||
return self._commit_change(
|
||
store,
|
||
scheduler,
|
||
actor=actor,
|
||
action="governance.rule.update",
|
||
rule_id=rule_id,
|
||
mutation=mutation,
|
||
confirmation=confirmation,
|
||
)
|
||
|
||
def delete_rule(
|
||
self,
|
||
rule_id: str,
|
||
*,
|
||
actor: str = "web",
|
||
confirmation: dict[str, Any] | None = None,
|
||
) -> dict[str, Any]:
|
||
scheduler = self._scheduler()
|
||
store = self._store()
|
||
rule = self._require_rule(rule_id, scheduler)
|
||
def mutation() -> tuple[dict[str, Any], Rule, dict[str, Any]]:
|
||
scheduler.executor.registry.unregister(rule_id)
|
||
scheduler.resume_rule(rule_id)
|
||
return {"deleted": True, "ruleId": rule_id}, rule, {"deleted": True}
|
||
|
||
return self._commit_change(
|
||
store,
|
||
scheduler,
|
||
actor=actor,
|
||
action="governance.rule.delete",
|
||
rule_id=rule_id,
|
||
mutation=mutation,
|
||
confirmation=confirmation,
|
||
)
|
||
|
||
def set_enabled(
|
||
self,
|
||
rule_id: str,
|
||
enabled: bool,
|
||
*,
|
||
actor: str = "web",
|
||
confirmation: dict[str, Any] | None = None,
|
||
) -> dict[str, Any]:
|
||
scheduler = self._scheduler()
|
||
store = self._store()
|
||
existing = self._require_rule(rule_id, scheduler)
|
||
if existing.enabled == enabled:
|
||
return self._rule_view(existing, scheduler)
|
||
rule = Rule.from_dict({**existing.as_dict(), "enabled": enabled})
|
||
try:
|
||
rule.validate()
|
||
except (ValueError, TypeError) as exc:
|
||
self._audit_failure(
|
||
store, scheduler, actor=actor,
|
||
action="governance.rule.enable" if enabled else "governance.rule.disable",
|
||
rule_id=rule_id, payload=existing.as_dict(),
|
||
code="INVALID_RULE", message=str(exc),
|
||
)
|
||
raise GovernanceRuleError("INVALID_RULE", str(exc)) from exc
|
||
action = "governance.rule.enable" if enabled else "governance.rule.disable"
|
||
|
||
def mutation() -> tuple[dict[str, Any], Rule, dict[str, Any]]:
|
||
scheduler.executor.registry.unregister(rule_id)
|
||
scheduler.executor.registry.register(rule)
|
||
return (
|
||
self._rule_view(rule, scheduler),
|
||
rule,
|
||
{
|
||
"before": {"enabled": existing.enabled},
|
||
"after": {"enabled": enabled},
|
||
},
|
||
)
|
||
|
||
return self._commit_change(
|
||
store,
|
||
scheduler,
|
||
actor=actor,
|
||
action=action,
|
||
rule_id=rule_id,
|
||
mutation=mutation,
|
||
confirmation=confirmation,
|
||
)
|
||
|
||
def rule_audit(self, rule_id: str, *, limit: int = 50) -> dict[str, Any]:
|
||
store = self._store()
|
||
events = [event for event in (store.data.get("auditEvents") or []) if _event_targets_rule(event, rule_id)]
|
||
return {
|
||
"ruleId": rule_id,
|
||
"total": len(events),
|
||
"events": events[-limit:],
|
||
}
|
||
|
||
# ---------------- 审计统计 ----------------
|
||
def audit_stats(
|
||
self,
|
||
*,
|
||
start_time: str | None = None,
|
||
end_time: str | None = None,
|
||
module: str | None = None,
|
||
action: str | None = None,
|
||
result: str | None = None,
|
||
granularity: str = "day",
|
||
) -> dict[str, Any]:
|
||
store = self._store()
|
||
from server.agent_core.audit_mirror import AuditMirror
|
||
|
||
mirror_events = AuditMirror(
|
||
getattr(store, "tenant_uuid", "platform") or "platform",
|
||
getattr(store, "world_key", "default") or "default",
|
||
).read_events()
|
||
if mirror_events:
|
||
events, source = mirror_events, "mirror"
|
||
else:
|
||
events, source = store.data.get("auditEvents") or [], "world"
|
||
stats = audit_stats(
|
||
events,
|
||
start_time=start_time,
|
||
end_time=end_time,
|
||
module=module,
|
||
action=action,
|
||
result=result,
|
||
granularity=granularity,
|
||
)
|
||
stats["source"] = source
|
||
return stats
|