ai-contract-platform/backend/app/api/review_rules.py

from typing import Optional

from fastapi import APIRouter, Depends, Form, Header
from sqlalchemy.orm import Session

from app.core.response import success_response
from app.db import get_db_session
from app.services.audit_log_service import AuditLogService
from app.services.auth_service import AuthService
from app.services.review_rule_service import ReviewRuleService

router = APIRouter(prefix="/review-rules", tags=["review-rules"])
ROUTE_PERMISSION_SCOPE = "review_rule_management"
ROUTE_PERMISSION_ACTIONS = {
    "list": "review_rules:list",
    "create": "review_rules:create",
    "update": "review_rules:update",
    "update_status": "review_rules:update_status",
    "publish": "review_rules:publish",
    "unpublish": "review_rules:unpublish",
    "rollback": "review_rules:rollback",
    "delete": "review_rules:delete",
}


def get_review_rule_service(db: Session = Depends(get_db_session)) -> ReviewRuleService:
    return ReviewRuleService(db)


def get_audit_log_service(db: Session = Depends(get_db_session)) -> AuditLogService:
    return AuditLogService(db)


def require_current_user(
    authorization: Optional[str] = Header(default=None),
    db: Session = Depends(get_db_session),
):
    return AuthService(db).require_current_user(authorization)


@router.get("")
def list_review_rules(
    page: int = 1,
    page_size: int = 20,
    review_rule_service: ReviewRuleService = Depends(get_review_rule_service),
    current_user: dict = Depends(require_current_user),
):
    return success_response(review_rule_service.list_rules(current_user, page, page_size))


@router.post("")
def create_review_rule(
    name: str = Form(...),
    rule_code: Optional[str] = Form(default=None),
    keyword: str = Form(...),
    contract_type: str = Form(default="all"),
    risk_level: str = Form(...),
    description: str = Form(...),
    suggestion: Optional[str] = Form(default=None),
    legal_basis: Optional[str] = Form(default=None),
    is_active: bool = Form(default=True),
    review_rule_service: ReviewRuleService = Depends(get_review_rule_service),
    audit_log_service: AuditLogService = Depends(get_audit_log_service),
    current_user: dict = Depends(require_current_user),
):
    result = review_rule_service.create_rule(
        current_user,
        name,
        keyword,
        contract_type,
        risk_level,
        description,
        suggestion,
        legal_basis,
        is_active,
        rule_code=rule_code,
    )
    audit_log_service.record_event(
        tenant_id=current_user.get("tenant_id"),
        user_id=current_user.get("id"),
        action="create_review_rule",
        resource_type="review_rule",
        resource_id=result["id"],
        detail_json={
            "name": result["name"],
            "rule_code": result.get("rule_code"),
            "keyword": result["keyword"],
            "contract_type": result["contract_type"],
            "risk_level": result["risk_level"],
            "is_active": result["is_active"],
        },
    )
    return success_response(result)


@router.put("/{rule_id}")
def update_review_rule(
    rule_id: str,
    name: str = Form(...),
    rule_code: Optional[str] = Form(default=None),
    keyword: str = Form(...),
    contract_type: str = Form(default="all"),
    risk_level: str = Form(...),
    description: str = Form(...),
    suggestion: Optional[str] = Form(default=None),
    legal_basis: Optional[str] = Form(default=None),
    is_active: bool = Form(default=True),
    review_rule_service: ReviewRuleService = Depends(get_review_rule_service),
    audit_log_service: AuditLogService = Depends(get_audit_log_service),
    current_user: dict = Depends(require_current_user),
):
    result = review_rule_service.update_rule(
        current_user,
        rule_id,
        name,
        keyword,
        contract_type,
        risk_level,
        description,
        suggestion,
        legal_basis,
        is_active,
        rule_code=rule_code,
    )
    audit_log_service.record_event(
        tenant_id=current_user.get("tenant_id"),
        user_id=current_user.get("id"),
        action="update_review_rule",
        resource_type="review_rule",
        resource_id=result["id"],
        detail_json={
            "name": result["name"],
            "rule_code": result.get("rule_code"),
            "keyword": result["keyword"],
            "contract_type": result["contract_type"],
            "risk_level": result["risk_level"],
            "is_active": result["is_active"],
        },
    )
    return success_response(result)


@router.patch("/{rule_id}/status")
def update_review_rule_status(
    rule_id: str,
    is_active: bool = Form(...),
    review_rule_service: ReviewRuleService = Depends(get_review_rule_service),
    audit_log_service: AuditLogService = Depends(get_audit_log_service),
    current_user: dict = Depends(require_current_user),
):
    result = review_rule_service.update_rule_status(current_user, rule_id, is_active)
    audit_log_service.record_event(
        tenant_id=current_user.get("tenant_id"),
        user_id=current_user.get("id"),
        action="update_review_rule_status",
        resource_type="review_rule",
        resource_id=result["id"],
        detail_json={
            "name": result["name"],
            "keyword": result["keyword"],
            "is_active": result["is_active"],
        },
    )
    return success_response(result)


@router.post("/{rule_id}/publish")
def publish_review_rule(
    rule_id: str,
    review_rule_service: ReviewRuleService = Depends(get_review_rule_service),
    audit_log_service: AuditLogService = Depends(get_audit_log_service),
    current_user: dict = Depends(require_current_user),
):
    result = review_rule_service.publish_rule(current_user, rule_id)
    audit_log_service.record_event(
        tenant_id=current_user.get("tenant_id"),
        user_id=current_user.get("id"),
        action="publish_review_rule",
        resource_type="review_rule",
        resource_id=result["id"],
        detail_json={
            "name": result["name"],
            "rule_code": result.get("rule_code"),
            "published_at": result.get("published_at"),
            "latest_governance_asset_id": result.get("latest_governance_asset_id"),
        },
    )
    return success_response(result)


@router.post("/{rule_id}/unpublish")
def unpublish_review_rule(
    rule_id: str,
    review_rule_service: ReviewRuleService = Depends(get_review_rule_service),
    audit_log_service: AuditLogService = Depends(get_audit_log_service),
    current_user: dict = Depends(require_current_user),
):
    result = review_rule_service.unpublish_rule(current_user, rule_id)
    audit_log_service.record_event(
        tenant_id=current_user.get("tenant_id"),
        user_id=current_user.get("id"),
        action="unpublish_review_rule",
        resource_type="review_rule",
        resource_id=result["id"],
        detail_json={
            "name": result["name"],
            "rule_code": result.get("rule_code"),
        },
    )
    return success_response(result)


@router.post("/{rule_id}/rollback")
def rollback_review_rule(
    rule_id: str,
    target_version_label: str = Form(...),
    change_summary: Optional[str] = Form(default=None),
    review_rule_service: ReviewRuleService = Depends(get_review_rule_service),
    audit_log_service: AuditLogService = Depends(get_audit_log_service),
    current_user: dict = Depends(require_current_user),
):
    result = review_rule_service.rollback_rule(current_user, rule_id, target_version_label, change_summary)
    audit_log_service.record_event(
        tenant_id=current_user.get("tenant_id"),
        user_id=current_user.get("id"),
        action="rollback_review_rule",
        resource_type="review_rule",
        resource_id=result["id"],
        detail_json={
            "name": result["name"],
            "rule_code": result.get("rule_code"),
            "target_version_label": target_version_label,
            "current_version_label": result.get("current_version_label"),
        },
    )
    return success_response(result)


@router.delete("/{rule_id}")
def delete_review_rule(
    rule_id: str,
    review_rule_service: ReviewRuleService = Depends(get_review_rule_service),
    audit_log_service: AuditLogService = Depends(get_audit_log_service),
    current_user: dict = Depends(require_current_user),
):
    result = review_rule_service.delete_rule(current_user, rule_id)
    audit_log_service.record_event(
        tenant_id=current_user.get("tenant_id"),
        user_id=current_user.get("id"),
        action="delete_review_rule",
        resource_type="review_rule",
        resource_id=rule_id,
        detail_json={
            "name": result["name"],
            "keyword": result["keyword"],
            "contract_type": result["contract_type"],
            "risk_level": result["risk_level"],
            "is_active": result["is_active"],
        },
    )
    return success_response(result)