Sync GovOPlaN module state

src/govoplan_audit/backend/retention.py

@@ -0,0 +1,74 @@
+from __future__ import annotations
+
+from collections.abc import Callable, Mapping
+from datetime import datetime, timedelta
+
+from sqlalchemy.orm import Session
+
+from govoplan_audit.backend.db.models import AuditLog
+from govoplan_audit.backend.recording import _record_ref
+from govoplan_core.core.access import AuditRecordRef, AuditRetentionProvider
+
+
+class SqlAuditRetentionProvider(AuditRetentionProvider):
+    def apply_detail_retention(
+        self,
+        session: object,
+        *,
+        dry_run: bool,
+        now: datetime,
+        policy_for_record: Callable[[AuditRecordRef], object],
+    ) -> Mapping[str, int]:
+        db = _session(session)
+        result = {"eligible": 0, "redacted": 0, "already_redacted": 0}
+        items = db.query(AuditLog).order_by(AuditLog.created_at.asc()).all()
+        for item in items:
+            policy = policy_for_record(_record_ref(item))
+            cutoff = _cutoff(getattr(policy, "audit_detail_retention_days", None), now=now)
+            if not _is_before_cutoff(item.created_at, cutoff):
+                continue
+            details = item.details if isinstance(item.details, dict) else {}
+            if details.get("_retention", {}).get("audit_detail_redacted"):
+                result["already_redacted"] += 1
+                continue
+            result["eligible"] += 1
+            if dry_run:
+                continue
+            item.details = {
+                "_retention": {
+                    "audit_detail_redacted": True,
+                    "redacted_at": now.isoformat(),
+                    "original_detail_sha256": _json_sha256(details),
+                }
+            }
+            db.add(item)
+            result["redacted"] += 1
+        return result
+
+
+def _cutoff(days: int | None, *, now: datetime) -> datetime | None:
+    if days is None:
+        return None
+    return now - timedelta(days=days)
+
+
+def _is_before_cutoff(value: datetime | None, cutoff: datetime | None) -> bool:
+    if value is None or cutoff is None:
+        return False
+    candidate = value
+    if candidate.tzinfo is None:
+        candidate = candidate.replace(tzinfo=cutoff.tzinfo)
+    return candidate < cutoff
+
+
+def _json_sha256(value: object) -> str:
+    import hashlib
+    import json
+
+    return hashlib.sha256(json.dumps(value, sort_keys=True, default=str).encode("utf-8")).hexdigest()
+
+
+def _session(session: object) -> Session:
+    if not isinstance(session, Session):
+        raise TypeError("Audit retention requires a SQLAlchemy Session")
+    return session