Janady13/missionmatch / cmd/demo-seed/main.go

1// Command demo-seed populates REAL engine backed screenMATCH evaluations for the demo org so the 2// Command Center WhoCanSupport panel and the Candidates Win Impact panel are not empty. For each 3// requirement in the org it screens a capped set of candidates through the existing 4// matching.Service.ScreenCandidate, which scores with the frozen engine.ScoreCandidate, writes a 5// served score audit event, and upserts a candidate_evaluations row. That is the ONLY correct way to 6// produce an evaluation: this tool never fabricates a score and never inserts a candidate_evaluations 7// row directly. 8// 9// It runs entirely under the NOBYPASSRLS application role, inside the tenant transaction that 10// ScreenCandidate opens (RLS scoped to the org set on the context via tenant.WithOrg). ScreenCandidate 11// upserts the latest qualification per candidate and requirement pair, so a rerun is safe and 12// idempotent. 13// 14// Env: MM_DATABASE_URL (the app DSN, required), MM_DEMO_ORG_ID (optional, overrides the default demo 15// org, itself overridable by the -org flag). Flags let you cap how many candidates are screened per 16// requirement, cap how many requirements are processed, and preview with -dry-run. 17package main 18 19import ( 20 "context" 21 "flag" 22 "fmt" 23 "log" 24 "os" 25 "sort" 26 "strings" 27 "time" 28 29 "github.com/google/uuid" 30 31 "github.com/missionworkforce/missionmatch/internal/modules/matching" 32 "github.com/missionworkforce/missionmatch/internal/modules/matching/engine" 33 "github.com/missionworkforce/missionmatch/internal/platform/audit" 34 "github.com/missionworkforce/missionmatch/internal/platform/database" 35 "github.com/missionworkforce/missionmatch/internal/platform/database/dbgen" 36 "github.com/missionworkforce/missionmatch/internal/platform/tenant" 37) 38 39// defaultOrg is the sales demo organization id. It is the same fixed id the other demo tooling uses. 40const defaultOrg = "11111111-1111-1111-1111-111111111111" 41 42// listPageLimit bounds a single ListRequirements or ListCandidates read. The demo org is small, so one 43// page covers it; the cap keeps the tool honest against a large org too. 44const listPageLimit = 500 45 46// bandCounts is the green, yellow, and red tally for one requirement, read from the engine returned 47// MatchResult band. The engine is the only source of a band; this only counts what it returned. 48type bandCounts struct { 49 green, yellow, red int 50} 51 52func (b bandCounts) total() int { return b.green + b.yellow + b.red } 53 54func main() { 55 orgFlag := flag.String("org", firstNonEmpty(os.Getenv("MM_DEMO_ORG_ID"), defaultOrg), 56 "organization id to seed (defaults to MM_DEMO_ORG_ID or the demo org)") 57 perRequirement := flag.Int("per-requirement", 40, 58 "cap on how many candidates to screen against each requirement") 59 maxRequirements := flag.Int("max-requirements", 0, 60 "cap on how many requirements to process (0 means all)") 61 dryRun := flag.Bool("dry-run", false, 62 "log what would be screened without writing any evaluation or audit row") 63 flag.Parse() 64 65 if *perRequirement <= 0 { 66 log.Fatal("demo-seed: -per-requirement must be positive") 67 } 68 if *maxRequirements < 0 { 69 log.Fatal("demo-seed: -max-requirements cannot be negative") 70 } 71 72 orgID, err := uuid.Parse(strings.TrimSpace(*orgFlag)) 73 if err != nil { 74 log.Fatalf("demo-seed: bad org id %q: %v", *orgFlag, err) 75 } 76 77 dsn := strings.TrimSpace(os.Getenv("MM_DATABASE_URL")) 78 if dsn == "" { 79 log.Fatal("demo-seed: MM_DATABASE_URL (the app DSN) is required") 80 } 81 82 ctx, cancel := context.WithTimeout(context.Background(), 30*time.Minute) 83 defer cancel() 84 85 pool, err := database.NewPool(ctx, dsn) 86 if err != nil { 87 log.Fatalf("demo-seed: db pool: %v", err) 88 } 89 defer pool.Close() 90 // Fail closed unless this is the NOBYPASSRLS app role, so the seed can never bypass tenant RLS and 91 // can only write the demo org it is scoped to. ScreenCandidate itself runs under RLS. 92 if err := database.AssertRole(ctx, pool, "missionmatch_app"); err != nil { 93 log.Fatalf("demo-seed: app pool role check: %v", err) 94 } 95 96 appDB := tenant.New(pool) 97 98 // The service is built with a nil matcher (exact match only, deterministic, no embedding provider 99 // needed) and a real audit writer so every served score is recorded, the same served score audit the 100 // live screenMATCH path writes. The nil matcher matches how the integration tests construct the 101 // service, matching.NewService(appDB, nil, nil), and keeps the run reproducible with no plane calls. 102 // The engine.ScoreCandidate reached through ScreenCandidate is the only scorer. 103 var aud *audit.Writer 104 if !*dryRun { 105 aud = audit.New(appDB) 106 } 107 svc := matching.NewService(appDB, nil, aud) 108 109 // Scope every read and write to the demo org. RunInTenantTx inside the service refuses to run without 110 // this, and the RLS policy would match zero rows, so this is the correctness boundary for the seed. 111 orgCtx := tenant.WithOrg(ctx, orgID.String()) 112 113 reqs, err := svc.ListRequirements(orgCtx, listPageLimit, 0) 114 if err != nil { 115 log.Fatalf("demo-seed: list requirements for org %s: %v", orgID, err) 116 } 117 if len(reqs) == 0 { 118 log.Fatalf("demo-seed: org %s has no requirements to seed", orgID) 119 } 120 if *maxRequirements > 0 && len(reqs) > *maxRequirements { 121 reqs = reqs[:*maxRequirements] 122 } 123 124 // Load the candidate pool once: it is the same set for every requirement, so one read avoids a 125 // per requirement round trip. ListCandidates already excludes soft deleted rows; anonymized rows are 126 // filtered here so an erased candidate is never rescreened. 127 cands, err := svc.ListCandidates(orgCtx, listPageLimit, 0) 128 if err != nil { 129 log.Fatalf("demo-seed: list candidates for org %s: %v", orgID, err) 130 } 131 cands = screenable(cands) 132 if len(cands) == 0 { 133 log.Fatalf("demo-seed: org %s has no screenable candidates", orgID) 134 } 135 if len(cands) > *perRequirement { 136 cands = cands[:*perRequirement] 137 } 138 139 log.Printf("demo-seed: org=%s requirements=%d candidates_per_requirement=%d dry_run=%v", 140 orgID, len(reqs), len(cands), *dryRun) 141 142 perReq := make(map[uuid.UUID]bandCounts, len(reqs)) 143 reqTitle := make(map[uuid.UUID]string, len(reqs)) 144 var totalWritten, totalErrors int 145 146 for _, r := range reqs { 147 reqTitle[r.ID] = r.Title 148 if *dryRun { 149 log.Printf("demo-seed: [dry run] would screen %d candidates against requirement %s (%q)", 150 len(cands), r.ID, r.Title) 151 continue 152 } 153 154 var counts bandCounts 155 for _, c := range cands { 156 res, serr := svc.ScreenCandidate(orgCtx, c.ID, r.ID) 157 if serr != nil { 158 // A single candidate screen failure must not abort the whole run. Log it, wrapped with %w, and 159 // keep going so a bad row does not deny the rest of the panel its evaluations. 160 totalErrors++ 161 log.Printf("demo-seed: %v", fmt.Errorf("screen candidate %s vs requirement %s: %w", c.ID, r.ID, serr)) 162 continue 163 } 164 tallyBand(&counts, res.Band) 165 totalWritten++ 166 } 167 perReq[r.ID] = counts 168 log.Printf("demo-seed: requirement %s (%q): screened %d, green=%d yellow=%d red=%d", 169 r.ID, r.Title, counts.total(), counts.green, counts.yellow, counts.red) 170 } 171 172 if *dryRun { 173 log.Printf("demo-seed: [dry run] complete, would have screened %d candidates across %d requirements", 174 len(cands)*len(reqs), len(reqs)) 175 return 176 } 177 178 // Final summary: total evaluations written and the green, yellow, red counts per requirement, ordered 179 // by requirement id so the report is stable across runs. 180 log.Printf("demo-seed: DONE, wrote %d evaluations across %d requirements (%d screen errors)", 181 totalWritten, len(reqs), totalErrors) 182 ids := make([]uuid.UUID, 0, len(perReq)) 183 for id := range perReq { 184 ids = append(ids, id) 185 } 186 sort.Slice(ids, func(i, j int) bool { return ids[i].String() < ids[j].String() }) 187 for _, id := range ids { 188 c := perReq[id] 189 log.Printf("demo-seed: summary requirement %s (%q): green=%d yellow=%d red=%d total=%d", 190 id, reqTitle[id], c.green, c.yellow, c.red, c.total()) 191 } 192} 193 194// screenable drops anonymized candidates from the pool. ListCandidates already excludes soft deleted 195// rows (deleted_at IS NULL). An anonymized row is an erased candidate that should never be rescreened, 196// so it is filtered here to keep the served scores clean. 197func screenable(in []dbgen.Candidate) []dbgen.Candidate { 198 out := in[:0:0] 199 for _, c := range in { 200 if c.AnonymizedAt != nil { 201 continue 202 } 203 out = append(out, c) 204 } 205 return out 206} 207 208// tallyBand increments the count for the band the engine returned. The band is authoritative from the 209// engine MatchResult; this only records it. 210func tallyBand(counts *bandCounts, b engine.Band) { 211 switch b { 212 case engine.BandGreen: 213 counts.green++ 214 case engine.BandYellow: 215 counts.yellow++ 216 case engine.BandRed: 217 counts.red++ 218 } 219} 220 221func firstNonEmpty(vals ...string) string { 222 for _, v := range vals { 223 if s := strings.TrimSpace(v); s != "" { 224 return s 225 } 226 } 227 return "" 228} 229