Janady13/missionmatch / cmd/fairness-snapshot/main.go

Source identity

Field	Recorded value
Source type	GitHub source
Original record	Janady13/missionmatch / cmd/fairness-snapshot/main.go
Date	Not specified in source
Repository	Janady13/missionmatch
Revision	1e9249840a4302ec82e123b9c9cb6f75badea3e4
Branch	master
Path or archive member	cmd/fairness-snapshot/main.go
Original SHA-256	894c95fbfa37e0a558a00fc2fd0192fd1a64eb6a25abdf64a966473a4bfc7404
Git blob SHA	93f30d33348041aeb24ce9bf4fc201eb6afe5619
Reading-copy SHA-256	894c95fbfa37e0a558a00fc2fd0192fd1a64eb6a25abdf64a966473a4bfc7404

Original source ↗

Every recorded occurrence

These 21 records contain identical original source bytes. Their paths and revisions remain part of the archive.

Original record	Branch or archive	Revision / identifier	Original location
Janady13/missionmatch / cmd/fairness-snapshot/main.go	master	1e9249840a4302ec82e123b9c9cb6f75badea3e4	Open original
Janady13/missionmatch / cmd/fairness-snapshot/main.go	feature/aioe-upgrade	2178e7298d0e5d9af83afa12402fd587f0ba6ed8	Open original
Janady13/missionmatch / cmd/fairness-snapshot/main.go	m5-price-to-win	41000ad30fff4129fdaf5ec84e15ba14c27d4890	Open original
Janady13/missionmatch / cmd/fairness-snapshot/main.go	collision-deconfliction	4ee5a09972608ed89f8377c6665542d5f450f0a6	Open original
Janady13/missionmatch / cmd/fairness-snapshot/main.go	graphrag-foundation	b0ddeb9f633fd138d09309d1a17b7d13bc3a67f7	Open original
Janady13/missionmatch / cmd/fairness-snapshot/main.go	time-to-fill-survival	b66e1e505863d4f17741a4b9ede73509e45bd6c6	Open original
Janady13/missionmatch / cmd/fairness-snapshot/main.go	mag-substrate	b82c7100a492dec67dfd1eda6b3f53def859be35	Open original
Janady13/missionmatch / cmd/fairness-snapshot/main.go	capture-readiness	bae6af7cb2997e819174a9e9cfff5e16067a1975	Open original
Janady13/missionmatch / cmd/fairness-snapshot/main.go	phase2-connectors	e038d4c687aec16f8bd9bc4d907eea14d91f8704	Open original
Janady13/missionmatch / cmd/fairness-snapshot/main.go	presentation-readiness	eb574acaa29d71ce4d0f852572e87c275c79fdb7	Open original
Janady13/missionmatch / cmd/fairness-snapshot/main.go	vendor-intelligence	fe9796a19c261951d3f2565206c0c1b5ac294465	Open original
Janady13/missionmatch / cmd/fairness-snapshot/main.go	collision-deconfliction	4ee5a09972608ed89f8377c6665542d5f450f0a6	Open original
Janady13/missionmatch / cmd/fairness-snapshot/main.go	m5-price-to-win	41000ad30fff4129fdaf5ec84e15ba14c27d4890	Open original
Janady13/missionmatch / cmd/fairness-snapshot/main.go	master	1e9249840a4302ec82e123b9c9cb6f75badea3e4	Open original
Janady13/missionmatch / cmd/fairness-snapshot/main.go	mag-substrate	b82c7100a492dec67dfd1eda6b3f53def859be35	Open original
Janady13/missionmatch / cmd/fairness-snapshot/main.go	time-to-fill-survival	b66e1e505863d4f17741a4b9ede73509e45bd6c6	Open original
Janady13/missionmatch / cmd/fairness-snapshot/main.go	graphrag-foundation	b0ddeb9f633fd138d09309d1a17b7d13bc3a67f7	Open original
Janady13/missionmatch / cmd/fairness-snapshot/main.go	presentation-readiness	eb574acaa29d71ce4d0f852572e87c275c79fdb7	Open original
Janady13/missionmatch / cmd/fairness-snapshot/main.go	phase2-connectors	e038d4c687aec16f8bd9bc4d907eea14d91f8704	Open original
Janady13/missionmatch / cmd/fairness-snapshot/main.go	feature/aioe-upgrade	2178e7298d0e5d9af83afa12402fd587f0ba6ed8	Open original
Janady13/missionmatch / cmd/fairness-snapshot/main.go	capture-readiness	bae6af7cb2997e819174a9e9cfff5e16067a1975	Open original

Recovered source transcript

Download complete source text ↓139 lines · 5.6 KB

// Command fairness-snapshot appends the continuous adverse impact four fifths time series. For each
// organization (or a single passed org), it computes the current adverse impact report and APPENDS one
// eeo.fairness_snapshots row per demographic group bucket, stamping the AEDT model version in force.
// Run on a schedule (a cron, the same way mm-opp-sync runs), it builds the time series that proves on
// every release the platform is not drifting into disparate impact. It is append only and safe to rerun.
//
// Isolation: this job runs as the COMPLIANCE role, the ONLY role granted the eeo schema. The application
// role and the AI path get nothing. When no -org is passed, the orgs to snapshot are enumerated from the
// distinct organization_id values in audit_logs, which is outside RLS and granted to the compliance role,
// so the job needs no cross org read of the tenant data. Each snapshot then runs inside a tenant
// transaction, so RLS scopes the report join and the snapshot insert to that one org.
//
// Output is GROUP LEVEL AGGREGATE only: orgs snapshotted, group rows written, and any below threshold
// count. No individual PII is read, computed, or printed.
//
// Env (server side only): MM_COMPLIANCE_DATABASE_URL (the compliance DSN, NOBYPASSRLS, required).
// Flags: -org (optional, a single organization uuid; default is every org with AEDT activity).
//
// Build and run FIPS validated: CGO_ENABLED=0 GOFIPS140=v1.0.0 go build, run with GODEBUG=fips140=on.
package main

import (
	"context"
	"crypto/fips140"
	"crypto/pbkdf2"
	"crypto/sha256"
	"errors"
	"flag"
	"log"
	"os"
	"strings"
	"time"

	"github.com/google/uuid"
	"github.com/jackc/pgx/v5/pgxpool"

	"github.com/missionworkforce/missionmatch/internal/modules/eeo"
	"github.com/missionworkforce/missionmatch/internal/platform/database"
	"github.com/missionworkforce/missionmatch/internal/platform/tenant"
)

func main() {
	orgFlag := flag.String("org", "", "snapshot a single organization uuid (default: every org with AEDT activity)")
	flag.Parse()

	// FIPS self test: derive one PBKDF2 key under the active crypto module and fail closed if it errors,
	// so a build that dropped the validated module is caught at boot, the same in build FIPS gate the api
	// and import-bench binaries use.
	if err := fipsSelfTest(); err != nil {
		log.Fatalf("fairness-snapshot: FIPS self test (PBKDF2 HMAC SHA 256) failed: %v", err)
	}
	log.Printf("fairness-snapshot: fips_enabled=%v module=%s", fips140.Enabled(), fips140.Version())

	dsn := strings.TrimSpace(os.Getenv("MM_COMPLIANCE_DATABASE_URL"))
	if dsn == "" {
		log.Fatal("fairness-snapshot: set MM_COMPLIANCE_DATABASE_URL (the compliance role DSN, the only path to the eeo schema)")
	}

	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Minute)
	defer cancel()

	pool, err := database.NewPool(ctx, dsn)
	if err != nil {
		log.Fatalf("fairness-snapshot: connect: %v", err)
	}
	defer pool.Close()

	// Fail closed unless this is the NOBYPASSRLS compliance role. A BYPASSRLS DSN here would let the
	// report join and the snapshot insert escape RLS and mix demographics across orgs.
	if err := database.AssertRole(ctx, pool, "missionmatch_compliance"); err != nil {
		log.Fatalf("fairness-snapshot: compliance pool role check: %v", err)
	}

	svc := eeo.NewService(tenant.New(pool))

	orgs, err := resolveOrgs(ctx, pool, *orgFlag)
	if err != nil {
		log.Fatalf("fairness-snapshot: resolve orgs: %v", err)
	}
	if len(orgs) == 0 {
		log.Print("fairness-snapshot: no organizations to snapshot")
		return
	}

	now := time.Now().UTC()
	var snapshotted, totalGroups, totalBelow int
	for _, org := range orgs {
		sum, serr := svc.SnapshotAdverseImpact(tenant.WithOrg(ctx, org.String()), now)
		if serr != nil {
			// One org failing must not abort the schedule for the rest. Log the org id (not PII) and move on.
			log.Printf("fairness-snapshot: org %s snapshot failed: %v", org, serr)
			continue
		}
		snapshotted++
		totalGroups += sum.GroupsWritten
		totalBelow += sum.BelowThreshold
		log.Printf("fairness-snapshot: org %s snapshotted %d groups, %d below threshold, model %s",
			org, sum.GroupsWritten, sum.BelowThreshold, sum.ModelVersion)
	}
	log.Printf("fairness-snapshot: done, %d orgs snapshotted, %d group rows written, %d below the 0.80 threshold",
		snapshotted, totalGroups, totalBelow)
}

// resolveOrgs returns the orgs to snapshot. A passed -org is used verbatim (after validation). Otherwise
// the orgs are the distinct non null organization_id values in audit_logs, which is OUTSIDE RLS and
// granted to the compliance role, so the job enumerates the orgs with AEDT activity without a cross org
// read of any tenant scoped table.
func resolveOrgs(ctx context.Context, pool *pgxpool.Pool, orgFlag string) ([]uuid.UUID, error) {
	if s := strings.TrimSpace(orgFlag); s != "" {
		id, err := uuid.Parse(s)
		if err != nil {
			return nil, errors.New("fairness-snapshot: -org is not a valid uuid: " + s)
		}
		return []uuid.UUID{id}, nil
	}
	rows, err := pool.Query(ctx,
		`SELECT DISTINCT organization_id FROM audit_logs WHERE organization_id IS NOT NULL ORDER BY organization_id`)
	if err != nil {
		return nil, err
	}
	defer rows.Close()
	var out []uuid.UUID
	for rows.Next() {
		var id uuid.UUID
		if e := rows.Scan(&id); e != nil {
			return nil, e
		}
		out = append(out, id)
	}
	return out, rows.Err()
}

// fipsSelfTest derives one PBKDF2 HMAC SHA 256 key at a representative cost under the active crypto
// module. It fails closed if the module is absent or errors, so a non FIPS build is caught at boot.
func fipsSelfTest() error {
	_, err := pbkdf2.Key(sha256.New, "fairness-snapshot-self-test", []byte("fairness-snapshot-salt"), 600000, 32)
	return err
}