Janady13/missionmatch / internal/modules/sourcing/service.go

1package sourcing 2 3import ( 4 "context" 5 "errors" 6 "fmt" 7 "time" 8 9 "github.com/google/uuid" 10 "github.com/jackc/pgx/v5" 11 12 "github.com/missionworkforce/missionmatch/internal/platform/audit" 13 "github.com/missionworkforce/missionmatch/internal/platform/database/dbgen" 14 "github.com/missionworkforce/missionmatch/internal/platform/tenant" 15) 16 17// ErrNoDatabase is returned when no pool is configured. ErrNotFound when a delete matches nothing. 18var ( 19 ErrNoDatabase = errors.New("sourcing: no database configured") 20 ErrNotFound = errors.New("sourcing: external candidate not found") 21) 22 23const listLimit = 200 24 25// Service reads externally sourced candidates and the compliance log, and deletes sourced records. 26type Service struct { 27 db *tenant.DB 28 aud *audit.Writer 29} 30 31// NewService builds the service. db may be nil (then calls return ErrNoDatabase). The audit writer 32// records the PII view and erasure events on the same tenant transaction as the work. 33func NewService(db *tenant.DB, aud *audit.Writer) *Service { return &Service{db: db, aud: aud} } 34 35// ListExternal returns the org's externally sourced candidates. 36func (s *Service) ListExternal(ctx context.Context) ([]ExternalCandidate, error) { 37 if s.db == nil { 38 return nil, ErrNoDatabase 39 } 40 var out []ExternalCandidate 41 err := s.db.RunInTenantTx(ctx, func(ctx context.Context, tx pgx.Tx) error { 42 rows, err := dbgen.New(tx).ListExternalCandidates(ctx, listLimit) 43 if err != nil { 44 return err 45 } 46 out = make([]ExternalCandidate, 0, len(rows)) 47 for _, r := range rows { 48 out = append(out, ExternalCandidate{ 49 ID: r.ID.String(), 50 FullName: r.FullName, 51 Email: deref(r.Email), 52 Headline: deref(r.Headline), 53 Location: deref(r.Location), 54 YearsExperience: int(r.YearsExperience), 55 Available: r.Available, 56 ExternalID: deref(r.ExternalID), 57 Source: "External", 58 Clearance: "Unknown", 59 CreatedAt: r.CreatedAt.Format(time.RFC3339), 60 }) 61 } 62 // Viewing externally sourced candidates surfaces contact PII, so record the access. 63 return s.audit(ctx, tx, audit.Event{Action: "candidate.pii.view", EntityType: "sourcing", NewValues: countJSON(len(out))}) 64 }) 65 return out, err 66} 67 68func countJSON(n int) []byte { 69 return []byte(fmt.Sprintf(`{"count":%d}`, n)) 70} 71 72// Log returns the org's sourcing compliance log. 73func (s *Service) Log(ctx context.Context) ([]SourcingLogEntry, error) { 74 if s.db == nil { 75 return nil, ErrNoDatabase 76 } 77 var out []SourcingLogEntry 78 err := s.db.RunInTenantTx(ctx, func(ctx context.Context, tx pgx.Tx) error { 79 rows, err := dbgen.New(tx).ListSourcingLog(ctx, listLimit) 80 if err != nil { 81 return err 82 } 83 out = make([]SourcingLogEntry, 0, len(rows)) 84 for _, r := range rows { 85 cid := "" 86 if r.CandidateID != nil { 87 cid = r.CandidateID.String() 88 } 89 out = append(out, SourcingLogEntry{ 90 ID: r.ID.String(), 91 CandidateID: cid, 92 ExternalID: r.ExternalID, 93 Source: r.Source, 94 Provider: r.Provider, 95 Query: r.Query, 96 LegalBasis: r.LegalBasis, 97 CollectedAt: r.CollectedAt.Format(time.RFC3339), 98 }) 99 } 100 return nil 101 }) 102 return out, err 103} 104 105// Delete hard deletes a sourced candidate (removing the personal data) and detaches its compliance row 106// so the audit that a record was collected and then deleted is retained without the personal data. 107func (s *Service) Delete(ctx context.Context, id uuid.UUID) error { 108 if s.db == nil { 109 return ErrNoDatabase 110 } 111 return s.db.RunInTenantTx(ctx, func(ctx context.Context, tx pgx.Tx) error { 112 q := dbgen.New(tx) 113 // Detach the compliance log so the audit that a record was collected survives without the 114 // candidate link. 115 if err := q.DetachSourcingLog(ctx, &id); err != nil { 116 return err 117 } 118 // Anonymize in place rather than hard delete: the PII is wiped but the de identified scored 119 // outcomes (slate_members) and the demographic bucket are KEPT for the adverse impact record, so 120 // erasure does not destroy the AEDT decision history. Once the name, email, contact, and resume 121 // vector are gone the person is no longer identifiable. 122 rows, err := q.AnonymizeCandidate(ctx, id) 123 if err != nil { 124 return err 125 } 126 if rows == 0 { 127 // Distinguish an already anonymized candidate (idempotent success) from one that does not 128 // exist in this org (not found). 129 if _, gerr := q.GetCandidate(ctx, id); errors.Is(gerr, pgx.ErrNoRows) { 130 return ErrNotFound 131 } 132 return nil 133 } 134 // Purge the qualification detail too (skills, certifications, customer agency experience) so no 135 // child PII survives the erasure. The frozen scored outcomes in slate_members are untouched. 136 if err := purgeCandidateChildData(ctx, tx, id); err != nil { 137 return err 138 } 139 // Wipe any AI memory about this candidate so erasure leaves no semantic trace in the AI layer 140 // (the same intent as nulling the resume vector). ai_memory is RLS scoped, so this is org bounded. 141 if _, err := tx.Exec(ctx, "DELETE FROM ai_memory WHERE candidate_id = $1", id); err != nil { 142 return err 143 } 144 // Remove the candidate's W3 staffing recommendations too. Anonymize keeps the candidate row and its 145 // frozen evaluations, so the FK cascade does not fire; this is the explicit cleanup, like ai_memory. 146 if err := q.DeleteRecommendationsForCandidate(ctx, &id); err != nil { 147 return err 148 } 149 return s.audit(ctx, tx, audit.Event{Action: "privacy.candidate.anonymized", EntityType: "candidate", EntityID: id.String()}) 150 }) 151} 152 153// purgeCandidateChildData removes a candidate's qualification rows. RLS scopes each delete to the org. 154func purgeCandidateChildData(ctx context.Context, tx pgx.Tx, id uuid.UUID) error { 155 for _, stmt := range []string{ 156 `DELETE FROM candidate_skills WHERE candidate_id = $1`, 157 `DELETE FROM candidate_certifications WHERE candidate_id = $1`, 158 `DELETE FROM candidate_customer_experience WHERE candidate_id = $1`, 159 } { 160 if _, err := tx.Exec(ctx, stmt, id); err != nil { 161 return err 162 } 163 } 164 return nil 165} 166 167// audit records an event on the tenant tx with the actor taken from the validated session. 168func (s *Service) audit(ctx context.Context, tx pgx.Tx, e audit.Event) error { 169 if s.aud == nil { 170 return nil 171 } 172 if p, ok := tenant.UserFromContext(ctx); ok { 173 if id, err := uuid.Parse(p.UserID); err == nil { 174 e.ActorUserID = &id 175 } 176 } 177 return s.aud.OnTx(ctx, tx, e) 178} 179 180func deref(s *string) string { 181 if s == nil { 182 return "" 183 } 184 return *s 185} 186