| | | 1 | | namespace AsiBackbone.Core.Classification; |
| | | 2 | | |
| | | 3 | | /// <summary> |
| | | 4 | | /// Defines provider-neutral policy options for resolving DLP or classification failure behavior. |
| | | 5 | | /// </summary> |
| | | 6 | | public sealed class DlpFailurePolicyOptions |
| | | 7 | | { |
| | | 8 | | /// <summary> |
| | | 9 | | /// Gets or sets the default behavior for low-risk intents. |
| | | 10 | | /// </summary> |
| | | 11 | | public DlpFailureBehavior LowRiskBehavior { get; set; } = DlpFailureBehavior.WarnAndAllow; |
| | | 12 | | |
| | | 13 | | /// <summary> |
| | | 14 | | /// Gets or sets the default behavior for medium-risk intents. |
| | | 15 | | /// </summary> |
| | | 16 | | public DlpFailureBehavior MediumRiskBehavior { get; set; } = DlpFailureBehavior.RequireAcknowledgment; |
| | | 17 | | |
| | | 18 | | /// <summary> |
| | | 19 | | /// Gets or sets the default behavior for high-risk or regulated intents. |
| | | 20 | | /// </summary> |
| | | 21 | | public DlpFailureBehavior HighRiskBehavior { get; set; } = DlpFailureBehavior.Deny; |
| | | 22 | | |
| | | 23 | | /// <summary> |
| | | 24 | | /// Gets risk- and failure-specific behavior overrides. |
| | | 25 | | /// </summary> |
| | | 26 | | public IDictionary<DlpFailurePolicyKey, DlpFailureBehavior> BehaviorOverrides { get; } = |
| | 30 | 27 | | new Dictionary<DlpFailurePolicyKey, DlpFailureBehavior>(); |
| | | 28 | | |
| | | 29 | | /// <summary> |
| | | 30 | | /// Resolves the configured behavior for the supplied failure context. |
| | | 31 | | /// </summary> |
| | | 32 | | /// <param name="context">The DLP failure policy context.</param> |
| | | 33 | | /// <returns>The configured behavior.</returns> |
| | | 34 | | public DlpFailureBehavior GetBehavior(DlpFailurePolicyContext context) |
| | | 35 | | { |
| | 30 | 36 | | ArgumentNullException.ThrowIfNull(context); |
| | | 37 | | |
| | 28 | 38 | | var key = new DlpFailurePolicyKey(context.RiskLevel, context.FailureKind); |
| | | 39 | | |
| | 28 | 40 | | if (BehaviorOverrides.TryGetValue(key, out DlpFailureBehavior overrideBehavior)) |
| | | 41 | | { |
| | 7 | 42 | | return ValidateBehavior(overrideBehavior, nameof(BehaviorOverrides)); |
| | | 43 | | } |
| | | 44 | | |
| | 21 | 45 | | DlpFailureBehavior behavior = context.RiskLevel switch |
| | 21 | 46 | | { |
| | 10 | 47 | | DlpIntentRiskLevel.Low => LowRiskBehavior, |
| | 6 | 48 | | DlpIntentRiskLevel.Medium => MediumRiskBehavior, |
| | 5 | 49 | | DlpIntentRiskLevel.High => HighRiskBehavior, |
| | 21 | 50 | | // DlpFailurePolicyContext rejects an unspecified risk level at construction, so this arm is unreachable thr |
| | 21 | 51 | | // a validly constructed context. It stays explicit so an unassigned tier can never fall through to a defaul |
| | 0 | 52 | | DlpIntentRiskLevel.Unspecified => throw new ArgumentOutOfRangeException(nameof(context), context.RiskLevel, |
| | 0 | 53 | | _ => throw new ArgumentOutOfRangeException(nameof(context), context.RiskLevel, "DLP intent risk level must b |
| | 21 | 54 | | }; |
| | | 55 | | |
| | 21 | 56 | | return ValidateBehavior(behavior, nameof(context)); |
| | | 57 | | } |
| | | 58 | | |
| | | 59 | | /// <summary> |
| | | 60 | | /// Validates a resolved or configured failure behavior. |
| | | 61 | | /// </summary> |
| | | 62 | | /// <remarks> |
| | | 63 | | /// This is the single choke point for both the risk-tier properties and <see cref="BehaviorOverrides" />, so reject |
| | | 64 | | /// <see cref="DlpFailureBehavior.Unspecified" /> here keeps a partially configured policy from resolving a screenin |
| | | 65 | | /// failure into an allow. An incomplete policy raises instead of quietly proceeding. |
| | | 66 | | /// </remarks> |
| | | 67 | | private static DlpFailureBehavior ValidateBehavior( |
| | | 68 | | DlpFailureBehavior behavior, |
| | | 69 | | string parameterName) |
| | | 70 | | { |
| | 28 | 71 | | return !Enum.IsDefined(behavior) |
| | 28 | 72 | | ? throw new ArgumentOutOfRangeException(parameterName, behavior, "DLP failure behavior must be defined.") |
| | 28 | 73 | | : behavior == DlpFailureBehavior.Unspecified |
| | 28 | 74 | | ? throw new ArgumentOutOfRangeException( |
| | 28 | 75 | | parameterName, |
| | 28 | 76 | | behavior, |
| | 28 | 77 | | "DLP failure behavior must be configured. Set an explicit behavior rather than leaving it unspecifie |
| | 28 | 78 | | : behavior; |
| | | 79 | | } |
| | | 80 | | } |