Complete pipeline rewrite: correct BFS, O(1) permissions, 5 checks, seed data, frontend

Author: Anubhav852

.env.example

@@ -0,0 +1,2 @@
+SUPABASE_URL=your_supabase_project_url_here
+SUPABASE_KEY=your_supabase_anon_key_here

backend/filters.py

@@ -1,38 +1,34 @@
-from datetime import datetime
+from datetime import datetime, timezone
 
-def check_dept_match(user_id, node_id, db):
-    # Fetch user's department
-    user = db.table("users").select("department").eq("id", user_id).single().execute()
-    # Fetch node's department
-    node = db.table("nodes").select("department").eq("id", node_id).single().execute()
-    
-    return user.data["department"] == node.data["department"]
+def check_isolation(node, org_id):
+    """Check 1: Node must belong to same org"""
+    return node.get("org_id") == org_id
 
-def check_temporal_validity(node_id, db):
-    # Fetch node expiry date
-    node = db.table("nodes").select("expiry_date").eq("id", node_id).single().execute()
-    expiry_date = node.data["expiry_date"] # Expecting ISO format string
-    
-    return datetime.fromisoformat(expiry_date) > datetime.now()
-
-def check_compliance(user_id, node_id, db):
-    # Fetch user clearance and node MNPI status
-    user = db.table("users").select("clearance_level").eq("id", user_id).single().execute()
-    node = db.table("nodes").select("is_mnpi").eq("id", node_id).single().execute()
-    
-    # If node is MNPI, user clearance must be 'high'
-    if node.data["is_mnpi"]:
-        return user.data["clearance_level"] == "high"
+def check_compliance(node, user_compliance_clearance):
+    """Check 2: MNPI-tagged nodes excluded if user has no clearance"""
+    node_tags = node.get("compliance_tags") or []
+    for tag in node_tags:
+        if tag not in user_compliance_clearance:
+            return False
     return True
 
-def is_highly_derivable(node_id, db):
-    # Check if node is marked as general knowledge (too basic/derivable)
-    node = db.table("nodes").select("category").eq("id", node_id).single().execute()
-    return node.data["category"] == "general_knowledge"
+def check_permission(node, permission_map):
+    """Check 3: Node's hierarchy level must be >= user's ceiling level"""
+    level_id = node.get("hierarchy_level_id")
+    return permission_map.get(level_id, False)
+
+def check_temporal(node):
+    """Check 4: Exclude superseded and expired nodes"""
+    if node.get("status") == "SUPERSEDED":
+        return False
+    valid_until = node.get("valid_until")
+    if valid_until:
+        expiry = datetime.fromisoformat(valid_until.replace("Z", "+00:00"))
+        if expiry < datetime.now(timezone.utc):
+            return False
+    return True
 
-def check_user_constraints(user_id, node_id, db):
-    # Custom rule: Check if node is on user's specific blocklist
-    blocklist = db.table("user_constraints").select("blocked_node_id").eq("user_id", user_id).execute()
-    blocked_ids = [row["blocked_node_id"] for row in blocklist.data]
-    
-    return node_id not in blocked_ids
+def check_derivability(node):
+    """Check 5: Exclude nodes with derivability_score >= 0.7"""
+    score = node.get("derivability_score", 0)
+    return float(score) < 0.7

backend/permission_compiler.py

@@ -1,20 +1,29 @@
-def compile_user_permissions(user_id, supabase_client):
+def compile_permissions(user, hierarchy_levels):
     """
-    Builds an O(1) lookup hashmap for all user permissions.
-    Call this ONCE at the start of your request.
+    Builds O(1) lookup hashmap compiled ONCE per session.
+    
+    Input:  user record + all hierarchy levels
+    Output: {hierarchy_level_id: True/False} — can this user read this level?
+    
+    Rule:
+    - ADMIN: can read everything
+    - HOD/EDITOR/QUALITY: can read levels where level_number >= user ceiling_level
+    - VIEWER: can read levels where level_number >= user ceiling_level
     """
-    try:
-        response = supabase_client.table('user_permissions')\
-            .select('node_id, access_level')\
-            .eq('user_id', user_id)\
-            .execute()
+    role = user.get("role", "VIEWER")
+    ceiling = user.get("ceiling_level", 15)
+    
+    permission_map = {}
+    
+    for level in hierarchy_levels:
+        level_id = level["id"]
+        level_number = level.get("level_number", 15)
 
-        # Hashmap: {node_id: access_level}
-        return {item['node_id']: item['access_level'] for item in response.data}
-    except Exception as e:
-        print(f"Error compiling permissions: {e}")
-        return {}
-
-def check_permission(node_id, permission_map):
-    # O(1) lookup
-    return node_id in permission_map
+        if role == "ADMIN":
+            permission_map[level_id] = True
+        else:
+            # User can read this level if level_number >= their ceiling
+            # (higher number = lower in hierarchy = less sensitive)
+            permission_map[level_id] = level_number >= ceiling
+    
+    return permission_map

backend/traversal.py

@@ -1,50 +1,39 @@
-def get_reachable_nodes(entry_node_id, supabase_client):
+from collections import deque
+
+def get_reachable_nodes(entry_level_id, supabase_client):
     """
-    Performs BFS to traverse the DAG upward to find all ancestors.
-    Optimized to handle parent-child relationships efficiently.
+    BFS upward through hierarchy_levels DAG.
+    Returns dict: {hierarchy_level_id: distance_from_entry}
     """
-    visited = set()
-    queue = [entry_node_id]
-    
+    visited = {}   # {level_id: distance}
+    queue = deque()
+    queue.append((entry_level_id, 0))
+
+    # First load ALL hierarchy levels into memory (one DB call)
+    response = supabase_client.table("hierarchy_levels").select("id, parent_ids").execute()
+    level_map = {row["id"]: row.get("parent_ids") or [] for row in response.data}
+
     while queue:
-        current_id = queue.pop(0)
-        
-        if current_id not in visited:
-            visited.add(current_id)
-            
-            try:
-                # Fetch only the parent_id for the current node
-                # Note: Adjust 'parent_id' column name if your schema uses an array
-                response = supabase_client.table('nodes')\
-                    .select('parent_id')\
-                    .eq('id', current_id)\
-                    .execute()
-                
-                # Check for valid data
-                if response.data:
-                    for row in response.data:
-                        # Handle case where parent_id might be None for root nodes
-                        p_id = row.get('parent_id')
-                        if p_id and p_id not in visited:
-                            queue.append(p_id)
-            
-            except Exception as e:
-                print(f"Error traversing DAG at node {current_id}: {e}")
-                continue
-    
-    return list(visited)
+        current_id, distance = queue.popleft()
+        if current_id in visited:
+            continue
+        visited[current_id] = distance
+
+        # Walk UP to parents
+        for parent_id in level_map.get(current_id, []):
+            if parent_id not in visited:
+                queue.append((parent_id, distance + 1))
+
+    return visited  # {level_id: distance}
+
 
-def get_children_of_node(parent_node_id, supabase_client):
+def inject_zone2_nodes(supabase_client):
     """
-    Retrieves all direct children for a node.
+    Fetch all Zone 2 (GLOBAL) nodes — injected after BFS, before 5 checks.
+    Returns list of node dicts.
     """
-    try:
-        response = supabase_client.table('nodes')\
-            .select('id')\
-            .eq('parent_id', parent_node_id)\
-            .execute()
-            
-        return [row['id'] for row in response.data] if response.data else []
-    except Exception as e:
-        print(f"Error fetching children for parent {parent_node_id}: {e}")
-        return []
+    response = supabase_client.table("knowledge_nodes")\
+        .select("*")\
+        .eq("zone", 2)\
+        .execute()
+    return response.data or []