+
{models.length === 0 ? (
No models available
) : (
- models.map(model => (
-
- ))
+ (() => {
+ // Filter models by compliance level if feature is enabled
+ const complianceEnabled = features?.compliance_levels
+ const filteredModels = complianceEnabled && complianceLevelFilter
+ ? models.filter(m => {
+ const model = typeof m === 'string' ? { name: m } : m
+ // Include models without compliance_level (backward compatible)
+ if (!model.compliance_level) return true
+ return model.compliance_level === complianceLevelFilter
+ })
+ : models
+
+ return filteredModels.map(m => {
+ const model = typeof m === 'string' ? { name: m } : m
+ const modelName = model.name || m
+ return (
+
+ )
+ })
+ })()
)}
)}
diff --git a/frontend/src/hooks/chat/useChatConfig.js b/frontend/src/hooks/chat/useChatConfig.js
index 8921b63..3ac5a4b 100644
--- a/frontend/src/hooks/chat/useChatConfig.js
+++ b/frontend/src/hooks/chat/useChatConfig.js
@@ -52,20 +52,23 @@ export function useChatConfig() {
setIsInAdminGroup(!!cfg.is_in_admin_group)
// Set default model if none saved and models available
if (!currentModel && cfg.models?.length) {
- const defaultModel = cfg.models[0]
+ const defaultModel = cfg.models[0].name || cfg.models[0]
setCurrentModel(defaultModel)
localStorage.setItem('chatui-current-model', defaultModel)
}
// Validate saved model is still available
- else if (currentModel && cfg.models?.length && !cfg.models.includes(currentModel)) {
- const defaultModel = cfg.models[0]
- setCurrentModel(defaultModel)
- localStorage.setItem('chatui-current-model', defaultModel)
+ else if (currentModel && cfg.models?.length) {
+ const modelNames = cfg.models.map(m => m.name || m)
+ if (!modelNames.includes(currentModel)) {
+ const defaultModel = cfg.models[0].name || cfg.models[0]
+ setCurrentModel(defaultModel)
+ localStorage.setItem('chatui-current-model', defaultModel)
+ }
}
} catch (e) {
// Fallback demo data
setAppName('Chat UI (Demo)')
- setModels(['gpt-4o', 'gpt-4o-mini'])
+ setModels([{name: 'gpt-4o'}, {name: 'gpt-4o-mini'}])
setTools([{ server: 'canvas', tools: ['canvas'], description: 'Create and display visual content', tool_count: 1, is_exclusive: false }])
setDataSources(['demo_documents'])
setUser('Demo User')
From 85f6e38cf69ed71c4a0724012683c3a6c10b2735 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 1 Nov 2025 14:42:15 +0000
Subject: [PATCH 12/24] Update documentation with LLM endpoint filtering
details
Co-authored-by: garland3 <1162675+garland3@users.noreply.github.com>
---
docs/compliance-level-feature.md | 77 +++++++++++++++++++++++++-------
1 file changed, 62 insertions(+), 15 deletions(-)
diff --git a/docs/compliance-level-feature.md b/docs/compliance-level-feature.md
index 46fb050..a58b937 100644
--- a/docs/compliance-level-feature.md
+++ b/docs/compliance-level-feature.md
@@ -1,7 +1,7 @@
# Compliance Level Feature
## Overview
-This feature allows MCP servers and RAG data sources to declare a compliance level (e.g., SOC2, HIPAA, Public). Users can then filter their session to only connect to and use sources matching a specific compliance level. This helps minimize the risk of mixing data from secure and insecure environments.
+This feature allows MCP servers, RAG data sources, and LLM endpoints to declare a compliance level (e.g., SOC2, HIPAA, Public, External, Internal). Users can then filter their session to only connect to and use sources matching a specific compliance level. This helps minimize the risk of mixing data from secure and insecure environments.
The feature includes a **rollout control flag** (`FEATURE_COMPLIANCE_LEVELS_ENABLED`) to enable gradual deployment and backend transmission of the compliance filter for future compliance-dependent logic.
@@ -26,7 +26,7 @@ FEATURE_COMPLIANCE_LEVELS_ENABLED=true
### Backend Changes
-#### 1. Configuration Model (`backend/modules/config/manager.py`)
+#### 1. Configuration Models (`backend/modules/config/manager.py`)
Added `compliance_level` field to `MCPServerConfig`:
```python
@@ -35,6 +35,14 @@ class MCPServerConfig(BaseModel):
compliance_level: Optional[str] = None # Compliance/security level (e.g., "SOC2", "HIPAA", "Public")
```
+Added `compliance_level` field to `ModelConfig` for LLM endpoints:
+
+```python
+class ModelConfig(BaseModel):
+ # ... existing fields ...
+ compliance_level: Optional[str] = None # Compliance/security level (e.g., "External", "Internal", "Public")
+```
+
Added feature flag to `AppSettings`:
```python
class AppSettings(BaseSettings):
@@ -82,10 +90,21 @@ Updated MCP server configurations to include compliance levels:
}
```
+**config/defaults/llmconfig.yml** and **config/overrides/llmconfig.yml** (LLM endpoints):
+```yaml
+models:
+ gpt-4.1:
+ model_url: "https://api.openai.com/v1/chat/completions"
+ model_name: "gpt-4.1"
+ api_key: "${OPENAI_API_KEY}"
+ compliance_level: "External"
+```
+
#### 3. API Responses (`backend/routes/config_routes.py`)
The `/api/config` endpoint now includes:
- `compliance_level` in **tools** array (for MCP tool servers)
- `compliance_level` in **prompts** array (for MCP prompt servers)
+- `compliance_level` in **models** array (for LLM endpoints)
- `compliance_levels` in **features** object (feature flag status)
**RAG MCP Service** (`backend/domain/rag_mcp_service.py`):
@@ -95,6 +114,18 @@ The `/api/config` endpoint now includes:
Example API response:
```json
{
+ "models": [
+ {
+ "name": "gpt-4.1",
+ "description": null,
+ "compliance_level": "External"
+ },
+ {
+ "name": "internal-llm",
+ "description": "Internal LLM for sensitive data",
+ "compliance_level": "Internal"
+ }
+ ],
"tools": [
{
"server": "calculator",
@@ -196,6 +227,8 @@ const getComplianceFilteredTools = (complianceLevel) => {
- Includes quick clear button (×) to remove the filter
- Ensures users always know their current compliance setting
- Hidden when `FEATURE_COMPLIANCE_LEVELS_ENABLED=false`
+- **Model dropdown**: Filters LLM endpoints by compliance level
+- **Model badges**: Display compliance level badge on each model option
**ToolsPanel (`frontend/src/components/ToolsPanel.jsx`)**:
- **Filter dropdown**: Allows users to select a compliance level (All Levels, Public, SOC2, etc.)
@@ -260,11 +293,20 @@ UI Example (when feature enabled):
}
}
```
-3. Supported values are arbitrary strings, but common examples include:
- - `"Public"` - Publicly available, no special compliance
- - `"SOC2"` - SOC 2 Type II compliant
- - `"HIPAA"` - HIPAA compliant
- - `"FedRAMP"` - FedRAMP authorized
+
+4. For LLM endpoints in `llmconfig.yml`:
+ ```yaml
+ models:
+ gpt-4.1:
+ model_url: "https://api.openai.com/v1/chat/completions"
+ model_name: "gpt-4.1"
+ api_key: "${OPENAI_API_KEY}"
+ compliance_level: "External"
+ ```
+
+5. Supported values are arbitrary strings, but common examples include:
+ - **For MCP/RAG**: `"Public"`, `"SOC2"`, `"HIPAA"`, `"FedRAMP"`
+ - **For LLM endpoints**: `"External"`, `"Internal"`, `"Public"`
- Or any custom compliance level
### For End Users
@@ -272,25 +314,30 @@ UI Example (when feature enabled):
**Setting Compliance Level:**
1. Open the Tools panel OR RAG panel in the chat interface
2. Look for the "Compliance Level" dropdown in the controls section
-3. Select a compliance level (e.g., "SOC2")
+3. Select a compliance level (e.g., "SOC2", "External", "Internal")
4. The selected level will appear in the header as a blue badge with a Shield icon
-5. Only tools and data sources matching that compliance level will be available
+5. Only matching tools, data sources, and LLM models will be available
**Viewing Active Compliance Level:**
- The header always shows the active compliance level (if one is selected)
- Click the "×" in the header badge to quickly clear the compliance filter
+**How It Affects Different Components:**
+- **LLM Models**: Model dropdown only shows models matching the compliance level (with badges)
+- **MCP Tools**: Tools panel only shows servers matching the compliance level
+- **RAG Sources**: Data sources panel only shows sources matching the compliance level
+
**Important Safety Features:**
- When switching compliance levels, any selected tools/prompts that don't match are **automatically cleared**
- This prevents accidentally running non-compliant tools from previous sessions
-- The filter applies across both Tools and RAG Data Sources panels
+- The filter applies across Tools, RAG Data Sources, and LLM model selection
**Example Workflow:**
-1. User selects "SOC2" compliance level from Tools panel
-2. Header shows: `[🔒 SOC2 ×]`
-3. Only SOC2-compliant tools and data sources are visible
-4. Previously selected "Public" tools are automatically unselected
-5. User can work safely knowing all interactions are SOC2-compliant
+1. User selects "External" compliance level from Tools panel
+2. Header shows: `[🔒 External ×]`
+3. Only External-compliant LLMs, tools, and data sources are visible
+4. Previously selected "Internal" LLM model is automatically unselected
+5. User can work safely knowing all interactions use external-compliant resources
## Benefits
From 6ef3d5855001ba9e19c4cf1f77c8321c24ee1a18 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 1 Nov 2025 19:34:59 +0000
Subject: [PATCH 13/24] Add compliance level validation and hierarchical
filtering
- Create compliance-levels.json with standard levels and hierarchy
- Add ComplianceLevelManager in backend/core/compliance.py
- Validate compliance levels on config load with warnings for invalid levels
- Normalize compliance level names using aliases (e.g., "SOC 2" -> "SOC2")
- Implement hierarchical filtering (higher levels can access lower levels)
- Add /api/compliance-levels endpoint to expose level definitions
- Update MarketplaceContext to fetch and use hierarchical filtering
- Update Header model dropdown to use hierarchical filtering
- Tests pass (backend: 59/60, frontend: 15/15)
Co-authored-by: garland3 <1162675+garland3@users.noreply.github.com>
---
backend/core/compliance.py | 232 +++++++++++++++++++
backend/modules/config/manager.py | 45 +++-
backend/routes/config_routes.py | 34 +++
config/defaults/compliance-levels.json | 44 ++++
frontend/src/components/Header.jsx | 5 +-
frontend/src/contexts/MarketplaceContext.jsx | 47 +++-
6 files changed, 399 insertions(+), 8 deletions(-)
create mode 100644 backend/core/compliance.py
create mode 100644 config/defaults/compliance-levels.json
diff --git a/backend/core/compliance.py b/backend/core/compliance.py
new file mode 100644
index 0000000..689731f
--- /dev/null
+++ b/backend/core/compliance.py
@@ -0,0 +1,232 @@
+"""
+Compliance level management and validation.
+
+Loads compliance level definitions from compliance-levels.json and provides
+validation and hierarchy checking.
+"""
+
+import json
+import logging
+from pathlib import Path
+from typing import Dict, List, Optional, Set
+from dataclasses import dataclass
+
+logger = logging.getLogger(__name__)
+
+
+@dataclass
+class ComplianceLevel:
+ """Represents a single compliance level definition."""
+ name: str
+ level: int
+ description: str
+ aliases: List[str]
+
+
+class ComplianceLevelManager:
+ """Manages compliance level definitions and validation."""
+
+ def __init__(self, config_path: Optional[Path] = None):
+ """Initialize the compliance level manager.
+
+ Args:
+ config_path: Path to compliance-levels.json. If None, uses default location.
+ """
+ self.levels: Dict[str, ComplianceLevel] = {}
+ self.hierarchy_mode: str = "inclusive"
+ self._name_to_canonical: Dict[str, str] = {} # Maps aliases to canonical names
+
+ if config_path is None:
+ # Try to find config in standard locations
+ backend_root = Path(__file__).parent.parent.parent
+ project_root = backend_root.parent
+
+ search_paths = [
+ project_root / "config" / "overrides" / "compliance-levels.json",
+ project_root / "config" / "defaults" / "compliance-levels.json",
+ backend_root / "configfilesadmin" / "compliance-levels.json",
+ backend_root / "configfiles" / "compliance-levels.json",
+ ]
+
+ for path in search_paths:
+ if path.exists():
+ config_path = path
+ break
+
+ if config_path and config_path.exists():
+ self._load_config(config_path)
+ else:
+ logger.warning("No compliance-levels.json found, using permissive validation")
+
+ def _load_config(self, config_path: Path):
+ """Load compliance level configuration from JSON file."""
+ try:
+ with open(config_path, 'r', encoding='utf-8') as f:
+ config = json.load(f)
+
+ self.hierarchy_mode = config.get('hierarchy_mode', 'inclusive')
+
+ for level_data in config.get('levels', []):
+ level = ComplianceLevel(
+ name=level_data['name'],
+ level=level_data['level'],
+ description=level_data.get('description', ''),
+ aliases=level_data.get('aliases', [])
+ )
+ self.levels[level.name] = level
+
+ # Map canonical name to itself
+ self._name_to_canonical[level.name] = level.name
+
+ # Map aliases to canonical name
+ for alias in level.aliases:
+ self._name_to_canonical[alias] = level.name
+
+ logger.info(f"Loaded {len(self.levels)} compliance levels from {config_path}")
+ logger.debug(f"Compliance levels: {list(self.levels.keys())}")
+
+ except Exception as e:
+ logger.error(f"Error loading compliance-levels.json: {e}")
+ # Continue with empty config for permissive validation
+
+ def get_canonical_name(self, name: Optional[str]) -> Optional[str]:
+ """Get the canonical name for a compliance level (resolves aliases).
+
+ Args:
+ name: Compliance level name or alias
+
+ Returns:
+ Canonical name, or None if not found
+ """
+ if not name:
+ return None
+ return self._name_to_canonical.get(name)
+
+ def validate_compliance_level(self, level_name: Optional[str], context: str = "") -> Optional[str]:
+ """Validate a compliance level name.
+
+ Args:
+ level_name: The compliance level to validate
+ context: Context for logging (e.g., "MCP server 'calculator'")
+
+ Returns:
+ Canonical name if valid, None if invalid (with warning logged)
+ """
+ if not level_name:
+ return None
+
+ canonical = self.get_canonical_name(level_name)
+
+ if canonical is None:
+ # No compliance config loaded - permissive mode
+ if not self.levels:
+ return level_name
+
+ # Unknown compliance level
+ valid_levels = list(self.levels.keys())
+ logger.warning(
+ f"Invalid compliance level '{level_name}' {context}. "
+ f"Valid levels: {', '.join(valid_levels)}. "
+ f"Setting to None."
+ )
+ return None
+
+ if canonical != level_name:
+ logger.debug(f"Resolved alias '{level_name}' to '{canonical}' {context}")
+
+ return canonical
+
+ def is_accessible(self, user_level: Optional[str], resource_level: Optional[str]) -> bool:
+ """Check if a resource at resource_level is accessible given user_level.
+
+ In inclusive hierarchy mode:
+ - Higher levels can access lower levels
+ - Same level can access same level
+ - None (unset) is accessible by all and can access all
+
+ Args:
+ user_level: User's selected compliance level
+ resource_level: Resource's compliance level
+
+ Returns:
+ True if resource is accessible, False otherwise
+ """
+ # If either is None/unset, resource is accessible (backward compatibility)
+ if not user_level or not resource_level:
+ return True
+
+ # Get canonical names
+ user_canonical = self.get_canonical_name(user_level)
+ resource_canonical = self.get_canonical_name(resource_level)
+
+ # If we don't have level info, be permissive
+ if not user_canonical or not resource_canonical:
+ return True
+
+ # Get level objects
+ user_level_obj = self.levels.get(user_canonical)
+ resource_level_obj = self.levels.get(resource_canonical)
+
+ if not user_level_obj or not resource_level_obj:
+ return True
+
+ # In inclusive mode, higher or equal levels can access lower levels
+ if self.hierarchy_mode == "inclusive":
+ return user_level_obj.level >= resource_level_obj.level
+
+ # Exact match mode
+ return user_canonical == resource_canonical
+
+ def get_accessible_levels(self, user_level: Optional[str]) -> Set[str]:
+ """Get all compliance levels accessible to a user.
+
+ Args:
+ user_level: User's selected compliance level
+
+ Returns:
+ Set of accessible compliance level names (canonical)
+ """
+ if not user_level or not self.levels:
+ # Return all levels if no user level or no config
+ return set(self.levels.keys()) if self.levels else set()
+
+ user_canonical = self.get_canonical_name(user_level)
+ if not user_canonical or user_canonical not in self.levels:
+ return set(self.levels.keys())
+
+ user_level_obj = self.levels[user_canonical]
+
+ if self.hierarchy_mode == "inclusive":
+ # Return all levels at or below user's level
+ return {
+ name for name, level_obj in self.levels.items()
+ if level_obj.level <= user_level_obj.level
+ }
+ else:
+ # Exact match mode - only user's level
+ return {user_canonical}
+
+ def get_all_levels(self) -> List[str]:
+ """Get all defined compliance level names (canonical).
+
+ Returns:
+ List of compliance level names sorted by level (lowest to highest)
+ """
+ return [
+ name for name, _ in sorted(
+ self.levels.items(),
+ key=lambda x: x[1].level
+ )
+ ]
+
+
+# Global instance
+_compliance_manager: Optional[ComplianceLevelManager] = None
+
+
+def get_compliance_manager() -> ComplianceLevelManager:
+ """Get the global compliance level manager instance."""
+ global _compliance_manager
+ if _compliance_manager is None:
+ _compliance_manager = ComplianceLevelManager()
+ return _compliance_manager
diff --git a/backend/modules/config/manager.py b/backend/modules/config/manager.py
index 6f9f657..73515e9 100644
--- a/backend/modules/config/manager.py
+++ b/backend/modules/config/manager.py
@@ -331,6 +331,8 @@ def llm_config(self) -> LLMConfig:
if data:
self._llm_config = LLMConfig(**data)
+ # Validate compliance levels
+ self._validate_llm_compliance_levels()
logger.info(f"Loaded {len(self._llm_config.models)} models from LLM config")
else:
self._llm_config = LLMConfig(models={})
@@ -342,6 +344,23 @@ def llm_config(self) -> LLMConfig:
return self._llm_config
+ def _validate_llm_compliance_levels(self):
+ """Validate compliance levels for all LLM models."""
+ try:
+ from backend.core.compliance import get_compliance_manager
+ compliance_mgr = get_compliance_manager()
+
+ for model_name, model_config in self._llm_config.models.items():
+ if model_config.compliance_level:
+ validated = compliance_mgr.validate_compliance_level(
+ model_config.compliance_level,
+ context=f"for LLM model '{model_name}'"
+ )
+ # Update to canonical name or None if invalid
+ model_config.compliance_level = validated
+ except Exception as e:
+ logger.warning(f"Could not validate LLM compliance levels: {e}")
+
@property
def mcp_config(self) -> MCPConfig:
"""Get MCP configuration (cached)."""
@@ -356,6 +375,8 @@ def mcp_config(self) -> MCPConfig:
# Convert flat structure to nested structure for Pydantic
servers_data = {"servers": data}
self._mcp_config = MCPConfig(**servers_data)
+ # Validate compliance levels
+ self._validate_mcp_compliance_levels(self._mcp_config, "MCP")
logger.info(f"Loaded MCP config with {len(self._mcp_config.servers)} servers: {list(self._mcp_config.servers.keys())}")
else:
self._mcp_config = MCPConfig()
@@ -379,18 +400,36 @@ def rag_mcp_config(self) -> MCPConfig:
if data:
servers_data = {"servers": data}
self._rag_mcp_config = MCPConfig(**servers_data)
- logger.info(
- f"Loaded RAG MCP config with {len(self._rag_mcp_config.servers)} servers: {list(self._rag_mcp_config.servers.keys())}"
- )
+ # Validate compliance levels
+ self._validate_mcp_compliance_levels(self._rag_mcp_config, "RAG MCP")
+ logger.info(f"Loaded RAG MCP config with {len(self._rag_mcp_config.servers)} servers: {list(self._rag_mcp_config.servers.keys())}")
else:
self._rag_mcp_config = MCPConfig()
logger.info("Created empty RAG MCP config (no configuration file found)")
+
except Exception as e:
logger.error(f"Failed to parse RAG MCP configuration: {e}", exc_info=True)
self._rag_mcp_config = MCPConfig()
return self._rag_mcp_config
+ def _validate_mcp_compliance_levels(self, config: MCPConfig, config_type: str):
+ """Validate compliance levels for all MCP servers."""
+ try:
+ from backend.core.compliance import get_compliance_manager
+ compliance_mgr = get_compliance_manager()
+
+ for server_name, server_config in config.servers.items():
+ if server_config.compliance_level:
+ validated = compliance_mgr.validate_compliance_level(
+ server_config.compliance_level,
+ context=f"for {config_type} server '{server_name}'"
+ )
+ # Update to canonical name or None if invalid
+ server_config.compliance_level = validated
+ except Exception as e:
+ logger.warning(f"Could not validate {config_type} compliance levels: {e}")
+
def reload_configs(self) -> None:
"""Reload all configurations from files."""
self._app_settings = None
diff --git a/backend/routes/config_routes.py b/backend/routes/config_routes.py
index 95acbf3..89aad34 100644
--- a/backend/routes/config_routes.py
+++ b/backend/routes/config_routes.py
@@ -223,6 +223,40 @@ async def get_config(current_user: str = Depends(get_current_user)):
}
+@router.get("/compliance-levels")
+async def get_compliance_levels(current_user: str = Depends(get_current_user)):
+ """Get compliance level definitions and hierarchy."""
+ try:
+ from core.compliance import get_compliance_manager
+ compliance_mgr = get_compliance_manager()
+
+ # Return level definitions for frontend use
+ levels = []
+ for name, level_obj in compliance_mgr.levels.items():
+ levels.append({
+ "name": name,
+ "level": level_obj.level,
+ "description": level_obj.description,
+ "aliases": level_obj.aliases
+ })
+
+ # Sort by level
+ levels.sort(key=lambda x: x['level'])
+
+ return {
+ "levels": levels,
+ "hierarchy_mode": compliance_mgr.hierarchy_mode,
+ "all_level_names": compliance_mgr.get_all_levels()
+ }
+ except Exception as e:
+ logger.error(f"Error getting compliance levels: {e}", exc_info=True)
+ return {
+ "levels": [],
+ "hierarchy_mode": "inclusive",
+ "all_level_names": []
+ }
+
+
# @router.get("/sessions")
# async def get_session_info(current_user: str = Depends(get_current_user)):
# """Get session information for the current user."""
diff --git a/config/defaults/compliance-levels.json b/config/defaults/compliance-levels.json
new file mode 100644
index 0000000..d1ad6e7
--- /dev/null
+++ b/config/defaults/compliance-levels.json
@@ -0,0 +1,44 @@
+{
+ "version": "1.0",
+ "description": "Defines compliance level types and their hierarchical relationships",
+ "levels": [
+ {
+ "name": "Public",
+ "level": 0,
+ "description": "Publicly accessible data, no restrictions",
+ "aliases": []
+ },
+ {
+ "name": "External",
+ "level": 1,
+ "description": "External services with basic enterprise security",
+ "aliases": []
+ },
+ {
+ "name": "Internal",
+ "level": 2,
+ "description": "Internal systems, can handle company IP information",
+ "aliases": []
+ },
+ {
+ "name": "SOC2",
+ "level": 3,
+ "description": "SOC 2 Type II compliant systems",
+ "aliases": ["SOC-2", "SOC 2"]
+ },
+ {
+ "name": "HIPAA",
+ "level": 4,
+ "description": "HIPAA compliant systems for healthcare data",
+ "aliases": ["HIPAA-Compliant"]
+ },
+ {
+ "name": "FedRAMP",
+ "level": 5,
+ "description": "FedRAMP authorized systems for government data",
+ "aliases": ["FedRAMP-Moderate", "FedRAMP-High"]
+ }
+ ],
+ "hierarchy_mode": "inclusive",
+ "hierarchy_description": "Higher levels can access lower levels. E.g., SOC2 (level 3) can use External (level 1) and Public (level 0) resources."
+}
diff --git a/frontend/src/components/Header.jsx b/frontend/src/components/Header.jsx
index 61f293f..f3d7c1b 100644
--- a/frontend/src/components/Header.jsx
+++ b/frontend/src/components/Header.jsx
@@ -2,6 +2,7 @@ import { useState, useEffect } from 'react'
import { useNavigate } from 'react-router-dom'
import { useChat } from '../contexts/ChatContext'
import { useWS } from '../contexts/WSContext'
+import { useMarketplace } from '../contexts/MarketplaceContext'
import { Menu, ChevronDown, Wrench, Bot, Download, Plus, HelpCircle, Shield, FolderOpen, Monitor, Settings } from 'lucide-react'
const Header = ({ onToggleRag, onToggleTools, onToggleFiles, onToggleCanvas, onCloseCanvas, onToggleSettings }) => {
@@ -23,6 +24,7 @@ const Header = ({ onToggleRag, onToggleTools, onToggleFiles, onToggleCanvas, onC
complianceLevelFilter,
setComplianceLevelFilter
} = useChat()
+ const { isComplianceAccessible } = useMarketplace()
const { connectionStatus, isConnected } = useWS()
const [dropdownOpen, setDropdownOpen] = useState(false)
const [downloadDropdownOpen, setDownloadDropdownOpen] = useState(false)
@@ -122,7 +124,8 @@ const Header = ({ onToggleRag, onToggleTools, onToggleFiles, onToggleCanvas, onC
const model = typeof m === 'string' ? { name: m } : m
// Include models without compliance_level (backward compatible)
if (!model.compliance_level) return true
- return model.compliance_level === complianceLevelFilter
+ // Use hierarchical filtering
+ return isComplianceAccessible(complianceLevelFilter, model.compliance_level)
})
: models
diff --git a/frontend/src/contexts/MarketplaceContext.jsx b/frontend/src/contexts/MarketplaceContext.jsx
index 57bd2f1..9103ea0 100644
--- a/frontend/src/contexts/MarketplaceContext.jsx
+++ b/frontend/src/contexts/MarketplaceContext.jsx
@@ -4,11 +4,26 @@ import { useChat } from './ChatContext'
const MarketplaceContext = createContext()
export const MarketplaceProvider = ({ children }) => {
- const { tools, prompts } = useChat()
+ const { tools, prompts, features } = useChat()
const [selectedServers, setSelectedServers] = useState(new Set())
+ const [complianceLevels, setComplianceLevels] = useState([])
+ const [hierarchyMode, setHierarchyMode] = useState('inclusive')
const initializedRef = useRef(false)
const knownServersRef = useRef(new Set())
+ // Load compliance levels from API
+ useEffect(() => {
+ if (!features?.compliance_levels) return
+
+ fetch('/api/compliance-levels')
+ .then(res => res.json())
+ .then(data => {
+ setComplianceLevels(data.levels || [])
+ setHierarchyMode(data.hierarchy_mode || 'inclusive')
+ })
+ .catch(err => console.error('Failed to load compliance levels:', err))
+ }, [features])
+
// Load selected servers from localStorage once on mount
useEffect(() => {
if (initializedRef.current) return
@@ -131,12 +146,33 @@ export const MarketplaceProvider = ({ children }) => {
return prompts.filter(prompt => selectedServers.has(prompt.server))
}
+ // Check if a resource is accessible given the user's compliance level and hierarchy
+ const isComplianceAccessible = (userLevel, resourceLevel) => {
+ // If either is not set, resource is accessible (backward compatibility)
+ if (!userLevel || !resourceLevel) return true
+
+ // Find level objects
+ const userLevelObj = complianceLevels.find(l => l.name === userLevel)
+ const resourceLevelObj = complianceLevels.find(l => l.name === resourceLevel)
+
+ // If we don't have level info, be permissive
+ if (!userLevelObj || !resourceLevelObj) return true
+
+ // In inclusive mode, higher or equal levels can access lower levels
+ if (hierarchyMode === 'inclusive') {
+ return userLevelObj.level >= resourceLevelObj.level
+ }
+
+ // Exact match mode
+ return userLevel === resourceLevel
+ }
+
const getComplianceFilteredTools = (complianceLevel) => {
if (!complianceLevel) return getFilteredTools()
return getFilteredTools().filter(tool => {
// If no compliance_level specified, include in all filters (backward compatible)
if (!tool.compliance_level) return true
- return tool.compliance_level === complianceLevel
+ return isComplianceAccessible(complianceLevel, tool.compliance_level)
})
}
@@ -144,7 +180,7 @@ export const MarketplaceProvider = ({ children }) => {
if (!complianceLevel) return getFilteredPrompts()
return getFilteredPrompts().filter(prompt => {
if (!prompt.compliance_level) return true
- return prompt.compliance_level === complianceLevel
+ return isComplianceAccessible(complianceLevel, prompt.compliance_level)
})
}
@@ -157,7 +193,10 @@ export const MarketplaceProvider = ({ children }) => {
getFilteredTools,
getFilteredPrompts,
getComplianceFilteredTools,
- getComplianceFilteredPrompts
+ getComplianceFilteredPrompts,
+ complianceLevels,
+ hierarchyMode,
+ isComplianceAccessible
}
return (
From 2c41bba3eefe65cac3b9f2b5b037da504bf20dda Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 1 Nov 2025 19:36:23 +0000
Subject: [PATCH 14/24] Update documentation with validation and hierarchy
details
Co-authored-by: garland3 <1162675+garland3@users.noreply.github.com>
---
docs/compliance-level-feature.md | 108 ++++++++++++++++++++++++++++++-
1 file changed, 105 insertions(+), 3 deletions(-)
diff --git a/docs/compliance-level-feature.md b/docs/compliance-level-feature.md
index a58b937..f5de20b 100644
--- a/docs/compliance-level-feature.md
+++ b/docs/compliance-level-feature.md
@@ -3,7 +3,72 @@
## Overview
This feature allows MCP servers, RAG data sources, and LLM endpoints to declare a compliance level (e.g., SOC2, HIPAA, Public, External, Internal). Users can then filter their session to only connect to and use sources matching a specific compliance level. This helps minimize the risk of mixing data from secure and insecure environments.
-The feature includes a **rollout control flag** (`FEATURE_COMPLIANCE_LEVELS_ENABLED`) to enable gradual deployment and backend transmission of the compliance filter for future compliance-dependent logic.
+The feature includes:
+- **Standardized compliance levels** defined in `compliance-levels.json`
+- **Hierarchical access control** where higher levels can access lower level resources
+- **Validation and normalization** of compliance level names with warnings for invalid values
+- **Rollout control flag** (`FEATURE_COMPLIANCE_LEVELS_ENABLED`) for gradual deployment
+
+## Compliance Level Definitions
+
+Compliance levels are defined in `config/defaults/compliance-levels.json` (can be overridden in `config/overrides/compliance-levels.json`):
+
+```json
+{
+ "version": "1.0",
+ "levels": [
+ {
+ "name": "Public",
+ "level": 0,
+ "description": "Publicly accessible data, no restrictions",
+ "aliases": []
+ },
+ {
+ "name": "External",
+ "level": 1,
+ "description": "External services with basic enterprise security",
+ "aliases": []
+ },
+ {
+ "name": "Internal",
+ "level": 2,
+ "description": "Internal systems, can handle company IP information",
+ "aliases": []
+ },
+ {
+ "name": "SOC2",
+ "level": 3,
+ "description": "SOC 2 Type II compliant systems",
+ "aliases": ["SOC-2", "SOC 2"]
+ },
+ {
+ "name": "HIPAA",
+ "level": 4,
+ "description": "HIPAA compliant systems for healthcare data",
+ "aliases": ["HIPAA-Compliant"]
+ },
+ {
+ "name": "FedRAMP",
+ "level": 5,
+ "description": "FedRAMP authorized systems for government data",
+ "aliases": ["FedRAMP-Moderate", "FedRAMP-High"]
+ }
+ ],
+ "hierarchy_mode": "inclusive"
+}
+```
+
+### Hierarchical Access
+
+In **inclusive mode** (default), higher compliance levels can access resources at their level and all lower levels:
+- **FedRAMP (5)** can use: Public, External, Internal, SOC2, HIPAA, FedRAMP
+- **HIPAA (4)** can use: Public, External, Internal, SOC2, HIPAA
+- **SOC2 (3)** can use: Public, External, Internal, SOC2
+- **Internal (2)** can use: Public, External, Internal
+- **External (1)** can use: Public, External
+- **Public (0)** can use: Public only
+
+Resources without a compliance_level are accessible by all levels (backward compatibility).
## Feature Flag
@@ -26,7 +91,32 @@ FEATURE_COMPLIANCE_LEVELS_ENABLED=true
### Backend Changes
-#### 1. Configuration Models (`backend/modules/config/manager.py`)
+#### 1. Compliance Level Manager (`backend/core/compliance.py`)
+New module that manages compliance level definitions:
+- Loads compliance levels from `compliance-levels.json`
+- Validates compliance level names against defined options
+- Normalizes aliases to canonical names (e.g., "SOC 2" → "SOC2")
+- Implements hierarchical access checking
+- Logs warnings for invalid compliance levels
+
+Key methods:
+```python
+compliance_mgr = get_compliance_manager()
+
+# Validate and normalize a compliance level
+canonical = compliance_mgr.validate_compliance_level("SOC 2", context="for LLM model 'gpt-4'")
+# Returns: "SOC2" (canonical name)
+
+# Check if a resource is accessible
+is_ok = compliance_mgr.is_accessible("SOC2", "Internal")
+# Returns: True (SOC2 level 3 can access Internal level 2)
+
+# Get all accessible levels for a user
+levels = compliance_mgr.get_accessible_levels("SOC2")
+# Returns: {"Public", "External", "Internal", "SOC2"}
+```
+
+#### 2. Configuration Models (`backend/modules/config/manager.py`)
Added `compliance_level` field to `MCPServerConfig`:
```python
@@ -43,6 +133,18 @@ class ModelConfig(BaseModel):
compliance_level: Optional[str] = None # Compliance/security level (e.g., "External", "Internal", "Public")
```
+**Validation on Config Load:**
+When configurations are loaded, compliance levels are automatically validated:
+- Invalid levels trigger warning logs
+- Aliases are normalized to canonical names
+- Invalid levels are set to `None` to prevent errors
+
+Example warning log:
+```
+WARNING: Invalid compliance level 'SOCII' for MCP server 'pdfbasic'.
+Valid levels: Public, External, Internal, SOC2, HIPAA, FedRAMP. Setting to None.
+```
+
Added feature flag to `AppSettings`:
```python
class AppSettings(BaseSettings):
@@ -54,7 +156,7 @@ class AppSettings(BaseSettings):
)
```
-#### 2. Configuration Files
+#### 3. Configuration Files
Updated MCP server configurations to include compliance levels:
**config/defaults/mcp.json** and **config/overrides/mcp.json**:
From 96bdc961bfa6409c20a8478971ad5008c6aaf453 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 1 Nov 2025 19:54:05 +0000
Subject: [PATCH 15/24] Change to explicit allowlist model for compliance
levels
- Replace hierarchical model with explicit allowlist in compliance-levels.json
- Each compliance level now has "allowed_with" list defining compatible levels
- Prevents dangerous combinations like HIPAA + Public (internet search with PII)
- Update ComplianceLevelManager to use allowlist instead of hierarchy
- Update frontend filtering to use allowlist
- Update /api/compliance-levels endpoint to expose allowlist
- Example: HIPAA allows [HIPAA, SOC2] but NOT Public or External
- Tests pass (backend: 59/60, frontend: 15/15)
Co-authored-by: garland3 <1162675+garland3@users.noreply.github.com>
---
backend/core/compliance.py | 51 +++++++-------------
backend/routes/config_routes.py | 13 ++---
config/defaults/compliance-levels.json | 32 ++++++------
frontend/src/contexts/MarketplaceContext.jsx | 22 +++------
4 files changed, 46 insertions(+), 72 deletions(-)
diff --git a/backend/core/compliance.py b/backend/core/compliance.py
index 689731f..2bae7ed 100644
--- a/backend/core/compliance.py
+++ b/backend/core/compliance.py
@@ -2,7 +2,7 @@
Compliance level management and validation.
Loads compliance level definitions from compliance-levels.json and provides
-validation and hierarchy checking.
+validation and allowlist checking.
"""
import json
@@ -18,9 +18,9 @@
class ComplianceLevel:
"""Represents a single compliance level definition."""
name: str
- level: int
description: str
aliases: List[str]
+ allowed_with: List[str] # List of compliance levels that can be used together
class ComplianceLevelManager:
@@ -33,7 +33,7 @@ def __init__(self, config_path: Optional[Path] = None):
config_path: Path to compliance-levels.json. If None, uses default location.
"""
self.levels: Dict[str, ComplianceLevel] = {}
- self.hierarchy_mode: str = "inclusive"
+ self.mode: str = "explicit_allowlist"
self._name_to_canonical: Dict[str, str] = {} # Maps aliases to canonical names
if config_path is None:
@@ -64,14 +64,14 @@ def _load_config(self, config_path: Path):
with open(config_path, 'r', encoding='utf-8') as f:
config = json.load(f)
- self.hierarchy_mode = config.get('hierarchy_mode', 'inclusive')
+ self.mode = config.get('mode', 'explicit_allowlist')
for level_data in config.get('levels', []):
level = ComplianceLevel(
name=level_data['name'],
- level=level_data['level'],
description=level_data.get('description', ''),
- aliases=level_data.get('aliases', [])
+ aliases=level_data.get('aliases', []),
+ allowed_with=level_data.get('allowed_with', [level_data['name']])
)
self.levels[level.name] = level
@@ -139,9 +139,9 @@ def validate_compliance_level(self, level_name: Optional[str], context: str = ""
def is_accessible(self, user_level: Optional[str], resource_level: Optional[str]) -> bool:
"""Check if a resource at resource_level is accessible given user_level.
- In inclusive hierarchy mode:
- - Higher levels can access lower levels
- - Same level can access same level
+ In explicit allowlist mode:
+ - Each level defines which other levels can be used together
+ - For example, HIPAA might allow HIPAA and SOC2, but not Public
- None (unset) is accessible by all and can access all
Args:
@@ -163,19 +163,14 @@ def is_accessible(self, user_level: Optional[str], resource_level: Optional[str]
if not user_canonical or not resource_canonical:
return True
- # Get level objects
+ # Get level object for user
user_level_obj = self.levels.get(user_canonical)
- resource_level_obj = self.levels.get(resource_canonical)
- if not user_level_obj or not resource_level_obj:
+ if not user_level_obj:
return True
- # In inclusive mode, higher or equal levels can access lower levels
- if self.hierarchy_mode == "inclusive":
- return user_level_obj.level >= resource_level_obj.level
-
- # Exact match mode
- return user_canonical == resource_canonical
+ # Check if resource_level is in the user's allowed_with list
+ return resource_canonical in user_level_obj.allowed_with
def get_accessible_levels(self, user_level: Optional[str]) -> Set[str]:
"""Get all compliance levels accessible to a user.
@@ -196,28 +191,16 @@ def get_accessible_levels(self, user_level: Optional[str]) -> Set[str]:
user_level_obj = self.levels[user_canonical]
- if self.hierarchy_mode == "inclusive":
- # Return all levels at or below user's level
- return {
- name for name, level_obj in self.levels.items()
- if level_obj.level <= user_level_obj.level
- }
- else:
- # Exact match mode - only user's level
- return {user_canonical}
+ # Return the allowed_with list for this level
+ return set(user_level_obj.allowed_with)
def get_all_levels(self) -> List[str]:
"""Get all defined compliance level names (canonical).
Returns:
- List of compliance level names sorted by level (lowest to highest)
+ List of compliance level names in definition order
"""
- return [
- name for name, _ in sorted(
- self.levels.items(),
- key=lambda x: x[1].level
- )
- ]
+ return list(self.levels.keys())
# Global instance
diff --git a/backend/routes/config_routes.py b/backend/routes/config_routes.py
index 89aad34..c9d60e6 100644
--- a/backend/routes/config_routes.py
+++ b/backend/routes/config_routes.py
@@ -225,7 +225,7 @@ async def get_config(current_user: str = Depends(get_current_user)):
@router.get("/compliance-levels")
async def get_compliance_levels(current_user: str = Depends(get_current_user)):
- """Get compliance level definitions and hierarchy."""
+ """Get compliance level definitions and allowlist."""
try:
from core.compliance import get_compliance_manager
compliance_mgr = get_compliance_manager()
@@ -235,24 +235,21 @@ async def get_compliance_levels(current_user: str = Depends(get_current_user)):
for name, level_obj in compliance_mgr.levels.items():
levels.append({
"name": name,
- "level": level_obj.level,
"description": level_obj.description,
- "aliases": level_obj.aliases
+ "aliases": level_obj.aliases,
+ "allowed_with": level_obj.allowed_with
})
- # Sort by level
- levels.sort(key=lambda x: x['level'])
-
return {
"levels": levels,
- "hierarchy_mode": compliance_mgr.hierarchy_mode,
+ "mode": compliance_mgr.mode,
"all_level_names": compliance_mgr.get_all_levels()
}
except Exception as e:
logger.error(f"Error getting compliance levels: {e}", exc_info=True)
return {
"levels": [],
- "hierarchy_mode": "inclusive",
+ "mode": "explicit_allowlist",
"all_level_names": []
}
diff --git a/config/defaults/compliance-levels.json b/config/defaults/compliance-levels.json
index d1ad6e7..d549cc1 100644
--- a/config/defaults/compliance-levels.json
+++ b/config/defaults/compliance-levels.json
@@ -1,44 +1,44 @@
{
- "version": "1.0",
- "description": "Defines compliance level types and their hierarchical relationships",
+ "version": "2.0",
+ "description": "Defines compliance level types and their allowed combinations",
"levels": [
{
"name": "Public",
- "level": 0,
"description": "Publicly accessible data, no restrictions",
- "aliases": []
+ "aliases": [],
+ "allowed_with": ["Public"]
},
{
"name": "External",
- "level": 1,
"description": "External services with basic enterprise security",
- "aliases": []
+ "aliases": [],
+ "allowed_with": ["External"]
},
{
"name": "Internal",
- "level": 2,
"description": "Internal systems, can handle company IP information",
- "aliases": []
+ "aliases": [],
+ "allowed_with": ["Internal"]
},
{
"name": "SOC2",
- "level": 3,
"description": "SOC 2 Type II compliant systems",
- "aliases": ["SOC-2", "SOC 2"]
+ "aliases": ["SOC-2", "SOC 2"],
+ "allowed_with": ["SOC2"]
},
{
"name": "HIPAA",
- "level": 4,
"description": "HIPAA compliant systems for healthcare data",
- "aliases": ["HIPAA-Compliant"]
+ "aliases": ["HIPAA-Compliant"],
+ "allowed_with": ["HIPAA", "SOC2"]
},
{
"name": "FedRAMP",
- "level": 5,
"description": "FedRAMP authorized systems for government data",
- "aliases": ["FedRAMP-Moderate", "FedRAMP-High"]
+ "aliases": ["FedRAMP-Moderate", "FedRAMP-High"],
+ "allowed_with": ["FedRAMP", "SOC2"]
}
],
- "hierarchy_mode": "inclusive",
- "hierarchy_description": "Higher levels can access lower levels. E.g., SOC2 (level 3) can use External (level 1) and Public (level 0) resources."
+ "mode": "explicit_allowlist",
+ "mode_description": "Each compliance level explicitly defines which other levels can be used in the same session. For example, HIPAA can use HIPAA and SOC2 resources, but not Public or External to prevent data leakage."
}
diff --git a/frontend/src/contexts/MarketplaceContext.jsx b/frontend/src/contexts/MarketplaceContext.jsx
index 9103ea0..df1040a 100644
--- a/frontend/src/contexts/MarketplaceContext.jsx
+++ b/frontend/src/contexts/MarketplaceContext.jsx
@@ -7,7 +7,7 @@ export const MarketplaceProvider = ({ children }) => {
const { tools, prompts, features } = useChat()
const [selectedServers, setSelectedServers] = useState(new Set())
const [complianceLevels, setComplianceLevels] = useState([])
- const [hierarchyMode, setHierarchyMode] = useState('inclusive')
+ const [complianceMode, setComplianceMode] = useState('explicit_allowlist')
const initializedRef = useRef(false)
const knownServersRef = useRef(new Set())
@@ -19,7 +19,7 @@ export const MarketplaceProvider = ({ children }) => {
.then(res => res.json())
.then(data => {
setComplianceLevels(data.levels || [])
- setHierarchyMode(data.hierarchy_mode || 'inclusive')
+ setComplianceMode(data.mode || 'explicit_allowlist')
})
.catch(err => console.error('Failed to load compliance levels:', err))
}, [features])
@@ -146,25 +146,19 @@ export const MarketplaceProvider = ({ children }) => {
return prompts.filter(prompt => selectedServers.has(prompt.server))
}
- // Check if a resource is accessible given the user's compliance level and hierarchy
+ // Check if a resource is accessible given the user's compliance level using allowlist
const isComplianceAccessible = (userLevel, resourceLevel) => {
// If either is not set, resource is accessible (backward compatibility)
if (!userLevel || !resourceLevel) return true
- // Find level objects
+ // Find user's compliance level object
const userLevelObj = complianceLevels.find(l => l.name === userLevel)
- const resourceLevelObj = complianceLevels.find(l => l.name === resourceLevel)
// If we don't have level info, be permissive
- if (!userLevelObj || !resourceLevelObj) return true
+ if (!userLevelObj) return true
- // In inclusive mode, higher or equal levels can access lower levels
- if (hierarchyMode === 'inclusive') {
- return userLevelObj.level >= resourceLevelObj.level
- }
-
- // Exact match mode
- return userLevel === resourceLevel
+ // Check if resource level is in the user's allowed_with list
+ return userLevelObj.allowed_with && userLevelObj.allowed_with.includes(resourceLevel)
}
const getComplianceFilteredTools = (complianceLevel) => {
@@ -195,7 +189,7 @@ export const MarketplaceProvider = ({ children }) => {
getComplianceFilteredTools,
getComplianceFilteredPrompts,
complianceLevels,
- hierarchyMode,
+ complianceMode,
isComplianceAccessible
}
From 2b0366c65be2329bc03b3e98826e5f6c2822ea9d Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 1 Nov 2025 19:54:55 +0000
Subject: [PATCH 16/24] Update documentation for explicit allowlist model
Co-authored-by: garland3 <1162675+garland3@users.noreply.github.com>
---
docs/compliance-level-feature.md | 65 +++++++++++++++++++++-----------
1 file changed, 42 insertions(+), 23 deletions(-)
diff --git a/docs/compliance-level-feature.md b/docs/compliance-level-feature.md
index f5de20b..b299792 100644
--- a/docs/compliance-level-feature.md
+++ b/docs/compliance-level-feature.md
@@ -5,7 +5,7 @@ This feature allows MCP servers, RAG data sources, and LLM endpoints to declare
The feature includes:
- **Standardized compliance levels** defined in `compliance-levels.json`
-- **Hierarchical access control** where higher levels can access lower level resources
+- **Explicit allowlist model** where each level defines which other levels can be used together
- **Validation and normalization** of compliance level names with warnings for invalid values
- **Rollout control flag** (`FEATURE_COMPLIANCE_LEVELS_ENABLED`) for gradual deployment
@@ -15,58 +15,77 @@ Compliance levels are defined in `config/defaults/compliance-levels.json` (can b
```json
{
- "version": "1.0",
+ "version": "2.0",
+ "description": "Defines compliance level types and their allowed combinations",
"levels": [
{
"name": "Public",
- "level": 0,
"description": "Publicly accessible data, no restrictions",
- "aliases": []
+ "aliases": [],
+ "allowed_with": ["Public"]
},
{
"name": "External",
- "level": 1,
"description": "External services with basic enterprise security",
- "aliases": []
+ "aliases": [],
+ "allowed_with": ["External"]
},
{
"name": "Internal",
- "level": 2,
"description": "Internal systems, can handle company IP information",
- "aliases": []
+ "aliases": [],
+ "allowed_with": ["Internal"]
},
{
"name": "SOC2",
- "level": 3,
"description": "SOC 2 Type II compliant systems",
- "aliases": ["SOC-2", "SOC 2"]
+ "aliases": ["SOC-2", "SOC 2"],
+ "allowed_with": ["SOC2"]
},
{
"name": "HIPAA",
- "level": 4,
"description": "HIPAA compliant systems for healthcare data",
- "aliases": ["HIPAA-Compliant"]
+ "aliases": ["HIPAA-Compliant"],
+ "allowed_with": ["HIPAA", "SOC2"]
},
{
"name": "FedRAMP",
- "level": 5,
"description": "FedRAMP authorized systems for government data",
- "aliases": ["FedRAMP-Moderate", "FedRAMP-High"]
+ "aliases": ["FedRAMP-Moderate", "FedRAMP-High"],
+ "allowed_with": ["FedRAMP", "SOC2"]
}
],
- "hierarchy_mode": "inclusive"
+ "mode": "explicit_allowlist",
+ "mode_description": "Each compliance level explicitly defines which other levels can be used in the same session."
}
```
-### Hierarchical Access
+### Explicit Allowlist Model
-In **inclusive mode** (default), higher compliance levels can access resources at their level and all lower levels:
-- **FedRAMP (5)** can use: Public, External, Internal, SOC2, HIPAA, FedRAMP
-- **HIPAA (4)** can use: Public, External, Internal, SOC2, HIPAA
-- **SOC2 (3)** can use: Public, External, Internal, SOC2
-- **Internal (2)** can use: Public, External, Internal
-- **External (1)** can use: Public, External
-- **Public (0)** can use: Public only
+Each compliance level has an `allowed_with` array that explicitly defines which compliance levels can be used together in the same session:
+
+- **Public** sessions can use: Public resources only
+- **External** sessions can use: External resources only
+- **Internal** sessions can use: Internal resources only
+- **SOC2** sessions can use: SOC2 resources only
+- **HIPAA** sessions can use: HIPAA and SOC2 resources
+- **FedRAMP** sessions can use: FedRAMP and SOC2 resources
+
+### Why Explicit Allowlist?
+
+The allowlist model prevents dangerous resource combinations:
+
+**Problem with hierarchical model:**
+- If HIPAA (high security) could access Public (low security) resources
+- A HIPAA session could use public internet search tools
+- Search queries containing patient PII could leak to public services
+
+**Solution with allowlist:**
+- HIPAA explicitly allows only HIPAA and SOC2
+- Public internet search tools are excluded
+- Prevents accidental PII leakage
+
+Administrators have full control over which combinations are safe for their environment by editing the `allowed_with` arrays.
Resources without a compliance_level are accessible by all levels (backward compatibility).
From 15c008e080998925e1d7bc996ae218cab67dec94 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 1 Nov 2025 20:09:52 +0000
Subject: [PATCH 17/24] Add comprehensive tests for compliance level filtering
Backend tests (19 new tests in test_compliance_manager.py):
- Test configuration loading and validation
- Test canonical name resolution and aliases
- Test compliance level validation
- Test allowlist-based access control
- Test accessible levels calculation
- Test permissive mode when no config exists
Frontend tests (10 new tests in compliance.test.jsx):
- Test allowlist-based access logic
- Test HIPAA accessing only HIPAA and SOC2
- Test Public isolation (only Public resources)
- Test FedRAMP allowlist (FedRAMP + SOC2)
- Test None/unset permissive behavior
- Test tool filtering by compliance level
- Test security - HIPAA cannot access Public (prevents PII leakage)
- Test allowlist is not bidirectional
- Test prevention of mixing security environments
Total: 29 new tests (19 backend + 10 frontend)
All tests passing: Backend 23/23, Frontend 10/10
Co-authored-by: garland3 <1162675+garland3@users.noreply.github.com>
---
backend/tests/test_compliance_manager.py | 251 +++++++++++++++++++++++
frontend/src/test/compliance.test.jsx | 166 +++++++++++++++
2 files changed, 417 insertions(+)
create mode 100644 backend/tests/test_compliance_manager.py
create mode 100644 frontend/src/test/compliance.test.jsx
diff --git a/backend/tests/test_compliance_manager.py b/backend/tests/test_compliance_manager.py
new file mode 100644
index 0000000..8b5768b
--- /dev/null
+++ b/backend/tests/test_compliance_manager.py
@@ -0,0 +1,251 @@
+"""Comprehensive tests for ComplianceLevelManager."""
+
+import json
+import pytest
+from pathlib import Path
+from tempfile import TemporaryDirectory
+from backend.core.compliance import ComplianceLevelManager, ComplianceLevel
+
+
+@pytest.fixture
+def sample_compliance_config():
+ """Sample compliance level configuration."""
+ return {
+ "version": "2.0",
+ "mode": "explicit_allowlist",
+ "levels": [
+ {
+ "name": "Public",
+ "description": "Publicly accessible",
+ "aliases": ["public"],
+ "allowed_with": ["Public"]
+ },
+ {
+ "name": "External",
+ "description": "External services",
+ "aliases": ["ext"],
+ "allowed_with": ["External"]
+ },
+ {
+ "name": "Internal",
+ "description": "Internal systems",
+ "aliases": ["int"],
+ "allowed_with": ["Internal"]
+ },
+ {
+ "name": "SOC2",
+ "description": "SOC 2 compliant",
+ "aliases": ["SOC-2", "SOC 2"],
+ "allowed_with": ["SOC2"]
+ },
+ {
+ "name": "HIPAA",
+ "description": "HIPAA compliant",
+ "aliases": ["HIPAA-Compliant"],
+ "allowed_with": ["HIPAA", "SOC2"]
+ },
+ {
+ "name": "FedRAMP",
+ "description": "FedRAMP authorized",
+ "aliases": ["FedRAMP-Moderate"],
+ "allowed_with": ["FedRAMP", "SOC2"]
+ }
+ ]
+ }
+
+
+@pytest.fixture
+def temp_compliance_config(sample_compliance_config):
+ """Create a temporary compliance config file."""
+ with TemporaryDirectory() as tmpdir:
+ config_path = Path(tmpdir) / "compliance-levels.json"
+ with open(config_path, 'w', encoding='utf-8') as f:
+ json.dump(sample_compliance_config, f)
+ yield config_path
+
+
+class TestComplianceLevelManager:
+ """Tests for ComplianceLevelManager class."""
+
+ def test_load_config_success(self, temp_compliance_config):
+ """Test loading a valid compliance configuration."""
+ manager = ComplianceLevelManager(temp_compliance_config)
+
+ assert len(manager.levels) == 6
+ assert "Public" in manager.levels
+ assert "HIPAA" in manager.levels
+ assert "FedRAMP" in manager.levels
+ assert manager.mode == "explicit_allowlist"
+
+ def test_load_config_missing_file(self):
+ """Test handling of missing config file."""
+ manager = ComplianceLevelManager(Path("/nonexistent/path.json"))
+
+ # Should not crash, should have empty levels
+ assert len(manager.levels) == 0
+
+ def test_get_canonical_name_exact_match(self, temp_compliance_config):
+ """Test getting canonical name with exact match."""
+ manager = ComplianceLevelManager(temp_compliance_config)
+
+ assert manager.get_canonical_name("Public") == "Public"
+ assert manager.get_canonical_name("HIPAA") == "HIPAA"
+ assert manager.get_canonical_name("SOC2") == "SOC2"
+
+ def test_get_canonical_name_alias(self, temp_compliance_config):
+ """Test getting canonical name from alias."""
+ manager = ComplianceLevelManager(temp_compliance_config)
+
+ assert manager.get_canonical_name("SOC 2") == "SOC2"
+ assert manager.get_canonical_name("SOC-2") == "SOC2"
+ assert manager.get_canonical_name("HIPAA-Compliant") == "HIPAA"
+ assert manager.get_canonical_name("FedRAMP-Moderate") == "FedRAMP"
+
+ def test_get_canonical_name_invalid(self, temp_compliance_config):
+ """Test getting canonical name for invalid level."""
+ manager = ComplianceLevelManager(temp_compliance_config)
+
+ assert manager.get_canonical_name("Invalid") is None
+ assert manager.get_canonical_name("SOCII") is None
+ assert manager.get_canonical_name(None) is None
+
+ def test_validate_compliance_level_valid(self, temp_compliance_config):
+ """Test validation of valid compliance levels."""
+ manager = ComplianceLevelManager(temp_compliance_config)
+
+ assert manager.validate_compliance_level("Public") == "Public"
+ assert manager.validate_compliance_level("HIPAA") == "HIPAA"
+ assert manager.validate_compliance_level("SOC2") == "SOC2"
+
+ def test_validate_compliance_level_alias(self, temp_compliance_config):
+ """Test validation with alias (should return canonical name)."""
+ manager = ComplianceLevelManager(temp_compliance_config)
+
+ assert manager.validate_compliance_level("SOC 2") == "SOC2"
+ assert manager.validate_compliance_level("SOC-2") == "SOC2"
+ assert manager.validate_compliance_level("HIPAA-Compliant") == "HIPAA"
+
+ def test_validate_compliance_level_invalid(self, temp_compliance_config):
+ """Test validation of invalid compliance level (should return None and log)."""
+ manager = ComplianceLevelManager(temp_compliance_config)
+
+ assert manager.validate_compliance_level("InvalidLevel") is None
+ assert manager.validate_compliance_level("SOCII") is None
+ assert manager.validate_compliance_level("") is None
+ assert manager.validate_compliance_level(None) is None
+
+ def test_is_accessible_same_level(self, temp_compliance_config):
+ """Test access control when user and resource have same level."""
+ manager = ComplianceLevelManager(temp_compliance_config)
+
+ # Each level can access itself
+ assert manager.is_accessible("Public", "Public") is True
+ assert manager.is_accessible("Internal", "Internal") is True
+ assert manager.is_accessible("HIPAA", "HIPAA") is True
+
+ def test_is_accessible_different_level_not_allowed(self, temp_compliance_config):
+ """Test access control when different levels are not in allowlist."""
+ manager = ComplianceLevelManager(temp_compliance_config)
+
+ # Public cannot access HIPAA
+ assert manager.is_accessible("Public", "HIPAA") is False
+
+ # HIPAA cannot access Public (security!)
+ assert manager.is_accessible("HIPAA", "Public") is False
+
+ # Internal cannot access External
+ assert manager.is_accessible("Internal", "External") is False
+
+ def test_is_accessible_allowlist_grants_access(self, temp_compliance_config):
+ """Test access control when allowlist grants access."""
+ manager = ComplianceLevelManager(temp_compliance_config)
+
+ # HIPAA can access SOC2 (in allowlist)
+ assert manager.is_accessible("HIPAA", "SOC2") is True
+
+ # FedRAMP can access SOC2 (in allowlist)
+ assert manager.is_accessible("FedRAMP", "SOC2") is True
+
+ def test_is_accessible_one_sided_allowlist(self, temp_compliance_config):
+ """Test that allowlist is not bidirectional."""
+ manager = ComplianceLevelManager(temp_compliance_config)
+
+ # HIPAA can access SOC2
+ assert manager.is_accessible("HIPAA", "SOC2") is True
+
+ # But SOC2 cannot access HIPAA (not in SOC2's allowlist)
+ assert manager.is_accessible("SOC2", "HIPAA") is False
+
+ def test_is_accessible_none_is_permissive(self, temp_compliance_config):
+ """Test that None (unset) compliance level is always accessible."""
+ manager = ComplianceLevelManager(temp_compliance_config)
+
+ # None user can access any resource
+ assert manager.is_accessible(None, "HIPAA") is True
+ assert manager.is_accessible(None, "Public") is True
+
+ # Any user can access None resource
+ assert manager.is_accessible("HIPAA", None) is True
+ assert manager.is_accessible("Public", None) is True
+
+ # None to None
+ assert manager.is_accessible(None, None) is True
+
+ def test_get_accessible_levels_public(self, temp_compliance_config):
+ """Test getting accessible levels for Public."""
+ manager = ComplianceLevelManager(temp_compliance_config)
+
+ accessible = manager.get_accessible_levels("Public")
+
+ assert accessible == {"Public"}
+
+ def test_get_accessible_levels_hipaa(self, temp_compliance_config):
+ """Test getting accessible levels for HIPAA."""
+ manager = ComplianceLevelManager(temp_compliance_config)
+
+ accessible = manager.get_accessible_levels("HIPAA")
+
+ assert accessible == {"HIPAA", "SOC2"}
+
+ def test_get_accessible_levels_fedramp(self, temp_compliance_config):
+ """Test getting accessible levels for FedRAMP."""
+ manager = ComplianceLevelManager(temp_compliance_config)
+
+ accessible = manager.get_accessible_levels("FedRAMP")
+
+ assert accessible == {"FedRAMP", "SOC2"}
+
+ def test_get_accessible_levels_none(self, temp_compliance_config):
+ """Test getting accessible levels when user level is None."""
+ manager = ComplianceLevelManager(temp_compliance_config)
+
+ accessible = manager.get_accessible_levels(None)
+
+ # Should return all levels
+ assert len(accessible) == 6
+ assert "Public" in accessible
+ assert "HIPAA" in accessible
+
+ def test_get_all_levels(self, temp_compliance_config):
+ """Test getting all defined compliance levels."""
+ manager = ComplianceLevelManager(temp_compliance_config)
+
+ all_levels = manager.get_all_levels()
+
+ assert len(all_levels) == 6
+ assert "Public" in all_levels
+ assert "External" in all_levels
+ assert "Internal" in all_levels
+ assert "SOC2" in all_levels
+ assert "HIPAA" in all_levels
+ assert "FedRAMP" in all_levels
+
+ def test_permissive_mode_no_config(self):
+ """Test permissive mode when no config is loaded."""
+ manager = ComplianceLevelManager(Path("/nonexistent"))
+
+ # Should validate anything in permissive mode
+ assert manager.validate_compliance_level("AnyLevel") == "AnyLevel"
+
+ # Should allow all access
+ assert manager.is_accessible("Level1", "Level2") is True
diff --git a/frontend/src/test/compliance.test.jsx b/frontend/src/test/compliance.test.jsx
new file mode 100644
index 0000000..28f29dc
--- /dev/null
+++ b/frontend/src/test/compliance.test.jsx
@@ -0,0 +1,166 @@
+/**
+ * Comprehensive tests for compliance level filtering functionality
+ */
+
+import { describe, it, expect } from 'vitest';
+
+describe('Compliance Level Filtering', () => {
+ describe('Compliance Level Accessibility Logic', () => {
+ const complianceLevels = {
+ levels: [
+ { name: 'Public', allowed_with: ['Public'] },
+ { name: 'External', allowed_with: ['External'] },
+ { name: 'Internal', allowed_with: ['Internal'] },
+ { name: 'SOC2', allowed_with: ['SOC2'] },
+ { name: 'HIPAA', allowed_with: ['HIPAA', 'SOC2'] },
+ { name: 'FedRAMP', allowed_with: ['FedRAMP', 'SOC2'] }
+ ]
+ };
+
+ // Helper function to simulate isComplianceAccessible
+ const isAccessible = (userLevel, resourceLevel, levels) => {
+ if (!userLevel || !resourceLevel) return true;
+
+ const userLevelObj = levels.levels.find(l => l.name === userLevel);
+ if (!userLevelObj) return true;
+
+ return userLevelObj.allowed_with.includes(resourceLevel);
+ };
+
+ it('should allow Public to access only Public resources', () => {
+ expect(isAccessible('Public', 'Public', complianceLevels)).toBe(true);
+ expect(isAccessible('Public', 'HIPAA', complianceLevels)).toBe(false);
+ expect(isAccessible('Public', 'External', complianceLevels)).toBe(false);
+ });
+
+ it('should allow HIPAA to access HIPAA and SOC2 resources', () => {
+ expect(isAccessible('HIPAA', 'HIPAA', complianceLevels)).toBe(true);
+ expect(isAccessible('HIPAA', 'SOC2', complianceLevels)).toBe(true);
+ expect(isAccessible('HIPAA', 'Public', complianceLevels)).toBe(false);
+ expect(isAccessible('HIPAA', 'Internal', complianceLevels)).toBe(false);
+ });
+
+ it('should allow FedRAMP to access FedRAMP and SOC2 resources', () => {
+ expect(isAccessible('FedRAMP', 'FedRAMP', complianceLevels)).toBe(true);
+ expect(isAccessible('FedRAMP', 'SOC2', complianceLevels)).toBe(true);
+ expect(isAccessible('FedRAMP', 'HIPAA', complianceLevels)).toBe(false);
+ expect(isAccessible('FedRAMP', 'Public', complianceLevels)).toBe(false);
+ });
+
+ it('should prevent HIPAA from accessing Public resources (security)', () => {
+ // Critical security test - HIPAA should NOT access Public
+ // Prevents PII leakage through public internet search
+ expect(isAccessible('HIPAA', 'Public', complianceLevels)).toBe(false);
+ });
+
+ it('should allow None (unset) to be permissive', () => {
+ // None user can access any resource
+ expect(isAccessible(null, 'HIPAA', complianceLevels)).toBe(true);
+ expect(isAccessible(null, 'Public', complianceLevels)).toBe(true);
+
+ // Any user can access None resource
+ expect(isAccessible('HIPAA', null, complianceLevels)).toBe(true);
+ expect(isAccessible('Public', null, complianceLevels)).toBe(true);
+
+ // None to None
+ expect(isAccessible(null, null, complianceLevels)).toBe(true);
+ });
+
+ it('should filter tools by compliance level allowlist', () => {
+ const tools = [
+ { name: 'public-tool', compliance_level: 'Public' },
+ { name: 'internal-tool', compliance_level: 'Internal' },
+ { name: 'soc2-tool', compliance_level: 'SOC2' },
+ { name: 'hipaa-tool', compliance_level: 'HIPAA' },
+ { name: 'no-compliance-tool', compliance_level: null }
+ ];
+
+ // Filter tools for HIPAA user
+ const hipaaTools = tools.filter(tool =>
+ isAccessible('HIPAA', tool.compliance_level, complianceLevels)
+ );
+
+ expect(hipaaTools.map(t => t.name)).toContain('hipaa-tool');
+ expect(hipaaTools.map(t => t.name)).toContain('soc2-tool');
+ expect(hipaaTools.map(t => t.name)).toContain('no-compliance-tool');
+ expect(hipaaTools.map(t => t.name)).not.toContain('public-tool');
+ expect(hipaaTools.map(t => t.name)).not.toContain('internal-tool');
+ });
+
+ it('should filter tools for Public user (only Public + unset)', () => {
+ const tools = [
+ { name: 'public-tool', compliance_level: 'Public' },
+ { name: 'internal-tool', compliance_level: 'Internal' },
+ { name: 'hipaa-tool', compliance_level: 'HIPAA' },
+ { name: 'no-compliance-tool', compliance_level: null }
+ ];
+
+ const publicTools = tools.filter(tool =>
+ isAccessible('Public', tool.compliance_level, complianceLevels)
+ );
+
+ expect(publicTools.map(t => t.name)).toContain('public-tool');
+ expect(publicTools.map(t => t.name)).toContain('no-compliance-tool');
+ expect(publicTools.map(t => t.name)).not.toContain('internal-tool');
+ expect(publicTools.map(t => t.name)).not.toContain('hipaa-tool');
+ });
+
+ it('should show all tools when no compliance filter is set', () => {
+ const tools = [
+ { name: 'public-tool', compliance_level: 'Public' },
+ { name: 'internal-tool', compliance_level: 'Internal' },
+ { name: 'hipaa-tool', compliance_level: 'HIPAA' }
+ ];
+
+ const allTools = tools.filter(tool =>
+ isAccessible(null, tool.compliance_level, complianceLevels)
+ );
+
+ expect(allTools.length).toBe(3);
+ });
+ });
+
+ describe('Allowlist Model Security', () => {
+ it('should ensure allowlist is not bidirectional', () => {
+ const levels = {
+ levels: [
+ { name: 'SOC2', allowed_with: ['SOC2'] },
+ { name: 'HIPAA', allowed_with: ['HIPAA', 'SOC2'] }
+ ]
+ };
+
+ const isAccessible = (userLevel, resourceLevel, levels) => {
+ if (!userLevel || !resourceLevel) return true;
+ const userLevelObj = levels.levels.find(l => l.name === userLevel);
+ if (!userLevelObj) return true;
+ return userLevelObj.allowed_with.includes(resourceLevel);
+ };
+
+ // HIPAA can access SOC2
+ expect(isAccessible('HIPAA', 'SOC2', levels)).toBe(true);
+
+ // But SOC2 cannot access HIPAA (not bidirectional)
+ expect(isAccessible('SOC2', 'HIPAA', levels)).toBe(false);
+ });
+
+ it('should prevent mixing data from different security environments', () => {
+ const levels = {
+ levels: [
+ { name: 'Public', allowed_with: ['Public'] },
+ { name: 'HIPAA', allowed_with: ['HIPAA', 'SOC2'] }
+ ]
+ };
+
+ const isAccessible = (userLevel, resourceLevel, levels) => {
+ if (!userLevel || !resourceLevel) return true;
+ const userLevelObj = levels.levels.find(l => l.name === userLevel);
+ if (!userLevelObj) return true;
+ return userLevelObj.allowed_with.includes(resourceLevel);
+ };
+
+ // Public and HIPAA should NOT mix
+ expect(isAccessible('Public', 'HIPAA', levels)).toBe(false);
+ expect(isAccessible('HIPAA', 'Public', levels)).toBe(false);
+ });
+ });
+});
From 654e31b674d12c08f5c89720801b3ebf4cd9d915 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 1 Nov 2025 20:25:42 +0000
Subject: [PATCH 18/24] Fix compliance filtering and centralize dropdown in
header
- Add example compliance-levels.json to config/overrides folder
- Move compliance level dropdown to Header (single source of truth)
- Remove compliance dropdowns from ToolsPanel and RagPanel
- Implement STRICT filtering: when compliance level selected, only resources with matching compliance_level show
- Resources without compliance_level are hidden when filter is active (prevents Public MCPs showing in SOC2 sessions)
- Update MarketplaceContext isComplianceAccessible to enforce strict mode
- Update Header model filtering to use strict mode
- Update frontend tests to reflect strict filtering behavior
- Frontend build passes successfully
Co-authored-by: garland3 <1162675+garland3@users.noreply.github.com>
---
config/overrides/compliance-levels.json | 44 ++++++++++++++++++++
frontend/src/components/Header.jsx | 34 ++++++++-------
frontend/src/components/RagPanel.jsx | 22 ----------
frontend/src/components/ToolsPanel.jsx | 23 ----------
frontend/src/contexts/MarketplaceContext.jsx | 16 +++----
frontend/src/test/compliance.test.jsx | 36 +++++++++-------
6 files changed, 92 insertions(+), 83 deletions(-)
create mode 100644 config/overrides/compliance-levels.json
diff --git a/config/overrides/compliance-levels.json b/config/overrides/compliance-levels.json
new file mode 100644
index 0000000..5ca0439
--- /dev/null
+++ b/config/overrides/compliance-levels.json
@@ -0,0 +1,44 @@
+{
+ "version": "2.0",
+ "description": "Override compliance level definitions for your environment. This file allows customization of compliance levels and their allowed combinations.",
+ "levels": [
+ {
+ "name": "Public",
+ "description": "Publicly accessible data, no restrictions. Use for public-facing applications.",
+ "aliases": [],
+ "allowed_with": ["Public"]
+ },
+ {
+ "name": "External",
+ "description": "External services with basic enterprise security (e.g., OpenAI, Anthropic)",
+ "aliases": [],
+ "allowed_with": ["External"]
+ },
+ {
+ "name": "Internal",
+ "description": "Internal systems that can handle company IP information",
+ "aliases": [],
+ "allowed_with": ["Internal"]
+ },
+ {
+ "name": "SOC2",
+ "description": "SOC 2 Type II compliant systems",
+ "aliases": ["SOC-2", "SOC 2"],
+ "allowed_with": ["SOC2"]
+ },
+ {
+ "name": "HIPAA",
+ "description": "HIPAA compliant systems for healthcare data. Can also use SOC2 resources.",
+ "aliases": ["HIPAA-Compliant"],
+ "allowed_with": ["HIPAA", "SOC2"]
+ },
+ {
+ "name": "FedRAMP",
+ "description": "FedRAMP authorized systems for government data. Can also use SOC2 resources.",
+ "aliases": ["FedRAMP-Moderate", "FedRAMP-High"],
+ "allowed_with": ["FedRAMP", "SOC2"]
+ }
+ ],
+ "mode": "explicit_allowlist",
+ "mode_description": "Each compliance level explicitly defines which other levels can be used in the same session. For example, HIPAA can use HIPAA and SOC2 resources, but not Public or External to prevent data leakage."
+}
diff --git a/frontend/src/components/Header.jsx b/frontend/src/components/Header.jsx
index f3d7c1b..b22b4fe 100644
--- a/frontend/src/components/Header.jsx
+++ b/frontend/src/components/Header.jsx
@@ -24,10 +24,13 @@ const Header = ({ onToggleRag, onToggleTools, onToggleFiles, onToggleCanvas, onC
complianceLevelFilter,
setComplianceLevelFilter
} = useChat()
- const { isComplianceAccessible } = useMarketplace()
+ const { isComplianceAccessible, complianceLevels } = useMarketplace()
const { connectionStatus, isConnected } = useWS()
const [dropdownOpen, setDropdownOpen] = useState(false)
const [downloadDropdownOpen, setDownloadDropdownOpen] = useState(false)
+
+ // Extract unique compliance levels from all available tools and prompts
+ const availableComplianceLevels = complianceLevels.map(l => l.name)
const handleModelSelect = (model) => {
setCurrentModel(model)
@@ -122,9 +125,7 @@ const Header = ({ onToggleRag, onToggleTools, onToggleFiles, onToggleCanvas, onC
const filteredModels = complianceEnabled && complianceLevelFilter
? models.filter(m => {
const model = typeof m === 'string' ? { name: m } : m
- // Include models without compliance_level (backward compatible)
- if (!model.compliance_level) return true
- // Use hierarchical filtering
+ // STRICT MODE: When compliance filter is active, only show models with matching compliance levels
return isComplianceAccessible(complianceLevelFilter, model.compliance_level)
})
: models
@@ -204,18 +205,21 @@ const Header = ({ onToggleRag, onToggleTools, onToggleFiles, onToggleCanvas, onC
)}