decision_agent 0.2.0 → 1.0.1

data/lib/decision_agent/web/server.rb

@@ -12,6 +12,10 @@ require_relative "../testing/test_coverage_analyzer"
 require_relative "../evaluators/json_rule_evaluator"
 require_relative "../agent"
 
+# DMN components
+require_relative "../dmn/importer"
+require_relative "../dmn/exporter"
+
 # Auth components
 require_relative "../auth/user"
 require_relative "../auth/role"
@@ -24,6 +28,15 @@ require_relative "../auth/access_audit_logger"
 require_relative "middleware/auth_middleware"
 require_relative "middleware/permission_middleware"
 
+# Simulation components
+require_relative "../simulation/replay_engine"
+require_relative "../simulation/what_if_analyzer"
+require_relative "../simulation/impact_analyzer"
+require_relative "../simulation/shadow_test_engine"
+require_relative "../simulation/scenario_engine"
+require_relative "../simulation/scenario_library"
+require_relative "../versioning/version_manager"
+
 module DecisionAgent
   module Web
     # rubocop:disable Metrics/ClassLength
@@ -37,25 +50,27 @@ module DecisionAgent
       @batch_test_storage = {}
       @batch_test_storage_mutex = Mutex.new
 
+      # In-memory storage for simulation runs
+      @simulation_storage = {}
+      @simulation_storage_mutex = Mutex.new
+
       # Auth components
       @authenticator = nil
       @permission_checker = nil
       @access_audit_logger = nil
-
-      def self.batch_test_storage
-        @batch_test_storage ||= {}
-      end
-
-      def self.batch_test_storage_mutex
-        @batch_test_storage_mutex ||= Mutex.new
-      end
+      @auth_mutex = Mutex.new
 
       class << self
+        attr_reader :batch_test_storage, :batch_test_storage_mutex, :simulation_storage, :simulation_storage_mutex
         attr_writer :authenticator
       end
 
       def self.authenticator
-        @authenticator ||= Auth::Authenticator.new
+        return @authenticator if @authenticator
+
+        @auth_mutex.synchronize do
+          @authenticator ||= Auth::Authenticator.new
+        end
       end
 
       class << self
@@ -63,7 +78,11 @@ module DecisionAgent
       end
 
       def self.permission_checker
-        @permission_checker ||= Auth::PermissionChecker.new(adapter: DecisionAgent.rbac_config.adapter)
+        return @permission_checker if @permission_checker
+
+        @auth_mutex.synchronize do
+          @permission_checker ||= Auth::PermissionChecker.new(adapter: DecisionAgent.rbac_config.adapter)
+        end
       end
 
       class << self
@@ -71,7 +90,11 @@ module DecisionAgent
       end
 
       def self.access_audit_logger
-        @access_audit_logger ||= Auth::AccessAuditLogger.new
+        return @access_audit_logger if @access_audit_logger
+
+        @auth_mutex.synchronize do
+          @access_audit_logger ||= Auth::AccessAuditLogger.new
+        end
       end
 
       # Enable CORS for API calls
@@ -200,19 +223,55 @@ module DecisionAgent
           result = evaluator.evaluate(DecisionAgent::Context.new(context))
 
           if result
-            {
-              success: true,
-              decision: result.decision,
-              weight: result.weight,
-              reason: result.reason,
-              evaluator_name: result.evaluator_name,
-              metadata: result.metadata
-            }.to_json
+            # Get explainability data from metadata if available
+            explainability = result.metadata[:explainability] if result.metadata.is_a?(Hash)
+
+            # Structure response as explainability by default
+            # This makes explainability the primary format for decision results
+            response = if explainability
+                         {
+                           success: true,
+                           decision: explainability[:decision] || result.decision,
+                           because: explainability[:because] || [],
+                           failed_conditions: explainability[:failed_conditions] || [],
+                           # Include additional metadata for completeness
+                           confidence: result.weight,
+                           reason: result.reason,
+                           evaluator_name: result.evaluator_name,
+                           # Full explainability data (includes rule_traces in verbose mode)
+                           explainability: explainability
+                         }
+                       else
+                         # Fallback if explainability is not available
+                         {
+                           success: true,
+                           decision: result.decision,
+                           because: [],
+                           failed_conditions: [],
+                           confidence: result.weight,
+                           reason: result.reason,
+                           evaluator_name: result.evaluator_name,
+                           explainability: {
+                             decision: result.decision,
+                             because: [],
+                             failed_conditions: []
+                           }
+                         }
+                       end
+
+            response.to_json
           else
             {
               success: true,
               decision: nil,
-              message: "No rules matched the given context"
+              because: [],
+              failed_conditions: [],
+              message: "No rules matched the given context",
+              explainability: {
+                decision: nil,
+                because: [],
+                failed_conditions: []
+              }
             }.to_json
           end
         rescue StandardError => e
@@ -1141,6 +1200,516 @@ module DecisionAgent
         "Batch testing page not found"
       end
 
+      # Simulation API Endpoints
+
+      # POST /api/simulation/replay - Historical replay/backtesting
+      post "/api/simulation/replay" do
+        content_type :json
+
+        begin
+          request_body = request.body.read
+          data = request_body.empty? ? {} : JSON.parse(request_body)
+
+          historical_data = data["historical_data"]
+          rule_version = data["rule_version"]
+          compare_with = data["compare_with"]
+          options = data["options"] || {}
+
+          unless historical_data
+            status 400
+            return { error: "historical_data is required" }.to_json
+          end
+
+          # Get rules for agent creation
+          rules_json = data["rules"]
+          unless rules_json
+            status 400
+            return { error: "rules JSON is required" }.to_json
+          end
+
+          # Create agent
+          evaluator = DecisionAgent::Evaluators::JsonRuleEvaluator.new(rules_json: rules_json)
+          agent = DecisionAgent::Agent.new(evaluators: [evaluator])
+          version_manager = DecisionAgent::Versioning::VersionManager.new
+
+          # Create replay engine
+          replay_engine = DecisionAgent::Simulation::ReplayEngine.new(
+            agent: agent,
+            version_manager: version_manager
+          )
+
+          # Convert historical data if it's a file path (for future file upload support)
+          contexts = if historical_data.is_a?(Array)
+                       historical_data
+                     else
+                       # Assume it's a file path - load it
+                       raise ArgumentError, "File not found: #{historical_data}" unless File.exist?(historical_data)
+
+                       if historical_data.end_with?(".json")
+                         JSON.parse(File.read(historical_data))
+                       elsif historical_data.end_with?(".csv")
+                         # Simple CSV parsing
+                         require "csv"
+                         csv_data = CSV.read(historical_data, headers: true)
+                         csv_data.map(&:to_h)
+                       else
+                         raise ArgumentError, "Unsupported file format"
+                       end
+
+                     end
+
+          # Execute replay
+          results = if compare_with
+                      replay_engine.replay(
+                        historical_data: contexts,
+                        rule_version: rule_version,
+                        compare_with: compare_with
+                      )
+                    else
+                      replay_engine.replay(
+                        historical_data: contexts,
+                        rule_version: rule_version,
+                        options: options
+                      )
+                    end
+
+          # Store results
+          replay_id = SecureRandom.uuid
+          self.class.simulation_storage_mutex.synchronize do
+            self.class.simulation_storage[replay_id] = {
+              id: replay_id,
+              type: "replay",
+              status: "completed",
+              created_at: Time.now.utc.iso8601,
+              results: results
+            }
+          end
+
+          {
+            replay_id: replay_id,
+            results: results
+          }.to_json
+        rescue StandardError => e
+          status 500
+          { error: "Replay failed: #{e.message}" }.to_json
+        end
+      end
+
+      # POST /api/simulation/whatif - What-if analysis
+      post "/api/simulation/whatif" do
+        content_type :json
+
+        begin
+          request_body = request.body.read
+          data = request_body.empty? ? {} : JSON.parse(request_body)
+
+          scenarios = data["scenarios"]
+          rule_version = data["rule_version"]
+          options = data["options"] || {}
+
+          unless scenarios.is_a?(Array)
+            status 400
+            return { error: "scenarios array is required" }.to_json
+          end
+
+          # Get rules for agent creation
+          rules_json = data["rules"]
+          unless rules_json
+            status 400
+            return { error: "rules JSON is required" }.to_json
+          end
+
+          # Create agent
+          evaluator = DecisionAgent::Evaluators::JsonRuleEvaluator.new(rules_json: rules_json)
+          agent = DecisionAgent::Agent.new(evaluators: [evaluator])
+          version_manager = DecisionAgent::Versioning::VersionManager.new
+
+          # Create what-if analyzer
+          analyzer = DecisionAgent::Simulation::WhatIfAnalyzer.new(
+            agent: agent,
+            version_manager: version_manager
+          )
+
+          # Execute analysis
+          results = analyzer.analyze(
+            scenarios: scenarios,
+            rule_version: rule_version,
+            options: options
+          )
+
+          # Store results
+          analysis_id = SecureRandom.uuid
+          self.class.simulation_storage_mutex.synchronize do
+            self.class.simulation_storage[analysis_id] = {
+              id: analysis_id,
+              type: "whatif",
+              status: "completed",
+              created_at: Time.now.utc.iso8601,
+              results: results
+            }
+          end
+
+          {
+            analysis_id: analysis_id,
+            results: results
+          }.to_json
+        rescue StandardError => e
+          status 500
+          { error: "What-if analysis failed: #{e.message}" }.to_json
+        end
+      end
+
+      # POST /api/simulation/whatif/sensitivity - Sensitivity analysis
+      post "/api/simulation/whatif/sensitivity" do
+        content_type :json
+
+        begin
+          request_body = request.body.read
+          data = request_body.empty? ? {} : JSON.parse(request_body)
+
+          base_scenario = data["base_scenario"]
+          variations = data["variations"]
+          rule_version = data["rule_version"]
+
+          unless base_scenario && variations
+            status 400
+            return { error: "base_scenario and variations are required" }.to_json
+          end
+
+          # Get rules for agent creation
+          rules_json = data["rules"]
+          unless rules_json
+            status 400
+            return { error: "rules JSON is required" }.to_json
+          end
+
+          # Create agent
+          evaluator = DecisionAgent::Evaluators::JsonRuleEvaluator.new(rules_json: rules_json)
+          agent = DecisionAgent::Agent.new(evaluators: [evaluator])
+          version_manager = DecisionAgent::Versioning::VersionManager.new
+
+          # Create what-if analyzer
+          analyzer = DecisionAgent::Simulation::WhatIfAnalyzer.new(
+            agent: agent,
+            version_manager: version_manager
+          )
+
+          # Execute sensitivity analysis
+          results = analyzer.sensitivity_analysis(
+            base_scenario: base_scenario,
+            variations: variations,
+            rule_version: rule_version
+          )
+
+          {
+            results: results
+          }.to_json
+        rescue StandardError => e
+          status 500
+          { error: "Sensitivity analysis failed: #{e.message}" }.to_json
+        end
+      end
+
+      # POST /api/simulation/impact - Impact analysis
+      post "/api/simulation/impact" do
+        content_type :json
+
+        begin
+          request_body = request.body.read
+          data = request_body.empty? ? {} : JSON.parse(request_body)
+
+          baseline_version = data["baseline_version"]
+          proposed_version = data["proposed_version"]
+          test_data = data["test_data"]
+          options = data["options"] || {}
+
+          unless baseline_version && proposed_version && test_data
+            status 400
+            return { error: "baseline_version, proposed_version, and test_data are required" }.to_json
+          end
+
+          version_manager = DecisionAgent::Versioning::VersionManager.new
+
+          # Create impact analyzer
+          analyzer = DecisionAgent::Simulation::ImpactAnalyzer.new(
+            version_manager: version_manager
+          )
+
+          # Execute impact analysis
+          results = analyzer.analyze(
+            baseline_version: baseline_version,
+            proposed_version: proposed_version,
+            test_data: test_data,
+            options: options
+          )
+
+          # Store results
+          impact_id = SecureRandom.uuid
+          self.class.simulation_storage_mutex.synchronize do
+            self.class.simulation_storage[impact_id] = {
+              id: impact_id,
+              type: "impact",
+              status: "completed",
+              created_at: Time.now.utc.iso8601,
+              results: results
+            }
+          end
+
+          {
+            impact_id: impact_id,
+            results: results
+          }.to_json
+        rescue StandardError => e
+          status 500
+          { error: "Impact analysis failed: #{e.message}" }.to_json
+        end
+      end
+
+      # POST /api/simulation/shadow - Shadow testing
+      post "/api/simulation/shadow" do
+        content_type :json
+
+        begin
+          request_body = request.body.read
+          data = request_body.empty? ? {} : JSON.parse(request_body)
+
+          context = data["context"]
+          shadow_version = data["shadow_version"]
+          production_rules = data["production_rules"]
+          shadow_rules = data["shadow_rules"]
+          options = data["options"] || {}
+
+          unless context
+            status 400
+            return { error: "context is required" }.to_json
+          end
+
+          unless (production_rules && shadow_rules) || shadow_version
+            status 400
+            return { error: "Either (production_rules and shadow_rules) or shadow_version is required" }.to_json
+          end
+
+          version_manager = DecisionAgent::Versioning::VersionManager.new
+
+          # Create production agent
+          if production_rules
+            prod_evaluator = DecisionAgent::Evaluators::JsonRuleEvaluator.new(rules_json: production_rules)
+            production_agent = DecisionAgent::Agent.new(evaluators: [prod_evaluator])
+          else
+            # Use active version
+            active_version = version_manager.get_active_version
+            if active_version
+              prod_evaluator = DecisionAgent::Evaluators::JsonRuleEvaluator.new(rules_json: active_version[:content])
+              production_agent = DecisionAgent::Agent.new(evaluators: [prod_evaluator])
+            else
+              status 400
+              return { error: "No active version found and production_rules not provided" }.to_json
+            end
+          end
+
+          # Create shadow test engine
+          shadow_engine = DecisionAgent::Simulation::ShadowTestEngine.new(
+            production_agent: production_agent,
+            version_manager: version_manager
+          )
+
+          # Execute shadow test
+          if shadow_rules
+            # Create a temporary version for shadow rules
+            temp_version = {
+              content: shadow_rules,
+              rule_id: "shadow_temp",
+              version_number: 1
+            }
+            result = shadow_engine.test(
+              context: context,
+              shadow_version: temp_version,
+              options: options
+            )
+          else
+            result = shadow_engine.test(
+              context: context,
+              shadow_version: shadow_version,
+              options: options
+            )
+          end
+
+          {
+            result: result
+          }.to_json
+        rescue StandardError => e
+          status 500
+          { error: "Shadow test failed: #{e.message}" }.to_json
+        end
+      end
+
+      # POST /api/simulation/shadow/batch - Batch shadow testing
+      post "/api/simulation/shadow/batch" do
+        content_type :json
+
+        begin
+          request_body = request.body.read
+          data = request_body.empty? ? {} : JSON.parse(request_body)
+
+          contexts = data["contexts"]
+          shadow_version = data["shadow_version"]
+          production_rules = data["production_rules"]
+          shadow_rules = data["shadow_rules"]
+          options = data["options"] || {}
+
+          unless contexts.is_a?(Array)
+            status 400
+            return { error: "contexts array is required" }.to_json
+          end
+
+          unless (production_rules && shadow_rules) || shadow_version
+            status 400
+            return { error: "Either (production_rules and shadow_rules) or shadow_version is required" }.to_json
+          end
+
+          version_manager = DecisionAgent::Versioning::VersionManager.new
+
+          # Create production agent
+          if production_rules
+            prod_evaluator = DecisionAgent::Evaluators::JsonRuleEvaluator.new(rules_json: production_rules)
+            production_agent = DecisionAgent::Agent.new(evaluators: [prod_evaluator])
+          else
+            # Use active version
+            active_version = version_manager.get_active_version
+            if active_version
+              prod_evaluator = DecisionAgent::Evaluators::JsonRuleEvaluator.new(rules_json: active_version[:content])
+              production_agent = DecisionAgent::Agent.new(evaluators: [prod_evaluator])
+            else
+              status 400
+              return { error: "No active version found and production_rules not provided" }.to_json
+            end
+          end
+
+          # Create shadow test engine
+          shadow_engine = DecisionAgent::Simulation::ShadowTestEngine.new(
+            production_agent: production_agent,
+            version_manager: version_manager
+          )
+
+          # Execute batch shadow test
+          if shadow_rules
+            # Create a temporary version for shadow rules
+            temp_version = {
+              content: shadow_rules,
+              rule_id: "shadow_temp",
+              version_number: 1
+            }
+            results = shadow_engine.batch_test(
+              contexts: contexts,
+              shadow_version: temp_version,
+              options: options
+            )
+          else
+            results = shadow_engine.batch_test(
+              contexts: contexts,
+              shadow_version: shadow_version,
+              options: options
+            )
+          end
+
+          {
+            results: results
+          }.to_json
+        rescue StandardError => e
+          status 500
+          { error: "Batch shadow test failed: #{e.message}" }.to_json
+        end
+      end
+
+      # GET /api/simulation/:id - Get simulation results
+      get "/api/simulation/:id" do
+        content_type :json
+
+        begin
+          sim_id = params[:id]
+
+          sim_data = nil
+          self.class.simulation_storage_mutex.synchronize do
+            sim_data = self.class.simulation_storage[sim_id]
+          end
+
+          unless sim_data
+            status 404
+            return { error: "Simulation not found" }.to_json
+          end
+
+          sim_data.to_json
+        rescue StandardError => e
+          status 500
+          { error: e.message }.to_json
+        end
+      end
+
+      # GET /api/versions - List all versions (for simulation dropdowns)
+      get "/api/versions" do
+        content_type :json
+
+        begin
+          version_manager = DecisionAgent::Versioning::VersionManager.new
+          versions = version_manager.list_versions
+
+          {
+            versions: versions.map do |v|
+              {
+                id: v[:id] || v["id"],
+                rule_id: v[:rule_id] || v["rule_id"],
+                version_number: v[:version_number] || v["version_number"],
+                status: v[:status] || v["status"],
+                created_at: v[:created_at] || v["created_at"]
+              }
+            end
+          }.to_json
+        rescue StandardError => e
+          status 500
+          { error: e.message }.to_json
+        end
+      end
+
+      # GET /simulation - Simulation dashboard UI page
+      get "/simulation" do
+        send_file File.join(settings.public_folder, "simulation.html")
+      rescue StandardError
+        status 404
+        "Simulation page not found"
+      end
+
+      # GET /simulation/replay - Historical replay UI page
+      get "/simulation/replay" do
+        send_file File.join(settings.public_folder, "simulation_replay.html")
+      rescue StandardError
+        status 404
+        "Historical replay page not found"
+      end
+
+      # GET /simulation/whatif - What-if analysis UI page
+      get "/simulation/whatif" do
+        send_file File.join(settings.public_folder, "simulation_whatif.html")
+      rescue StandardError
+        status 404
+        "What-if analysis page not found"
+      end
+
+      # GET /simulation/impact - Impact analysis UI page
+      get "/simulation/impact" do
+        send_file File.join(settings.public_folder, "simulation_impact.html")
+      rescue StandardError
+        status 404
+        "Impact analysis page not found"
+      end
+
+      # GET /simulation/shadow - Shadow testing UI page
+      get "/simulation/shadow" do
+        send_file File.join(settings.public_folder, "simulation_shadow.html")
+      rescue StandardError
+        status 404
+        "Shadow testing page not found"
+      end
+
       # GET /auth/login - Login page
       get "/auth/login" do
         send_file File.join(settings.public_folder, "login.html")
@@ -1157,8 +1726,469 @@ module DecisionAgent
         "User management page not found"
       end
 
+      # DMN Editor Routes
+
+      # GET /dmn/editor - DMN Editor UI page
+      get "/dmn/editor" do
+        send_file File.join(settings.public_folder, "dmn-editor.html")
+      rescue StandardError
+        status 404
+        "DMN Editor page not found"
+      end
+
+      # API: List all DMN models
+      get "/api/dmn/models" do
+        content_type :json
+        dmn_editor.list_models.to_json
+      end
+
+      # API: Create new DMN model
+      post "/api/dmn/models" do
+        content_type :json
+
+        begin
+          request_body = request.body.read
+          data = JSON.parse(request_body)
+
+          model = dmn_editor.create_model(
+            name: data["name"],
+            namespace: data["namespace"]
+          )
+
+          status 201
+          model.to_json
+        rescue StandardError => e
+          status 500
+          { error: e.message }.to_json
+        end
+      end
+
+      # API: Get DMN model
+      get "/api/dmn/models/:id" do
+        content_type :json
+
+        model = dmn_editor.get_model(params[:id])
+        if model
+          model.to_json
+        else
+          status 404
+          { error: "Model not found" }.to_json
+        end
+      end
+
+      # API: Update DMN model
+      put "/api/dmn/models/:id" do
+        content_type :json
+
+        begin
+          request_body = request.body.read
+          data = JSON.parse(request_body)
+
+          model = dmn_editor.update_model(
+            params[:id],
+            name: data["name"],
+            namespace: data["namespace"]
+          )
+
+          if model
+            model.to_json
+          else
+            status 404
+            { error: "Model not found" }.to_json
+          end
+        rescue StandardError => e
+          status 500
+          { error: e.message }.to_json
+        end
+      end
+
+      # API: Delete DMN model
+      delete "/api/dmn/models/:id" do
+        content_type :json
+
+        result = dmn_editor.delete_model(params[:id])
+        { success: result }.to_json
+      end
+
+      # API: Add decision to model
+      post "/api/dmn/models/:model_id/decisions" do
+        content_type :json
+
+        begin
+          request_body = request.body.read
+          data = JSON.parse(request_body)
+
+          decision = dmn_editor.add_decision(
+            model_id: params[:model_id],
+            decision_id: data["decision_id"],
+            name: data["name"],
+            type: data["type"] || "decision_table"
+          )
+
+          if decision
+            status 201
+            decision.to_json
+          else
+            status 404
+            { error: "Model not found" }.to_json
+          end
+        rescue StandardError => e
+          status 500
+          { error: e.message }.to_json
+        end
+      end
+
+      # API: Update decision
+      put "/api/dmn/models/:model_id/decisions/:decision_id" do
+        content_type :json
+
+        begin
+          request_body = request.body.read
+          data = JSON.parse(request_body)
+
+          decision = dmn_editor.update_decision(
+            model_id: params[:model_id],
+            decision_id: params[:decision_id],
+            name: data["name"],
+            logic: data["logic"]
+          )
+
+          if decision
+            decision.to_json
+          else
+            status 404
+            { error: "Decision not found" }.to_json
+          end
+        rescue StandardError => e
+          status 500
+          { error: e.message }.to_json
+        end
+      end
+
+      # API: Delete decision
+      delete "/api/dmn/models/:model_id/decisions/:decision_id" do
+        content_type :json
+
+        result = dmn_editor.delete_decision(
+          model_id: params[:model_id],
+          decision_id: params[:decision_id]
+        )
+
+        { success: result }.to_json
+      end
+
+      # API: Add input column
+      post "/api/dmn/models/:model_id/decisions/:decision_id/inputs" do
+        content_type :json
+
+        begin
+          request_body = request.body.read
+          data = JSON.parse(request_body)
+
+          input = dmn_editor.add_input(
+            model_id: params[:model_id],
+            decision_id: params[:decision_id],
+            input_id: data["input_id"],
+            label: data["label"],
+            type_ref: data["type_ref"],
+            expression: data["expression"]
+          )
+
+          if input
+            status 201
+            input.to_json
+          else
+            status 404
+            { error: "Decision not found" }.to_json
+          end
+        rescue StandardError => e
+          status 500
+          { error: e.message }.to_json
+        end
+      end
+
+      # API: Add output column
+      post "/api/dmn/models/:model_id/decisions/:decision_id/outputs" do
+        content_type :json
+
+        begin
+          request_body = request.body.read
+          data = JSON.parse(request_body)
+
+          output = dmn_editor.add_output(
+            model_id: params[:model_id],
+            decision_id: params[:decision_id],
+            output_id: data["output_id"],
+            label: data["label"],
+            type_ref: data["type_ref"],
+            name: data["name"]
+          )
+
+          if output
+            status 201
+            output.to_json
+          else
+            status 404
+            { error: "Decision not found" }.to_json
+          end
+        rescue StandardError => e
+          status 500
+          { error: e.message }.to_json
+        end
+      end
+
+      # API: Add rule
+      post "/api/dmn/models/:model_id/decisions/:decision_id/rules" do
+        content_type :json
+
+        begin
+          request_body = request.body.read
+          data = JSON.parse(request_body)
+
+          rule = dmn_editor.add_rule(
+            model_id: params[:model_id],
+            decision_id: params[:decision_id],
+            rule_id: data["rule_id"],
+            input_entries: data["input_entries"],
+            output_entries: data["output_entries"],
+            description: data["description"]
+          )
+
+          if rule
+            status 201
+            rule.to_json
+          else
+            status 404
+            { error: "Decision not found" }.to_json
+          end
+        rescue StandardError => e
+          status 500
+          { error: e.message }.to_json
+        end
+      end
+
+      # API: Update rule
+      put "/api/dmn/models/:model_id/decisions/:decision_id/rules/:rule_id" do
+        content_type :json
+
+        begin
+          request_body = request.body.read
+          data = JSON.parse(request_body)
+
+          rule = dmn_editor.update_rule(
+            model_id: params[:model_id],
+            decision_id: params[:decision_id],
+            rule_id: params[:rule_id],
+            input_entries: data["input_entries"],
+            output_entries: data["output_entries"],
+            description: data["description"]
+          )
+
+          if rule
+            rule.to_json
+          else
+            status 404
+            { error: "Rule not found" }.to_json
+          end
+        rescue StandardError => e
+          status 500
+          { error: e.message }.to_json
+        end
+      end
+
+      # API: Delete rule
+      delete "/api/dmn/models/:model_id/decisions/:decision_id/rules/:rule_id" do
+        content_type :json
+
+        result = dmn_editor.delete_rule(
+          model_id: params[:model_id],
+          decision_id: params[:decision_id],
+          rule_id: params[:rule_id]
+        )
+
+        { success: result }.to_json
+      end
+
+      # API: Validate DMN model
+      get "/api/dmn/models/:id/validate" do
+        content_type :json
+        dmn_editor.validate_model(params[:id]).to_json
+      end
+
+      # API: Export DMN model to XML
+      get "/api/dmn/models/:id/export" do
+        content_type :xml
+
+        xml = dmn_editor.export_to_xml(params[:id])
+        if xml
+          xml
+        else
+          status 404
+          "Model not found"
+        end
+      end
+
+      # API: Import DMN model from XML
+      post "/api/dmn/models/import" do
+        content_type :json
+
+        begin
+          request_body = request.body.read
+          data = JSON.parse(request_body)
+
+          model = dmn_editor.import_from_xml(data["xml"], name: data["name"])
+
+          if model
+            status 201
+            model.to_json
+          else
+            status 400
+            { error: "Failed to import model" }.to_json
+          end
+        rescue StandardError => e
+          status 500
+          { error: e.message }.to_json
+        end
+      end
+
+      # API: Visualize decision tree
+      get "/api/dmn/models/:model_id/decisions/:decision_id/visualize/tree" do
+        format = params[:format] || "svg"
+
+        visualization = dmn_editor.visualize_tree(
+          model_id: params[:model_id],
+          decision_id: params[:decision_id],
+          format: format
+        )
+
+        if visualization
+          content_type format == "svg" ? "image/svg+xml" : :text
+          visualization
+        else
+          status 404
+          "Decision not found or not a tree"
+        end
+      end
+
+      # API: Visualize decision graph
+      get "/api/dmn/models/:id/visualize/graph" do
+        format = params[:format] || "svg"
+
+        visualization = dmn_editor.visualize_graph(
+          model_id: params[:id],
+          format: format
+        )
+
+        if visualization
+          content_type format == "svg" ? "image/svg+xml" : :text
+          visualization
+        else
+          status 404
+          "Model not found"
+        end
+      end
+
+      # API: Import DMN file (uploads and imports to versioning system)
+      post "/api/dmn/import" do
+        content_type :json
+
+        begin
+          # Check if request has multipart form data (file upload)
+          if params[:file] && params[:file][:tempfile]
+            # File upload
+            file = params[:file][:tempfile]
+            xml_content = file.read
+            ruleset_name = params[:ruleset_name] || params[:file][:filename]&.gsub(/\.dmn$/i, "")
+            created_by = @current_user ? @current_user.id.to_s : params[:created_by] || "system"
+          elsif request.content_type&.include?("application/json")
+            # JSON body with XML content
+            request_body = request.body.read
+            data = JSON.parse(request_body)
+            xml_content = data["xml"] || data["content"]
+            ruleset_name = data["ruleset_name"] || data["name"]
+            created_by = @current_user ? @current_user.id.to_s : data["created_by"] || "system"
+          elsif request.content_type&.include?("application/xml") || request.content_type&.include?("text/xml")
+            # Direct XML upload
+            xml_content = request.body.read
+            ruleset_name = params[:ruleset_name] || "imported_dmn"
+            created_by = @current_user ? @current_user.id.to_s : params[:created_by] || "system"
+          else
+            status 400
+            return { error: "Invalid request. Expected file upload, JSON with 'xml' field, or XML content." }.to_json
+          end
+
+          raise ArgumentError, "DMN XML content is required" if xml_content.nil? || xml_content.strip.empty?
+
+          # Import using DMN Importer
+          importer = Dmn::Importer.new(version_manager: version_manager)
+          result = importer.import_from_xml(
+            xml_content,
+            ruleset_name: ruleset_name,
+            created_by: created_by
+          )
+
+          status 201
+          {
+            success: true,
+            ruleset_name: ruleset_name,
+            decisions_imported: result[:decisions_imported],
+            model: {
+              id: result[:model].id,
+              name: result[:model].name,
+              namespace: result[:model].namespace,
+              decisions: result[:model].decisions.map do |d|
+                {
+                  id: d.id,
+                  name: d.name
+                }
+              end
+            },
+            versions: result[:versions].map do |v|
+              {
+                version: v[:version],
+                rule_id: v[:rule_id],
+                created_by: v[:created_by],
+                created_at: v[:created_at]
+              }
+            end
+          }.to_json
+        rescue Dmn::InvalidDmnModelError, Dmn::DmnParseError => e
+          status 400
+          { error: "DMN validation error", message: e.message }.to_json
+        rescue StandardError => e
+          status 500
+          { error: "Import failed", message: e.message }.to_json
+        end
+      end
+
+      # API: Export ruleset as DMN XML
+      get "/api/dmn/export/:ruleset_id" do
+        content_type :xml
+
+        begin
+          ruleset_id = params[:ruleset_id]
+          exporter = Dmn::Exporter.new(version_manager: version_manager)
+          dmn_xml = exporter.export(ruleset_id)
+
+          headers["Content-Disposition"] = "attachment; filename=\"#{ruleset_id}.dmn\""
+          dmn_xml
+        rescue Dmn::InvalidDmnModelError => e
+          status 404
+          content_type :json
+          { error: "Ruleset not found", message: e.message }.to_json
+        rescue StandardError => e
+          status 500
+          content_type :json
+          { error: "Export failed", message: e.message }.to_json
+        end
+      end
+
       private
 
+      def dmn_editor
+        @dmn_editor ||= DmnEditor.new
+      end
+
       def version_manager
         @version_manager ||= DecisionAgent::Versioning::VersionManager.new
       end
@@ -1195,10 +2225,14 @@ module DecisionAgent
         return true if permissions_disabled?
 
         checker = self.class.permission_checker
-        unless checker.can?(@current_user, permission, resource)
+        granted = checker.can?(@current_user, permission, resource)
+
+        unless granted
+          # Log the permission denial, but don't let logging failures prevent the denial
           begin
+            user_id = checker.user_id(@current_user)
             self.class.access_audit_logger.log_permission_check(
-              user_id: checker.user_id(@current_user),
+              user_id: user_id,
               permission: permission,
               resource_type: resource&.class&.name,
               resource_id: resource&.id,
@@ -1214,9 +2248,11 @@ module DecisionAgent
           halt 403, { error: "Permission denied: #{permission}" }.to_json
         end
 
+        # Log successful permission check, but don't let logging failures prevent access
         begin
+          user_id = checker.user_id(@current_user)
           self.class.access_audit_logger.log_permission_check(
-            user_id: checker.user_id(@current_user),
+            user_id: user_id,
             permission: permission,
             resource_type: resource&.class&.name,
             resource_id: resource&.id,