@liuhange/dsh-data-asset-compliance-check 3.0.0

package/lib/__tests__/complianceChecker.test.js

@@ -0,0 +1,71 @@
+import { describe, it, expect } from 'vitest';
+import { checkCompliance } from '../complianceChecker.js';
+const config = {
+    sourceRules: [
+        { id: 'SRC_001', condition: '数据来源须有合同或协议', lawRef: '数据安全法第八条', compliant: true },
+        { id: 'SRC_002', condition: '采集方式须明示告知', lawRef: '个人信息保护法第十四条', compliant: true },
+        { id: 'SRC_003', condition: '不得非法获取他人数据', lawRef: '数据安全法第八条', compliant: true },
+    ],
+    processingRules: [
+        { id: 'PRC_001', condition: '加工不得超出授权范围', lawRef: '个人信息保护法第十三条', compliant: true },
+        { id: 'PRC_002', condition: '个人信息须脱敏处理', lawRef: '个人信息保护法第五十一条', compliant: true },
+    ],
+    usageRules: [
+        { id: 'USE_001', condition: '使用不得超出约定场景', lawRef: '数据安全法第八条', compliant: true },
+    ],
+    personalInfoMinimizeFields: ['idCard', 'phone', 'bankCard', 'email', 'address', 'name', 'birthDate'],
+};
+const policyDocs = [{ name: '数据安全法', docNumber: '主席令第八十四号', coreRequirement: '安全保护' }];
+describe('complianceChecker', () => {
+    it('全合规场景通过', () => {
+        const report = checkCompliance({
+            assetName: '测试资产',
+            sourceDescription: '通过合同获取，已明示告知用户',
+            processingDescription: '在授权范围内加工，个人信息已脱敏',
+            usageDescription: '用于约定场景',
+            hasPersonalInfo: true,
+            personalInfoFields: ['phone', 'email'],
+        }, config, policyDocs);
+        expect(report.overallPassed).toBe(true);
+        expect(report.sourceCompliance.passed).toBe(true);
+        expect(report.processingCompliance.passed).toBe(true);
+        expect(report.usageCompliance.passed).toBe(true);
+    });
+    it('来源含非法获取→不通过', () => {
+        const report = checkCompliance({
+            assetName: '测试资产',
+            sourceDescription: '非法获取他人数据',
+            processingDescription: '正常加工',
+            usageDescription: '正常使用',
+            hasPersonalInfo: false,
+            personalInfoFields: [],
+        }, config, policyDocs);
+        expect(report.sourceCompliance.passed).toBe(false);
+        expect(report.overallPassed).toBe(false);
+        expect(report.sourceCompliance.issues.length).toBeGreaterThan(0);
+    });
+    it('个人信息未脱敏字段→不通过', () => {
+        const report = checkCompliance({
+            assetName: '测试资产',
+            sourceDescription: '合法来源',
+            processingDescription: '正常加工',
+            usageDescription: '正常使用',
+            hasPersonalInfo: true,
+            personalInfoFields: ['rawIdCard', 'rawPhone'],
+        }, config, policyDocs);
+        expect(report.personalInfoMinimize.allMinimized).toBe(false);
+        expect(report.overallPassed).toBe(false);
+    });
+    it('无个人信息时脱敏检查自动通过', () => {
+        const report = checkCompliance({
+            assetName: '测试资产',
+            sourceDescription: '合法来源',
+            processingDescription: '正常加工',
+            usageDescription: '正常使用',
+            hasPersonalInfo: false,
+            personalInfoFields: [],
+        }, config, policyDocs);
+        expect(report.personalInfoMinimize.allMinimized).toBe(true);
+    });
+});
+//# sourceMappingURL=complianceChecker.test.js.map

package/lib/complianceChecker.js

@@ -0,0 +1,60 @@
+export function checkCompliance(input, config, policyDocuments) {
+    const sourceCompliance = checkCategory(input.sourceDescription, config.sourceRules);
+    const processingCompliance = checkCategory(input.processingDescription, config.processingRules);
+    const usageCompliance = checkCategory(input.usageDescription, config.usageRules);
+    const personalInfoMinimize = checkPersonalInfoMinimize(input.hasPersonalInfo, input.personalInfoFields, config.personalInfoMinimizeFields);
+    const overallPassed = sourceCompliance.passed &&
+        processingCompliance.passed &&
+        usageCompliance.passed &&
+        personalInfoMinimize.allMinimized;
+    return {
+        assetName: input.assetName,
+        sourceCompliance,
+        processingCompliance,
+        usageCompliance,
+        personalInfoMinimize,
+        overallPassed,
+        policyReferences: policyDocuments,
+        timestamp: new Date().toISOString(),
+    };
+}
+function checkCategory(description, rules) {
+    const issues = [];
+    const checkedRules = rules.map(rule => {
+        const violated = detectViolation(description, rule);
+        if (violated) {
+            issues.push(`${rule.id}: ${rule.condition}（${rule.lawRef}）——检测到违规`);
+            return { ...rule, compliant: false };
+        }
+        return rule;
+    });
+    return {
+        passed: issues.length === 0,
+        checkedRules,
+        issues,
+    };
+}
+function detectViolation(description, rule) {
+    const negativeIndicators = ['非法', '未授权', '未经同意', '隐瞒', '虚假', '欺诈', '窃取', '违规'];
+    const conditionLower = rule.condition.toLowerCase();
+    const hasNegative = negativeIndicators.some(ind => description.includes(ind));
+    const conditionMentionsNegative = negativeIndicators.some(ind => conditionLower.includes(ind));
+    return hasNegative && conditionMentionsNegative;
+}
+function checkPersonalInfoMinimize(hasPersonalInfo, fields, minimizeFields) {
+    const issues = [];
+    if (!hasPersonalInfo) {
+        return { hasPersonalInfo, fields, allMinimized: true, issues };
+    }
+    const unminimized = fields.filter(f => !minimizeFields.includes(f));
+    if (unminimized.length > 0) {
+        issues.push(`以下个人信息字段未脱敏: ${unminimized.join(', ')}`);
+    }
+    return {
+        hasPersonalInfo,
+        fields,
+        allMinimized: unminimized.length === 0,
+        issues,
+    };
+}
+//# sourceMappingURL=complianceChecker.js.map

package/lib/index.js

@@ -0,0 +1,68 @@
+import { checkCompliance } from './complianceChecker.js';
+import { validateComplianceArgs } from './invariant.js';
+export const name = '@liuhange/dsh-data-asset-compliance-check';
+export const inject = ['tools'];
+export function apply(ctx) {
+    ctx.tools.register({
+        name: 'check_compliance',
+        description: '数据资产合规审查：来源合规+加工合规+用途合规三查，个人信息脱敏检查，输出合规报告与政策依据',
+        parameters: {
+            type: 'object',
+            properties: {
+                assetName: { type: 'string', description: '数据资产名称' },
+                sourceDescription: { type: 'string', description: '数据来源描述' },
+                processingDescription: { type: 'string', description: '数据加工描述' },
+                usageDescription: { type: 'string', description: '数据使用场景描述' },
+                hasPersonalInfo: { type: 'boolean', description: '是否包含个人信息' },
+                personalInfoFields: { type: 'array', items: { type: 'string' }, description: '个人信息字段列表' },
+            },
+            required: ['assetName', 'sourceDescription', 'processingDescription', 'usageDescription'],
+        },
+        async execute(args) {
+            try {
+                const validated = validateComplianceArgs(args);
+                const { readFileSync } = await import('node:fs');
+                let rulesConfig;
+                try {
+                    rulesConfig = JSON.parse(readFileSync(process.env.BUSINESS_RULES_PATH || 'config/business-rules.json', 'utf-8'));
+                }
+                catch {
+                    return JSON.stringify({ error: 'COMPLIANCE_RULES_MISSING', message: '无法加载business-rules.json' });
+                }
+                const complianceConfig = rulesConfig.complianceCheck;
+                if (!complianceConfig) {
+                    return JSON.stringify({ error: 'COMPLIANCE_RULES_MISSING', message: 'complianceCheck配置段缺失' });
+                }
+                let policyDocuments;
+                try {
+                    const policyConfig = JSON.parse(readFileSync(process.env.POLICY_REFS_PATH || 'config/policy-references.json', 'utf-8'));
+                    const stage = policyConfig.policyReferences?.find((s) => s.stage === 'COMPLIANCE_CHECK');
+                    policyDocuments = stage?.documents ?? [];
+                }
+                catch {
+                    policyDocuments = [];
+                }
+                if (!policyDocuments || policyDocuments.length === 0) {
+                    return JSON.stringify({ error: 'POLICY_REFERENCES_EMPTY', message: 'COMPLIANCE_CHECK阶段政策依据缺失' });
+                }
+                const report = checkCompliance({
+                    assetName: validated.assetName,
+                    sourceDescription: validated.sourceDescription,
+                    processingDescription: validated.processingDescription,
+                    usageDescription: validated.usageDescription,
+                    hasPersonalInfo: validated.hasPersonalInfo,
+                    personalInfoFields: validated.personalInfoFields,
+                }, complianceConfig, policyDocuments);
+                return JSON.stringify(report, null, 2);
+            }
+            catch (e) {
+                const err = e;
+                return JSON.stringify({
+                    error: err.message.split(':')[0] ?? 'UNKNOWN_ERROR',
+                    message: err.message,
+                });
+            }
+        },
+    });
+}
+//# sourceMappingURL=index.js.map

package/lib/invariant.js

@@ -0,0 +1,35 @@
+export function invariant(condition, message) {
+    if (!condition) {
+        throw new Error(`INVARIANT_VIOLATION: ${message}`);
+    }
+}
+export function validateComplianceArgs(args) {
+    if (!args || typeof args !== 'object') {
+        throw new Error('INVALID_ARGS: args must be an object');
+    }
+    if (!args.assetName || typeof args.assetName !== 'string') {
+        throw new Error('INVALID_ARGS: assetName is required and must be a string');
+    }
+    if (typeof args.sourceDescription !== 'string') {
+        throw new Error('INVALID_ARGS: sourceDescription is required and must be a string');
+    }
+    if (typeof args.processingDescription !== 'string') {
+        throw new Error('INVALID_ARGS: processingDescription is required and must be a string');
+    }
+    if (typeof args.usageDescription !== 'string') {
+        throw new Error('INVALID_ARGS: usageDescription is required and must be a string');
+    }
+    const hasPersonalInfo = args.hasPersonalInfo === true;
+    const personalInfoFields = Array.isArray(args.personalInfoFields)
+        ? args.personalInfoFields.filter(f => typeof f === 'string')
+        : [];
+    return {
+        assetName: args.assetName,
+        sourceDescription: args.sourceDescription,
+        processingDescription: args.processingDescription,
+        usageDescription: args.usageDescription,
+        hasPersonalInfo,
+        personalInfoFields,
+    };
+}
+//# sourceMappingURL=invariant.js.map

package/lib/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/package.json

@@ -0,0 +1,28 @@
+{
+  "name": "@liuhange/dsh-data-asset-compliance-check",
+  "description": "Data asset compliance check plugin: source + processing + usage three-dimensional compliance audit",
+  "version": "3.0.0",
+  "publishConfig": { "access": "public" },
+  "repository": { "type": "git", "url": "git+https://github.com/liuhange789/data-asset-inspector.git", "directory": "packages/data-asset/data-asset-compliance-check" },
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/types/index.d.ts",
+  "exports": {
+    ".": { "types": "./lib/types/index.d.ts", "default": "./lib/index.js" },
+    "./src/*": "./src/*",
+    "./package.json": "./package.json"
+  },
+  "files": ["lib/**/*.js", "lib/types/**/*.d.ts"],
+  "license": "MIT",
+  "scripts": {
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "build": "tsc"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.0",
+    "@deepseek-ai/dsh-tools": "0.0.1-rc.1",
+    "@liuhange/dsh-data-asset-shared": "^3.0.0"
+  },
+  "dsh": { "bundle": { "patch": true } }
+}