abs-auth-rbac-core 0.1.8__py3-none-any.whl → 0.3.18__py3-none-any.whl

abs_auth_rbac_core/rbac/service.py

@@ -1,8 +1,10 @@
 from typing import List, Optional, Callable,Any,Tuple
 import os
+from pydantic import BaseModel
 import casbin
 from casbin_sqlalchemy_adapter import Adapter
-from sqlalchemy import and_, select
+from casbin_redis_watcher import RedisWatcher, WatcherOptions,new_watcher
+from sqlalchemy import and_, or_, select
 from sqlalchemy.orm import Session, joinedload
 from ..schema import CreatePermissionSchema
 from ..models import (
@@ -13,7 +15,9 @@ from ..models import (
     Permission,
     UserPermission
 )
+from abs_utils.logger import setup_logger
 
+logger = setup_logger(__name__)
 from abs_exception_core.exceptions import (
     DuplicatedError,
     NotFoundError,
@@ -21,9 +25,17 @@ from abs_exception_core.exceptions import (
 )
 
 from ..models.gov_casbin_rule import GovCasbinRule
+from redis import Redis
+
+class RedisWatcherSchema(BaseModel):
+    host: str
+    port: int
+    channel: str
+    ssl: Optional[bool] = False
+    password: Optional[str] = None
 
 class RBACService:
-    def __init__(self, session: Callable[...,Session]):
+    def __init__(self, session: Callable[...,Session],redis_config:Optional[RedisWatcherSchema]=None):
         """
         Service For Managing the RBAC
         Args:
@@ -31,9 +43,48 @@ class RBACService:
         """
         self.db = session
         self.enforcer = None
-        self._initialize_casbin()
+        self._initialize_casbin(redis_config)
+        self.watcher = None
+
+
+    def _save_policy_if_watcher_active(self):
+        """
+        Helper method to save policy only if Redis watcher is active.
+        This ensures distributed systems stay in sync while avoiding
+        unnecessary load_policy calls on the current instance.
+        """
+        if self.is_watcher_active():
+            self.enforcer.save_policy()
+
+    def _bulk_operation_context(self):
+        """
+        Context manager for bulk Casbin operations.
+        Temporarily disables auto_save, executes operations, then saves once at the end.
+        This significantly reduces overhead for bulk policy changes.
 
-    def _initialize_casbin(self):
+        Usage:
+            with self._bulk_operation_context():
+                self.enforcer.add_policies(policies)
+        """
+        class BulkOperationContext:
+            def __init__(self, service):
+                self.service = service
+                self.original_auto_save = None
+
+            def __enter__(self):
+                self.original_auto_save = self.service.enforcer.auto_save
+                self.service.enforcer.enable_auto_save(False)
+                return self
+
+            def __exit__(self, exc_type, exc_val, exc_tb):
+                if exc_type is None:  # Only save if no exception occurred
+                    self.service._save_policy_if_watcher_active()
+                self.service.enforcer.enable_auto_save(self.original_auto_save)
+                return False
+
+        return BulkOperationContext(self)
+
+    def _initialize_casbin(self,redis_config:Optional[RedisWatcherSchema]=None):
         """
         Initiates the casbin policy using the default rules
         """
@@ -51,36 +102,82 @@ class RBACService:
             self.enforcer = casbin.Enforcer(
                 policy_path, adapter
             )
-            # Load policies
-            self.enforcer.load_policy()
+            self.enforcer.enable_auto_save(True)
+
+            if redis_config:
+                try:
+                    redis_client = Redis(
+                        host=redis_config.host,
+                        port=redis_config.port,
+                        password=redis_config.password if hasattr(redis_config, 'password') else None,
+                        ssl=redis_config.ssl, # This is crucial for azure redis
+                        ssl_cert_reqs=None,  # This is crucial for azure redis (Should be none for azure redis)
+                        ssl_check_hostname=False,
+                        socket_connect_timeout=10, # Only socket_connect_timeout is required for azure redis watcher
+                        decode_responses=True,
+                        retry_on_timeout=True,
+                        health_check_interval=30 # Required for open connection
+                        )
+                    
+                    
+                    # Test Redis connection
+                    redis_client.ping()
+
+                    # Create Watcher and Options
+                    option = WatcherOptions()
+                    option.host = redis_config.host
+                    option.port = redis_config.port
+                    option.password = redis_config.password
+                    option.ssl = redis_config.ssl
+                    option.channel = redis_config.channel
+                    option.optional_update_callback = lambda _: self.enforcer.load_policy()
+
+                    option.init_config()
+
+                    watcher = RedisWatcher()
+
+                    watcher.sub_client = redis_client.pubsub()
+                    watcher.pub_client = redis_client
+                    watcher.init_config(option)
+                    watcher.close = False
+                    watcher.subscribe_thread.start()
+                    watcher.subscribe_event.wait(timeout=10)
+
+                    self.enforcer.set_watcher(watcher)
+                    self.watcher = watcher
+                except Exception as e:
+                    logger.error(f"Failed to initialize Redis watcher: {e}")
+                    self.watcher = None
+            else:
+                logger.info("Redis watcher not configured - Casbin will work without real-time policy updates")
 
     def add_policy(self,role:str,resource:str,action:str,module:str):
         """
-        Add a policy to the casbin enforcer
+        Add a policy to the casbin enforcer (optimized for distributed systems)
         """
-        self.enforcer.add_policy(role,resource,action,module)
-        self.enforcer.save_policy()
+        with self._bulk_operation_context():
+            self.enforcer.add_policy(role,resource,action,module)
 
     def remove_policy(self,role:str,resource:str,action:str,module:str):
         """
-        Remove a policy from the casbin enforcer
+        Remove a policy from the casbin enforcer (optimized for distributed systems)
         """
-        self.enforcer.remove_policy(role,resource,action,module)
-        self.enforcer.save_policy()
+        with self._bulk_operation_context():
+            self.enforcer.remove_policy(role,resource,action,module)
 
     def add_policies(self,policies:List[Tuple[str,str,str,str]]):
         """
-        Add a list of policies to the casbin enforcer
+        Add a list of policies to the casbin enforcer (optimized for distributed systems)
         """
-        self.enforcer.add_policies(policies)
-        self.enforcer.save_policy()
+        with self._bulk_operation_context():
+            self.enforcer.add_policies(policies)
 
     def remove_policies(self,policies:List[List[str]]):
         """
-        Remove a list of policies from the casbin enforcer
+        Remove a list of policies from the casbin enforcer (optimized for distributed systems)
         """
-        self.enforcer.remove_policies(policies)
-        self.enforcer.save_policy()
+        with self._bulk_operation_context():
+            self.enforcer.remove_policies(policies)
 
     def enforce_policy(self,role:str,resource:str,action:str,module:str):
         """
@@ -90,13 +187,13 @@ class RBACService:
     
     def remove_filter_policy(self,index:int,value:str):
         """
-        Remove a policy by filtering the policy
+        Remove a policy by filtering the policy (optimized for distributed systems)
         Args:
             index: The index of the policy to remove
             value: The value of the policy to remove
         """
-        self.enforcer.remove_filtered_policy(index,value)
-        self.enforcer.save_policy()
+        with self._bulk_operation_context():
+            self.enforcer.remove_filtered_policy(index,value)
 
     async def bulk_create_permissions(self,permissions:List[CreatePermissionSchema]):
         """
@@ -104,40 +201,77 @@ class RBACService:
         """
         with self.db() as session:
             try:
-                permission_objs = [Permission(**permission.model_dump()) for permission in permissions]
-                session.bulk_save_objects(permission_objs)
+                if not permissions:
+                    return []
+                
+                if hasattr(permissions[0],'model_dump'):
+                    add_permissions = [Permission(**permission.model_dump()) for permission in permissions]
+                else:
+                    add_permissions = [Permission(**permission) for permission in permissions]
+
+                session.bulk_save_objects(add_permissions)
                 session.commit()
-                return permission_objs
+                return add_permissions
             except Exception as e:
                 raise e
             
-    async def get_permissions_by_condition(self, condition: dict, use_filter_by: bool = True):
+    def build_filter(self,cond: dict):
+        if "and" in cond:
+            return and_(*[self.build_filter(c) for c in cond["and"]])
+        elif "or" in cond:
+            return or_(*[self.build_filter(c) for c in cond["or"]])
+        else:
+            # Multiple simple field=value pairs in the same dict
+            return and_(*[
+                getattr(Permission, field) == value
+                for field, value in cond.items()
+            ])
+
+
+    async def get_permissions_by_condition(self, condition: dict):
         """
-        Get permission(s) based on a condition dict.
-        If use_filter_by is True, assumes all conditions are `==`.
+        Get permission(s) based on nested logical conditions.
+
+        Example:
+        {
+            "and": [
+                {"entity_id": "123"},
+                {"or": [
+                    {"user_id": "456"},
+                    {"group_id": "789"}
+                ]}
+            ]
+        }
         """
         with self.db() as session:
             try:
-                query = session.query(Permission)
-                if use_filter_by:
-                    query = query.filter_by(**condition)
-                else:
-                    filters = [getattr(Permission, k) == v for k, v in condition.items()]
-                    query = query.filter(*filters)
+                query = session.query(Permission).filter(self.build_filter(condition))
                 return query.all()
             except Exception as e:
                 raise e
-            
+
     async def delete_permission_by_uuids(self,permission_uuids:List[str]):
         """
-        Delete a permission by uuids
+        Delete permissions by uuids (optimized for distributed systems)
+        Handles cascade deletion in proper order:
+        1. Delete UserPermission associations
+        2. Delete RolePermission associations
+        3. Delete Permissions
         """
         with self.db() as session:
             try:
+                # Step 1: Delete user_permissions associations
+                user_permissions = session.query(UserPermission).filter(UserPermission.permission_uuid.in_(permission_uuids)).delete(synchronize_session=False)
+
+                # Step 2: Delete role_permissions associations (CRITICAL for FK constraint)
+                role_permissions = session.query(RolePermission).filter(RolePermission.permission_uuid.in_(permission_uuids)).delete(synchronize_session=False)
+
+                # Step 3: Delete permissions
                 permissions = session.query(Permission).filter(Permission.uuid.in_(permission_uuids))
-                for permission in permissions:
-                    self.enforcer.remove_filtered_policy(1,permission.resource)
-                    self.enforcer.save_policy()
+
+                with self._bulk_operation_context():
+                    for permission in permissions:
+                        self.enforcer.remove_filtered_policy(1,permission.resource)
 
                 permissions.delete(synchronize_session=False)
                 session.commit()
@@ -150,63 +284,161 @@ class RBACService:
         Assign permissions to a user
         """
         with self.db() as session:
-            current_permissions = session.query(UserPermission).filter(UserPermission.user_uuid==user_uuid).all()
-            current_permission_uuids = [permission.permission_uuid for permission in current_permissions]
-            remove_permissions = set(current_permission_uuids) - set(permission_uuids)
-            add_permissions = set(permission_uuids) - set(current_permission_uuids)
-            if remove_permissions:
-                self.revoke_user_permissions(user_uuid,list(remove_permissions))
-            if add_permissions:
-                self.attach_permissions_to_user(user_uuid,list(add_permissions))
-            return True
+            try:
+                current_permissions = session.query(UserPermission).filter(UserPermission.user_uuid==user_uuid).all()
+                current_permission_uuids = [permission.permission_uuid for permission in current_permissions]
+                remove_permissions = set(current_permission_uuids) - set(permission_uuids)
+                add_permissions = set(permission_uuids) - set(current_permission_uuids)
+                if remove_permissions:
+                    self.revoke_user_permissions(user_uuid,list(remove_permissions))
+                if add_permissions:
+                    self.attach_permissions_to_user(user_uuid,list(add_permissions))
+                return self.get_user_only_permissions(user_uuid)    
+            except Exception as e:
+                raise e
 
     def attach_permissions_to_user(self, user_uuid: str, permission_uuids: List[str]):
+        """
+        Attach permissions to user (optimized for distributed systems)
+        """
         with self.db() as session:
-            user_permissions = [
-                UserPermission(user_uuid=user_uuid, permission_uuid=permission_uuid)
-                for permission_uuid in permission_uuids
-            ]
-            session.bulk_save_objects(user_permissions)
-            session.commit()
+            try:
+                # Use bulk_insert_mappings for better performance
+                user_permissions_data = [
+                    {"user_uuid": user_uuid, "permission_uuid": permission_uuid}
+                    for permission_uuid in permission_uuids
+                ]
+                session.bulk_insert_mappings(UserPermission, user_permissions_data)
+                session.commit()
 
-            permissions = session.query(Permission).filter(Permission.uuid.in_(permission_uuids)).all()
-            policies = [
-                [f"user:{user_uuid}", permission.resource, permission.action, permission.module]
-                for permission in permissions
-            ]
-            self.enforcer.add_policies(policies)
-            self.enforcer.save_policy()
-            return user_permissions
+                # Fetch permissions and build policies
+                permissions = session.query(Permission).filter(Permission.uuid.in_(permission_uuids)).all()
+                policies = [
+                    [f"user:{user_uuid}", permission.resource, permission.action, permission.module]
+                    for permission in permissions
+                ]
 
+                # Use context manager for optimized bulk operation
+                with self._bulk_operation_context():
+                    self.enforcer.add_policies(policies)
+
+                return self.get_user_only_permissions(user_uuid)
+            except Exception as e:
+                raise e
 
     def revoke_user_permissions(self, user_uuid: str, permission_uuids: List[str]):
+        """
+        Revoke permissions from user (optimized for distributed systems)
+        """
         with self.db() as session:
-            user_permissions = session.query(UserPermission).filter(
-                UserPermission.user_uuid == user_uuid,
-                UserPermission.permission_uuid.in_(permission_uuids)
-            )
+            try:
+                user_permissions = session.query(UserPermission).filter(
+                    UserPermission.user_uuid == user_uuid,
+                    UserPermission.permission_uuid.in_(permission_uuids)
+                )
 
-            permissions = session.query(Permission).filter(Permission.uuid.in_(permission_uuids)).all()
-            policies = [
-                [f"user:{user_uuid}", permission.resource, permission.action, permission.module]
-                for permission in permissions
-            ]
-            self.enforcer.remove_policies(policies)
-            self.enforcer.save_policy()
+                permissions = session.query(Permission).filter(Permission.uuid.in_(permission_uuids)).all()
+                policies = [
+                    [f"user:{user_uuid}", permission.resource, permission.action, permission.module]
+                    for permission in permissions
+                ]
+                with self._bulk_operation_context():
+                    self.enforcer.remove_policies(policies)
+
+                user_permissions.delete(synchronize_session=False)
+                session.commit()
+                return self.get_user_only_permissions(user_uuid)
+            except Exception as e:
+                raise e
+
+    def revoke_all_user_access(self, user_uuid: str) -> dict:
+        """
+        Revoke all roles and permissions from a user in a single operation.
+        This is typically used when soft-deleting a user.
+
+        Args:
+            user_uuid: The UUID of the user to revoke all access from
+
+        Returns:
+            dict: Summary of revoked roles and permissions
+        """
+        with self.db() as session:
+            try:
+                if not session.is_active:
+                    session.begin()
+
+                # Get all user roles
+                user_roles = (
+                    session.query(UserRole)
+                    .options(joinedload(UserRole.role))
+                    .filter(UserRole.user_uuid == user_uuid)
+                    .all()
+                )
+
+                role_uuids = [ur.role.uuid for ur in user_roles] if user_roles else []
+
+                # Get all direct user permissions
+                user_permissions = (
+                    session.query(UserPermission)
+                    .options(joinedload(UserPermission.permission))
+                    .filter(UserPermission.user_uuid == user_uuid)
+                    .all()
+                )
+
+                permission_uuids = [up.permission.uuid for up in user_permissions] if user_permissions else []
+
+                # Revoke all roles
+                if role_uuids:
+                    session.query(UserRole).filter(
+                        UserRole.user_uuid == user_uuid,
+                        UserRole.role_uuid.in_(role_uuids)
+                    ).delete(synchronize_session=False)
+
+                # Revoke all direct permissions and remove from Casbin
+                if permission_uuids:
+                    permissions = session.query(Permission).filter(
+                        Permission.uuid.in_(permission_uuids)
+                    ).all()
+
+                    # Remove Casbin policies (optimized)
+                    policies = [
+                        [f"user:{user_uuid}", permission.resource, permission.action, permission.module]
+                        for permission in permissions
+                    ]
+                    with self._bulk_operation_context():
+                        self.enforcer.remove_policies(policies)
+
+                    # Delete from database
+                    session.query(UserPermission).filter(
+                        UserPermission.user_uuid == user_uuid,
+                        UserPermission.permission_uuid.in_(permission_uuids)
+                    ).delete(synchronize_session=False)
+
+                session.commit()
+
+                return {
+                    "user_uuid": user_uuid,
+                    "roles_revoked": len(role_uuids),
+                    "permissions_revoked": len(permission_uuids),
+                    "role_uuids": role_uuids,
+                    "permission_uuids": permission_uuids
+                }
+
+            except Exception as e:
+                raise e
 
-            user_permissions.delete(synchronize_session=False)
-            session.commit()
-            return True
-            
     def list_roles(self) -> Any:
         """
         Get the list of all roles
         """
         with self.db() as session:
-            """List all roles"""
-            total = session.query(Role).count()
-            roles = session.query(Role).all()
-            return {"roles": roles, "total": total}
+            try:
+                """List all roles"""
+                total = session.query(Role).count()
+                roles = session.query(Role).all()
+                return {"roles": roles, "total": total}
+            except Exception as e:
+                raise e
 
     def create_role(
         self,
@@ -278,13 +510,13 @@ class RBACService:
                     ]
                     session.bulk_insert_mappings(RolePermission, role_permissions)
 
-                    # Batch add Casbin policies
+                    # Batch add Casbin policies (optimized)
                     policies = [
                         [role.uuid, permission.resource, permission.action, permission.module]
                         for permission in existing_permissions
                     ]
-                    self.enforcer.add_policies(policies)
-                    self.enforcer.save_policy()
+                    with self._bulk_operation_context():
+                        self.enforcer.add_policies(policies)
 
                 # Commit transaction
                 session.commit()
@@ -308,7 +540,7 @@ class RBACService:
             if not role:
                 raise NotFoundError(detail="Requested role does not exist")
                 
-            return role
+            return role    
 
     def update_role_permissions(
         self,
@@ -318,6 +550,7 @@ class RBACService:
         description: Optional[str] = None,
     ) -> Any:
         """Update role permissions by replacing all existing permissions with new ones"""
+
         with self.db() as session:
             try:
                 if not session.is_active:
@@ -354,50 +587,45 @@ class RBACService:
                         role.description = description
 
                 if permissions is not None:
-                    existing_permissions = role.permissions
-
-                    # Remove Casbin policies for existing permissions
-                    remove_policies = [
-                        [role_uuid, existing_permission.resource, existing_permission.action, existing_permission.module]
-                        for existing_permission in existing_permissions
-                    ]
-                    self.enforcer.remove_policies(remove_policies)
-                    self.enforcer.save_policy()
-
-                    # Delete existing role permissions
-                    session.query(RolePermission).filter(
-                        RolePermission.role_uuid == role_uuid
-                    ).delete(synchronize_session=False)
-
-                if permissions:
-                    # Fetch all permissions in a single query
-                    permissions_objs = (
-                        session.query(Permission)
-                        .filter(Permission.uuid.in_(permissions))
-                        .all()
-                    )
-
-                    found_permission_ids = {p.uuid for p in permissions_objs}
-                    missing_permission_ids = set(permissions) - found_permission_ids
-                    if missing_permission_ids:
-                        raise NotFoundError(
-                            detail=f"Permissions with UUIDs '{', '.join(missing_permission_ids)}' not found"
-                        )
-
-                    # Bulk insert role permissions
-                    role_permissions = [
-                        {"role_uuid": role_uuid, "permission_uuid": permission.uuid}
-                        for permission in permissions_objs
-                    ]
-                    session.bulk_insert_mappings(RolePermission, role_permissions)
-
-                    # Add Casbin policies
-                    policies = [
-                        [role_uuid, permission.resource, permission.action, permission.module]
-                        for permission in permissions_objs
-                    ]
-                    self.enforcer.add_policies(policies)
-                    self.enforcer.save_policy()
+                    # Update permissions with optimized Casbin operations
+                    with self._bulk_operation_context():
+                        # Remove ALL existing policies for this role from Casbin
+                        self.enforcer.remove_filtered_policy(0, str(role_uuid))
+
+                        # Delete existing role permissions from database
+                        session.query(RolePermission).filter(
+                            RolePermission.role_uuid == role_uuid
+                        ).delete(synchronize_session=False)
+
+                        # Add new permissions if provided
+                        if permissions:
+                            # Fetch all permissions in a single query
+                            permissions_objs = (
+                                session.query(Permission)
+                                .filter(Permission.uuid.in_(permissions))
+                                .all()
+                            )
+
+                            found_permission_ids = {p.uuid for p in permissions_objs}
+                            missing_permission_ids = set(permissions) - found_permission_ids
+                            if missing_permission_ids:
+                                raise NotFoundError(
+                                    detail=f"Permissions with UUIDs '{', '.join(missing_permission_ids)}' not found"
+                                )
+
+                            # Bulk insert role permissions
+                            role_permissions = [
+                                {"role_uuid": role_uuid, "permission_uuid": permission.uuid}
+                                for permission in permissions_objs
+                            ]
+                            session.bulk_insert_mappings(RolePermission, role_permissions)
+
+                            # Add new Casbin policies
+                            policies = [
+                                [role_uuid, permission.resource, permission.action, permission.module]
+                                for permission in permissions_objs
+                            ]
+                            self.enforcer.add_policies(policies)
 
                 session.commit()
 
@@ -435,12 +663,11 @@ class RBACService:
                     [role.uuid, permission.resource, permission.action, permission.module]
                     for permission in role.permissions
                 ]
-                
-                # Remove all policies at once
-                if remove_policies:
 
-                    self.enforcer.remove_policies(remove_policies)
-                    self.enforcer.save_policy()
+                # Remove all policies at once (optimized)
+                if remove_policies:
+                    with self._bulk_operation_context():
+                        self.enforcer.remove_policies(remove_policies)
 
                 # Delete role (cascade will handle role_permissions and user_roles)
                 session.delete(role)
@@ -561,13 +788,13 @@ class RBACService:
                     )
                 ).delete(synchronize_session=False)
 
-                # Remove Casbin policies
+                # Remove Casbin policies (optimized)
                 policies_to_remove = [
                     [role.uuid, permission.resource, permission.action, permission.module]
                     for permission in permissions_to_revoke
                 ]
-                self.enforcer.remove_policies(policies_to_remove)
-                self.enforcer.save_policy()
+                with self._bulk_operation_context():
+                    self.enforcer.remove_policies(policies_to_remove)
                 
                 session.commit()
 
@@ -629,13 +856,13 @@ class RBACService:
                 ]
                 session.bulk_insert_mappings(RolePermission, role_permissions)
 
-                # Add Casbin policies
+                # Add Casbin policies (optimized)
                 policies_to_add = [
                     [role.uuid, permission.resource, permission.action, permission.module]
                     for permission in new_permissions
                 ]
-                self.enforcer.add_policies(policies_to_add)
-                self.enforcer.save_policy()
+                with self._bulk_operation_context():
+                    self.enforcer.add_policies(policies_to_add)
 
                 session.commit()
 
@@ -816,6 +1043,8 @@ class RBACService:
                 # Try with module first
                 if self.enforcer.enforce(role.uuid, resource, action, module):
                     return True
+                if self.enforcer.enforce(role.name, resource, action, module):
+                    return True
             return False
 
     def check_permission_by_role(
@@ -825,6 +1054,11 @@ class RBACService:
         if self.enforcer.enforce(role_uuid, resource, action, module):
             return True
         return False
+    
+    def check_permission_by_user(self,user_uuid:str,resource:str,action:str,module:str) -> bool:
+        if self.enforcer.enforce(f"user:{user_uuid}", resource, action, module):
+            return True
+        return False
 
     def get_role(self, role_uuid: str,session: Optional[Session] = None) -> Any:
         """Get role by uuid"""
@@ -839,3 +1073,55 @@ class RBACService:
         else:
             with self.db() as session:
                 return query_role(session)
+
+    def is_watcher_active(self) -> bool:
+        """Check if Redis watcher is active and connected"""
+        return self.watcher is not None and hasattr(self.watcher, 'pub_client') and self.watcher.pub_client is not None
+
+    def get_watcher_status(self) -> dict:
+        """Get detailed watcher status information"""
+        if not self.is_watcher_active():
+            return {
+                "active": False,
+                "message": "Watcher not initialized or not active"
+            }
+        
+        try:
+            # Test Redis connection
+            self.watcher.pub_client.ping()
+            return {
+                "active": True,
+                "host": self.watcher.pub_client.connection_pool.connection_kwargs.get('host'),
+                "port": self.watcher.pub_client.connection_pool.connection_kwargs.get('port'),
+                "channel": getattr(self.watcher, 'channel', 'unknown'),
+                "connected": True
+            }
+        except Exception as e:
+            return {
+                "active": False,
+                "error": str(e),
+                "message": "Watcher exists but Redis connection failed"
+            }
+
+    def reload_policies(self) -> bool:
+        """Manually reload policies from database"""
+        try:
+            self.enforcer.load_policy()
+            return True
+        except Exception as e:
+            logger.error(f"Failed to reload policies: {e}")
+            return False
+
+    def get_policy_count(self) -> int:
+        """Get the total number of policies in the enforcer"""
+        return len(self.enforcer.get_policy())
+
+    def clear_all_policies(self) -> bool:
+        """Clear all policies from the enforcer (use with caution)"""
+        try:
+            self.enforcer.clear_policy()
+            self.enforcer.save_policy()
+            return True
+        except Exception as e:
+            logger.error(f"Failed to clear policies: {e}")
+            return False