feat(server): policy + context CRUD endpoints

Cargo.toml

@@ -30,6 +30,12 @@ documentation = "https://docs.rs/nvisy-server"
 #
 # See for more details: https://github.com/rust-lang/cargo/issues/11329
 
+# Runtime crates (detection & redaction engine); tracks main.
+# The engine needs its default modality features (tabular/image/audio/
+# document); disabling them selects an uncompilable feature combination.
+nvisy-engine = { git = "https://github.com/nvisycom/runtime", branch = "main" }
+nvisy-schema = { git = "https://github.com/nvisycom/runtime", branch = "main", default-features = false }
+
 # Internal crates
 nvisy-base = { path = "./crates/nvisy-base", version = "0.1.0" }
 nvisy-nats = { path = "./crates/nvisy-nats", version = "0.1.0" }

crates/nvisy-postgres/src/model/mod.rs

@@ -19,6 +19,7 @@ mod workspace_member;
 mod workspace_pipeline;
 mod workspace_pipeline_artifact;
 mod workspace_pipeline_run;
+mod workspace_policy;
 mod workspace_webhook;
 
 // Account models
@@ -53,4 +54,5 @@ pub use workspace_pipeline_artifact::{NewWorkspacePipelineArtifact, WorkspacePip
 pub use workspace_pipeline_run::{
     NewWorkspacePipelineRun, UpdateWorkspacePipelineRun, WorkspacePipelineRun,
 };
+pub use workspace_policy::{NewWorkspacePolicy, UpdateWorkspacePolicy, WorkspacePolicy};
 pub use workspace_webhook::{NewWorkspaceWebhook, UpdateWorkspaceWebhook, WorkspaceWebhook};

crates/nvisy-postgres/src/model/workspace_context.rs

@@ -8,10 +8,10 @@ use uuid::Uuid;
 use crate::schema::workspace_contexts;
 use crate::types::{HasCreatedAt, HasDeletedAt, HasUpdatedAt};
 
-/// Workspace context model representing metadata for encrypted context files.
+/// Workspace context representing structured reference-data for redaction.
 ///
-/// The actual encrypted content is stored in NATS object storage.
-/// This record holds the metadata and storage reference.
+/// The `definition` holds a `nvisy_schema` Context (typed reference-data
+/// entries) that the redaction engine consumes.
 #[derive(Debug, Clone, PartialEq, Queryable, Selectable)]
 #[diesel(table_name = workspace_contexts)]
 #[diesel(check_for_backend(diesel::pg::Pg))]
@@ -26,15 +26,11 @@ pub struct WorkspaceContext {
     pub name: String,
     /// Context description.
     pub description: Option<String>,
-    /// Content MIME type.
-    pub mime_type: String,
-    /// NATS object store key for the encrypted content.
-    pub storage_key: String,
-    /// Size of the encrypted content in bytes.
-    pub content_size: i64,
-    /// SHA-256 hash of the encrypted content.
-    pub content_hash: Vec<u8>,
-    /// Non-encrypted metadata for filtering/display.
+    /// Semver of the context body.
+    pub version: String,
+    /// Encrypted Context body (the engine's Context type as JSON).
+    pub definition: Vec<u8>,
+    /// Metadata for filtering/display.
     pub metadata: JsonValue,
     /// Timestamp when the context was created.
     pub created_at: Timestamp,
@@ -57,15 +53,11 @@ pub struct NewWorkspaceContext {
     pub name: String,
     /// Context description.
     pub description: Option<String>,
-    /// Content MIME type.
-    pub mime_type: String,
-    /// NATS object store key.
-    pub storage_key: String,
-    /// Size of the encrypted content in bytes.
-    pub content_size: i64,
-    /// SHA-256 hash of the encrypted content.
-    pub content_hash: Vec<u8>,
-    /// Non-encrypted metadata for filtering/display.
+    /// Semver of the context body.
+    pub version: String,
+    /// Encrypted Context body (the engine's Context type as JSON).
+    pub definition: Vec<u8>,
+    /// Metadata for filtering/display.
     pub metadata: Option<JsonValue>,
 }
 
@@ -78,15 +70,11 @@ pub struct UpdateWorkspaceContext {
     pub name: Option<String>,
     /// Context description.
     pub description: Option<Option<String>>,
-    /// Content MIME type.
-    pub mime_type: Option<String>,
-    /// NATS object store key (updated on content replacement).
-    pub storage_key: Option<String>,
-    /// Size of the encrypted content in bytes.
-    pub content_size: Option<i64>,
-    /// SHA-256 hash of the encrypted content.
-    pub content_hash: Option<Vec<u8>>,
-    /// Non-encrypted metadata for filtering/display.
+    /// Semver of the context body.
+    pub version: Option<String>,
+    /// Encrypted Context body (the engine's Context type as JSON).
+    pub definition: Option<Vec<u8>>,
+    /// Metadata for filtering/display.
     pub metadata: Option<JsonValue>,
     /// Soft delete timestamp.
     pub deleted_at: Option<Option<Timestamp>>,

crates/nvisy-postgres/src/model/workspace_policy.rs

@@ -0,0 +1,106 @@
+//! Workspace policy model for PostgreSQL database operations.
+
+use diesel::prelude::*;
+use jiff_diesel::Timestamp;
+use serde_json::Value as JsonValue;
+use uuid::Uuid;
+
+use crate::schema::workspace_policies;
+use crate::types::{HasCreatedAt, HasDeletedAt, HasUpdatedAt};
+
+/// Workspace policy representing a structured redaction governance policy.
+///
+/// The `definition` holds a `nvisy_schema` Policy (rules, labels, fallback,
+/// retention) that the redaction engine consumes.
+#[derive(Debug, Clone, PartialEq, Queryable, Selectable)]
+#[diesel(table_name = workspace_policies)]
+#[diesel(check_for_backend(diesel::pg::Pg))]
+pub struct WorkspacePolicy {
+    /// Unique policy identifier.
+    pub id: Uuid,
+    /// Reference to the workspace this policy belongs to.
+    pub workspace_id: Uuid,
+    /// Reference to the account that created this policy.
+    pub account_id: Uuid,
+    /// Human-readable policy name.
+    pub name: String,
+    /// Policy description.
+    pub description: Option<String>,
+    /// Semver of the policy body.
+    pub version: String,
+    /// Encrypted Policy body (the engine's Policy type as JSON).
+    pub definition: Vec<u8>,
+    /// Metadata for filtering/display.
+    pub metadata: JsonValue,
+    /// Timestamp when the policy was created.
+    pub created_at: Timestamp,
+    /// Timestamp when the policy was last updated.
+    pub updated_at: Timestamp,
+    /// Timestamp when the policy was soft-deleted.
+    pub deleted_at: Option<Timestamp>,
+}
+
+/// Data for creating a new workspace policy.
+#[derive(Debug, Clone, Insertable)]
+#[diesel(table_name = workspace_policies)]
+#[diesel(check_for_backend(diesel::pg::Pg))]
+pub struct NewWorkspacePolicy {
+    /// Workspace ID (required).
+    pub workspace_id: Uuid,
+    /// Account ID (required).
+    pub account_id: Uuid,
+    /// Policy name.
+    pub name: String,
+    /// Policy description.
+    pub description: Option<String>,
+    /// Semver of the policy body.
+    pub version: String,
+    /// Encrypted Policy body (the engine's Policy type as JSON).
+    pub definition: Vec<u8>,
+    /// Metadata for filtering/display.
+    pub metadata: Option<JsonValue>,
+}
+
+/// Data for updating a workspace policy.
+#[derive(Debug, Clone, Default, AsChangeset)]
+#[diesel(table_name = workspace_policies)]
+#[diesel(check_for_backend(diesel::pg::Pg))]
+pub struct UpdateWorkspacePolicy {
+    /// Policy name.
+    pub name: Option<String>,
+    /// Policy description.
+    pub description: Option<Option<String>>,
+    /// Semver of the policy body.
+    pub version: Option<String>,
+    /// Encrypted Policy body (the engine's Policy type as JSON).
+    pub definition: Option<Vec<u8>>,
+    /// Metadata for filtering/display.
+    pub metadata: Option<JsonValue>,
+    /// Soft delete timestamp.
+    pub deleted_at: Option<Option<Timestamp>>,
+}
+
+impl WorkspacePolicy {
+    /// Returns whether the policy is deleted.
+    pub fn is_deleted(&self) -> bool {
+        self.deleted_at.is_some()
+    }
+}
+
+impl HasCreatedAt for WorkspacePolicy {
+    fn created_at(&self) -> jiff::Timestamp {
+        self.created_at.into()
+    }
+}
+
+impl HasUpdatedAt for WorkspacePolicy {
+    fn updated_at(&self) -> jiff::Timestamp {
+        self.updated_at.into()
+    }
+}
+
+impl HasDeletedAt for WorkspacePolicy {
+    fn deleted_at(&self) -> Option<jiff::Timestamp> {
+        self.deleted_at.map(Into::into)
+    }
+}

crates/nvisy-postgres/src/query/mod.rs

@@ -29,6 +29,7 @@ mod workspace_member;
 mod workspace_pipeline;
 mod workspace_pipeline_artifact;
 mod workspace_pipeline_run;
+mod workspace_policy;
 mod workspace_webhook;
 
 pub use account::AccountRepository;
@@ -47,4 +48,5 @@ pub use workspace_member::WorkspaceMemberRepository;
 pub use workspace_pipeline::WorkspacePipelineRepository;
 pub use workspace_pipeline_artifact::WorkspacePipelineArtifactRepository;
 pub use workspace_pipeline_run::WorkspacePipelineRunRepository;
+pub use workspace_policy::WorkspacePolicyRepository;
 pub use workspace_webhook::WorkspaceWebhookRepository;