app.py

"""
TSZ (Thyris Safe Zone) - Interactive Demo
==========================================
GitHub: https://github.com/thyrisAI/safe-zone
Website: https://thyris.ai
"""

import gradio as gr
import re
import uuid
import hashlib
from dataclasses import dataclass
from typing import List, Tuple


@dataclass
class Detection:
    type: str
    value: str
    placeholder: str
    start: int
    end: int
    confidence: str
    mask_id: str


class TSZDetector:
    PATTERNS = {
        "EMAIL": {
            "pattern": r'\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b',
            "description": "Email addresses"
        },
        "PHONE": {
            "pattern": r'\b(?:\+?1[-.\s]?)?\(?[0-9]{3}\)?[-.\s]?[0-9]{3}[-.\s]?[0-9]{4}\b',
            "description": "Phone numbers (US format)"
        },
        "PHONE_TR": {
            "pattern": r'\b(?:\+90|0)?[-.\s]?[0-9]{3}[-.\s]?[0-9]{3}[-.\s]?[0-9]{2}[-.\s]?[0-9]{2}\b',
            "description": "Phone numbers (Turkey format)"
        },
        "CREDIT_CARD": {
            "pattern": r'\b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|3[47][0-9]{13}|6(?:011|5[0-9]{2})[0-9]{12})\b',
            "description": "Credit card numbers"
        },
        "SSN": {
            "pattern": r'\b[0-9]{3}-[0-9]{2}-[0-9]{4}\b',
            "description": "Social Security Numbers (US)"
        },
        "TC_KIMLIK": {
            "pattern": r'\b[1-9][0-9]{10}\b',
            "description": "Turkish National ID"
        },
        "IBAN": {
            "pattern": r'\b[A-Z]{2}[0-9]{2}[A-Z0-9]{4}[0-9]{7}([A-Z0-9]?){0,16}\b',
            "description": "International Bank Account Numbers"
        },
        "IP_ADDRESS": {
            "pattern": r'\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b',
            "description": "IPv4 addresses"
        },
        "API_KEY": {
            "pattern": r'\b(?:sk-[a-zA-Z0-9]{32,}|api[_-]?key[_-]?[=:]\s*["\']?[a-zA-Z0-9]{16,}["\']?)\b',
            "description": "API keys and secrets"
        },
        "AWS_KEY": {
            "pattern": r'\b(?:AKIA|ABIA|ACCA|ASIA)[A-Z0-9]{16}\b',
            "description": "AWS Access Keys"
        },
        "PASSWORD": {
            "pattern": r'(?:password|passwd|pwd)[_\s]*[=:]\s*["\']?[^\s"\']{4,}["\']?',
            "description": "Passwords in config/code"
        },
        "JWT_TOKEN": {
            "pattern": r'\beyJ[A-Za-z0-9-_]+\.eyJ[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\b',
            "description": "JSON Web Tokens"
        }
    }

    def _generate_mask_id(self, value: str) -> str:
        """Generate a short unique mask ID based on value hash"""
        hash_val = hashlib.md5(value.encode()).hexdigest()[:6]
        return hash_val

    def detect(self, text: str, rid: str = "NO-RID") -> Tuple[List[Detection], str]:
        detections = []
        redacted_text = text
        type_counters = {}

        for pii_type, config in self.PATTERNS.items():
            pattern = config["pattern"]
            for match in re.finditer(pattern, text, re.IGNORECASE):
                value = match.group()
                if pii_type == "TC_KIMLIK" and len(value) != 11:
                    continue

                if pii_type not in type_counters:
                    type_counters[pii_type] = 0
                type_counters[pii_type] += 1

                mask_id = self._generate_mask_id(value)
                placeholder = f"[{rid}_{pii_type}_{mask_id}]"

                detections.append(Detection(
                    type=pii_type,
                    value=value,
                    placeholder=placeholder,
                    start=match.start(),
                    end=match.end(),
                    confidence="HIGH" if len(value) > 8 else "MEDIUM",
                    mask_id=mask_id
                ))

        detections.sort(key=lambda x: x.start, reverse=True)
        for det in detections:
            redacted_text = redacted_text[:det.start] + det.placeholder + redacted_text[det.end:]

        detections.sort(key=lambda x: x.start)
        return detections, redacted_text


detector = TSZDetector()


def analyze_text(text: str, rid: str) -> Tuple[str, str, str, str]:
    if not text.strip():
        return "", "Please enter some text to analyze.", "", ""

    if not rid.strip():
        rid = f"TSZ-{uuid.uuid4().hex[:8].upper()}"

    detections, redacted_text = detector.detect(text, rid)

    if not detections:
        return text, "No sensitive information detected.", "**0** PII entities found", f"Request ID: `{rid}`"

    report_lines = ["### Detected Entities\n"]
    by_type = {}
    for det in detections:
        if det.type not in by_type:
            by_type[det.type] = []
        by_type[det.type].append(det)

    for pii_type, items in by_type.items():
        desc = detector.PATTERNS[pii_type]["description"]
        report_lines.append(f"\n**{pii_type}** ({desc})")
        for item in items:
            masked_value = item.value[:3] + "***" + item.value[-2:] if len(item.value) > 5 else "***"
            report_lines.append(f"- `{masked_value}` → `{item.placeholder}`")
            report_lines.append(f"  - Mask ID: `{item.mask_id}` | Confidence: {item.confidence}")

    report = "\n".join(report_lines)
    stats = f"**{len(detections)}** PII entities found across **{len(by_type)}** categories"
    rid_display = f"Request ID: `{rid}`"

    return redacted_text, report, stats, rid_display


EXAMPLES = [
    ["Hi, my name is John Smith and my email is john.smith@company.com. You can reach me at +1-555-123-4567. My SSN is 123-45-6789.", "REQ-001"],
    ["Customer Order #12345\nName: Jane Doe\nEmail: jane.doe@example.org\nPhone: (555) 987-6543\nCredit Card: 4532015112830366", "ORDER-12345"],
    ["API Configuration:\napi_key = \"sk-1234567890abcdefghijklmnopqrstuvwxyz\"\nAWS_ACCESS_KEY: AKIAIOSFODNN7EXAMPLE\npassword: \"super_secret_123\"", "CONFIG-SCAN"],
    ["Merhaba, ben Ahmet Yilmaz. TC Kimlik numaram 12345678901.\nTelefon: 0532 123 45 67\nIBAN: TR330006100519786457841326", "TR-REQ-001"],
]


with gr.Blocks(title="TSZ - Thyris Safe Zone Demo", theme=gr.themes.Soft()) as demo:

    gr.Markdown("""
    # 🛡️ TSZ (Thyris Safe Zone)
    **Enterprise-grade PII detection and guardrails gateway** that prevents sensitive data from leaking to LLMs and third-party APIs.

    [![GitHub](https://img.shields.io/badge/GitHub-Repository-black?logo=github)](https://github.com/thyrisAI/safe-zone)
    [![Website](https://img.shields.io/badge/Website-thyris.ai-blue)](https://thyris.ai)
    [![License](https://img.shields.io/badge/License-Apache%202.0-green)](https://github.com/thyrisAI/safe-zone/blob/main/LICENSE)
    """)

    with gr.Tabs():
        with gr.TabItem("🔍 Interactive Demo"):
            with gr.Row():
                with gr.Column():
                    rid_input = gr.Textbox(
                        label="Request ID (RID)",
                        placeholder="e.g., REQ-001 (auto-generated if empty)",
                        lines=1
                    )
                    input_text = gr.Textbox(
                        label="Input Text",
                        placeholder="Paste text containing emails, phone numbers, credit cards, API keys...",
                        lines=8
                    )
                    analyze_btn = gr.Button("Analyze & Redact", variant="primary")
                    gr.Markdown("### Try These Examples")
                    gr.Examples(examples=EXAMPLES, inputs=[input_text, rid_input])

                with gr.Column():
                    rid_display = gr.Markdown(label="Request ID")
                    stats_output = gr.Markdown(label="Statistics")
                    redacted_output = gr.Textbox(
                        label="Redacted Output (Safe to send to LLMs)",
                        lines=8,
                        interactive=False
                    )
                    detection_report = gr.Markdown(label="Detection Report")

            gr.Markdown("""
            ---
            ### Placeholder Format

            TSZ uses the format `[RID_TYPE_maskId]` for placeholders:
            - **RID**: Request ID for audit correlation
            - **TYPE**: Detection type (EMAIL, PHONE, etc.)
            - **maskId**: Unique identifier derived from the original value

            Example: `[REQ-001_EMAIL_a1b2c3]`

            This allows you to:
            - Track which request generated the redaction
            - Identify the type of sensitive data
            - Correlate with audit logs for compliance
            """)

            analyze_btn.click(fn=analyze_text, inputs=[input_text, rid_input], outputs=[redacted_output, detection_report, stats_output, rid_display])
            input_text.submit(fn=analyze_text, inputs=[input_text, rid_input], outputs=[redacted_output, detection_report, stats_output, rid_display])

        with gr.TabItem("📚 API Reference"):
            gr.Markdown("""
## TSZ API Reference
TSZ is an enterprise-grade PII detection and guardrails gateway. It acts as a zero-trust middleware between your applications and external systems.
---
### Confidence & Guardrails Model
| Confidence | Action |
|------------|--------|
| < 0.30 | ALLOW (ignored) |
| 0.30 – 0.85 | MASK (redact) |
| ≥ 0.85 | AUTO-BLOCK |
---
### POST /detect
**Request:**
```json
{
  "text": "My email is user@company.com",
  "rid": "REQ-001",
  "guardrails": ["TOXIC_LANGUAGE"]
}
```
**Response:**
```json
{
  "redacted_text": "My email is [REQ-001_EMAIL_a1b2c3]",
  "detections": [
    {
      "type": "EMAIL",
      "value": "user@company.com",
      "placeholder": "[REQ-001_EMAIL_a1b2c3]",
      "start": 12,
      "end": 28,
      "confidence_score": "0.78",
      "confidence_explanation": {
        "source": "HYBRID",
        "regex_score": "0.55",
        "ai_score": "0.90",
        "final_score": "0.78"
      }
    }
  ],
  "blocked": false,
  "contains_pii": true,
  "overall_confidence": "0.78"
}
```
---
### Placeholder Format
TSZ generates unique placeholders in the format:
```
[{RID}_{TYPE}_{maskId}]
```
- **RID**: Request ID for audit log correlation
- **TYPE**: Detection type (EMAIL, CREDIT_CARD, etc.)
- **maskId**: Hash-based unique identifier
Example: `[RID-GW-001_EMAIL_a1b2c3]`
---
### POST /v1/chat/completions
OpenAI-compatible LLM Gateway with built-in guardrails.
**Headers:**
- `X-TSZ-RID`: Request ID for audit logs
- `X-TSZ-Guardrails`: Comma-separated validators
- `X-TSZ-Guardrails-Mode`: `final-only` | `stream-sync` | `stream-async`
**Response with tsz_meta:**
```json
{
  "id": "chatcmpl-58",
  "choices": [...],
  "tsz_meta": {
    "rid": "RID-GW-001",
    "guardrails": ["TOXIC_LANGUAGE"],
    "input": [
      {
        "redacted_text": "My email is [RID-GW-001_EMAIL_a1b2c3]",
        "detections": [...],
        "blocked": false
      }
    ],
    "output": [...]
  }
}
```
---
### Pattern Management
| Method | Endpoint | Description |
|--------|----------|-------------|
| `POST` | `/patterns` | Create pattern |
| `GET` | `/patterns` | List patterns |
| `DELETE` | `/patterns/{id}` | Delete pattern |
---
### Validators & Guardrails
```json
{
  "name": "TOXIC_LANGUAGE",
  "type": "AI_PROMPT",
  "rule": "Is this text toxic? Answer YES or NO.",
  "expected_response": "NO"
}
```
---
### Health & Admin
| Endpoint | Description |
|----------|-------------|
| `GET /healthz` | Liveness probe |
| `GET /ready` | Readiness probe |
| `POST /admin/reload` | Clear caches |
---
📖 **Full Documentation:** [API_REFERENCE.md](https://github.com/thyrisAI/safe-zone/blob/main/docs/API_REFERENCE.md)
            """)

        with gr.TabItem("🚀 Quick Start"):
            gr.Markdown("""
## Get Started with TSZ
### Docker (Recommended)
```bash
git clone https://github.com/thyrisAI/safe-zone.git
cd safe-zone
docker-compose up -d
```
TSZ will be available at `http://localhost:8080`
---
### Environment Variables
```bash
# LLM Gateway Configuration
THYRIS_AI_MODEL_URL=https://api.openai.com/v1
THYRIS_AI_API_KEY=sk-your-key
# Confidence Thresholds
CONFIDENCE_ALLOW_THRESHOLD=0.30
CONFIDENCE_BLOCK_THRESHOLD=0.85
# PII Mode
PII_MODE=MASK  # or BLOCK
GATEWAY_BLOCK_MODE=BLOCK  # BLOCK, MASK, or WARN
```
---
### Test with Request ID
```bash
curl -X POST http://localhost:8080/detect \\
  -H "Content-Type: application/json" \\
  -d '{
    "text": "Email: test@example.com",
    "rid": "MY-REQ-001"
  }'
```
**Response:**
```json
{
  "redacted_text": "Email: [MY-REQ-001_EMAIL_abc123]",
  "detections": [...],
  "contains_pii": true
}
```
---
### Architecture
```
┌─────────────┐     ┌─────────────┐     ┌─────────────┐
│  Your App   │────▶│     TSZ     │────▶│  LLM API    │
└─────────────┘     └─────────────┘     └─────────────┘
       │                  │
       │            ┌─────▼─────┐
       │            │ Audit Log │
       │            │ (with RID)│
       └───────────▶└───────────┘
```
---
📖 **Documentation:** [github.com/thyrisAI/safe-zone/docs](https://github.com/thyrisAI/safe-zone/tree/main/docs)
            """)

        with gr.TabItem("ℹ️ About"):
            gr.Markdown("""
## About TSZ (Thyris Safe Zone)
Developed by **Thyris.AI** as an open-source enterprise AI security solution.
### Key Features
| Feature | Description |
|---------|-------------|
| **Hybrid Detection** | Regex + AI-powered confidence scoring |
| **Traceable Redaction** | `[RID_TYPE_maskId]` format for audit |
| **LLM Gateway** | OpenAI-compatible proxy |
| **Streaming Support** | sync/async modes for SSE |
| **Guardrails** | AI validators (toxic, schema, custom) |
---
### Placeholder System
Each redacted value gets a unique, traceable placeholder:
```
[RID-GW-001_EMAIL_a1b2c3]
  │          │      │
  │          │      └── Unique mask ID (hash of value)
  │          └── Detection type
  └── Request ID for correlation
```
Benefits:
- Full audit trail
- SIEM integration
- Compliance reporting
- Debug & investigation
---
### Compliance Ready
- ✅ GDPR (EU)
- ✅ KVKK (Turkey)
- ✅ CCPA (California)
- ✅ HIPAA (Healthcare)
- ✅ PCI-DSS (Payment)
---
Built with ❤️ by [Thyris.AI](https://thyris.ai)
            """)


if __name__ == "__main__":
    demo.launch()