Spaces:
Paused
Paused
Improve input flow and reporting
#2
by
anmol11p
- opened
- src/compliance_lib.py +108 -46
src/compliance_lib.py
CHANGED
|
@@ -1,58 +1,120 @@
|
|
| 1 |
-
import
|
| 2 |
-
from
|
| 3 |
-
|
| 4 |
-
|
| 5 |
-
|
| 6 |
-
|
| 7 |
-
|
| 8 |
-
|
| 9 |
-
|
| 10 |
-
""
|
| 11 |
-
|
| 12 |
-
if os.path.exists(cache_path):
|
| 13 |
-
mtime = datetime.fromtimestamp(os.path.getmtime(cache_path))
|
| 14 |
-
if datetime.utcnow() - mtime < timedelta(hours=ttl_hours):
|
| 15 |
-
return open(cache_path, encoding="utf-8").read()
|
| 16 |
-
r = requests.get(url, headers=HEADERS, timeout=20)
|
| 17 |
-
soup = bs4.BeautifulSoup(r.text, "html.parser")
|
| 18 |
-
text = " ".join(t.get_text(" ", strip=True) for t in soup.find_all(["p", "li"]))
|
| 19 |
-
open(cache_path, "w", encoding="utf-8").write(text)
|
| 20 |
-
return text
|
| 21 |
-
|
| 22 |
-
# ---- 2. minimal rule base ---------------------------------------------------
|
| 23 |
-
RULES = {
|
| 24 |
-
"GDPR": [
|
| 25 |
-
("Lawful basis documented", r"lawful\s+basis"),
|
| 26 |
("Data-subject rights process", r"right\s+to\s+access|erasure"),
|
| 27 |
("72-hour breach notice plan", r"72\s*hour"),
|
| 28 |
],
|
| 29 |
-
"
|
| 30 |
-
|
| 31 |
("Training data governance", r"data\s+governance"),
|
| 32 |
],
|
| 33 |
-
"ISO_27001":
|
| 34 |
("Annex A control list", r"annex\s*a"),
|
| 35 |
("Statement of Applicability", r"statement\s+of\s+applicability"),
|
| 36 |
-
]
|
| 37 |
-
|
| 38 |
-
|
| 39 |
-
|
| 40 |
-
|
| 41 |
-
|
| 42 |
-
|
| 43 |
-
|
| 44 |
-
|
| 45 |
-
for label, pattern in
|
| 46 |
-
|
| 47 |
-
|
| 48 |
return results
|
| 49 |
|
| 50 |
-
|
| 51 |
-
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 52 |
|
| 53 |
HF_MODEL = "mistralai/Mixtral-8x7B-Instruct-v0.1"
|
| 54 |
|
| 55 |
-
|
| 56 |
-
|
| 57 |
-
|
| 58 |
-
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 1 |
+
import re
|
| 2 |
+
from huggingface_hub import InferenceClient
|
| 3 |
+
import os
|
| 4 |
+
import requests as req
|
| 5 |
+
from bs4 import BeautifulSoup
|
| 6 |
+
import streamlit as st
|
| 7 |
+
from dotenv import load_dotenv
|
| 8 |
+
load_dotenv()
|
| 9 |
+
RULES={
|
| 10 |
+
"GDPR":[
|
| 11 |
+
("Lawful basis documented", r"lawful\s+basis"),
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 12 |
("Data-subject rights process", r"right\s+to\s+access|erasure"),
|
| 13 |
("72-hour breach notice plan", r"72\s*hour"),
|
| 14 |
],
|
| 15 |
+
"EU_AI_ACT":[
|
| 16 |
+
("High-risk AI DPIA", r"risk\s+assessment"),
|
| 17 |
("Training data governance", r"data\s+governance"),
|
| 18 |
],
|
| 19 |
+
"ISO_27001":[
|
| 20 |
("Annex A control list", r"annex\s*a"),
|
| 21 |
("Statement of Applicability", r"statement\s+of\s+applicability"),
|
| 22 |
+
]
|
| 23 |
+
}
|
| 24 |
+
|
| 25 |
+
def run_check(text,framework):
|
| 26 |
+
# print(text,framework) #array from me aata hai framework
|
| 27 |
+
results={}
|
| 28 |
+
for fw in framework:
|
| 29 |
+
results[fw]=[] #store particular fw data
|
| 30 |
+
# one work as label & one work as pattern e.g==>label: Training data governance pattern: data\s+governance
|
| 31 |
+
for label, pattern in RULES[fw]:
|
| 32 |
+
match = re.search(pattern, text, re.I) # re.I = re.IGNORECASE
|
| 33 |
+
results[fw].append((label, bool(match)))
|
| 34 |
return results
|
| 35 |
|
| 36 |
+
|
| 37 |
+
|
| 38 |
+
AI_REPORT_PROMPT = """
|
| 39 |
+
You are an expert compliance consultant with deep experience in GDPR, the EU AI Act, ISO 27001, and related global data‑privacy and security standards. You have just received a concise checklist summary showing, for each framework, how many controls passed and which specific items failed.
|
| 40 |
+
|
| 41 |
+
Your task is to produce a **clear, actionable report** tailored to a technical audience. Structure it as follows:
|
| 42 |
+
|
| 43 |
+
1. **Executive Summary**
|
| 44 |
+
- One or two sentences on overall compliance posture
|
| 45 |
+
- Highest‑level takeaways
|
| 46 |
+
|
| 47 |
+
2. **Key Issues Identified**
|
| 48 |
+
- For each framework with failures, list:
|
| 49 |
+
- The specific failed control(s) by label
|
| 50 |
+
- A brief description of why that control matters
|
| 51 |
+
- Use bullet points and group by framework
|
| 52 |
+
|
| 53 |
+
3. **Redemption Strategies**
|
| 54 |
+
- For each key issue above, recommend a **concrete next step** or mitigation strategy
|
| 55 |
+
- Prioritize actions by risk/impact (e.g., “High‑priority: Encrypt data at rest to meet ISO 27001 A.10.1”)
|
| 56 |
+
|
| 57 |
+
4. **Additional Resources & Next Steps**
|
| 58 |
+
- A short paragraph on how deeper expert review can streamline remediation
|
| 59 |
+
- A call‑out promoting AnkTechSol’s professional compliance consulting (e.g., “For a full policy audit, tailored gap analysis, and implementation roadmap, visit anktechsol.com or contact our team at [contact link].”)
|
| 60 |
+
|
| 61 |
+
5. **Appendix (Optional)**
|
| 62 |
+
- Raw bullet list of “Framework: X passed/total, Y failed/total”
|
| 63 |
+
|
| 64 |
+
Make sure to:
|
| 65 |
+
- Use clear headings (`## Executive Summary`, etc.)
|
| 66 |
+
- Keep each section brief but substantive (no more than 4–6 bullets per section)
|
| 67 |
+
- Write in a confident, consultative tone
|
| 68 |
+
|
| 69 |
+
Here are the raw results to incorporate:
|
| 70 |
+
|
| 71 |
+
{bullet}
|
| 72 |
+
|
| 73 |
+
Generate the report as markdown.
|
| 74 |
+
"""
|
| 75 |
|
| 76 |
HF_MODEL = "mistralai/Mixtral-8x7B-Instruct-v0.1"
|
| 77 |
|
| 78 |
+
|
| 79 |
+
|
| 80 |
+
|
| 81 |
+
def generate_report(prompt,max_tokens=600):
|
| 82 |
+
token = os.getenv("HF_TOKEN")
|
| 83 |
+
if not token:
|
| 84 |
+
raise EnvironmentError("token is not found in env issue")
|
| 85 |
+
|
| 86 |
+
client = InferenceClient(
|
| 87 |
+
provider="together",
|
| 88 |
+
api_key=token,
|
| 89 |
+
)
|
| 90 |
+
try:
|
| 91 |
+
response = client.chat.completions.create(
|
| 92 |
+
model=HF_MODEL,
|
| 93 |
+
messages=[ {
|
| 94 |
+
"role": "user",
|
| 95 |
+
"content": prompt
|
| 96 |
+
}]
|
| 97 |
+
|
| 98 |
+
)
|
| 99 |
+
|
| 100 |
+
return response.choices[0].message.content
|
| 101 |
+
except Exception as e:
|
| 102 |
+
|
| 103 |
+
return "Error: Failed to generate report."
|
| 104 |
+
|
| 105 |
+
|
| 106 |
+
def fetchText(url):
|
| 107 |
+
try:
|
| 108 |
+
response = req.get(url)
|
| 109 |
+
response.raise_for_status()
|
| 110 |
+
soup = BeautifulSoup(response.text, 'html.parser')
|
| 111 |
+
main_content = soup.find('main')
|
| 112 |
+
if main_content:
|
| 113 |
+
text = main_content.get_text(separator='\n', strip=True)
|
| 114 |
+
else:
|
| 115 |
+
text = soup.body.get_text(separator='\n', strip=True)
|
| 116 |
+
|
| 117 |
+
return text.strip(), None # No error
|
| 118 |
+
except Exception as e:
|
| 119 |
+
return "", f"Error fetching URL: {e}"
|
| 120 |
+
__all__=["RULES","run_check","AI_REPORT_PROMPT","generate_report","fetchText"]
|