Upload 32 files

.env.example

@@ -0,0 +1,11 @@
+APP_NAME=Two Wheeler Scorecard API
+ENVIRONMENT=local
+DATABASE_URL=postgresql+psycopg://scorecard:scorecard@postgres:5432/scorecard
+REDIS_URL=redis://redis:6379/0
+JWT_SECRET_KEY=change-me-in-production
+JWT_ALGORITHM=HS256
+ACCESS_TOKEN_EXPIRE_MINUTES=60
+DEFAULT_TENANT_ID=default
+DEFAULT_PRODUCT_TYPE=TWO_WHEELER_LOAN
+ENABLE_AUTH=false
+

.gitattributes

@@ -33,3 +33,4 @@ saved_model/**/* filter=lfs diff=lfs merge=lfs -text
 *.zip filter=lfs diff=lfs merge=lfs -text
 *.zst filter=lfs diff=lfs merge=lfs -text
 *tfevents* filter=lfs diff=lfs merge=lfs -text
+scorecard.db filter=lfs diff=lfs merge=lfs -text

0001_initial_schema.py

@@ -0,0 +1,144 @@
+"""initial schema
+
+Revision ID: 0001_initial_schema
+Revises:
+Create Date: 2026-05-06
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+revision: str = "0001_initial_schema"
+down_revision: Union[str, None] = None
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "rule_master",
+        sa.Column("id", sa.Integer(), nullable=False),
+        sa.Column("tenant_id", sa.String(length=100), nullable=False),
+        sa.Column("product_type", sa.String(length=50), nullable=False),
+        sa.Column("dealer_id", sa.String(length=100), nullable=True),
+        sa.Column("rule_code", sa.String(length=100), nullable=False),
+        sa.Column("rule_name", sa.String(length=255), nullable=False),
+        sa.Column("rule_type", sa.String(length=50), nullable=False),
+        sa.Column("field_name", sa.String(length=100), nullable=False),
+        sa.Column("operator", sa.String(length=20), nullable=False),
+        sa.Column("field_value", sa.String(length=255), nullable=False),
+        sa.Column("score_value", sa.Numeric(10, 2), nullable=True),
+        sa.Column("score_component", sa.String(length=50), nullable=True),
+        sa.Column("decision_action", sa.String(length=50), nullable=True),
+        sa.Column("reason_code", sa.String(length=100), nullable=False),
+        sa.Column("priority", sa.Integer(), nullable=False),
+        sa.Column("version", sa.Integer(), nullable=False),
+        sa.Column("is_active", sa.Boolean(), nullable=False),
+        sa.Column("created_by", sa.String(length=100), nullable=True),
+        sa.Column("created_at", sa.DateTime(), nullable=False),
+        sa.Column("updated_at", sa.DateTime(), nullable=False),
+        sa.PrimaryKeyConstraint("id"),
+        sa.UniqueConstraint("rule_code", "version", "tenant_id", "product_type", "dealer_id"),
+    )
+    op.create_index(op.f("ix_rule_master_dealer_id"), "rule_master", ["dealer_id"], unique=False)
+    op.create_index(op.f("ix_rule_master_id"), "rule_master", ["id"], unique=False)
+    op.create_index(op.f("ix_rule_master_is_active"), "rule_master", ["is_active"], unique=False)
+    op.create_index(op.f("ix_rule_master_product_type"), "rule_master", ["product_type"], unique=False)
+    op.create_index(op.f("ix_rule_master_rule_code"), "rule_master", ["rule_code"], unique=False)
+    op.create_index(op.f("ix_rule_master_rule_type"), "rule_master", ["rule_type"], unique=False)
+    op.create_index(op.f("ix_rule_master_tenant_id"), "rule_master", ["tenant_id"], unique=False)
+
+    op.create_table(
+        "scorecard_result",
+        sa.Column("id", sa.Integer(), nullable=False),
+        sa.Column("tenant_id", sa.String(length=100), nullable=False),
+        sa.Column("product_type", sa.String(length=50), nullable=False),
+        sa.Column("lead_id", sa.String(length=100), nullable=False),
+        sa.Column("final_score", sa.Numeric(10, 2), nullable=False),
+        sa.Column("decision", sa.String(length=50), nullable=False),
+        sa.Column("underwriting_required", sa.Boolean(), nullable=False),
+        sa.Column("reject_flag", sa.Boolean(), nullable=False),
+        sa.Column("journey_action", sa.String(length=50), nullable=False),
+        sa.Column("bureau_risk", sa.String(length=50), nullable=False),
+        sa.Column("score_breakup", sa.JSON(), nullable=False),
+        sa.Column("triggered_rules", sa.JSON(), nullable=False),
+        sa.Column("reason_codes", sa.JSON(), nullable=False),
+        sa.Column("request_hash", sa.String(length=64), nullable=False),
+        sa.Column("created_at", sa.DateTime(), nullable=False),
+        sa.PrimaryKeyConstraint("id"),
+    )
+    op.create_index(op.f("ix_scorecard_result_id"), "scorecard_result", ["id"], unique=False)
+    op.create_index(op.f("ix_scorecard_result_lead_id"), "scorecard_result", ["lead_id"], unique=False)
+    op.create_index(
+        op.f("ix_scorecard_result_product_type"), "scorecard_result", ["product_type"], unique=False
+    )
+    op.create_index(
+        op.f("ix_scorecard_result_request_hash"), "scorecard_result", ["request_hash"], unique=False
+    )
+    op.create_index(op.f("ix_scorecard_result_tenant_id"), "scorecard_result", ["tenant_id"], unique=False)
+
+    op.create_table(
+        "rule_audit_log",
+        sa.Column("id", sa.Integer(), nullable=False),
+        sa.Column("rule_id", sa.Integer(), nullable=True),
+        sa.Column("action", sa.String(length=50), nullable=False),
+        sa.Column("actor", sa.String(length=100), nullable=True),
+        sa.Column("before", sa.JSON(), nullable=True),
+        sa.Column("after", sa.JSON(), nullable=True),
+        sa.Column("created_at", sa.DateTime(), nullable=False),
+        sa.PrimaryKeyConstraint("id"),
+    )
+    op.create_index(op.f("ix_rule_audit_log_id"), "rule_audit_log", ["id"], unique=False)
+    op.create_index(op.f("ix_rule_audit_log_rule_id"), "rule_audit_log", ["rule_id"], unique=False)
+
+    op.create_table(
+        "scorecard_execution_audit",
+        sa.Column("id", sa.Integer(), nullable=False),
+        sa.Column("lead_id", sa.String(length=100), nullable=False),
+        sa.Column("tenant_id", sa.String(length=100), nullable=False),
+        sa.Column("product_type", sa.String(length=50), nullable=False),
+        sa.Column("request_hash", sa.String(length=64), nullable=False),
+        sa.Column("matched_rules", sa.JSON(), nullable=False),
+        sa.Column("skipped_rules", sa.JSON(), nullable=False),
+        sa.Column("status", sa.String(length=50), nullable=False),
+        sa.Column("error_message", sa.Text(), nullable=True),
+        sa.Column("latency_ms", sa.Integer(), nullable=False),
+        sa.Column("created_at", sa.DateTime(), nullable=False),
+        sa.PrimaryKeyConstraint("id"),
+    )
+    op.create_index(
+        op.f("ix_scorecard_execution_audit_id"), "scorecard_execution_audit", ["id"], unique=False
+    )
+    op.create_index(
+        op.f("ix_scorecard_execution_audit_lead_id"),
+        "scorecard_execution_audit",
+        ["lead_id"],
+        unique=False,
+    )
+    op.create_index(
+        op.f("ix_scorecard_execution_audit_product_type"),
+        "scorecard_execution_audit",
+        ["product_type"],
+        unique=False,
+    )
+    op.create_index(
+        op.f("ix_scorecard_execution_audit_request_hash"),
+        "scorecard_execution_audit",
+        ["request_hash"],
+        unique=False,
+    )
+    op.create_index(
+        op.f("ix_scorecard_execution_audit_tenant_id"),
+        "scorecard_execution_audit",
+        ["tenant_id"],
+        unique=False,
+    )
+
+
+def downgrade() -> None:
+    op.drop_table("scorecard_execution_audit")
+    op.drop_table("rule_audit_log")
+    op.drop_table("scorecard_result")
+    op.drop_table("rule_master")
+

Dockerfile

@@ -0,0 +1,17 @@
+FROM python:3.11-slim
+
+ENV PYTHONDONTWRITEBYTECODE=1
+ENV PYTHONUNBUFFERED=1
+ENV DATABASE_URL=sqlite:///./scorecard.db
+ENV ENABLE_AUTH=false
+
+WORKDIR /app
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY . .
+
+EXPOSE 7860
+
+CMD ["sh", "-c", "python -m app.db.init_db && uvicorn app.main:app --host 0.0.0.0 --port 7860"]

README.md

@@ -1,12 +1,17 @@
 ---
-title: SCORECARDAPI2
-emoji: ⚡
-colorFrom: purple
+title: Scorecard STP API
+emoji: 🏦
+colorFrom: blue
 colorTo: green
 sdk: docker
+app_port: 7860
+base_path: /generate-scorecard
 pinned: false
-license: mit
-short_description: SCORECARDAPI FOR STP
 ---
 
-Check out the configuration reference at https://huggingface.co/docs/hub/spaces-config-reference
+# Scorecard STP API
+
+FastAPI scorecard API and browser testing console.
+
+Open `/generate-scorecard` for the testing UI.
+Open `/docs` for Swagger API documentation.

__init__.py

@@ -0,0 +1 @@
+

alembic.ini

@@ -0,0 +1,41 @@
+[alembic]
+script_location = alembic
+prepend_sys_path = .
+sqlalchemy.url = sqlite:///./scorecard.db
+
+[post_write_hooks]
+
+[loggers]
+keys = root,sqlalchemy,alembic
+
+[handlers]
+keys = console
+
+[formatters]
+keys = generic
+
+[logger_root]
+level = WARN
+handlers = console
+qualname =
+
+[logger_sqlalchemy]
+level = WARN
+handlers =
+qualname = sqlalchemy.engine
+
+[logger_alembic]
+level = INFO
+handlers =
+qualname = alembic
+
+[handler_console]
+class = StreamHandler
+args = (sys.stderr,)
+level = NOTSET
+formatter = generic
+
+[formatter_generic]
+format = %(levelname)-5.5s [%(name)s] %(message)s
+datefmt = %H:%M:%S
+

audit.py

@@ -0,0 +1,50 @@
+from typing import Any
+
+from sqlalchemy.orm import Session
+
+from app.models.audit import RuleAuditLog
+from app.models.rule import RuleMaster
+
+
+def rule_to_dict(rule: RuleMaster | None) -> dict[str, Any] | None:
+    if not rule:
+        return None
+    return {
+        "id": rule.id,
+        "tenant_id": rule.tenant_id,
+        "product_type": rule.product_type,
+        "dealer_id": rule.dealer_id,
+        "rule_code": rule.rule_code,
+        "rule_name": rule.rule_name,
+        "rule_type": rule.rule_type,
+        "field_name": rule.field_name,
+        "operator": rule.operator,
+        "field_value": rule.field_value,
+        "score_value": str(rule.score_value) if rule.score_value is not None else None,
+        "score_component": rule.score_component,
+        "decision_action": rule.decision_action,
+        "reason_code": rule.reason_code,
+        "priority": rule.priority,
+        "version": rule.version,
+        "is_active": rule.is_active,
+    }
+
+
+def write_rule_audit(
+    db: Session,
+    rule_id: int | None,
+    action: str,
+    actor: str | None,
+    before: dict[str, Any] | None,
+    after: dict[str, Any] | None,
+) -> None:
+    db.add(
+        RuleAuditLog(
+            rule_id=rule_id,
+            action=action,
+            actor=actor,
+            before=before,
+            after=after,
+        )
+    )
+

bureau.py

@@ -0,0 +1,22 @@
+from app.core.enums import BureauRisk
+
+
+class BureauRiskClassifier:
+    def classify(self, context: dict) -> BureauRisk:
+        max_dpd = context.get("maxDPD") or 0
+        dpd60 = context.get("dpd60Count") or 0
+        dpd90 = context.get("dpd90Count") or 0
+        enquiries = context.get("creditEnquiries6M") or 0
+        unsecured = context.get("activeUnsecuredLoans") or 0
+        cibil = context.get("cibilScore") or 0
+        overdue = context.get("overdueAmount") or 0
+        dpd30 = context.get("dpd30Count") or 0
+
+        if dpd60 > 0 or dpd90 > 0 or max_dpd > 90 or enquiries > 5 or unsecured > 2:
+            return BureauRisk.HIGH
+        if dpd30 > 0 or max_dpd > 0 or enquiries > 2 or 700 <= cibil <= 750:
+            return BureauRisk.MEDIUM
+        if cibil > 750 and overdue <= 0 and enquiries <= 2:
+            return BureauRisk.LOW
+        return BureauRisk.MEDIUM
+

config.py

@@ -0,0 +1,31 @@
+from functools import lru_cache
+
+from pydantic import Field, field_validator
+from pydantic_settings import BaseSettings, SettingsConfigDict
+
+
+class Settings(BaseSettings):
+    app_name: str = "Two Wheeler Scorecard API"
+    environment: str = "local"
+    database_url: str = "sqlite:///./scorecard.db"
+    redis_url: str | None = None
+    jwt_secret_key: str = "change-me"
+    jwt_algorithm: str = "HS256"
+    access_token_expire_minutes: int = 60
+    default_tenant_id: str = "default"
+    default_product_type: str = "TWO_WHEELER_LOAN"
+    enable_auth: bool = Field(default=False)
+
+    model_config = SettingsConfigDict(env_file=".env", env_file_encoding="utf-8")
+
+    @field_validator("database_url")
+    @classmethod
+    def normalize_database_url(cls, value: str) -> str:
+        if value.startswith("postgresql://"):
+            return value.replace("postgresql://", "postgresql+psycopg://", 1)
+        return value
+
+
+@lru_cache
+def get_settings() -> Settings:
+    return Settings()

context.py

@@ -0,0 +1,45 @@
+from typing import Any
+
+from pydantic import BaseModel
+
+from app.schemas.scorecard import ScorecardRequest
+
+
+ALIASES = {
+    "leadId": "leadId",
+    "dealerId": "dealerId",
+    "enquiries6M": "creditEnquiries6M",
+    "creditEnquiries6M": "creditEnquiries6M",
+    "enquiries12M": "creditEnquiries12M",
+    "creditEnquiries12M": "creditEnquiries12M",
+    "fraudFlag": "fraudFlag",
+    "writtenOffAccounts": "writtenOffAccounts",
+    "settledAccounts": "settledAccounts",
+}
+
+
+def _dump(model: BaseModel) -> dict[str, Any]:
+    return model.model_dump(by_alias=False)
+
+
+def build_evaluation_context(request: ScorecardRequest) -> dict[str, Any]:
+    context = {}
+    context.update(_dump(request.application))
+    context.update(_dump(request.bureau))
+    context["tenantId"] = request.tenantId
+    context["productType"] = request.productType
+    for alias, target in ALIASES.items():
+        if target in context:
+            context[alias] = context[target]
+    context["kycVerified"] = bool(context.get("panVerified")) and bool(context.get("aadhaarVerified"))
+    context["stableEmployment"] = context.get("employmentType") in {"SALARIED", "SELF_EMPLOYED"}
+    context["noDpd"] = (
+        (context.get("maxDPD") or 0) <= 0
+        and (context.get("dpd30Count") or 0) <= 0
+        and (context.get("dpd60Count") or 0) <= 0
+        and (context.get("dpd90Count") or 0) <= 0
+    )
+    context["noFraud"] = not bool(context.get("fraudFlag") or context.get("blacklistMatch"))
+    context["noOverdue"] = (context.get("overdueAmount") or 0) <= 0
+    return context
+

dependencies.py

@@ -0,0 +1,25 @@
+from fastapi import Depends, HTTPException, status
+from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
+from jose import JWTError, jwt
+
+from app.core.config import get_settings
+
+
+bearer = HTTPBearer(auto_error=False)
+
+
+def require_auth(credentials: HTTPAuthorizationCredentials | None = Depends(bearer)) -> dict:
+    settings = get_settings()
+    if not settings.enable_auth:
+        return {"sub": "local-dev"}
+    if not credentials:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Missing bearer token")
+    try:
+        return jwt.decode(
+            credentials.credentials,
+            settings.jwt_secret_key,
+            algorithms=[settings.jwt_algorithm],
+        )
+    except JWTError as exc:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid token") from exc
+

enums.py

@@ -0,0 +1,37 @@
+from enum import StrEnum
+
+
+class RuleType(StrEnum):
+    SCORE = "SCORE"
+    HARD_REJECT = "HARD_REJECT"
+    NON_STP = "NON_STP"
+    STP_ELIGIBILITY = "STP_ELIGIBILITY"
+
+
+class DecisionAction(StrEnum):
+    STP = "STP"
+    CONDITIONAL_STP = "CONDITIONAL_STP"
+    NON_STP = "NON_STP"
+    UW = "UW"
+    REJECT = "REJECT"
+    SCORE = "SCORE"
+
+
+class ScorecardDecision(StrEnum):
+    STP = "STP"
+    CONDITIONAL_STP = "CONDITIONAL_STP"
+    NON_STP = "NON_STP"
+    REJECT = "REJECT"
+
+
+class JourneyAction(StrEnum):
+    SKIP_UNDERWRITING = "SKIP_UNDERWRITING"
+    SEND_TO_UNDERWRITING = "SEND_TO_UNDERWRITING"
+    REJECT_APPLICATION = "REJECT_APPLICATION"
+
+
+class BureauRisk(StrEnum):
+    LOW = "LOW"
+    MEDIUM = "MEDIUM"
+    HIGH = "HIGH"
+

env.py

@@ -0,0 +1,41 @@
+from logging.config import fileConfig
+
+from alembic import context
+from sqlalchemy import engine_from_config, pool
+
+from app.core.config import get_settings
+from app.db.session import Base
+from app.models import audit, rule, scorecard  # noqa: F401
+
+config = context.config
+if config.config_file_name is not None:
+    fileConfig(config.config_file_name)
+
+target_metadata = Base.metadata
+config.set_main_option("sqlalchemy.url", get_settings().database_url)
+
+
+def run_migrations_offline() -> None:
+    url = config.get_main_option("sqlalchemy.url")
+    context.configure(url=url, target_metadata=target_metadata, literal_binds=True)
+    with context.begin_transaction():
+        context.run_migrations()
+
+
+def run_migrations_online() -> None:
+    connectable = engine_from_config(
+        config.get_section(config.config_ini_section, {}),
+        prefix="sqlalchemy.",
+        poolclass=pool.NullPool,
+    )
+    with connectable.connect() as connection:
+        context.configure(connection=connection, target_metadata=target_metadata)
+        with context.begin_transaction():
+            context.run_migrations()
+
+
+if context.is_offline_mode():
+    run_migrations_offline()
+else:
+    run_migrations_online()
+

hash.py

@@ -0,0 +1,16 @@
+import hashlib
+import json
+from decimal import Decimal
+from typing import Any
+
+
+def _json_default(value: Any) -> str:
+    if isinstance(value, Decimal):
+        return str(value)
+    return str(value)
+
+
+def stable_payload_hash(payload: dict[str, Any]) -> str:
+    serialized = json.dumps(payload, sort_keys=True, default=_json_default, separators=(",", ":"))
+    return hashlib.sha256(serialized.encode("utf-8")).hexdigest()
+

health.py

@@ -0,0 +1,34 @@
+from fastapi import APIRouter, Depends
+from redis import Redis
+from sqlalchemy import text
+from sqlalchemy.orm import Session
+
+from app.core.config import get_settings
+from app.db.session import get_db
+from app.schemas.scorecard import HealthResponse
+
+router = APIRouter(tags=["Health"])
+
+
+@router.get("/health", response_model=HealthResponse)
+def health(db: Session = Depends(get_db)) -> HealthResponse:
+    database = "ok"
+    redis_status = "disabled"
+    details = {}
+    try:
+        db.execute(text("SELECT 1"))
+    except Exception as exc:
+        database = "error"
+        details["database_error"] = str(exc)
+
+    settings = get_settings()
+    if settings.redis_url:
+        try:
+            Redis.from_url(settings.redis_url).ping()
+            redis_status = "ok"
+        except Exception as exc:
+            redis_status = "error"
+            details["redis_error"] = str(exc)
+    status = "ok" if database == "ok" and redis_status in {"ok", "disabled"} else "degraded"
+    return HealthResponse(status=status, database=database, redis=redis_status, details=details)
+

index.html

@@ -0,0 +1,892 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>Two Wheeler Scorecard Console</title>
+    <style>
+      :root {
+        --bg: #f4f7fb;
+        --panel: #ffffff;
+        --line: #d9e2ec;
+        --text: #172033;
+        --muted: #637083;
+        --accent: #116d6e;
+        --accent-2: #204b8c;
+        --danger: #b42318;
+        --warn: #a15c07;
+        --ok: #16794c;
+      }
+
+      * {
+        box-sizing: border-box;
+      }
+
+      body {
+        margin: 0;
+        background: var(--bg);
+        color: var(--text);
+        font-family: Arial, Helvetica, sans-serif;
+      }
+
+      header {
+        background: #0d1b2a;
+        color: white;
+        padding: 18px 24px;
+      }
+
+      header h1 {
+        margin: 0;
+        font-size: 22px;
+        font-weight: 700;
+      }
+
+      header p {
+        margin: 6px 0 0;
+        color: #cbd5e1;
+        font-size: 14px;
+      }
+
+      main {
+        display: grid;
+        grid-template-columns: minmax(360px, 1.05fr) minmax(360px, 0.95fr);
+        gap: 16px;
+        padding: 16px;
+      }
+
+      section {
+        background: var(--panel);
+        border: 1px solid var(--line);
+        border-radius: 8px;
+        min-width: 0;
+      }
+
+      .section-head {
+        display: flex;
+        justify-content: space-between;
+        gap: 12px;
+        align-items: center;
+        padding: 14px 16px;
+        border-bottom: 1px solid var(--line);
+      }
+
+      h2 {
+        margin: 0;
+        font-size: 17px;
+      }
+
+      .body {
+        padding: 16px;
+      }
+
+      .row {
+        display: grid;
+        grid-template-columns: repeat(4, minmax(0, 1fr));
+        gap: 10px;
+        margin-bottom: 10px;
+      }
+
+      .api-row {
+        display: grid;
+        grid-template-columns: minmax(220px, 1.2fr) minmax(170px, 0.8fr) minmax(150px, 0.7fr);
+        gap: 10px;
+        margin-bottom: 10px;
+      }
+
+      label {
+        display: block;
+        color: var(--muted);
+        font-size: 12px;
+        margin-bottom: 4px;
+      }
+
+      input,
+      select,
+      textarea {
+        width: 100%;
+        border: 1px solid var(--line);
+        border-radius: 6px;
+        padding: 9px 10px;
+        background: white;
+        color: var(--text);
+        font-size: 14px;
+      }
+
+      textarea {
+        min-height: 320px;
+        resize: vertical;
+        font-family: Consolas, monospace;
+        line-height: 1.35;
+      }
+
+      button {
+        border: 0;
+        border-radius: 6px;
+        background: var(--accent);
+        color: white;
+        cursor: pointer;
+        font-weight: 700;
+        padding: 10px 13px;
+      }
+
+      button.secondary {
+        background: var(--accent-2);
+      }
+
+      button.ghost {
+        background: #e8eef6;
+        color: var(--text);
+      }
+
+      button.danger {
+        background: var(--danger);
+      }
+
+      .actions {
+        display: flex;
+        flex-wrap: wrap;
+        gap: 8px;
+        margin: 12px 0;
+      }
+
+      .decision {
+        display: grid;
+        grid-template-columns: repeat(4, minmax(0, 1fr));
+        gap: 10px;
+        margin-top: 12px;
+      }
+
+      .metric {
+        border: 1px solid var(--line);
+        border-radius: 8px;
+        padding: 12px;
+        background: #fbfdff;
+      }
+
+      .metric span {
+        color: var(--muted);
+        display: block;
+        font-size: 12px;
+      }
+
+      .metric strong {
+        display: block;
+        font-size: 18px;
+        margin-top: 5px;
+        overflow-wrap: anywhere;
+      }
+
+      .STP {
+        color: var(--ok);
+      }
+
+      .CONDITIONAL_STP {
+        color: var(--warn);
+      }
+
+      .NON_STP,
+      .REJECT {
+        color: var(--danger);
+      }
+
+      pre {
+        background: #101827;
+        color: #dbeafe;
+        border-radius: 8px;
+        padding: 12px;
+        overflow: auto;
+        max-height: 360px;
+        font-size: 13px;
+      }
+
+      table {
+        width: 100%;
+        border-collapse: collapse;
+        font-size: 13px;
+      }
+
+      th,
+      td {
+        border-bottom: 1px solid var(--line);
+        padding: 9px 7px;
+        text-align: left;
+        vertical-align: top;
+      }
+
+      th {
+        color: var(--muted);
+        font-weight: 700;
+        background: #f8fafc;
+        position: sticky;
+        top: 0;
+      }
+
+      .table-wrap {
+        border: 1px solid var(--line);
+        border-radius: 8px;
+        overflow: auto;
+        max-height: 390px;
+      }
+
+      .status {
+        min-height: 20px;
+        color: var(--muted);
+        font-size: 13px;
+      }
+
+      .status.ok {
+        color: var(--ok);
+      }
+
+      .status.error {
+        color: var(--danger);
+      }
+
+      .hint {
+        color: var(--muted);
+        font-size: 12px;
+        line-height: 1.45;
+        margin: 4px 0 12px;
+      }
+
+      .request-line {
+        background: #eef6f6;
+        border: 1px solid var(--line);
+        border-radius: 6px;
+        color: var(--accent);
+        font-family: Consolas, monospace;
+        font-size: 13px;
+        margin: 8px 0 12px;
+        overflow-wrap: anywhere;
+        padding: 9px 10px;
+      }
+
+      .edit-banner {
+        display: none;
+        align-items: center;
+        justify-content: space-between;
+        gap: 10px;
+        border: 1px solid #f2c94c;
+        background: #fff8db;
+        border-radius: 8px;
+        padding: 10px 12px;
+        margin-bottom: 12px;
+        color: #6b4e00;
+        font-size: 13px;
+      }
+
+      .rule-form {
+        display: grid;
+        grid-template-columns: repeat(3, minmax(0, 1fr));
+        gap: 10px;
+        margin-bottom: 12px;
+      }
+
+      .wide {
+        grid-column: span 2;
+      }
+
+      @media (max-width: 980px) {
+        main,
+        .api-row,
+        .row,
+        .decision,
+        .rule-form {
+          grid-template-columns: 1fr;
+        }
+
+        .wide {
+          grid-column: auto;
+        }
+      }
+    </style>
+  </head>
+  <body>
+    <header>
+      <h1>Two Wheeler Loan STP Scorecard Console</h1>
+      <p>Configure rules, simulate decisions, and generate persisted scorecards from one screen.</p>
+    </header>
+
+    <main>
+      <section>
+        <div class="section-head">
+          <h2>Scorecard Tester</h2>
+          <button class="ghost" onclick="loadSample()">Load Sample</button>
+        </div>
+        <div class="body">
+          <div class="row">
+            <div>
+              <label>Tenant</label>
+              <input id="tenantId" value="default" />
+            </div>
+            <div>
+              <label>Product</label>
+              <select id="productType" onchange="syncProductChange()">
+                <option value="TWO_WHEELER_LOAN">Two Wheeler Loan</option>
+                <option value="NEW_CAR_LOAN">New Car Loan</option>
+                <option value="USED_CAR_LOAN">Used Car Loan</option>
+                <option value="NEW_COMMERCIAL_VEHICLE_LOAN">New Commercial Vehicle</option>
+                <option value="USED_COMMERCIAL_VEHICLE_LOAN">Used Commercial Vehicle</option>
+                <option value="NEW_TRACTOR_LOAN">New Tractor Loan</option>
+                <option value="USED_TRACTOR_LOAN">Used Tractor Loan</option>
+              </select>
+            </div>
+            <div>
+              <label>Lead ID</label>
+              <input id="leadId" value="TW10001" />
+            </div>
+            <div>
+              <label>Journey Trigger</label>
+              <select id="dueDiligenceStatus">
+                <option value="APPROVED">Due Diligence Approved</option>
+                <option value="PENDING">Due Diligence Pending</option>
+                <option value="REJECTED">Due Diligence Rejected</option>
+              </select>
+            </div>
+          </div>
+
+          <div class="api-row">
+            <div>
+              <label>API Base URL</label>
+              <input id="apiBaseUrl" />
+            </div>
+            <div>
+              <label>Endpoint</label>
+              <select id="mode" onchange="refreshRequestPreview()">
+                <option value="simulate-scorecard">POST /simulate-scorecard</option>
+                <option value="generate-scorecard">POST /generate-scorecard</option>
+              </select>
+            </div>
+            <div>
+              <label>Method</label>
+              <input id="method" value="POST" disabled />
+            </div>
+          </div>
+          <div class="hint">
+            Use simulate for testing only. Use generate after due diligence approval when you want the scorecard result saved against the lead.
+          </div>
+          <div class="request-line" id="requestPreview"></div>
+
+          <label>Request JSON</label>
+          <textarea id="payload"></textarea>
+
+          <div class="actions">
+            <button onclick="runScorecard()">Send API Request</button>
+            <button class="secondary" onclick="triggerAfterDueDiligence()">Trigger After Due Diligence</button>
+            <button class="secondary" onclick="getSavedResult()">Get Saved Result</button>
+            <button class="ghost" onclick="openDocs()">Swagger Docs</button>
+            <button class="ghost" onclick="copyCurl()">Copy cURL</button>
+          </div>
+          <div class="status" id="scoreStatus"></div>
+
+          <div class="decision">
+            <div class="metric">
+              <span>Decision</span>
+              <strong id="decision">-</strong>
+            </div>
+            <div class="metric">
+              <span>Final Score</span>
+              <strong id="finalScore">-</strong>
+            </div>
+            <div class="metric">
+              <span>Journey Action</span>
+              <strong id="journeyAction">-</strong>
+            </div>
+            <div class="metric">
+              <span>Bureau Risk</span>
+              <strong id="bureauRisk">-</strong>
+            </div>
+          </div>
+
+          <pre id="scoreOutput">{}</pre>
+          <label>Request Preview</label>
+          <pre id="requestOutput">{}</pre>
+        </div>
+      </section>
+
+      <section>
+        <div class="section-head">
+          <h2>Rule Configuration</h2>
+          <button class="ghost" onclick="loadRules()">Refresh Rules</button>
+        </div>
+        <div class="body">
+          <div class="rule-form">
+            <input id="editingRuleId" type="hidden" />
+            <div>
+              <label>Rule Code</label>
+              <input id="ruleCode" placeholder="CIBIL_SUPER_HIGH" />
+            </div>
+            <div class="wide">
+              <label>Rule Name</label>
+              <input id="ruleName" placeholder="CIBIL score above 800" />
+            </div>
+            <div>
+              <label>Rule Type</label>
+              <select id="ruleType">
+                <option>SCORE</option>
+                <option>HARD_REJECT</option>
+                <option>NON_STP</option>
+                <option>STP_ELIGIBILITY</option>
+              </select>
+            </div>
+            <div>
+              <label>Field Name</label>
+              <input id="fieldName" placeholder="cibilScore" />
+            </div>
+            <div>
+              <label>Operator</label>
+              <select id="operator">
+                <option>&gt;=</option>
+                <option>&gt;</option>
+                <option>&lt;=</option>
+                <option>&lt;</option>
+                <option>=</option>
+                <option>!=</option>
+                <option>BETWEEN</option>
+                <option>IN</option>
+                <option>NOT_IN</option>
+              </select>
+            </div>
+            <div>
+              <label>Value</label>
+              <input id="fieldValue" placeholder="750 or 700,749" />
+            </div>
+            <div>
+              <label>Score Value</label>
+              <input id="scoreValue" placeholder="10" />
+            </div>
+            <div>
+              <label>Score Component</label>
+              <input id="scoreComponent" placeholder="cibil" />
+            </div>
+            <div>
+              <label>Decision Action</label>
+              <select id="decisionAction">
+                <option value="">None</option>
+                <option>SCORE</option>
+                <option>STP</option>
+                <option>UW</option>
+                <option>REJECT</option>
+                <option>NON_STP</option>
+              </select>
+            </div>
+            <div>
+              <label>Reason Code</label>
+              <input id="reasonCode" placeholder="HIGH_CIBIL" />
+            </div>
+            <div>
+              <label>Priority</label>
+              <input id="priority" value="100" />
+            </div>
+          </div>
+
+          <div class="edit-banner" id="editBanner">
+            <span id="editText">Editing rule</span>
+            <button class="ghost" onclick="cancelEdit()">Cancel Edit</button>
+          </div>
+
+          <div class="actions">
+            <button id="saveRuleButton" onclick="saveRule()">Create Rule</button>
+            <button class="ghost" onclick="clearRuleForm()">Clear</button>
+            <button class="secondary" onclick="exportRules()">Export Product Rules</button>
+          </div>
+          <div class="status" id="ruleStatus"></div>
+
+          <div class="table-wrap">
+            <table>
+              <thead>
+                <tr>
+                  <th>ID</th>
+                  <th>Code</th>
+                  <th>Type</th>
+                  <th>Condition</th>
+                  <th>Score/Action</th>
+                  <th>Status</th>
+              <th>Actions</th>
+                </tr>
+              </thead>
+              <tbody id="rulesTable"></tbody>
+            </table>
+          </div>
+        </div>
+      </section>
+    </main>
+
+    <script>
+      const samplePayload = {
+        tenantId: "default",
+        productType: "TWO_WHEELER_LOAN",
+        application: {
+          leadId: "TW10001",
+          customerName: "ABC",
+          mobile: "9999999999",
+          employmentType: "SALARIED",
+          monthlyIncome: 45000,
+          existingEMI: 8000,
+          foir: 32,
+          loanAmount: 95000,
+          assetCost: 125000,
+          ltv: 76,
+          tenure: 36,
+          dealerId: "DL101",
+          state: "Karnataka",
+          city: "Bangalore",
+          negativeArea: false,
+          fraudFlag: false,
+          faceMatchScore: 92,
+          panVerified: true,
+          aadhaarVerified: true,
+          bankingSurrogate: true,
+          coApplicant: false
+        },
+        bureau: {
+          cibilScore: 753,
+          creditVintageMonths: 123,
+          activeAccounts: 2,
+          closedAccounts: 47,
+          overdueAmount: 0,
+          writtenOffAccounts: 0,
+          settledAccounts: 0,
+          active90PlusDpd: false,
+          maxDPD: 0,
+          dpd30Count: 0,
+          dpd60Count: 0,
+          dpd90Count: 0,
+          creditEnquiries6M: 2,
+          creditEnquiries12M: 4,
+          activeUnsecuredLoans: 1,
+          activeSecuredLoans: 1,
+          jointAccounts: 0,
+          creditUtilization: 2
+        }
+      };
+
+      function setStatus(id, message) {
+        const element = document.getElementById(id);
+        element.textContent = message;
+        element.className = "status";
+      }
+
+      function setStatusState(id, message, state) {
+        const element = document.getElementById(id);
+        element.textContent = message;
+        element.className = `status ${state || ""}`;
+      }
+
+      function loadSample() {
+        document.getElementById("payload").value = JSON.stringify(samplePayload, null, 2);
+        document.getElementById("leadId").value = samplePayload.application.leadId;
+        refreshRequestPreview();
+      }
+
+      function syncProductChange() {
+        try {
+          const payload = JSON.parse(document.getElementById("payload").value);
+          payload.productType = document.getElementById("productType").value;
+          document.getElementById("payload").value = JSON.stringify(payload, null, 2);
+        } catch (_) {
+          // Keep user-entered JSON untouched if it is mid-edit.
+        }
+        cancelEdit();
+        loadRules();
+        refreshRequestPreview();
+      }
+
+      function syncHeaderFields(payload) {
+        payload.tenantId = document.getElementById("tenantId").value || "default";
+        payload.productType = document.getElementById("productType").value || "TWO_WHEELER_LOAN";
+        payload.application.leadId = document.getElementById("leadId").value || payload.application.leadId;
+        return payload;
+      }
+
+      function getBaseUrl() {
+        return (document.getElementById("apiBaseUrl").value || window.location.origin).replace(/\/$/, "");
+      }
+
+      function buildUrl(path) {
+        return `${getBaseUrl()}${path.startsWith("/") ? path : `/${path}`}`;
+      }
+
+      function getScorecardPath() {
+        return `/${document.getElementById("mode").value}`;
+      }
+
+      function refreshRequestPreview() {
+        const path = getScorecardPath();
+        document.getElementById("requestPreview").textContent = `POST ${buildUrl(path)}`;
+      }
+
+      async function api(path, options = {}) {
+        const response = await fetch(buildUrl(path), {
+          headers: { "Content-Type": "application/json", ...(options.headers || {}) },
+          ...options
+        });
+        const text = await response.text();
+        let body = null;
+        try {
+          body = text ? JSON.parse(text) : null;
+        } catch (_) {
+          body = text;
+        }
+        if (!response.ok) {
+          throw new Error(body?.detail || body || response.statusText);
+        }
+        return { body, status: response.status, statusText: response.statusText };
+      }
+
+      function readPayload() {
+        const payload = syncHeaderFields(JSON.parse(document.getElementById("payload").value));
+        document.getElementById("payload").value = JSON.stringify(payload, null, 2);
+        return payload;
+      }
+
+      function renderRequest(path, payload) {
+        const request = {
+          method: "POST",
+          url: buildUrl(path),
+          headers: { "Content-Type": "application/json" },
+          body: payload
+        };
+        document.getElementById("requestOutput").textContent = JSON.stringify(request, null, 2);
+      }
+
+      function renderScore(body) {
+        document.getElementById("scoreOutput").textContent = JSON.stringify(body, null, 2);
+        const decision = document.getElementById("decision");
+        decision.textContent = body.decision || "-";
+        decision.className = body.decision || "";
+        document.getElementById("finalScore").textContent = body.finalScore ?? "-";
+        document.getElementById("journeyAction").textContent = body.journeyAction || "-";
+        document.getElementById("bureauRisk").textContent = body.bureauRisk || "-";
+      }
+
+      async function runScorecard() {
+        try {
+          setStatus("scoreStatus", "Sending API request...");
+          const payload = readPayload();
+          const path = getScorecardPath();
+          renderRequest(path, payload);
+          const result = await api(path, { method: "POST", body: JSON.stringify(payload) });
+          renderScore(result.body);
+          setStatusState("scoreStatus", `HTTP ${result.status} ${result.statusText} - scorecard completed.`, "ok");
+        } catch (error) {
+          setStatusState("scoreStatus", `Error: ${error.message}`, "error");
+        }
+      }
+
+      async function triggerAfterDueDiligence() {
+        const dueDiligenceStatus = document.getElementById("dueDiligenceStatus").value;
+        if (dueDiligenceStatus !== "APPROVED") {
+          setStatusState(
+            "scoreStatus",
+            `API not triggered because due diligence is ${dueDiligenceStatus}. Select Approved to call the scorecard.`,
+            "error"
+          );
+          return;
+        }
+        document.getElementById("mode").value = "generate-scorecard";
+        refreshRequestPreview();
+        await runScorecard();
+      }
+
+      async function getSavedResult() {
+        try {
+          const leadId = document.getElementById("leadId").value;
+          setStatus("scoreStatus", "Fetching saved result...");
+          const result = await api(`/scorecard/${encodeURIComponent(leadId)}`);
+          renderScore(result.body);
+          setStatusState("scoreStatus", `HTTP ${result.status} ${result.statusText} - saved result loaded.`, "ok");
+        } catch (error) {
+          setStatusState("scoreStatus", `Error: ${error.message}`, "error");
+        }
+      }
+
+      async function loadRules() {
+        try {
+          setStatus("ruleStatus", "Loading rules...");
+          const tenant = encodeURIComponent(document.getElementById("tenantId").value || "default");
+          const product = encodeURIComponent(document.getElementById("productType").value || "TWO_WHEELER_LOAN");
+          const result = await api(`/rules?tenant_id=${tenant}&product_type=${product}`);
+          const rules = result.body;
+          const rows = rules.map(rule => `
+            <tr>
+              <td>${rule.id}</td>
+              <td>${rule.rule_code}<br><small>${rule.reason_code}</small></td>
+              <td>${rule.rule_type}</td>
+              <td>${rule.field_name} ${rule.operator} ${rule.field_value}</td>
+              <td>${rule.score_value ?? ""} ${rule.decision_action ?? ""}</td>
+              <td>${rule.is_active ? "Active" : "Disabled"}</td>
+              <td>
+                <button class="ghost" onclick='editRule(${JSON.stringify(rule)})'>Edit</button>
+                <button class="${rule.is_active ? "danger" : "secondary"}" onclick="toggleRule(${rule.id}, ${!rule.is_active})">
+                  ${rule.is_active ? "Disable" : "Enable"}
+                </button>
+              </td>
+            </tr>
+          `).join("");
+          document.getElementById("rulesTable").innerHTML = rows;
+          setStatus("ruleStatus", `${rules.length} rules loaded.`);
+        } catch (error) {
+          setStatus("ruleStatus", `Error: ${error.message}`);
+        }
+      }
+
+      function buildRulePayload() {
+        const scoreValue = document.getElementById("scoreValue").value;
+        return {
+          tenant_id: document.getElementById("tenantId").value || "default",
+          product_type: document.getElementById("productType").value || "TWO_WHEELER_LOAN",
+          rule_code: document.getElementById("ruleCode").value,
+          rule_name: document.getElementById("ruleName").value,
+          rule_type: document.getElementById("ruleType").value,
+          field_name: document.getElementById("fieldName").value,
+          operator: document.getElementById("operator").value,
+          field_value: document.getElementById("fieldValue").value,
+          score_value: scoreValue ? Number(scoreValue) : null,
+          score_component: document.getElementById("scoreComponent").value || null,
+          decision_action: document.getElementById("decisionAction").value || null,
+          reason_code: document.getElementById("reasonCode").value,
+          priority: Number(document.getElementById("priority").value || 100),
+          is_active: true
+        };
+      }
+
+      async function saveRule() {
+        const editingRuleId = document.getElementById("editingRuleId").value;
+        if (editingRuleId) {
+          await updateRule(editingRuleId);
+        } else {
+          await createRule();
+        }
+      }
+
+      async function createRule() {
+        try {
+          setStatus("ruleStatus", "Creating rule...");
+          const payload = buildRulePayload();
+          await api("/rules", { method: "POST", body: JSON.stringify(payload) });
+          clearRuleForm();
+          await loadRules();
+          setStatus("ruleStatus", "Rule created.");
+        } catch (error) {
+          setStatus("ruleStatus", `Error: ${error.message}`);
+        }
+      }
+
+      async function updateRule(ruleId) {
+        try {
+          setStatus("ruleStatus", "Updating rule...");
+          const payload = buildRulePayload();
+          delete payload.tenant_id;
+          delete payload.product_type;
+          delete payload.rule_code;
+          delete payload.rule_type;
+          payload.actor = "admin-ui";
+          await api(`/rules/${ruleId}`, { method: "PUT", body: JSON.stringify(payload) });
+          clearRuleForm();
+          await loadRules();
+          setStatus("ruleStatus", "Rule updated.");
+        } catch (error) {
+          setStatus("ruleStatus", `Error: ${error.message}`);
+        }
+      }
+
+      function editRule(rule) {
+        document.getElementById("editingRuleId").value = rule.id;
+        document.getElementById("ruleCode").value = rule.rule_code || "";
+        document.getElementById("ruleName").value = rule.rule_name || "";
+        document.getElementById("ruleType").value = rule.rule_type || "SCORE";
+        document.getElementById("fieldName").value = rule.field_name || "";
+        document.getElementById("operator").value = rule.operator || "=";
+        document.getElementById("fieldValue").value = rule.field_value || "";
+        document.getElementById("scoreValue").value = rule.score_value ?? "";
+        document.getElementById("scoreComponent").value = rule.score_component || "";
+        document.getElementById("decisionAction").value = rule.decision_action || "";
+        document.getElementById("reasonCode").value = rule.reason_code || "";
+        document.getElementById("priority").value = rule.priority || 100;
+        document.getElementById("saveRuleButton").textContent = "Save Rule Changes";
+        document.getElementById("editText").textContent = `Editing #${rule.id} - ${rule.rule_code}`;
+        document.getElementById("editBanner").style.display = "flex";
+        setStatus("ruleStatus", "Rule loaded into form. Change values and save.");
+        window.scrollTo({ top: 0, behavior: "smooth" });
+      }
+
+      async function toggleRule(id, isActive) {
+        try {
+          await api(`/rules/${id}/status`, {
+            method: "PATCH",
+            body: JSON.stringify({ is_active: isActive, actor: "admin-ui" })
+          });
+          await loadRules();
+        } catch (error) {
+          setStatus("ruleStatus", `Error: ${error.message}`);
+        }
+      }
+
+      function clearRuleForm() {
+        [
+          "ruleCode",
+          "ruleName",
+          "fieldName",
+          "fieldValue",
+          "scoreValue",
+          "scoreComponent",
+          "reasonCode"
+        ].forEach(id => document.getElementById(id).value = "");
+        document.getElementById("priority").value = "100";
+        cancelEdit();
+      }
+
+      function cancelEdit() {
+        document.getElementById("editingRuleId").value = "";
+        document.getElementById("saveRuleButton").textContent = "Create Rule";
+        document.getElementById("editBanner").style.display = "none";
+      }
+
+      async function exportRules() {
+        try {
+          const tenant = encodeURIComponent(document.getElementById("tenantId").value || "default");
+          const product = encodeURIComponent(document.getElementById("productType").value || "TWO_WHEELER_LOAN");
+          const result = await api(`/rules?tenant_id=${tenant}&product_type=${product}`);
+          const rules = result.body;
+          const blob = new Blob([JSON.stringify(rules, null, 2)], { type: "application/json" });
+          const url = URL.createObjectURL(blob);
+          const link = document.createElement("a");
+          link.href = url;
+          link.download = `${product}_rules.json`;
+          link.click();
+          URL.revokeObjectURL(url);
+          setStatus("ruleStatus", "Rules exported.");
+        } catch (error) {
+          setStatus("ruleStatus", `Error: ${error.message}`);
+        }
+      }
+
+      function openDocs() {
+        window.open(buildUrl("/docs"), "_blank");
+      }
+
+      async function copyCurl() {
+        try {
+          const payload = readPayload();
+          const path = getScorecardPath();
+          renderRequest(path, payload);
+          const curl = [
+            `curl -X POST "${buildUrl(path)}"`,
+            `-H "Content-Type: application/json"`,
+            `-d '${JSON.stringify(payload)}'`
+          ].join(" ");
+          await navigator.clipboard.writeText(curl);
+          setStatusState("scoreStatus", "cURL copied.", "ok");
+        } catch (error) {
+          setStatusState("scoreStatus", `Error: ${error.message}`, "error");
+        }
+      }
+
+      document.getElementById("apiBaseUrl").value = window.location.origin;
+      document.getElementById("apiBaseUrl").addEventListener("input", refreshRequestPreview);
+      loadSample();
+      loadRules();
+    </script>
+  </body>
+</html>

init_db.py

@@ -0,0 +1,27 @@
+from sqlalchemy.orm import Session
+
+from app.db.session import Base, engine
+from app.models import RuleMaster
+from app.services.seed_rules import seed_all_product_rules
+
+
+def create_database() -> None:
+    Base.metadata.create_all(bind=engine)
+
+
+def seed_database(db: Session) -> int:
+    return seed_all_product_rules(db)
+
+
+if __name__ == "__main__":
+    from app.db.session import SessionLocal
+
+    create_database()
+    session = SessionLocal()
+    try:
+        inserted = seed_database(session)
+        session.commit()
+        print(f"Seeded {inserted} rules")
+        print(f"Total rules: {session.query(RuleMaster).count()}")
+    finally:
+        session.close()

main.py

@@ -0,0 +1,23 @@
+from fastapi import FastAPI
+from fastapi.staticfiles import StaticFiles
+
+from app.api.routes import health, rules, scorecard, ui
+from app.core.config import get_settings
+
+
+def create_app() -> FastAPI:
+    settings = get_settings()
+    app = FastAPI(
+        title=settings.app_name,
+        version="0.1.0",
+        description="Configurable STP scorecard engine for two wheeler loan LOS integrations.",
+    )
+    app.include_router(health.router)
+    app.include_router(scorecard.router)
+    app.include_router(rules.router)
+    app.include_router(ui.router)
+    app.mount("/static", StaticFiles(directory="app/static"), name="static")
+    return app
+
+
+app = create_app()

operators.py

@@ -0,0 +1,76 @@
+from decimal import Decimal, InvalidOperation
+from typing import Any
+
+
+def _to_bool(value: Any) -> bool | None:
+    if isinstance(value, bool):
+        return value
+    if isinstance(value, str):
+        lowered = value.strip().lower()
+        if lowered in {"true", "1", "yes", "y"}:
+            return True
+        if lowered in {"false", "0", "no", "n"}:
+            return False
+    return None
+
+
+def _to_decimal(value: Any) -> Decimal | None:
+    if value is None:
+        return None
+    try:
+        return Decimal(str(value))
+    except (InvalidOperation, ValueError):
+        return None
+
+
+def _split_values(expected: str) -> list[str]:
+    return [item.strip() for item in expected.split(",") if item.strip()]
+
+
+def evaluate_operator(actual: Any, operator: str, expected: str) -> bool:
+    op = operator.strip().upper()
+    if actual is None:
+        return False
+
+    actual_bool = _to_bool(actual)
+    expected_bool = _to_bool(expected)
+    if actual_bool is not None and expected_bool is not None and op in {"=", "==", "!=", "<>"}:
+        return actual_bool == expected_bool if op in {"=", "=="} else actual_bool != expected_bool
+
+    actual_num = _to_decimal(actual)
+    if op == "BETWEEN":
+        bounds = _split_values(expected)
+        if actual_num is None or len(bounds) != 2:
+            return False
+        low = _to_decimal(bounds[0])
+        high = _to_decimal(bounds[1])
+        return low is not None and high is not None and low <= actual_num <= high
+
+    expected_num = _to_decimal(expected)
+    if actual_num is not None and expected_num is not None:
+        if op in {"=", "=="}:
+            return actual_num == expected_num
+        if op in {"!=", "<>"}:
+            return actual_num != expected_num
+        if op == ">":
+            return actual_num > expected_num
+        if op == ">=":
+            return actual_num >= expected_num
+        if op == "<":
+            return actual_num < expected_num
+        if op == "<=":
+            return actual_num <= expected_num
+
+    actual_str = str(actual).strip().upper()
+    expected_str = str(expected).strip().upper()
+    if op in {"=", "=="}:
+        return actual_str == expected_str
+    if op in {"!=", "<>"}:
+        return actual_str != expected_str
+    if op in {"IN", "NOT_IN"}:
+        values = {value.upper() for value in _split_values(expected)}
+        matched = actual_str in values
+        return matched if op == "IN" else not matched
+
+    raise ValueError(f"Unsupported operator: {operator}")
+

requirements.txt

@@ -0,0 +1,12 @@
+alembic==1.13.2
+fastapi==0.115.0
+httpx==0.27.2
+passlib[bcrypt]==1.7.4
+psycopg[binary]==3.2.1
+pydantic-settings==2.5.2
+python-jose[cryptography]==3.3.0
+python-multipart==0.0.9
+redis==5.0.8
+sqlalchemy==2.0.34
+uvicorn[standard]==0.30.6
+

rule.py

@@ -0,0 +1,58 @@
+from datetime import datetime
+from decimal import Decimal
+
+from pydantic import BaseModel, ConfigDict, Field
+
+from app.core.enums import DecisionAction, RuleType
+
+
+class RuleBase(BaseModel):
+    tenant_id: str = "default"
+    product_type: str = "TWO_WHEELER_LOAN"
+    dealer_id: str | None = None
+    rule_code: str = Field(min_length=2, max_length=100)
+    rule_name: str = Field(min_length=2, max_length=255)
+    rule_type: RuleType
+    field_name: str = Field(min_length=1, max_length=100)
+    operator: str = Field(min_length=1, max_length=20)
+    field_value: str = Field(min_length=1, max_length=255)
+    score_value: Decimal | None = None
+    score_component: str | None = None
+    decision_action: DecisionAction | None = None
+    reason_code: str = Field(min_length=2, max_length=100)
+    priority: int = 100
+    is_active: bool = True
+
+
+class RuleCreate(RuleBase):
+    created_by: str | None = "system"
+
+
+class RuleUpdate(BaseModel):
+    rule_name: str | None = None
+    field_name: str | None = None
+    operator: str | None = None
+    field_value: str | None = None
+    score_value: Decimal | None = None
+    score_component: str | None = None
+    decision_action: DecisionAction | None = None
+    reason_code: str | None = None
+    priority: int | None = None
+    is_active: bool | None = None
+    actor: str | None = "system"
+
+
+class RuleStatusUpdate(BaseModel):
+    is_active: bool
+    actor: str | None = "system"
+
+
+class RuleResponse(RuleBase):
+    id: int
+    version: int
+    created_by: str | None
+    created_at: datetime
+    updated_at: datetime
+
+    model_config = ConfigDict(from_attributes=True)
+

rule_engine.py

@@ -0,0 +1,48 @@
+from dataclasses import dataclass, field
+from decimal import Decimal
+
+from app.core.enums import RuleType
+from app.models.rule import RuleMaster
+from app.services.operators import evaluate_operator
+
+
+@dataclass
+class RuleEvaluation:
+    matched: list[RuleMaster] = field(default_factory=list)
+    skipped: list[str] = field(default_factory=list)
+
+    @property
+    def codes(self) -> list[str]:
+        return [rule.rule_code for rule in self.matched]
+
+    @property
+    def reason_codes(self) -> list[str]:
+        return [rule.reason_code for rule in self.matched]
+
+
+class RuleEngine:
+    def evaluate(self, rules: list[RuleMaster], context: dict) -> RuleEvaluation:
+        result = RuleEvaluation()
+        for rule in sorted(rules, key=lambda item: item.priority):
+            try:
+                if evaluate_operator(context.get(rule.field_name), rule.operator, rule.field_value):
+                    result.matched.append(rule)
+                else:
+                    result.skipped.append(rule.rule_code)
+            except ValueError:
+                result.skipped.append(rule.rule_code)
+        return result
+
+    def score(self, rules: list[RuleMaster], context: dict) -> tuple[Decimal, dict[str, Decimal], RuleEvaluation]:
+        score_rules = [rule for rule in rules if rule.rule_type == RuleType.SCORE]
+        evaluation = self.evaluate(score_rules, context)
+        total = Decimal("0")
+        breakup: dict[str, Decimal] = {}
+        for rule in evaluation.matched:
+            value = Decimal(rule.score_value or 0)
+            component = rule.score_component or "other"
+            breakup[component] = breakup.get(component, Decimal("0")) + value
+            total += value
+        capped = max(Decimal("0"), min(Decimal("100"), total))
+        return capped, breakup, evaluation
+

rule_repository.py

@@ -0,0 +1,125 @@
+import json
+from decimal import Decimal
+from typing import Any
+
+from redis import Redis
+from sqlalchemy import and_, or_, select
+from sqlalchemy.orm import Session
+
+from app.core.config import get_settings
+from app.models.rule import RuleMaster
+
+
+def _serialize_rule(rule: RuleMaster) -> dict[str, Any]:
+    return {
+        "id": rule.id,
+        "tenant_id": rule.tenant_id,
+        "product_type": rule.product_type,
+        "dealer_id": rule.dealer_id,
+        "rule_code": rule.rule_code,
+        "rule_name": rule.rule_name,
+        "rule_type": rule.rule_type,
+        "field_name": rule.field_name,
+        "operator": rule.operator,
+        "field_value": rule.field_value,
+        "score_value": str(rule.score_value) if rule.score_value is not None else None,
+        "score_component": rule.score_component,
+        "decision_action": rule.decision_action,
+        "reason_code": rule.reason_code,
+        "priority": rule.priority,
+        "version": rule.version,
+        "is_active": rule.is_active,
+        "created_by": rule.created_by,
+        "created_at": rule.created_at.isoformat(),
+        "updated_at": rule.updated_at.isoformat(),
+    }
+
+
+def _hydrate_rule(data: dict[str, Any]) -> RuleMaster:
+    rule = RuleMaster(**{k: v for k, v in data.items() if k not in {"created_at", "updated_at"}})
+    if data.get("score_value") is not None:
+        rule.score_value = Decimal(data["score_value"])
+    return rule
+
+
+class RuleRepository:
+    def __init__(self) -> None:
+        self.settings = get_settings()
+        self.redis: Redis | None = None
+        if self.settings.redis_url:
+            try:
+                self.redis = Redis.from_url(self.settings.redis_url, decode_responses=True)
+            except Exception:
+                self.redis = None
+
+    def cache_key(self, tenant_id: str, product_type: str, dealer_id: str | None) -> str:
+        dealer = dealer_id or "ALL"
+        return f"rules:{tenant_id}:{product_type}:{dealer}"
+
+    def get_active_rules(
+        self, db: Session, tenant_id: str, product_type: str, dealer_id: str | None
+    ) -> list[RuleMaster]:
+        key = self.cache_key(tenant_id, product_type, dealer_id)
+        if self.redis:
+            try:
+                cached = self.redis.get(key)
+                if cached:
+                    return [_hydrate_rule(item) for item in json.loads(cached)]
+            except Exception:
+                pass
+
+        stmt = (
+            select(RuleMaster)
+            .where(
+                RuleMaster.is_active.is_(True),
+                RuleMaster.tenant_id == tenant_id,
+                RuleMaster.product_type == product_type,
+                or_(RuleMaster.dealer_id.is_(None), RuleMaster.dealer_id == dealer_id),
+            )
+            .order_by(RuleMaster.priority.asc(), RuleMaster.id.asc())
+        )
+        rules = list(db.scalars(stmt).all())
+        if self.redis:
+            try:
+                self.redis.setex(key, 300, json.dumps([_serialize_rule(rule) for rule in rules]))
+            except Exception:
+                pass
+        return rules
+
+    def invalidate(self, tenant_id: str, product_type: str, dealer_id: str | None = None) -> None:
+        if not self.redis:
+            return
+        keys = [
+            self.cache_key(tenant_id, product_type, dealer_id),
+            self.cache_key(tenant_id, product_type, None),
+        ]
+        try:
+            self.redis.delete(*set(keys))
+        except Exception:
+            pass
+
+    def list_rules(
+        self,
+        db: Session,
+        tenant_id: str | None = None,
+        product_type: str | None = None,
+        dealer_id: str | None = None,
+        rule_type: str | None = None,
+        is_active: bool | None = None,
+    ) -> list[RuleMaster]:
+        filters = []
+        if tenant_id:
+            filters.append(RuleMaster.tenant_id == tenant_id)
+        if product_type:
+            filters.append(RuleMaster.product_type == product_type)
+        if dealer_id:
+            filters.append(RuleMaster.dealer_id == dealer_id)
+        if rule_type:
+            filters.append(RuleMaster.rule_type == rule_type)
+        if is_active is not None:
+            filters.append(RuleMaster.is_active.is_(is_active))
+        stmt = select(RuleMaster).order_by(RuleMaster.priority.asc(), RuleMaster.id.asc())
+        if filters:
+            stmt = stmt.where(and_(*filters))
+        return list(db.scalars(stmt).all())
+

rules.py

@@ -0,0 +1,83 @@
+from fastapi import APIRouter, Depends, HTTPException, Query, status
+from sqlalchemy import func, select
+from sqlalchemy.orm import Session
+
+from app.api.dependencies import require_auth
+from app.db.session import get_db
+from app.models.rule import RuleMaster
+from app.schemas.rule import RuleCreate, RuleResponse, RuleStatusUpdate, RuleUpdate
+from app.services.audit import rule_to_dict, write_rule_audit
+from app.services.rule_repository import RuleRepository
+
+router = APIRouter(prefix="/rules", tags=["Rule Management"], dependencies=[Depends(require_auth)])
+repo = RuleRepository()
+
+
+@router.get("", response_model=list[RuleResponse])
+def list_rules(
+    tenant_id: str | None = None,
+    product_type: str | None = None,
+    dealer_id: str | None = None,
+    rule_type: str | None = None,
+    is_active: bool | None = Query(default=None),
+    db: Session = Depends(get_db),
+) -> list[RuleMaster]:
+    return repo.list_rules(db, tenant_id, product_type, dealer_id, rule_type, is_active)
+
+
+@router.post("", response_model=RuleResponse, status_code=status.HTTP_201_CREATED)
+def create_rule(payload: RuleCreate, db: Session = Depends(get_db)) -> RuleMaster:
+    dealer_filter = (
+        RuleMaster.dealer_id.is_(None)
+        if payload.dealer_id is None
+        else RuleMaster.dealer_id == payload.dealer_id
+    )
+    latest_version = db.scalar(
+        select(func.max(RuleMaster.version)).where(
+            RuleMaster.rule_code == payload.rule_code,
+            RuleMaster.tenant_id == payload.tenant_id,
+            RuleMaster.product_type == payload.product_type,
+            dealer_filter,
+        )
+    )
+    rule = RuleMaster(**payload.model_dump(), version=(latest_version or 0) + 1)
+    db.add(rule)
+    db.flush()
+    write_rule_audit(db, rule.id, "CREATE", payload.created_by, None, rule_to_dict(rule))
+    db.commit()
+    db.refresh(rule)
+    repo.invalidate(rule.tenant_id, rule.product_type, rule.dealer_id)
+    return rule
+
+
+@router.put("/{rule_id}", response_model=RuleResponse)
+def update_rule(rule_id: int, payload: RuleUpdate, db: Session = Depends(get_db)) -> RuleMaster:
+    rule = db.get(RuleMaster, rule_id)
+    if not rule:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Rule not found")
+    before = rule_to_dict(rule)
+    updates = payload.model_dump(exclude_unset=True)
+    actor = updates.pop("actor", "system")
+    for field, value in updates.items():
+        setattr(rule, field, value)
+    write_rule_audit(db, rule.id, "UPDATE", actor, before, rule_to_dict(rule))
+    db.commit()
+    db.refresh(rule)
+    repo.invalidate(rule.tenant_id, rule.product_type, rule.dealer_id)
+    return rule
+
+
+@router.patch("/{rule_id}/status", response_model=RuleResponse)
+def update_rule_status(
+    rule_id: int, payload: RuleStatusUpdate, db: Session = Depends(get_db)
+) -> RuleMaster:
+    rule = db.get(RuleMaster, rule_id)
+    if not rule:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Rule not found")
+    before = rule_to_dict(rule)
+    rule.is_active = payload.is_active
+    write_rule_audit(db, rule.id, "STATUS_UPDATE", payload.actor, before, rule_to_dict(rule))
+    db.commit()
+    db.refresh(rule)
+    repo.invalidate(rule.tenant_id, rule.product_type, rule.dealer_id)
+    return rule

runtime.txt

@@ -0,0 +1,2 @@
+python-3.11.9
+

scorecard.db

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:772cdc993e65c56670c27fa77ae32e7c17df26231adeb8a603b06cf49c18e400
+size 184320

scorecard.py

@@ -0,0 +1,96 @@
+from decimal import Decimal
+from typing import Any
+
+from pydantic import BaseModel, ConfigDict, Field
+
+
+class ApplicationDetails(BaseModel):
+    leadId: str
+    customerName: str | None = None
+    mobile: str | None = None
+    employmentType: str | None = None
+    monthlyIncome: Decimal | None = None
+    existingEMI: Decimal | None = None
+    foir: Decimal | None = None
+    loanAmount: Decimal | None = None
+    assetCost: Decimal | None = None
+    ltv: Decimal | None = None
+    tenure: int | None = None
+    dealerId: str | None = None
+    state: str | None = None
+    city: str | None = None
+    pincode: str | None = None
+    negativeArea: bool | None = None
+    fraudFlag: bool | None = False
+    blacklistMatch: bool | None = False
+    fakeKyc: bool | None = False
+    panMismatch: bool | None = False
+    faceMatchScore: Decimal | None = None
+    panVerified: bool | None = None
+    aadhaarVerified: bool | None = None
+    bankingSurrogate: bool | None = None
+    coApplicant: bool | None = None
+
+
+class BureauData(BaseModel):
+    cibilScore: int | None = None
+    creditVintageMonths: int | None = None
+    activeAccounts: int | None = None
+    closedAccounts: int | None = None
+    overdueAmount: Decimal | None = None
+    writtenOffAccounts: int | None = None
+    settledAccounts: int | None = None
+    suitFiledAccounts: int | None = 0
+    active90PlusDpd: bool | None = False
+    maxDPD: int | None = None
+    dpd30Count: int | None = None
+    dpd60Count: int | None = None
+    dpd90Count: int | None = None
+    creditEnquiries6M: int | None = None
+    creditEnquiries12M: int | None = None
+    activeUnsecuredLoans: int | None = None
+    activeSecuredLoans: int | None = None
+    jointAccounts: int | None = None
+    creditUtilization: Decimal | None = None
+    bureauRisk: str | None = None
+
+
+class ScorecardRequest(BaseModel):
+    application: ApplicationDetails
+    bureau: BureauData
+    tenantId: str = "default"
+    productType: str = "TWO_WHEELER_LOAN"
+    forceRecalculate: bool = False
+
+
+class ScorecardResponse(BaseModel):
+    leadId: str
+    finalScore: Decimal
+    decision: str
+    underwritingRequired: bool
+    rejectFlag: bool
+    journeyAction: str
+    bureauRisk: str
+    reasonCodes: list[str]
+    triggeredRules: list[str]
+    scoreBreakup: dict[str, Decimal]
+
+    model_config = ConfigDict(from_attributes=True)
+
+
+class SimulationResponse(ScorecardResponse):
+    persisted: bool = False
+
+
+class StoredScorecardResponse(ScorecardResponse):
+    tenantId: str
+    productType: str
+    createdAt: str
+
+
+class HealthResponse(BaseModel):
+    status: str
+    database: str
+    redis: str
+    details: dict[str, Any] = Field(default_factory=dict)
+

scorecard_service.py

@@ -0,0 +1,198 @@
+import time
+from decimal import Decimal
+
+from sqlalchemy import select
+from sqlalchemy.orm import Session
+
+from app.core.enums import BureauRisk, JourneyAction, RuleType, ScorecardDecision
+from app.models.audit import ScorecardExecutionAudit
+from app.models.rule import RuleMaster
+from app.models.scorecard import ScorecardResult
+from app.schemas.scorecard import ScorecardRequest, ScorecardResponse
+from app.services.bureau import BureauRiskClassifier
+from app.services.context import build_evaluation_context
+from app.services.hash import stable_payload_hash
+from app.services.rule_engine import RuleEngine
+from app.services.rule_repository import RuleRepository
+
+
+class ScorecardService:
+    def __init__(self) -> None:
+        self.rules = RuleRepository()
+        self.engine = RuleEngine()
+        self.bureau = BureauRiskClassifier()
+
+    def _existing_result(
+        self, db: Session, request: ScorecardRequest, request_hash: str
+    ) -> ScorecardResult | None:
+        stmt = (
+            select(ScorecardResult)
+            .where(
+                ScorecardResult.lead_id == request.application.leadId,
+                ScorecardResult.tenant_id == request.tenantId,
+                ScorecardResult.product_type == request.productType,
+                ScorecardResult.request_hash == request_hash,
+            )
+            .order_by(ScorecardResult.created_at.desc())
+        )
+        return db.scalars(stmt).first()
+
+    def generate(self, db: Session, request: ScorecardRequest, persist: bool = True) -> ScorecardResponse:
+        start = time.perf_counter()
+        payload_hash = stable_payload_hash(request.model_dump())
+        if persist and not request.forceRecalculate:
+            existing = self._existing_result(db, request, payload_hash)
+            if existing:
+                return self._to_response(existing)
+
+        audit = ScorecardExecutionAudit(
+            lead_id=request.application.leadId,
+            tenant_id=request.tenantId,
+            product_type=request.productType,
+            request_hash=payload_hash,
+            matched_rules=[],
+            skipped_rules=[],
+            status="STARTED",
+        )
+        if persist:
+            db.add(audit)
+            db.flush()
+
+        try:
+            response = self._execute(db, request)
+            if persist:
+                result = ScorecardResult(
+                    tenant_id=request.tenantId,
+                    product_type=request.productType,
+                    lead_id=response.leadId,
+                    final_score=response.finalScore,
+                    decision=response.decision,
+                    underwriting_required=response.underwritingRequired,
+                    reject_flag=response.rejectFlag,
+                    journey_action=response.journeyAction,
+                    bureau_risk=response.bureauRisk,
+                    score_breakup={k: str(v) for k, v in response.scoreBreakup.items()},
+                    triggered_rules=response.triggeredRules,
+                    reason_codes=response.reasonCodes,
+                    request_hash=payload_hash,
+                )
+                db.add(result)
+                audit.matched_rules = response.triggeredRules
+                audit.status = "SUCCESS"
+                audit.latency_ms = int((time.perf_counter() - start) * 1000)
+                db.commit()
+                db.refresh(result)
+                return self._to_response(result)
+            return response
+        except Exception as exc:
+            if persist:
+                audit.status = "FAILED"
+                audit.error_message = str(exc)
+                audit.latency_ms = int((time.perf_counter() - start) * 1000)
+                db.commit()
+            raise
+
+    def _execute(self, db: Session, request: ScorecardRequest) -> ScorecardResponse:
+        context = build_evaluation_context(request)
+        rules = self.rules.get_active_rules(
+            db, request.tenantId, request.productType, request.application.dealerId
+        )
+
+        hard_reject = self.engine.evaluate(
+            [rule for rule in rules if rule.rule_type == RuleType.HARD_REJECT], context
+        )
+        score, breakup, score_eval = self.engine.score(rules, context)
+        bureau_risk = self.bureau.classify(context)
+        non_stp = self.engine.evaluate(
+            [rule for rule in rules if rule.rule_type == RuleType.NON_STP], context
+        )
+        stp_eligibility_rules = [
+            rule for rule in rules if rule.rule_type == RuleType.STP_ELIGIBILITY
+        ]
+        stp_eval = self.engine.evaluate(stp_eligibility_rules, context)
+
+        decision = self._decide(
+            score=score,
+            hard_reject_rules=hard_reject.matched,
+            non_stp_rules=non_stp.matched,
+            stp_rules=stp_eligibility_rules,
+            stp_matched=stp_eval.matched,
+            bureau_risk=bureau_risk,
+        )
+        underwriting_required = decision in {
+            ScorecardDecision.NON_STP,
+            ScorecardDecision.CONDITIONAL_STP,
+        }
+        reject_flag = decision == ScorecardDecision.REJECT
+        journey_action = self._journey_action(decision)
+
+        triggered_rules = (
+            hard_reject.codes + score_eval.codes + non_stp.codes + stp_eval.codes
+        )
+        reason_codes = list(
+            dict.fromkeys(
+                hard_reject.reason_codes
+                + score_eval.reason_codes
+                + non_stp.reason_codes
+                + stp_eval.reason_codes
+            )
+        )
+
+        return ScorecardResponse(
+            leadId=request.application.leadId,
+            finalScore=score,
+            decision=decision,
+            underwritingRequired=underwriting_required,
+            rejectFlag=reject_flag,
+            journeyAction=journey_action,
+            bureauRisk=bureau_risk,
+            reasonCodes=reason_codes,
+            triggeredRules=triggered_rules,
+            scoreBreakup=breakup,
+        )
+
+    def _decide(
+        self,
+        score: Decimal,
+        hard_reject_rules: list[RuleMaster],
+        non_stp_rules: list[RuleMaster],
+        stp_rules: list[RuleMaster],
+        stp_matched: list[RuleMaster],
+        bureau_risk: BureauRisk,
+    ) -> ScorecardDecision:
+        if hard_reject_rules:
+            return ScorecardDecision.REJECT
+        all_stp_rules_match = bool(stp_rules) and len(stp_rules) == len(stp_matched)
+        if (
+            all_stp_rules_match
+            and score >= Decimal("80")
+            and not non_stp_rules
+            and bureau_risk != BureauRisk.HIGH
+        ):
+            return ScorecardDecision.STP
+        if non_stp_rules or bureau_risk == BureauRisk.HIGH:
+            return ScorecardDecision.NON_STP
+        if Decimal("65") <= score <= Decimal("79"):
+            return ScorecardDecision.CONDITIONAL_STP
+        return ScorecardDecision.NON_STP
+
+    def _journey_action(self, decision: ScorecardDecision) -> JourneyAction:
+        if decision == ScorecardDecision.STP:
+            return JourneyAction.SKIP_UNDERWRITING
+        if decision == ScorecardDecision.REJECT:
+            return JourneyAction.REJECT_APPLICATION
+        return JourneyAction.SEND_TO_UNDERWRITING
+
+    def _to_response(self, result: ScorecardResult) -> ScorecardResponse:
+        return ScorecardResponse(
+            leadId=result.lead_id,
+            finalScore=result.final_score,
+            decision=result.decision,
+            underwritingRequired=result.underwriting_required,
+            rejectFlag=result.reject_flag,
+            journeyAction=result.journey_action,
+            bureauRisk=result.bureau_risk,
+            reasonCodes=list(result.reason_codes or []),
+            triggeredRules=list(result.triggered_rules or []),
+            scoreBreakup={k: Decimal(str(v)) for k, v in (result.score_breakup or {}).items()},
+        )

script.py.mako

@@ -0,0 +1,25 @@
+"""${message}
+
+Revision ID: ${up_revision}
+Revises: ${down_revision | comma,n}
+Create Date: ${create_date}
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+${imports if imports else ""}
+
+revision: str = ${repr(up_revision)}
+down_revision: Union[str, None] = ${repr(down_revision)}
+branch_labels: Union[str, Sequence[str], None] = ${repr(branch_labels)}
+depends_on: Union[str, Sequence[str], None] = ${repr(depends_on)}
+
+
+def upgrade() -> None:
+    ${upgrades if upgrades else "pass"}
+
+
+def downgrade() -> None:
+    ${downgrades if downgrades else "pass"}
+

seed_rules.py

@@ -0,0 +1,444 @@
+from decimal import Decimal
+
+from sqlalchemy import select
+from sqlalchemy.orm import Session
+
+from app.core.enums import DecisionAction, RuleType
+from app.models.rule import RuleMaster
+
+
+DEFAULT_RULES = [
+    {
+        "rule_code": "CIBIL_HIGH",
+        "rule_name": "High CIBIL score",
+        "rule_type": RuleType.SCORE,
+        "field_name": "cibilScore",
+        "operator": ">=",
+        "field_value": "750",
+        "score_value": Decimal("20"),
+        "score_component": "cibil",
+        "decision_action": DecisionAction.SCORE,
+        "reason_code": "HIGH_CIBIL",
+        "priority": 100,
+    },
+    {
+        "rule_code": "CIBIL_MEDIUM",
+        "rule_name": "Medium CIBIL score",
+        "rule_type": RuleType.SCORE,
+        "field_name": "cibilScore",
+        "operator": "BETWEEN",
+        "field_value": "700,749",
+        "score_value": Decimal("14"),
+        "score_component": "cibil",
+        "decision_action": DecisionAction.SCORE,
+        "reason_code": "MEDIUM_CIBIL",
+        "priority": 110,
+    },
+    {
+        "rule_code": "BUREAU_CLEAN",
+        "rule_name": "Clean repayment behaviour",
+        "rule_type": RuleType.SCORE,
+        "field_name": "noDpd",
+        "operator": "=",
+        "field_value": "true",
+        "score_value": Decimal("25"),
+        "score_component": "bureau",
+        "decision_action": DecisionAction.SCORE,
+        "reason_code": "NO_DELINQUENCY",
+        "priority": 120,
+    },
+    {
+        "rule_code": "FOIR_GOOD",
+        "rule_name": "Low FOIR",
+        "rule_type": RuleType.SCORE,
+        "field_name": "foir",
+        "operator": "<=",
+        "field_value": "35",
+        "score_value": Decimal("15"),
+        "score_component": "foir",
+        "decision_action": DecisionAction.SCORE,
+        "reason_code": "LOW_FOIR",
+        "priority": 130,
+    },
+    {
+        "rule_code": "FOIR_ACCEPTABLE",
+        "rule_name": "Acceptable FOIR",
+        "rule_type": RuleType.SCORE,
+        "field_name": "foir",
+        "operator": "BETWEEN",
+        "field_value": "36,50",
+        "score_value": Decimal("8"),
+        "score_component": "foir",
+        "decision_action": DecisionAction.SCORE,
+        "reason_code": "ACCEPTABLE_FOIR",
+        "priority": 131,
+    },
+    {
+        "rule_code": "LTV_GOOD",
+        "rule_name": "Low LTV",
+        "rule_type": RuleType.SCORE,
+        "field_name": "ltv",
+        "operator": "<=",
+        "field_value": "75",
+        "score_value": Decimal("10"),
+        "score_component": "ltv",
+        "decision_action": DecisionAction.SCORE,
+        "reason_code": "LOW_LTV",
+        "priority": 140,
+    },
+    {
+        "rule_code": "LTV_ACCEPTABLE",
+        "rule_name": "Acceptable LTV",
+        "rule_type": RuleType.SCORE,
+        "field_name": "ltv",
+        "operator": "BETWEEN",
+        "field_value": "76,85",
+        "score_value": Decimal("8"),
+        "score_component": "ltv",
+        "decision_action": DecisionAction.SCORE,
+        "reason_code": "ACCEPTABLE_LTV",
+        "priority": 141,
+    },
+    {
+        "rule_code": "NO_FRAUD",
+        "rule_name": "No fraud indicators",
+        "rule_type": RuleType.SCORE,
+        "field_name": "noFraud",
+        "operator": "=",
+        "field_value": "true",
+        "score_value": Decimal("10"),
+        "score_component": "fraud",
+        "decision_action": DecisionAction.SCORE,
+        "reason_code": "NO_FRAUD",
+        "priority": 150,
+    },
+    {
+        "rule_code": "STABLE_EMPLOYMENT",
+        "rule_name": "Stable employment type",
+        "rule_type": RuleType.SCORE,
+        "field_name": "stableEmployment",
+        "operator": "=",
+        "field_value": "true",
+        "score_value": Decimal("10"),
+        "score_component": "employment",
+        "decision_action": DecisionAction.SCORE,
+        "reason_code": "STABLE_EMPLOYMENT",
+        "priority": 160,
+    },
+    {
+        "rule_code": "BANKING_SURROGATE_OK",
+        "rule_name": "Banking surrogate available",
+        "rule_type": RuleType.SCORE,
+        "field_name": "bankingSurrogate",
+        "operator": "=",
+        "field_value": "true",
+        "score_value": Decimal("5"),
+        "score_component": "banking",
+        "decision_action": DecisionAction.SCORE,
+        "reason_code": "BANKING_SURROGATE",
+        "priority": 170,
+    },
+    {
+        "rule_code": "KYC_VERIFIED",
+        "rule_name": "PAN and Aadhaar verified",
+        "rule_type": RuleType.SCORE,
+        "field_name": "kycVerified",
+        "operator": "=",
+        "field_value": "true",
+        "score_value": Decimal("5"),
+        "score_component": "kyc",
+        "decision_action": DecisionAction.SCORE,
+        "reason_code": "KYC_VERIFIED",
+        "priority": 180,
+    },
+    {
+        "rule_code": "WRITTEN_OFF_REJECT",
+        "rule_name": "Written off account reject",
+        "rule_type": RuleType.HARD_REJECT,
+        "field_name": "writtenOffAccounts",
+        "operator": ">",
+        "field_value": "0",
+        "decision_action": DecisionAction.REJECT,
+        "reason_code": "WRITTEN_OFF_ACCOUNT",
+        "priority": 10,
+    },
+    {
+        "rule_code": "SETTLED_REJECT",
+        "rule_name": "Settled account reject",
+        "rule_type": RuleType.HARD_REJECT,
+        "field_name": "settledAccounts",
+        "operator": ">",
+        "field_value": "0",
+        "decision_action": DecisionAction.REJECT,
+        "reason_code": "SETTLED_ACCOUNT",
+        "priority": 11,
+    },
+    {
+        "rule_code": "OVERDUE_REJECT",
+        "rule_name": "Current overdue above threshold",
+        "rule_type": RuleType.HARD_REJECT,
+        "field_name": "overdueAmount",
+        "operator": ">",
+        "field_value": "5000",
+        "decision_action": DecisionAction.REJECT,
+        "reason_code": "CURRENT_OVERDUE",
+        "priority": 12,
+    },
+    {
+        "rule_code": "FRAUD_REJECT",
+        "rule_name": "Fraud flag reject",
+        "rule_type": RuleType.HARD_REJECT,
+        "field_name": "fraudFlag",
+        "operator": "=",
+        "field_value": "true",
+        "decision_action": DecisionAction.REJECT,
+        "reason_code": "FRAUD_FLAG",
+        "priority": 13,
+    },
+    {
+        "rule_code": "PAN_MISMATCH_REJECT",
+        "rule_name": "PAN mismatch reject",
+        "rule_type": RuleType.HARD_REJECT,
+        "field_name": "panMismatch",
+        "operator": "=",
+        "field_value": "true",
+        "decision_action": DecisionAction.REJECT,
+        "reason_code": "PAN_MISMATCH",
+        "priority": 14,
+    },
+    {
+        "rule_code": "DPD_90_REJECT",
+        "rule_name": "90 plus DPD reject",
+        "rule_type": RuleType.HARD_REJECT,
+        "field_name": "active90PlusDpd",
+        "operator": "=",
+        "field_value": "true",
+        "decision_action": DecisionAction.REJECT,
+        "reason_code": "ACTIVE_90_PLUS_DPD",
+        "priority": 15,
+    },
+    {
+        "rule_code": "MAX_DPD_UW",
+        "rule_name": "Max DPD above STP threshold",
+        "rule_type": RuleType.NON_STP,
+        "field_name": "maxDPD",
+        "operator": ">",
+        "field_value": "30",
+        "decision_action": DecisionAction.UW,
+        "reason_code": "MAX_DPD_ABOVE_30",
+        "priority": 200,
+    },
+    {
+        "rule_code": "DPD_60_UW",
+        "rule_name": "60 DPD history",
+        "rule_type": RuleType.NON_STP,
+        "field_name": "dpd60Count",
+        "operator": ">",
+        "field_value": "0",
+        "decision_action": DecisionAction.UW,
+        "reason_code": "DPD_60_HISTORY",
+        "priority": 201,
+    },
+    {
+        "rule_code": "DPD_90_UW",
+        "rule_name": "90 DPD history",
+        "rule_type": RuleType.NON_STP,
+        "field_name": "dpd90Count",
+        "operator": ">",
+        "field_value": "0",
+        "decision_action": DecisionAction.UW,
+        "reason_code": "DPD_90_HISTORY",
+        "priority": 202,
+    },
+    {
+        "rule_code": "ENQUIRY_HIGH_UW",
+        "rule_name": "High enquiry burst",
+        "rule_type": RuleType.NON_STP,
+        "field_name": "creditEnquiries6M",
+        "operator": ">",
+        "field_value": "5",
+        "decision_action": DecisionAction.UW,
+        "reason_code": "HIGH_ENQUIRY_BURST",
+        "priority": 203,
+    },
+    {
+        "rule_code": "FOIR_HIGH_UW",
+        "rule_name": "High FOIR underwriting",
+        "rule_type": RuleType.NON_STP,
+        "field_name": "foir",
+        "operator": ">",
+        "field_value": "50",
+        "decision_action": DecisionAction.UW,
+        "reason_code": "HIGH_FOIR",
+        "priority": 204,
+    },
+    {
+        "rule_code": "UNSECURED_LOANS_UW",
+        "rule_name": "Multiple active unsecured loans",
+        "rule_type": RuleType.NON_STP,
+        "field_name": "activeUnsecuredLoans",
+        "operator": ">",
+        "field_value": "1",
+        "decision_action": DecisionAction.UW,
+        "reason_code": "MULTIPLE_UNSECURED_LOANS",
+        "priority": 205,
+    },
+    {
+        "rule_code": "FACE_MATCH_LOW_UW",
+        "rule_name": "Low face match",
+        "rule_type": RuleType.NON_STP,
+        "field_name": "faceMatchScore",
+        "operator": "<",
+        "field_value": "75",
+        "decision_action": DecisionAction.UW,
+        "reason_code": "LOW_FACE_MATCH",
+        "priority": 206,
+    },
+    {
+        "rule_code": "STP_CIBIL",
+        "rule_name": "STP CIBIL threshold",
+        "rule_type": RuleType.STP_ELIGIBILITY,
+        "field_name": "cibilScore",
+        "operator": ">=",
+        "field_value": "750",
+        "decision_action": DecisionAction.STP,
+        "reason_code": "STP_CIBIL_OK",
+        "priority": 300,
+    },
+    {
+        "rule_code": "STP_NO_WRITEOFF",
+        "rule_name": "STP no written off",
+        "rule_type": RuleType.STP_ELIGIBILITY,
+        "field_name": "writtenOffAccounts",
+        "operator": "=",
+        "field_value": "0",
+        "decision_action": DecisionAction.STP,
+        "reason_code": "STP_NO_WRITEOFF",
+        "priority": 301,
+    },
+    {
+        "rule_code": "STP_NO_SETTLEMENT",
+        "rule_name": "STP no settlement",
+        "rule_type": RuleType.STP_ELIGIBILITY,
+        "field_name": "settledAccounts",
+        "operator": "=",
+        "field_value": "0",
+        "decision_action": DecisionAction.STP,
+        "reason_code": "STP_NO_SETTLEMENT",
+        "priority": 302,
+    },
+    {
+        "rule_code": "STP_NO_OVERDUE",
+        "rule_name": "STP no overdue",
+        "rule_type": RuleType.STP_ELIGIBILITY,
+        "field_name": "overdueAmount",
+        "operator": "=",
+        "field_value": "0",
+        "decision_action": DecisionAction.STP,
+        "reason_code": "STP_NO_OVERDUE",
+        "priority": 303,
+    },
+    {
+        "rule_code": "STP_MAX_DPD",
+        "rule_name": "STP max DPD threshold",
+        "rule_type": RuleType.STP_ELIGIBILITY,
+        "field_name": "maxDPD",
+        "operator": "<=",
+        "field_value": "30",
+        "decision_action": DecisionAction.STP,
+        "reason_code": "STP_DPD_OK",
+        "priority": 304,
+    },
+    {
+        "rule_code": "STP_FOIR",
+        "rule_name": "STP FOIR threshold",
+        "rule_type": RuleType.STP_ELIGIBILITY,
+        "field_name": "foir",
+        "operator": "<=",
+        "field_value": "40",
+        "decision_action": DecisionAction.STP,
+        "reason_code": "STP_FOIR_OK",
+        "priority": 305,
+    },
+    {
+        "rule_code": "STP_ENQUIRY",
+        "rule_name": "STP enquiry threshold",
+        "rule_type": RuleType.STP_ELIGIBILITY,
+        "field_name": "creditEnquiries6M",
+        "operator": "<=",
+        "field_value": "3",
+        "decision_action": DecisionAction.STP,
+        "reason_code": "STP_ENQUIRY_OK",
+        "priority": 306,
+    },
+    {
+        "rule_code": "STP_FACE_MATCH",
+        "rule_name": "STP face match threshold",
+        "rule_type": RuleType.STP_ELIGIBILITY,
+        "field_name": "faceMatchScore",
+        "operator": ">=",
+        "field_value": "85",
+        "decision_action": DecisionAction.STP,
+        "reason_code": "STP_FACE_MATCH_OK",
+        "priority": 307,
+    },
+    {
+        "rule_code": "STP_KYC",
+        "rule_name": "STP KYC verified",
+        "rule_type": RuleType.STP_ELIGIBILITY,
+        "field_name": "kycVerified",
+        "operator": "=",
+        "field_value": "true",
+        "decision_action": DecisionAction.STP,
+        "reason_code": "STP_KYC_OK",
+        "priority": 308,
+    },
+]
+
+SUPPORTED_PRODUCT_TYPES = [
+    "TWO_WHEELER_LOAN",
+    "NEW_CAR_LOAN",
+    "USED_CAR_LOAN",
+    "NEW_COMMERCIAL_VEHICLE_LOAN",
+    "USED_COMMERCIAL_VEHICLE_LOAN",
+    "NEW_TRACTOR_LOAN",
+    "USED_TRACTOR_LOAN",
+]
+
+
+def seed_default_rules(
+    db: Session, tenant_id: str = "default", product_type: str = "TWO_WHEELER_LOAN"
+) -> int:
+    inserted = 0
+    for item in DEFAULT_RULES:
+        exists = db.scalar(
+            select(RuleMaster.id).where(
+                RuleMaster.tenant_id == tenant_id,
+                RuleMaster.product_type == product_type,
+                RuleMaster.rule_code == item["rule_code"],
+                RuleMaster.version == 1,
+                RuleMaster.dealer_id.is_(None),
+            )
+        )
+        if exists:
+            continue
+        db.add(
+            RuleMaster(
+                tenant_id=tenant_id,
+                product_type=product_type,
+                dealer_id=None,
+                version=1,
+                is_active=True,
+                created_by="seed",
+                **item,
+            )
+        )
+        inserted += 1
+    return inserted
+
+
+def seed_all_product_rules(db: Session, tenant_id: str = "default") -> int:
+    inserted = 0
+    for product_type in SUPPORTED_PRODUCT_TYPES:
+        inserted += seed_default_rules(db, tenant_id=tenant_id, product_type=product_type)
+    return inserted

session.py

@@ -0,0 +1,25 @@
+from collections.abc import Generator
+
+from sqlalchemy import create_engine
+from sqlalchemy.orm import DeclarativeBase, Session, sessionmaker
+
+from app.core.config import get_settings
+
+
+class Base(DeclarativeBase):
+    pass
+
+
+settings = get_settings()
+connect_args = {"check_same_thread": False} if settings.database_url.startswith("sqlite") else {}
+engine = create_engine(settings.database_url, pool_pre_ping=True, connect_args=connect_args)
+SessionLocal = sessionmaker(bind=engine, autocommit=False, autoflush=False)
+
+
+def get_db() -> Generator[Session, None, None]:
+    db = SessionLocal()
+    try:
+        yield db
+    finally:
+        db.close()
+

ui.py

@@ -0,0 +1,21 @@
+from pathlib import Path
+
+from fastapi import APIRouter
+from fastapi.responses import FileResponse
+
+router = APIRouter(tags=["UI"])
+
+
+@router.get("/", include_in_schema=False)
+def scorecard_console() -> FileResponse:
+    return FileResponse(Path("app/static/index.html"))
+
+
+@router.get("/generate-scorecard", include_in_schema=False)
+def generate_scorecard_console() -> FileResponse:
+    return FileResponse(Path("app/static/index.html"))
+
+
+@router.get("/simulate-scorecard", include_in_schema=False)
+def simulate_scorecard_console() -> FileResponse:
+    return FileResponse(Path("app/static/index.html"))