CREATE TABLE compliance.module_frame_component_defaults (
    id                            SERIAL PRIMARY KEY,
    uid                           UUID NOT NULL DEFAULT gen_random_uuid(),
    module_frame_id               INTEGER NOT NULL,
    component_type                VARCHAR NOT NULL,
    title                         VARCHAR NOT NULL,
    description                   TEXT,
    purpose                       TEXT,
    status                        VARCHAR,
    leveraged_authorization_uid   UUID,  -- soft reference to module_frame_leveraged_authorization_defaults.uid
    props                         JSONB,
    created_at                    TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
    updated_at                    TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
    created_user                  VARCHAR,
    updated_user                  VARCHAR,
    UNIQUE (uid),
    UNIQUE (module_frame_id, title, component_type)
);

CREATE INDEX idx_module_frame_component_defaults_mf_id
    ON compliance.module_frame_component_defaults (module_frame_id);

GRANT SELECT, INSERT, UPDATE, DELETE ON compliance.module_frame_component_defaults TO cm_app;
GRANT USAGE, SELECT ON SEQUENCE compliance.module_frame_component_defaults_id_seq TO cm_app;

CREATE TABLE compliance.module_frame_leveraged_authorization_defaults (
    id                  SERIAL PRIMARY KEY,
    uid                 UUID NOT NULL DEFAULT gen_random_uuid(),
    module_frame_id     INTEGER NOT NULL,
    title               VARCHAR NOT NULL,
    party_uuid          UUID,        -- soft reference to oscal_parties.uid (跨 schema)
    date_authorized     DATE,
    props               JSONB,
    remarks             TEXT,
    created_at          TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
    updated_at          TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
    created_user        VARCHAR,
    updated_user        VARCHAR,
    UNIQUE (uid),
    UNIQUE (module_frame_id, title)
);

CREATE INDEX idx_module_frame_leveraged_authorization_defaults_mf_id
    ON compliance.module_frame_leveraged_authorization_defaults (module_frame_id);

GRANT SELECT, INSERT, UPDATE, DELETE ON compliance.module_frame_leveraged_authorization_defaults TO cm_app;
GRANT USAGE, SELECT ON SEQUENCE compliance.module_frame_leveraged_authorization_defaults_id_seq TO cm_app;

CREATE TABLE compliance.module_frame_inventory_item_defaults (
    id                  SERIAL PRIMARY KEY,
    uid                 UUID NOT NULL DEFAULT gen_random_uuid(),
    module_frame_id     INTEGER NOT NULL,
    description         TEXT NOT NULL,
    props               JSONB,
    created_at          TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
    updated_at          TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
    created_user        VARCHAR,
    updated_user        VARCHAR,
    UNIQUE (uid)
);

CREATE INDEX idx_module_frame_inventory_item_defaults_mf_id
    ON compliance.module_frame_inventory_item_defaults (module_frame_id);

GRANT SELECT, INSERT, UPDATE, DELETE ON compliance.module_frame_inventory_item_defaults TO cm_app;
GRANT USAGE, SELECT ON SEQUENCE compliance.module_frame_inventory_item_defaults_id_seq TO cm_app;

CREATE TABLE compliance.module_frame_system_characteristic_defaults (
    id                            SERIAL PRIMARY KEY,
    uid                           UUID NOT NULL DEFAULT gen_random_uuid(),
    module_frame_id               INTEGER NOT NULL,
    name                          VARCHAR NOT NULL,
    description                   TEXT,
    system_identifier             VARCHAR,
    security_sensitivity_level    VARCHAR,
    target_type                   VARCHAR,
    scope_description             TEXT,
    status                        VARCHAR,
    owner_uid                     VARCHAR,
    created_at                    TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
    updated_at                    TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
    created_user                  VARCHAR,
    updated_user                  VARCHAR,
    UNIQUE (uid),
    UNIQUE (module_frame_id)
);

CREATE INDEX idx_module_frame_system_characteristic_defaults_mf_id
    ON compliance.module_frame_system_characteristic_defaults (module_frame_id);

GRANT SELECT, INSERT, UPDATE, DELETE ON compliance.module_frame_system_characteristic_defaults TO cm_app;
GRANT USAGE, SELECT ON SEQUENCE compliance.module_frame_system_characteristic_defaults_id_seq TO cm_app;

# 1. branch + working tree
cd ~/Projects/Billows/Audit-Manager/compliance-manager-be
git branch --show-current
# 預期：feature/mf-template-defaults-phase2 (由 user 先 checkout)

git status --short
# 預期：working tree 乾淨（或只有 dev-only 改動如 pyproject.toml path dep）

# 2. BE listener
lsof -t -i:8000 && echo "BE up" || echo "BE down"
# 後面 Phase 1 跑完要重啟，現在不一定要 up

# 3. 既有 pytest 通過
poetry run pytest tests/ -q
# 預期：234+ tests pass

# 4. DB 連線（cmmgr）
PGPASSWORD='jedi@123!' psql -h 192.168.50.188 -p 25432 -U cmmgr -d guidant_ai_dev -c "SELECT 1"
# 預期：?column? = 1

# 5. FE repo branch
cd ~/Projects/Billows/Audit-Manager/compliance-manager-fe
git branch --show-current
# 預期：feature/mf-template-defaults-phase2 (由 user 先 checkout)
git status --short
# 預期：working tree 乾淨

# A. 確認 4 張新表確實不存在
PGPASSWORD='jedi@123!' psql -h 192.168.50.188 -p 25432 -U cmmgr -d guidant_ai_dev -A -c "
SET app.is_super_admin='t';
SELECT table_name FROM information_schema.tables
 WHERE table_schema='compliance' AND table_name LIKE 'module_frame_%default%' ORDER BY table_name;
"
# 預期：只有 control_defaults, control_objective_defaults, reference_documents, reference_document_mappings (4 row)

# B. 確認既有 ModuleFrameTemplateCopyService.copy 只 cover control / AO / refdoc
grep -nE 'def copy|def _copy_|component|leveraged|inventory|system_characteristic' \
  ~/Projects/Billows/Audit-Manager/compliance-manager-be/app/module_frame/service/module_frame_template_copy_service.py
# 預期：完全沒看到 component/leveraged/inventory/system_characteristic 相關 method

# C. 確認既有 mf-side leveraged endpoint 是 hack（走 profile_id → ssp.get_one）
grep -nA 3 'def _resolve_ssp_id' \
  ~/Projects/Billows/Audit-Manager/compliance-manager-be/app/module_frame/service/module_frame_leveraged_service.py
# 預期：看到 profile_id → ssp.get_one(profile_id=...)

# D. 確認 FE SspComponentsLeveragedInventoryTab.vue 只接 sspUid props
grep -nE 'defineProps|sspService\.|apiBase' \
  ~/Projects/Billows/Audit-Manager/compliance-manager-fe/src/components/grc/ssp/SspComponentsLeveragedInventoryTab.vue | head -15
# 預期：props 只有 sspUid，9 個 sspService.* API call 寫死

# E. 確認 既有 mf control_default 套件 7 個檔案存在
ls ~/Projects/Billows/Audit-Manager/compliance-manager-be/{infra,domain,app,api}/module_frame/**/module_frame_control_default*.py 2>/dev/null | wc -l
# 預期：11 files (含 dto / route 等)

-- Date: YYYY-MM-DD
-- Module Frame Template Defaults Phase 2 — 補 4 張 mf-scoped default 表
-- (component / leveraged_authorization / inventory_item / system_characteristic)
--
-- 參考 docs/features/FR-018.2-2605-module-frame-template-defaults-phase2/design.md §3

BEGIN;

-- 1. module_frame_component_defaults (YYYY-MM-DD)
CREATE TABLE compliance.module_frame_component_defaults (
    id                            SERIAL PRIMARY KEY,
    uid                           UUID NOT NULL DEFAULT gen_random_uuid(),
    module_frame_id               INTEGER NOT NULL,
    component_type                VARCHAR NOT NULL,
    title                         VARCHAR NOT NULL,
    description                   TEXT,
    purpose                       TEXT,
    status                        VARCHAR,
    leveraged_authorization_uid   UUID,
    props                         JSONB,
    created_at                    TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
    updated_at                    TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
    created_user                  VARCHAR,
    updated_user                  VARCHAR,
    UNIQUE (uid),
    UNIQUE (module_frame_id, title, component_type)
);
CREATE INDEX idx_module_frame_component_defaults_mf_id
    ON compliance.module_frame_component_defaults (module_frame_id);
GRANT SELECT, INSERT, UPDATE, DELETE ON compliance.module_frame_component_defaults TO cm_app;
GRANT USAGE, SELECT ON SEQUENCE compliance.module_frame_component_defaults_id_seq TO cm_app;

-- 2. module_frame_leveraged_authorization_defaults (YYYY-MM-DD)
CREATE TABLE compliance.module_frame_leveraged_authorization_defaults (
    id                  SERIAL PRIMARY KEY,
    uid                 UUID NOT NULL DEFAULT gen_random_uuid(),
    module_frame_id     INTEGER NOT NULL,
    title               VARCHAR NOT NULL,
    party_uuid          UUID,
    date_authorized     DATE,
    props               JSONB,
    remarks             TEXT,
    created_at          TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
    updated_at          TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
    created_user        VARCHAR,
    updated_user        VARCHAR,
    UNIQUE (uid),
    UNIQUE (module_frame_id, title)
);
CREATE INDEX idx_module_frame_leveraged_authorization_defaults_mf_id
    ON compliance.module_frame_leveraged_authorization_defaults (module_frame_id);
GRANT SELECT, INSERT, UPDATE, DELETE ON compliance.module_frame_leveraged_authorization_defaults TO cm_app;
GRANT USAGE, SELECT ON SEQUENCE compliance.module_frame_leveraged_authorization_defaults_id_seq TO cm_app;

-- 3. module_frame_inventory_item_defaults (YYYY-MM-DD)
CREATE TABLE compliance.module_frame_inventory_item_defaults (
    id                  SERIAL PRIMARY KEY,
    uid                 UUID NOT NULL DEFAULT gen_random_uuid(),
    module_frame_id     INTEGER NOT NULL,
    description         TEXT NOT NULL,
    props               JSONB,
    created_at          TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
    updated_at          TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
    created_user        VARCHAR,
    updated_user        VARCHAR,
    UNIQUE (uid)
);
CREATE INDEX idx_module_frame_inventory_item_defaults_mf_id
    ON compliance.module_frame_inventory_item_defaults (module_frame_id);
GRANT SELECT, INSERT, UPDATE, DELETE ON compliance.module_frame_inventory_item_defaults TO cm_app;
GRANT USAGE, SELECT ON SEQUENCE compliance.module_frame_inventory_item_defaults_id_seq TO cm_app;

-- 4. module_frame_system_characteristic_defaults (YYYY-MM-DD)
CREATE TABLE compliance.module_frame_system_characteristic_defaults (
    id                            SERIAL PRIMARY KEY,
    uid                           UUID NOT NULL DEFAULT gen_random_uuid(),
    module_frame_id               INTEGER NOT NULL,
    name                          VARCHAR NOT NULL,
    description                   TEXT,
    system_identifier             VARCHAR,
    security_sensitivity_level    VARCHAR,
    target_type                   VARCHAR,
    scope_description             TEXT,
    status                        VARCHAR,
    owner_uid                     VARCHAR,
    created_at                    TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
    updated_at                    TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
    created_user                  VARCHAR,
    updated_user                  VARCHAR,
    UNIQUE (uid),
    UNIQUE (module_frame_id)
);
CREATE INDEX idx_module_frame_system_characteristic_defaults_mf_id
    ON compliance.module_frame_system_characteristic_defaults (module_frame_id);
GRANT SELECT, INSERT, UPDATE, DELETE ON compliance.module_frame_system_characteristic_defaults TO cm_app;
GRANT USAGE, SELECT ON SEQUENCE compliance.module_frame_system_characteristic_defaults_id_seq TO cm_app;

COMMIT;

cd ~/Projects/Billows/Audit-Manager/compliance-manager-be
PGPASSWORD='jedi@123!' psql -h 192.168.50.188 -p 25432 -U cmmgr -d guidant_ai_dev \
  -f scripts/sql/YYYY-MM-DD-mf-template-defaults-phase2.sql

PGPASSWORD='jedi@123!' psql -h 192.168.50.188 -p 25432 -U cmmgr -d guidant_ai_dev -A -c "
SET app.is_super_admin='t';
SELECT table_name FROM information_schema.tables
 WHERE table_schema='compliance' AND table_name LIKE 'module_frame_%default%' ORDER BY table_name;
"

git add scripts/sql/YYYY-MM-DD-mf-template-defaults-phase2.sql
git commit -m "$(cat <<'EOF'
feat(mf-template-defaults-phase2): SQL migration — 4 張 mf-scoped default 表

新增 4 張 compliance.module_frame_*_defaults 表，補齊 schema 對稱性：
- module_frame_component_defaults
- module_frame_leveraged_authorization_defaults
- module_frame_inventory_item_defaults
- module_frame_system_characteristic_defaults

詳見 docs/features/FR-018.2-2605-module-frame-template-defaults-phase2/design.md §3。

下一步：Phase 2 加 BE entity/repo/service 4 套。

Co-Authored-By: Claude Sonnet (1M context) <noreply@anthropic.com>
EOF
)"

"""SQLAlchemy ORM model for compliance.module_frame_component_defaults."""
import uuid
from datetime import datetime
from sqlalchemy import Column, DateTime, ForeignKey, Integer, String, Text, UniqueConstraint
from sqlalchemy.dialects.postgresql import JSONB, UUID

from jedi_common.session.database.base_model import Base


class ModuleFrameComponentDefault(Base):
    __tablename__ = "module_frame_component_defaults"
    __table_args__ = (
        UniqueConstraint("uid", name="module_frame_component_defaults_uid_key"),
        UniqueConstraint(
            "module_frame_id", "title", "component_type",
            name="module_frame_component_defaults_mf_title_type_key",
        ),
        {"schema": "compliance"},
    )

    id = Column(Integer, primary_key=True)
    uid = Column(UUID(as_uuid=True), nullable=False, default=uuid.uuid4)
    module_frame_id = Column(Integer, nullable=False)
    component_type = Column(String, nullable=False)
    title = Column(String, nullable=False)
    description = Column(Text)
    purpose = Column(Text)
    status = Column(String)
    leveraged_authorization_uid = Column(UUID(as_uuid=True))
    props = Column(JSONB)
    created_at = Column(DateTime(timezone=True), nullable=False, default=datetime.utcnow)
    updated_at = Column(DateTime(timezone=True), nullable=False, default=datetime.utcnow, onupdate=datetime.utcnow)
    created_user = Column(String)
    updated_user = Column(String)

"""Domain entity for ModuleFrame component default."""
import uuid
from datetime import datetime
from typing import Optional


class ModuleFrameComponentDefaultEntity:
    def __init__(
        self,
        id: Optional[int] = None,
        uid: Optional[uuid.UUID] = None,
        module_frame_id: Optional[int] = None,
        component_type: Optional[str] = None,
        title: Optional[str] = None,
        description: Optional[str] = None,
        purpose: Optional[str] = None,
        status: Optional[str] = None,
        leveraged_authorization_uid: Optional[uuid.UUID] = None,
        props: Optional[dict] = None,
        created_at: Optional[datetime] = None,
        updated_at: Optional[datetime] = None,
        created_user: Optional[str] = None,
        updated_user: Optional[str] = None,
    ):
        self.id = id
        self.uid = uid
        self.module_frame_id = module_frame_id
        self.component_type = component_type
        self.title = title
        self.description = description
        self.purpose = purpose
        self.status = status
        self.leveraged_authorization_uid = leveraged_authorization_uid
        self.props = props
        self.created_at = created_at
        self.updated_at = updated_at
        self.created_user = created_user
        self.updated_user = updated_user

"""Query entity for ModuleFrame component default filtering."""
import uuid
from typing import Optional


class ModuleFrameComponentDefaultQueryEntity:
    def __init__(
        self,
        id: Optional[int] = None,
        uid: Optional[uuid.UUID] = None,
        module_frame_id: Optional[int] = None,
        component_type: Optional[str] = None,
        title: Optional[str] = None,
    ):
        self.id = id
        self.uid = uid
        self.module_frame_id = module_frame_id
        self.component_type = component_type
        self.title = title

"""model ↔ entity mapper for ModuleFrameComponentDefault."""
from typing import List, Optional

from domain.module_frame.entity.module_frame_component_default_entity import (
    ModuleFrameComponentDefaultEntity,
)
from infra.module_frame.models.module_frame_component_default import (
    ModuleFrameComponentDefault,
)


class ModuleFrameComponentDefaultMapper:
    @staticmethod
    def to_entity(model: ModuleFrameComponentDefault) -> ModuleFrameComponentDefaultEntity:
        return ModuleFrameComponentDefaultEntity(
            id=model.id,
            uid=model.uid,
            module_frame_id=model.module_frame_id,
            component_type=model.component_type,
            title=model.title,
            description=model.description,
            purpose=model.purpose,
            status=model.status,
            leveraged_authorization_uid=model.leveraged_authorization_uid,
            props=model.props,
            created_at=model.created_at,
            updated_at=model.updated_at,
            created_user=model.created_user,
            updated_user=model.updated_user,
        )

    @staticmethod
    def to_list_entity(models: List[ModuleFrameComponentDefault]) -> List[ModuleFrameComponentDefaultEntity]:
        return [ModuleFrameComponentDefaultMapper.to_entity(m) for m in models]

    @staticmethod
    def to_model(
        entity: ModuleFrameComponentDefaultEntity,
        model: Optional[ModuleFrameComponentDefault] = None,
    ) -> ModuleFrameComponentDefault:
        m = model or ModuleFrameComponentDefault()
        if entity.uid is not None:
            m.uid = entity.uid
        m.module_frame_id = entity.module_frame_id
        m.component_type = entity.component_type
        m.title = entity.title
        m.description = entity.description
        m.purpose = entity.purpose
        m.status = entity.status
        m.leveraged_authorization_uid = entity.leveraged_authorization_uid
        m.props = entity.props
        if entity.created_user is not None:
            m.created_user = entity.created_user
        if entity.updated_user is not None:
            m.updated_user = entity.updated_user
        return m

"""Abstract repo interface for ModuleFrameComponentDefault."""
from abc import abstractmethod
from typing import List, Optional

from jedi_common.session.database.repository.base_repository import IBaseRepository

from domain.module_frame.entity.module_frame_component_default_entity import (
    ModuleFrameComponentDefaultEntity,
)
from domain.module_frame.entity.module_frame_component_default_query_entity import (
    ModuleFrameComponentDefaultQueryEntity,
)


class IModuleFrameComponentDefaultRepo(IBaseRepository[
    ModuleFrameComponentDefaultEntity,
    ModuleFrameComponentDefaultQueryEntity,
]):
    @abstractmethod
    def get_by_uid(self, uid: str) -> Optional[ModuleFrameComponentDefaultEntity]:
        ...

    @abstractmethod
    def get_all_by_mf_id(self, module_frame_id: int) -> List[ModuleFrameComponentDefaultEntity]:
        ...

    @abstractmethod
    def delete_by_uid(self, uid: str) -> bool:
        ...

# Add to ModuleFrameContainer providers (位置在既有 module_frame_control_default_domain_service 後面)
module_frame_component_default_repo = providers.Singleton(
    ModuleFrameComponentDefaultRepoImpl,
)
module_frame_component_default_domain_service = providers.Factory(
    ModuleFrameComponentDefaultDomainService,
    repo=module_frame_component_default_repo,
)

"""Unit tests for ModuleFrameComponentDefaultDomainService."""
from unittest.mock import MagicMock
from types import SimpleNamespace
import pytest

from domain.module_frame.entity.module_frame_component_default_entity import (
    ModuleFrameComponentDefaultEntity,
)
from domain.module_frame.entity.module_frame_component_default_query_entity import (
    ModuleFrameComponentDefaultQueryEntity,
)
from domain.module_frame.service.module_frame_component_default_domain_service import (
    ModuleFrameComponentDefaultDomainService,
)


@pytest.fixture
def mock_repo():
    return MagicMock()


@pytest.fixture
def service(mock_repo):
    return ModuleFrameComponentDefaultDomainService(repo=mock_repo)


def test_add(service, mock_repo):
    entity = ModuleFrameComponentDefaultEntity(
        module_frame_id=343, component_type="service",
        title="Test Component", description="Test desc",
        created_user="alice",
    )
    mock_repo.add.return_value = SimpleNamespace(id=1, uid="mock-uid", **entity.__dict__)
    result = service.add(entity)
    mock_repo.add.assert_called_once_with(entity)
    assert result.id == 1


def test_get_all_by_mf_id(service, mock_repo):
    mock_repo.get_all_by_mf_id.return_value = [
        SimpleNamespace(id=1, title="Comp A"),
        SimpleNamespace(id=2, title="Comp B"),
    ]
    result = service.get_all_by_mf_id(343)
    assert len(result) == 2


def test_delete_by_uid(service, mock_repo):
    mock_repo.delete_by_uid.return_value = True
    assert service.delete_by_uid("test-uid") is True

poetry run pytest tests/test_module_frame_component_default_domain_service.py \
                  tests/test_module_frame_leveraged_authorization_default_domain_service.py \
                  tests/test_module_frame_inventory_item_default_domain_service.py \
                  tests/test_module_frame_system_characteristic_default_domain_service.py \
                  -q
# 預期：全 pass

git add infra/module_frame/{models,mapper,repository}/module_frame_component_default*.py \
        domain/module_frame/{entity,repository,service}/module_frame_component_default*.py \
        di_containers/module_frame/module_frame_containers.py \
        tests/test_module_frame_component_default_domain_service.py

git commit -m "feat(mf-template-defaults-phase2): add component_default entity + repo + service

Module Frame Component Default 7 個檔案 + DI wire + unit test。
詳見 docs/features/FR-018.2-2605-module-frame-template-defaults-phase2/design.md §2.A。

Co-Authored-By: Claude Sonnet (1M context) <noreply@anthropic.com>"

# Step 4 (Bug T Phase 2): 複製 mf leveraged_authorization defaults → ssp_leveraged_authorizations (INSERT)
# 必先於 Step 5 component（component 可能 ref leveraged_authorization_uid）。
# Build mf_la_uid → ssp_la_uid map 給 Step 5 用。
la_uid_map = {}
existing_la = session.execute(text("""
    INSERT INTO oscal.ssp_leveraged_authorizations (
        uid, ssp_id, title, party_uuid, date_authorized, props, remarks,
        tenant_id, created_user, updated_user, is_active
    )
    SELECT
        gen_random_uuid(),
        :ssp_id,
        mfld.title, mfld.party_uuid, mfld.date_authorized, mfld.props, mfld.remarks,
        :tenant_id, :curr_user, :curr_user, true
    FROM compliance.module_frame_leveraged_authorization_defaults mfld
    WHERE mfld.module_frame_id = :mf_id
    RETURNING uid, (SELECT mfld.uid FROM compliance.module_frame_leveraged_authorization_defaults mfld
                     WHERE mfld.module_frame_id = :mf_id
                       AND mfld.title = oscal.ssp_leveraged_authorizations.title LIMIT 1) AS mf_la_uid
"""), {"mf_id": module_frame_id, "ssp_id": ssp_id, "tenant_id": tenant_id, "curr_user": curr_user})
# Build mf_la_uid → ssp_la_uid map
for row in existing_la:
    la_uid_map[str(row.mf_la_uid)] = str(row.uid)
la_count = len(la_uid_map)

# 兩段式更安全版本
from sqlalchemy import text

# Step 4a: SELECT mf-default leveraged
mf_la_rows = session.execute(text("""
    SELECT uid, title, party_uuid, date_authorized, props, remarks
      FROM compliance.module_frame_leveraged_authorization_defaults
     WHERE module_frame_id = :mf_id
     ORDER BY id
"""), {"mf_id": module_frame_id}).mappings().all()

# Step 4b: For each, INSERT into oscal.ssp_leveraged_authorizations + build map
la_uid_map = {}
for mf_la in mf_la_rows:
    result = session.execute(text("""
        INSERT INTO oscal.ssp_leveraged_authorizations (
            uid, ssp_id, title, party_uuid, date_authorized, props, remarks,
            tenant_id, created_user, updated_user, is_active
        )
        VALUES (
            gen_random_uuid(), :ssp_id, :title, :party_uuid, :date_authorized,
            CAST(:props AS jsonb), :remarks,
            :tenant_id, :curr_user, :curr_user, true
        )
        RETURNING uid
    """), {
        "ssp_id": ssp_id,
        "title": mf_la["title"],
        "party_uuid": mf_la["party_uuid"],
        "date_authorized": mf_la["date_authorized"],
        "props": json.dumps(mf_la["props"]) if mf_la["props"] else None,
        "remarks": mf_la["remarks"],
        "tenant_id": tenant_id,
        "curr_user": curr_user,
    }).scalar()
    la_uid_map[str(mf_la["uid"])] = str(result)
la_count = len(la_uid_map)

# Step 5 (Bug T Phase 2): 複製 mf component defaults → ssp_components (INSERT)
# leveraged_authorization_uid 用 la_uid_map 從 mf-default uid 翻成新建的 ssp uid。
mf_comp_rows = session.execute(text("""
    SELECT uid, component_type, title, description, purpose, status,
           leveraged_authorization_uid, props
      FROM compliance.module_frame_component_defaults
     WHERE module_frame_id = :mf_id
     ORDER BY id
"""), {"mf_id": module_frame_id}).mappings().all()

comp_count = 0
for mf_comp in mf_comp_rows:
    translated_la_uid = None
    if mf_comp["leveraged_authorization_uid"]:
        translated_la_uid = la_uid_map.get(str(mf_comp["leveraged_authorization_uid"]))
        if translated_la_uid is None:
            logger.warning(
                "[mf-template-copy] component '%s' refs leveraged_authorization_uid=%s "
                "but no mf_la_uid->ssp_la_uid mapping (mf-default 內 leveraged 已被 user 刪？) — set NULL",
                mf_comp["title"], mf_comp["leveraged_authorization_uid"],
            )
    session.execute(text("""
        INSERT INTO oscal.ssp_components (
            uid, ssp_id, component_type, title, description, purpose, status,
            leveraged_authorization_uid, props,
            tenant_id, created_user, updated_user, is_active
        )
        VALUES (
            gen_random_uuid(), :ssp_id, :component_type, :title, :description, :purpose, :status,
            :leveraged_authorization_uid, CAST(:props AS jsonb),
            :tenant_id, :curr_user, :curr_user, true
        )
    """), {
        "ssp_id": ssp_id,
        "component_type": mf_comp["component_type"],
        "title": mf_comp["title"],
        "description": mf_comp["description"],
        "purpose": mf_comp["purpose"],
        "status": mf_comp["status"],
        "leveraged_authorization_uid": translated_la_uid,
        "props": json.dumps(mf_comp["props"]) if mf_comp["props"] else None,
        "tenant_id": tenant_id,
        "curr_user": curr_user,
    })
    comp_count += 1

# Step 6 (Bug T Phase 2): 複製 mf inventory defaults → ssp_inventory_items (INSERT, 無 cross-ref)
inv_result = session.execute(text("""
    INSERT INTO oscal.ssp_inventory_items (
        uid, ssp_id, description, props,
        tenant_id, created_user, updated_user, is_active
    )
    SELECT
        gen_random_uuid(),
        :ssp_id,
        mfid.description, mfid.props,
        :tenant_id, :curr_user, :curr_user, true
      FROM compliance.module_frame_inventory_item_defaults mfid
     WHERE mfid.module_frame_id = :mf_id
"""), {"mf_id": module_frame_id, "ssp_id": ssp_id, "tenant_id": tenant_id, "curr_user": curr_user})
inv_count = inv_result.rowcount

# Step 7 (Bug T Phase 2): 複製 mf system_characteristic default → SSP SC (UPDATE in place)
# Step 7.5 已建 SC 空殼 row，這邊 UPDATE 把 mf default 值填進去。
sc_result = session.execute(text("""
    UPDATE oscal.system_security_plans_system_characteristics sc
       SET
         name = COALESCE(mfsc.name, sc.name),
         description = COALESCE(mfsc.description, sc.description),
         system_identifier = COALESCE(mfsc.system_identifier, sc.system_identifier),
         security_sensitivity_level = COALESCE(mfsc.security_sensitivity_level, sc.security_sensitivity_level),
         target_type = COALESCE(mfsc.target_type, sc.target_type),
         scope_description = COALESCE(mfsc.scope_description, sc.scope_description),
         status = COALESCE(mfsc.status, sc.status),
         owner_uid = COALESCE(mfsc.owner_uid, sc.owner_uid),
         updated_user = :curr_user,
         updated_at = now()
      FROM compliance.module_frame_system_characteristic_defaults mfsc
     WHERE mfsc.module_frame_id = :mf_id
       AND sc.system_security_plan_id = :ssp_id
"""), {"mf_id": module_frame_id, "ssp_id": ssp_id, "curr_user": curr_user})
sc_updated = sc_result.rowcount

return {
    "controls_updated": controls_updated,
    "objectives_updated": objectives_updated,
    # Phase 2 新增:
    "leveraged_inserted": la_count,
    "components_inserted": comp_count,
    "inventory_inserted": inv_count,
    "system_characteristic_updated": sc_updated,
}

"""Phase 2 tests for ModuleFrameTemplateCopyService — 確認 Step 4-7 4 個新 copy step."""
# 用 fixtures + mock session 驗證 SQL 跑通 / row count 正確
# 詳細 test code sonnet 依既有 test pattern 寫

git add app/module_frame/service/module_frame_template_copy_service.py \
        tests/test_module_frame_template_copy_service_phase2.py

git commit -m "feat(mf-template-defaults-phase2): copy_service 加 Step 4-7

擴充 ModuleFrameTemplateCopyService.copy() 加 4 個新 step:
- Step 4: copy mf_leveraged_authorization_defaults → ssp_leveraged_authorizations
- Step 5: copy mf_component_defaults → ssp_components (用 la_uid_map 翻譯 ref)
- Step 6: copy mf_inventory_item_defaults → ssp_inventory_items
- Step 7: UPDATE ssp.system_characteristic from mf_system_characteristic_defaults

OSCAL project 啟動時，這 4 個 tab default 也從 mf-template 帶到 project SSP。

詳見 design.md §3.1。

Co-Authored-By: Claude Sonnet (1M context) <noreply@anthropic.com>"

"""ModuleFrame leveraged-authorization service (Bug T Phase 2 — mf-scoped storage)。

之前版本 (Track A, 2026-05-23) 是 hack：mf → profile_id → ssp.get_one → 寫 SSP 子表。
本期 Phase 2 改用 compliance.module_frame_leveraged_authorization_defaults 表
(mf-scoped storage)，徹底解掉「廢物 SSP 累積」+「user 寫的看不到」bug。

Used by `/module-frame/<uid>/leveraged` REST endpoints.
"""
import uuid
from typing import Optional

from jedi_common.handler.exception import NotFound
from jedi_common.session.database.db import transaction

from common.code.grc_error_code import GrcErrorCode
from domain.module_frame.entity.module_frame_leveraged_authorization_default_entity import (
    ModuleFrameLeveragedAuthorizationDefaultEntity,
)
from domain.module_frame.service.module_frame_leveraged_authorization_default_domain_service import (
    ModuleFrameLeveragedAuthorizationDefaultDomainService,
)


class ModuleFrameLeveragedService:
    def __init__(
        self,
        module_frame_domain_service=None,
        mf_la_default_domain_service: ModuleFrameLeveragedAuthorizationDefaultDomainService = None,
    ):
        self._mf = module_frame_domain_service
        self._svc = mf_la_default_domain_service

    @transaction
    def list_items(self, module_frame_uid: str) -> list[dict]:
        mf = self._require_mf(module_frame_uid)
        entities = self._svc.get_all_by_mf_id(mf.id)
        return [self._to_dict(e) for e in entities]

    @transaction
    def add_item(self, module_frame_uid: str, payload: dict, user: str) -> dict:
        mf = self._require_mf(module_frame_uid)
        entity = ModuleFrameLeveragedAuthorizationDefaultEntity(
            module_frame_id=mf.id,
            title=payload.get("title", ""),
            party_uuid=payload.get("party_uuid"),
            date_authorized=payload.get("date_authorized"),
            props=payload.get("props"),
            remarks=payload.get("remarks"),
            created_user=user,
            updated_user=user,
        )
        added = self._svc.add(entity)
        return self._to_dict(added)

    @transaction
    def update_item(
        self, module_frame_uid: str, item_uid: str, payload: dict, user: str,
    ) -> dict:
        mf = self._require_mf(module_frame_uid)
        existing = self._svc.get_by_uid(item_uid)
        if existing is None or existing.module_frame_id != mf.id:
            raise NotFound(GrcErrorCode.GRC_SSP_RESOURCE_NOT_FOUND)
        # Apply patch
        for k in ("title", "party_uuid", "date_authorized", "props", "remarks"):
            if k in payload:
                setattr(existing, k, payload[k])
        existing.updated_user = user
        updated = self._svc.update(existing)
        return self._to_dict(updated)

    @transaction
    def delete_item(self, module_frame_uid: str, item_uid: str) -> None:
        mf = self._require_mf(module_frame_uid)
        existing = self._svc.get_by_uid(item_uid)
        if existing is None or existing.module_frame_id != mf.id:
            raise NotFound(GrcErrorCode.GRC_SSP_RESOURCE_NOT_FOUND)
        self._svc.delete_by_uid(item_uid)

    # ─── internals ──────────────────────────────────────────────────
    def _require_mf(self, module_frame_uid: str):
        mf = self._mf.get_module_frame_by_uid(module_frame_uid)
        if mf is None:
            raise NotFound(GrcErrorCode.GRC_MODULE_FRAME_NOT_FOUND)
        return mf

    @staticmethod
    def _to_dict(entity) -> dict:
        return {
            "uid": str(entity.uid) if entity.uid else None,
            "title": entity.title,
            "party_uuid": str(entity.party_uuid) if entity.party_uuid else None,
            "date_authorized": entity.date_authorized.isoformat() if entity.date_authorized else None,
            "props": entity.props,
            "remarks": entity.remarks,
            "created_user": entity.created_user,
            "updated_user": entity.updated_user,
        }

git commit -m "feat(mf-template-defaults-phase2): ModuleFrameLeveragedService 改用 mf-default

之前 hack 走 profile_id → SSP；改用 compliance.module_frame_leveraged_authorization_defaults
mf-scoped 表。

詳見 design.md §4.1。

Co-Authored-By: Claude Sonnet (1M context) <noreply@anthropic.com>"

"""ModuleFrame components routes — `/module-frame/<uid>/components` CRUD."""
from dependency_injector.wiring import Provide, inject
from flask import request
from flask_apispec import MethodResource, doc
from flask_jwt_extended import jwt_required
from jedi_common.session.auth.auth_context import get_user_context

from app.module_frame.service.module_frame_components_service import (
    ModuleFrameComponentsService,
)
from common.util.response_util import return_response
from di_containers.containers import Containers


class ModuleFrameComponentsListResource(MethodResource):
    @doc(description="List components for this module_frame", tags=["ModuleFrame"])
    @jwt_required()
    @inject
    def get(
        self,
        uid: str,
        service: ModuleFrameComponentsService = Provide[
            Containers.oscal_container.module_frame_components_service
        ],
    ):
        result = service.list_items(uid)
        return return_response(True, result)

    @doc(description="Add a component", tags=["ModuleFrame"])
    @jwt_required()
    @inject
    def post(
        self,
        uid: str,
        service: ModuleFrameComponentsService = Provide[
            Containers.oscal_container.module_frame_components_service
        ],
    ):
        user = get_user_context().login_name
        payload = request.get_json(silent=True) or {}
        result = service.add_item(uid, payload, user)
        return return_response(True, result)


class ModuleFrameComponentsItemResource(MethodResource):
    @doc(description="Update a component", tags=["ModuleFrame"])
    @jwt_required()
    @inject
    def put(
        self,
        uid: str,
        item_uid: str,
        service: ModuleFrameComponentsService = Provide[
            Containers.oscal_container.module_frame_components_service
        ],
    ):
        user = get_user_context().login_name
        payload = request.get_json(silent=True) or {}
        result = service.update_item(uid, item_uid, payload, user)
        return return_response(True, result)

    @doc(description="Delete a component", tags=["ModuleFrame"])
    @jwt_required()
    @inject
    def delete(
        self,
        uid: str,
        item_uid: str,
        service: ModuleFrameComponentsService = Provide[
            Containers.oscal_container.module_frame_components_service
        ],
    ):
        service.delete_item(uid, item_uid)
        return return_response(True, None)

from api.module_frame.routes.module_frame_components_route import (
    ModuleFrameComponentsItemResource,
    ModuleFrameComponentsListResource,
)

# (在既有 add_resource 附近加)
api.add_resource(ModuleFrameComponentsListResource,
    '/module-frame/<string:uid>/components')
api.add_resource(ModuleFrameComponentsItemResource,
    '/module-frame/<string:uid>/components/<string:item_uid>')

head -300 ~/Projects/Billows/Audit-Manager/compliance-manager-fe/CLAUDE.md

// 舊
import SspComponentsLeveragedInventoryTab from '@/components/grc/ssp/SspComponentsLeveragedInventoryTab.vue'
// 新
import ModuleFrameComponentsLeveragedInventoryTab from '@/components/grc/module-frame/ModuleFrameComponentsLeveragedInventoryTab.vue'

cd ~/Projects/Billows/Audit-Manager/compliance-manager-fe
npm run build:DEV
# 預期：build success no error

git -C ~/Projects/Billows/Audit-Manager/compliance-manager-fe add \
  src/components/grc/module-frame/ModuleFrameComponentsLeveragedInventoryTab.vue \
  src/service/ModuleFrameService.js \
  src/views/module_frame/ModuleFrameTemplateEditView.vue

git -C ~/Projects/Billows/Audit-Manager/compliance-manager-fe commit -m "feat(mf-template-defaults-phase2): new mf-side components/leveraged/inventory tab

新建 ModuleFrameComponentsLeveragedInventoryTab.vue 取代既有
SspComponentsLeveragedInventoryTab reuse — 走 mf-side endpoint
(/module-frame/<uid>/components|leveraged|inventory) 不再用 sspUid。

BE 側對應 endpoint 由 BE repo Phase 4 提供。

詳見 BE design.md §5。

Co-Authored-By: Claude Sonnet (1M context) <noreply@anthropic.com>"

def _run_v2_bundle_confirm(self, parsed_result, effective_source_uid, source_type, user_context, log_ctx):
    """Bug T Phase 2 (2026-05-XX): mf source 改走 mf-default 表，不再用 ensure_shell。"""
    if source_type == "module_frame":
        return self._run_mf_default_confirm(
            parsed_result, effective_source_uid, user_context, log_ctx,
        )
    elif source_type == "project_ssp":
        # 既有 SSP 路徑保留 (project SSP 仍寫 oscal.ssp_*)
        return self._run_v2_bundle_confirm_legacy_ssp(
            parsed_result, effective_source_uid, user_context, log_ctx,
        )
    else:
        logger.warning(
            "_run_v2_bundle_confirm: unknown source_type=%s — skipping",
            source_type,
        )
        return {"written_las": 0, "written_components": 0, "written_inventory": 0, "warnings_added": 0}


def _run_mf_default_confirm(self, parsed_result, mf_uid, user_context, log_ctx):
    """Bug T Phase 2: docx import 對 mf source — 寫 compliance.module_frame_*_defaults
    表，不走 SspShellService.ensure_shell (不建 SSP shell)。

    parsed_result 內 components / leveraged / inventory / system_characteristic 直接
    bulk INSERT / UPSERT 到對應 mf-default 表。
    """
    self._safe_log_info(
        "[mf-default-confirm] enter mf_uid=%s parsed_components=%d parsed_la=%d "
        "parsed_inv=%d sc=%s",
        mf_uid,
        len(parsed_result.get("components") or []),
        len(parsed_result.get("leveraged_authorizations") or []),
        len(parsed_result.get("inventory_items") or []),
        "present" if parsed_result.get("system_characteristic") else "None",
    )

    # Resolve mf_id
    mf = self._mf_domain_service.get_module_frame_by_uid(mf_uid)
    if mf is None:
        raise NotFound(GrcErrorCode.GRC_MODULE_FRAME_NOT_FOUND)

    # Stats
    written_las = 0
    written_components = 0
    written_inventory = 0
    sc_upserted = 0

    # 1. Leveraged authorizations — INSERT (upsert by (mf_id, title) unique)
    for la_dict in (parsed_result.get("leveraged_authorizations") or []):
        # upsert: if exists by (mf_id, title), update; else insert
        existing = self._mf_la_default_domain_service.get_by_mf_and_title(mf.id, la_dict.get("title"))
        # ... apply fields
        # use Domain service add/update
        written_las += 1

    # 2. Components — INSERT (upsert by (mf_id, title, component_type) unique)
    # ... 同 pattern
    
    # 3. Inventory items — INSERT (no unique constraint, always insert new)
    # ... 同 pattern

    # 4. System characteristic — UPSERT (mf_id unique, 1:1)
    # ... 同 pattern

    self._safe_log_info(
        "[mf-default-confirm] done mf_uid=%s written_las=%d written_components=%d "
        "written_inventory=%d sc_upserted=%d",
        mf_uid, written_las, written_components, written_inventory, sc_upserted,
    )
    return {
        "written_las": written_las,
        "written_components": written_components,
        "written_inventory": written_inventory,
        "warnings_added": 0,
    }

git commit -m "feat(mf-template-defaults-phase2): docx import 對 mf source 改寫 mf-default 表

ssp_docx_import_app_service._run_v2_bundle_confirm:
- mf source → 新 _run_mf_default_confirm() 寫 compliance.module_frame_*_defaults
- project_ssp source → 既有 path 保留 (寫 oscal.ssp_*)

不再走 SspShellService.ensure_shell — 廢物 SSP 累積 root cause 解掉。

詳見 design.md §6。

Co-Authored-By: Claude Sonnet (1M context) <noreply@anthropic.com>"

-- Date: YYYY-MM-DD
-- Bug T Phase 2 cleanup: mf 343 (b8065ad5, 艾爾航空) 資料遷移
--
-- 把 ssp 285 (本次 Bug T 第一輪 fix 後新建) 內的 4 components + 1 LA
-- 遷到 compliance.module_frame_component_defaults + _leveraged_authorization_defaults
-- 然後砍 mf 343 的 6 個 orphan SSP (280-285) 跟其子表
-- 219/228 保留 (legacy OSCAL project SSP)

BEGIN;

-- 1. 遷 285 的 leveraged_authorizations 到 mf-default (YYYY-MM-DD)
INSERT INTO compliance.module_frame_leveraged_authorization_defaults
    (module_frame_id, title, party_uuid, date_authorized, props, remarks, created_user, updated_user)
SELECT
    343, title, party_uuid, date_authorized, props, remarks, created_user, updated_user
  FROM oscal.ssp_leveraged_authorizations
 WHERE ssp_id = 285;

-- 2. 遷 285 的 components 到 mf-default
INSERT INTO compliance.module_frame_component_defaults
    (module_frame_id, component_type, title, description, purpose, status,
     leveraged_authorization_uid, props, created_user, updated_user)
SELECT
    343, component_type, title, description, purpose, status,
    leveraged_authorization_uid, props, created_user, updated_user
  FROM oscal.ssp_components
 WHERE ssp_id = 285;
-- NOTE: leveraged_authorization_uid 仍指 oscal.ssp_leveraged.uid (old) — 之後 mf-default
-- 內 leveraged_authorization_uid 校正 by mfla.title match
UPDATE compliance.module_frame_component_defaults c
   SET leveraged_authorization_uid = mfla.uid
  FROM compliance.module_frame_leveraged_authorization_defaults mfla,
       oscal.ssp_leveraged_authorizations sla
 WHERE c.module_frame_id = 343
   AND c.leveraged_authorization_uid = sla.uid
   AND sla.ssp_id = 285
   AND mfla.title = sla.title
   AND mfla.module_frame_id = 343;

-- 3. 砍 mf 343 的 6 個 orphan SSP (280-285) sys_impl
DELETE FROM oscal.ssp_system_implementations
 WHERE scope_type='ssp' AND scope_id IN (280,281,282,283,284,285);

-- 4. 砍 6 個 SSP (CASCADE 自動清 ssp_components / leveraged / inventory / SC / control_impl)
DELETE FROM oscal.system_security_plans
 WHERE id IN (280, 281, 282, 283, 284, 285);

-- 5. 不動 219/228 (legacy OSCAL project SSP, 保留)

COMMIT;

PGPASSWORD='jedi@123!' psql -h 192.168.50.188 -p 25432 -U cmmgr -d guidant_ai_dev \
  -f scripts/sql/YYYY-MM-DD-mf-343-data-migration.sql

SELECT count(*) FROM compliance.module_frame_component_defaults WHERE module_frame_id=343;
-- 預期 = 4

SELECT count(*) FROM compliance.module_frame_leveraged_authorization_defaults WHERE module_frame_id=343;
-- 預期 = 1

SELECT count(*) FROM oscal.system_security_plans
 WHERE id IN (280, 281, 282, 283, 284, 285);
-- 預期 = 0

SELECT id FROM oscal.system_security_plans WHERE template_module_frame_id=343;
-- 預期：只有 219, 228 (legacy project SSP, 留)