Add custom decision functions with visibility-level evaluation

Introduce decision functions as standalone WASM-based policy gates that
control whether a policy fires. Key components:

- Decision function CRUD API with Javy CLI compilation (JS → WASM)
- Query-time evaluation in PolicyHook via wasmtime (dynamic two-module linking)
- Visibility-level evaluation in EngineCache for column_deny/table_deny/column_allow
- evaluate_context="session" evaluates at both visibility and query time
- evaluate_context="query" skips visibility (deferred to query time)
- Robust stdout parsing (parse_stdout_result) handles Javy 8.x console.log
  routing to stdout without requiring WASM recompilation
- 4 migrations: decision_function table, name index, policy FK, wasm clear
- Admin UI integration: PolicyForm decision function selector, audit display
- 15 integration tests, 16 unit tests covering all DF scenarios

Author: jumpbetweenrows

Cargo.lock

@@ -20,12 +20,14 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     pkg-config \
     && rm -rf /var/lib/apt/lists/*
 
-# Copy workspace manifests and lockfile for dependency caching
+# Copy workspace manifests, lockfile, and build script for dependency caching
 COPY Cargo.toml Cargo.lock ./
 COPY proxy/Cargo.toml proxy/Cargo.toml
+COPY proxy/build.rs proxy/build.rs
 COPY migration/ migration/
 
 # Create a dummy binary so `cargo build` can cache dependencies
+# build.rs downloads Javy CLI and emits plugin.wasm (cached in OUT_DIR)
 RUN mkdir -p proxy/src && echo 'fn main() {}' > proxy/src/main.rs \
     && cargo build --release \
     && rm -rf proxy/src
@@ -47,7 +49,9 @@ FROM base AS builder
 
 COPY proxy/src proxy/src
 
-RUN cargo build --release
+RUN cargo build --release \
+    && cp target/release/javy /usr/local/bin/javy \
+    && cp target/release/engine.wasm /usr/local/lib/engine.wasm
 
 # ── prod: minimal runtime image ───────────────────────────────────────────────
 FROM debian:bookworm-slim AS prod
@@ -61,6 +65,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 RUN mkdir -p /data && chown -R 1000:1000 /data
 
 COPY --from=builder /app/target/release/proxy /usr/local/bin/proxy
+COPY --from=builder /usr/local/bin/javy /usr/local/bin/javy
+COPY --from=builder /usr/local/lib/engine.wasm /usr/local/lib/engine.wasm
 COPY --from=ui-builder /app/admin-ui/dist /usr/local/share/admin-ui
 
 ENV BR_PROXY_BIND_ADDR=0.0.0.0:5434

Dockerfile

@@ -23,6 +23,8 @@ React 19, Vite 6, Tailwind 4, TanStack Query 5, react-router-dom 7, Vitest 3, @t
 - `src/pages/AdminAuditPage.tsx` — Centralized admin audit log with filters (resource type, actor, date range)
 - `src/types/policy.ts` — TypeScript interfaces for policies, assignments (`PolicyType`, `AssignmentScope`, `TargetEntry`)
 - `src/types/role.ts` — TypeScript interfaces for roles, members, audit entries
+- `src/types/decisionFunction.ts` — TypeScript interfaces for decision functions (`DecisionFunction`, `DecisionFunctionCreate`, `DecisionFunctionUpdate`)
+- `src/api/decisionFunctions.ts` — API client functions for decision function CRUD (`listDecisionFunctions`, `getDecisionFunction`, `createDecisionFunction`, `updateDecisionFunction`, `deleteDecisionFunction`)
 - `src/test/test-utils.tsx` — `renderWithProviders` (QueryClient + AuthProvider + MemoryRouter)
 - `src/test/factories.ts` — `makeUser`, `makeDataSource`, `makeDataSourceType`, `makeDiscoveredSchema/Table/Column`
 

admin-ui/CLAUDE.md

@@ -9,7 +9,18 @@ export interface AuditLogEntry {
   datasource_name: string
   original_query: string
   rewritten_query: string | null
-  policies_applied: Array<{ policy_id: string; version: number; name: string }>
+  policies_applied: Array<{
+    policy_id: string
+    version: number
+    name: string
+    decision?: {
+      result?: { fire: boolean; fuel_consumed?: number; time_us?: number }
+      logs?: string[]
+      fuel_consumed?: number
+      time_us?: number
+      error?: string | null
+    }
+  }>
   execution_time_ms: number | null
   client_ip: string | null
   client_info: string | null

admin-ui/src/api/audit.ts

@@ -0,0 +1,39 @@
+import { client } from './client'
+import type {
+  DecisionFunctionResponse,
+  CreateDecisionFunctionPayload,
+  UpdateDecisionFunctionPayload,
+  TestDecisionFnPayload,
+  TestDecisionFnResponse,
+} from '../types/decisionFunction'
+
+export async function createDecisionFunction(
+  payload: CreateDecisionFunctionPayload,
+): Promise<DecisionFunctionResponse> {
+  const { data } = await client.post<DecisionFunctionResponse>('/decision-functions', payload)
+  return data
+}
+
+export async function getDecisionFunction(id: string): Promise<DecisionFunctionResponse> {
+  const { data } = await client.get<DecisionFunctionResponse>(`/decision-functions/${id}`)
+  return data
+}
+
+export async function updateDecisionFunction(
+  id: string,
+  payload: UpdateDecisionFunctionPayload,
+): Promise<DecisionFunctionResponse> {
+  const { data } = await client.put<DecisionFunctionResponse>(`/decision-functions/${id}`, payload)
+  return data
+}
+
+export async function deleteDecisionFunction(id: string): Promise<void> {
+  await client.delete(`/decision-functions/${id}`)
+}
+
+export async function testDecisionFn(
+  payload: TestDecisionFnPayload,
+): Promise<TestDecisionFnResponse> {
+  const { data } = await client.post<TestDecisionFnResponse>('/decision-functions/test', payload)
+  return data
+}