feat: 006 dashboard/AI evidence classification 및 deletion proof 구현

apps/api/src/dashboard/dashboard-evidence.controller.ts

@@ -0,0 +1,41 @@
+import type { AuthUser } from '@aegisai/shared';
+import {
+  Controller,
+  Get,
+  NotFoundException,
+  Param,
+  Query,
+  UseGuards
+} from '@nestjs/common';
+
+import { CurrentUser } from '../auth/decorators/current-user.decorator';
+import { SessionAuthGuard } from '../auth/guards/session-auth.guard';
+import { SastEvidenceAccessService } from '../scan-plane/sast-evidence-access.service';
+
+@Controller('dashboard/evidence')
+@UseGuards(SessionAuthGuard)
+export class DashboardEvidenceController {
+  constructor(
+    private readonly evidenceAccess: SastEvidenceAccessService
+  ) {}
+
+  @Get(':evidencePackId')
+  async getEvidence(
+    @CurrentUser() user: AuthUser,
+    @Param('evidencePackId') evidencePackId: string,
+    @Query('repositoryBindingId') repositoryBindingId: string
+  ) {
+    const result = await this.evidenceAccess.readDashboard({
+      tenantId: user.tenantId,
+      repositoryBindingId,
+      evidencePackId
+    });
+    if (result.outcome !== 'ALLOWED' || !result.dashboardEvidence) {
+      throw new NotFoundException({
+        message: 'Evidence is not available.',
+        errorCode: 'EVIDENCE_NOT_AVAILABLE'
+      });
+    }
+    return result.dashboardEvidence;
+  }
+}

apps/api/src/dashboard/dashboard.module.ts

@@ -3,12 +3,14 @@ import { Module } from '@nestjs/common';
 import { AuthModule } from '../auth/auth.module';
 import { ConfigModule } from '../config/config.module';
 import { PrismaModule } from '../prisma/prisma.module';
+import { ScanPlaneModule } from '../scan-plane/scan-plane.module';
+import { DashboardEvidenceController } from './dashboard-evidence.controller';
 import { DashboardController } from './dashboard.controller';
 import { DashboardService } from './dashboard.service';
 
 @Module({
-  imports: [AuthModule, ConfigModule, PrismaModule],
-  controllers: [DashboardController],
+  imports: [AuthModule, ConfigModule, PrismaModule, ScanPlaneModule],
+  controllers: [DashboardController, DashboardEvidenceController],
   providers: [DashboardService],
   exports: [DashboardService]
 })

apps/api/src/scan-plane/prisma-sast-accepted-evidence.store.ts

@@ -3,6 +3,7 @@ import { setTimeout as delay } from 'node:timers/promises';
 
 import {
   SAST_ACCEPTED_EVIDENCE_POLICY,
+  buildSastEvidenceDeletionSchedule,
   isSastAcceptedEvidenceBuildResultShapeValid,
   isSastFingerprintedFindingShapeValid,
   isSastScanCoverageDecisionShapeValid,
@@ -25,6 +26,7 @@ import {
   type PersistedSastAcceptedEvidence,
   type SastAcceptedEvidenceContext
 } from './sast-accepted-evidence.store';
+import { sastEvidenceAccessScopeFromResult } from './sast-evidence-access.store';
 
 const EVIDENCE_POLICY_VERSION = 'sast-evidence-policy-v1';
 const SERIALIZABLE_ATTEMPTS = 3;
@@ -211,6 +213,41 @@ export class PrismaSastAcceptedEvidenceStore
             createdAt: new Date(pack.createdAt)
           }))
         });
+        const deletionSchedule =
+          buildSastEvidenceDeletionSchedule({
+            scope: sastEvidenceAccessScopeFromResult(
+              input.result
+            ),
+            scheduledAt: pack.createdAt,
+            deleteAfter: pack.expiresAt,
+            digestCanonical: digest
+          });
+        await transaction.sastEvidenceDeletionSchedule.create({
+          data: {
+            id: deletionSchedule.deletionScheduleId,
+            operationId: deletionSchedule.operationId,
+            evidencePackId: pack.evidencePackId,
+            buildDecisionId: decision.buildDecisionId,
+            tenantId: scope.tenantId,
+            repositoryBindingId: scope.repositoryBindingId,
+            scanRequestId: scope.scanRequestId,
+            attemptId: scope.attemptId,
+            occurrenceId: scope.occurrenceId,
+            sourcePackDigest: pack.packDigest,
+            deleteAfter: new Date(pack.expiresAt),
+            scheduledAt: new Date(pack.createdAt),
+            schedule: json(deletionSchedule),
+            scheduleDigest: deletionSchedule.scheduleDigest,
+            createdAt: new Date(pack.createdAt),
+            claim: {
+              create: {
+                status: 'PENDING',
+                nextAttemptAt: new Date(pack.expiresAt),
+                attemptCount: 0
+              }
+            }
+          }
+        });
       }
       return {
         buildDecisionId: decision.buildDecisionId,