Function buildPIIStatus

core/http/routes/middleware.go:308–397

buildPIIStatus builds the pii section of /api/middleware/status. It walks every model config and reports the resolved enabled state plus the NER detector models each one references — that's what the admin page renders so the operator can see at a glance which models are protected and by which detect

(app *application.Application)

// (entity→action, min score) lives on each detector model's
// pii_detection block.
func buildPIIStatus(app *application.Application) map[string]any {
	appCfg := app.ApplicationConfig()
	models := []map[string]any{}
	for _, cfg := range app.ModelConfigLoader().GetAllModelsConfigs() {
		// Only list models PII filtering can actually apply to (reachable
		// through a text-accepting endpoint with a PII adapter wired).
		// Skips VAD/STT/embedding/image-only models and the token_classify
		// detector models themselves, which are the filters, not consumers.
		if !cfg.PIIFilterApplies() {
			continue
		}
		explicit := cfg.PII.Enabled != nil
		ownDetectors := cfg.PIIDetectors()
		// Resolve through the shared policy so the table reflects the EFFECTIVE
		// state, including the instance-wide default detector — what the
		// request path actually does.
		enabled, detectors := app.ResolvePIIPolicy(&cfg)

		entry := map[string]any{
			"name":      cfg.Name,
			"backend":   cfg.Backend,
			"enabled":   enabled,
			"detectors": detectors,
			"explicit":  explicit,
			// Why is this on? backend default (cloud-proxy) vs an explicit YAML
			// toggle. Helps admins understand the resolved state without
			// reading source.
			"default_for_backend": !explicit && cfg.Backend == "cloud-proxy",
			// The detectors came from the global default, not this model's YAML.
			"detectors_from_default": enabled && len(ownDetectors) == 0 && len(detectors) > 0,
		}
		models = append(models, entry)
	}

	// Detector models: the token_classify "filter" models themselves (NER and
	// in-process pattern matchers), which PIIFilterApplies deliberately omits
	// from the consumer list above. The Filtering tab renders these as a table
	// with a per-row toggle marking membership in the instance-wide default
	// detector set, so admins manage defaults without retyping model names.
	defaultSet := map[string]bool{}
	for _, d := range appCfg.PIIDefaultDetectors {
		defaultSet[d] = true
	}
	detectorModels := []map[string]any{}
	for _, cfg := range app.ModelConfigLoader().GetAllModelsConfigs() {
		if !cfg.HasUsecases(config.FLAG_TOKEN_CLASSIFY) {
			continue
		}
		typ := "ner"
		if cfg.IsPatternDetector() {
			typ = "pattern"
		}
		detectorModels = append(detectorModels, map[string]any{
			"name":    cfg.Name,
			"backend": cfg.Backend,
			"type":    typ,
			// Whether this detector is in the instance-wide default set.
			"default": defaultSet[cfg.Name],