message Level {
  string title = 2;
  string description = 3;
  // The numeric level for ordering. Higher = more sensitive.
  int32 level = 4;
}

// ...

message DataClassification {
  string id = 1;
  string title = 2;
  string description = 3;
  // The sensitivity level. Maps to Level.level.
  optional int32 level = 4;
}

// The classification level that triggered masking.
int32 classification_level = 6;

buf format -w proto
buf lint proto

cd proto && buf generate

git add proto/ backend/generated-go/ frontend/src/types/proto-es/ backend/api/mcp/gen/
git commit -m "proto: change classification level from string to int32

Add level field (int32) to Level for explicit ordering. Change
DataClassification.level_id (string) to level (int32).
Change sql_service classification_level to int32."

-- Migration: Convert classification level from string to int
--
-- 1. In DATA_CLASSIFICATION setting: convert levelId (string) to level (int) in classifications,
--    add level (int) to levels based on array position.
-- 2. In MASKING_RULE policies: convert string classification_level values in CEL expressions to integers.

-- Step 1: Migrate DATA_CLASSIFICATION setting
-- Add level (int) to each level based on array position, convert levelId to level in classifications
UPDATE setting
SET value = (
    SELECT jsonb_set(
        value,
        '{configs}',
        (
            SELECT COALESCE(jsonb_agg(
                jsonb_set(
                    -- First: replace levels array — remove id, add level (int) based on position
                    jsonb_set(
                        config,
                        '{levels}',
                        (
                            SELECT COALESCE(jsonb_agg(
                                jsonb_build_object(
                                    'title', level_row.level->>'title',
                                    'description', level_row.level->>'description',
                                    'level', (level_row.rn)::int
                                )
                            ORDER BY level_row.rn), '[]'::jsonb)
                            FROM (
                                SELECT elem AS level, ordinality AS rn
                                FROM jsonb_array_elements(config->'levels') WITH ORDINALITY AS elem
                            ) level_row
                        )
                    ),
                    -- Second: convert levelId (string) to level (int) in classifications
                    -- Look up the old level id's array position to get the new numeric level
                    '{classification}',
                    (
                        SELECT COALESCE(jsonb_object_agg(
                            key,
                            CASE
                                WHEN cls_value ? 'levelId' THEN
                                    (cls_value - 'levelId') || jsonb_build_object(
                                        'level',
                                        (
                                            SELECT (level_row.rn)::int
                                            FROM (
                                                SELECT elem->>'id' AS level_id, ordinality AS rn
                                                FROM jsonb_array_elements(config->'levels') WITH ORDINALITY AS elem
                                            ) level_row
                                            WHERE level_row.level_id = cls_value->>'levelId'
                                        )
                                    )
                                ELSE cls_value
                            END
                        ), '{}'::jsonb)
                        FROM jsonb_each(config->'classification') AS cls(key, cls_value)
                    )
                )
            ), '[]'::jsonb)
            FROM jsonb_array_elements(value->'configs') AS config
        )
    )
)
WHERE name = 'DATA_CLASSIFICATION'
  AND value->'configs' IS NOT NULL;

-- Step 2: Migrate MASKING_RULE policy CEL expressions
-- Convert string classification_level values to integers in CEL expressions.
-- Handles patterns:
--   classification_level == "N"  -> classification_level == N
--   classification_level in ["N", "M"]  -> classification_level in [N, M]
--   classification_level != "N"  -> classification_level != N
--
-- Uses a two-pass approach to avoid affecting non-classification string values:
-- Pass 1: Convert equality/inequality patterns: classification_level == "N" or != "N"
-- Pass 2: Convert collection patterns: within [...] blocks that follow classification_level
UPDATE policy
SET payload = (
    SELECT jsonb_set(
        payload,
        '{rules}',
        (
            SELECT COALESCE(jsonb_agg(
                CASE
                    WHEN rule->'condition'->>'expression' ~ 'classification_level'
                    THEN jsonb_set(
                        rule,
                        '{condition,expression}',
                        to_jsonb(
                            -- Pass 2: Convert quoted numbers inside in [...] after classification_level
                            regexp_replace(
                                -- Pass 1: Convert classification_level == "N" and != "N"
                                regexp_replace(
                                    rule->'condition'->>'expression',
                                    'classification_level\s*(==|!=)\s*"(\d+)"',
                                    'classification_level \1 \2',
                                    'g'
                                ),
                                -- For "in" expressions, replace quoted digits within brackets
                                -- This targets the specific pattern: classification_level in [...]
                                'classification_level\s+in\s+\[([^\]]+)\]',
                                -- Use a function-style replacement to strip quotes from numbers in the bracket content
                                'classification_level in [\1]',
                                'g'
                            )
                        )
                    )
                    ELSE rule
                END
            ), '[]'::jsonb)
            FROM jsonb_array_elements(payload->'rules') AS rule
        )
    )
)
WHERE type = 'MASKING_RULE'
  AND payload->'rules' IS NOT NULL
  AND payload::text LIKE '%classification_level%';

-- Step 2b: Clean up quoted numbers inside classification_level in [...] brackets
-- The above regex preserves the bracket content as-is; now strip quotes from digits inside.
-- This runs as a separate pass because PostgreSQL regex doesn't support lookahead well.
UPDATE policy
SET payload = (
    SELECT jsonb_set(
        payload,
        '{rules}',
        (
            SELECT COALESCE(jsonb_agg(
                CASE
                    WHEN rule->'condition'->>'expression' ~ 'classification_level\s+in'
                    THEN jsonb_set(
                        rule,
                        '{condition,expression}',
                        to_jsonb(
                            regexp_replace(
                                rule->'condition'->>'expression',
                                '"(\d+)"',
                                '\1',
                                'g'
                            )
                        )
                    )
                    ELSE rule
                END
            ), '[]'::jsonb)
            FROM jsonb_array_elements(payload->'rules') AS rule
        )
    )
)
WHERE type = 'MASKING_RULE'
  AND payload->'rules' IS NOT NULL
  AND payload::text LIKE '%classification_level%';

go test -v -count=1 github.com/bytebase/bytebase/backend/migrator -run ^TestLatestVersion$

git add backend/migrator/
git commit -m "migration: convert classification level from string to int

Migrate DATA_CLASSIFICATION setting to use numeric level.
Migrate MASKING_RULE policy CEL expressions from string to int comparisons."

// Before:
cel.Variable(CELAttributeResourceClassificationLevel, cel.StringType),

// After:
cel.Variable(CELAttributeResourceClassificationLevel, cel.IntType),

type MaskingEvaluation struct {
	SemanticTypeID      string
	SemanticTypeTitle   string
	SemanticTypeIcon    string
	MaskingRuleID       string
	Algorithm           string
	Context             string
	ClassificationLevel int32
}

func getClassificationLevelOfColumn(columnClassificationID string, classificationConfig *storepb.DataClassificationSetting_DataClassificationConfig) int32 {
	if columnClassificationID == "" || classificationConfig == nil {
		return 0
	}

	classification, ok := classificationConfig.Classification[columnClassificationID]
	if !ok {
		return 0
	}
	if classification.Level == nil {
		return 0
	}

	return *classification.Level
}

common.CELAttributeResourceClassificationLevel: int64(classificationLevel),

v1Levels[i] = &v1pb.DataClassificationSetting_DataClassificationConfig_Level{
    Title:       level.Title,
    Description: level.Description,
    Level:       level.Level,
}

defaultClassification := &storepb.DataClassificationSetting{
    Configs: []*storepb.DataClassificationSetting_DataClassificationConfig{
        {
            Id: defaultProjectDatabaseDataClassificationID,
            Levels: []*storepb.DataClassificationSetting_DataClassificationConfig_Level{
                {Level: 1},
                {Level: 2},
            },
            Classification: map[string]*storepb.DataClassificationSetting_DataClassificationConfig_DataClassification{
                "1-1-1": {
                    Id:    "1-1-1",
                    Title: "personal",
                    Level: func() *int32 {
                        a := int32(2)
                        return &a
                    }(),
                },
            },
        },
    },
}

// Before:
Condition: &expr.Expr{Expression: `(resource.table_name == "no_table") || (resource.classification_level == "S2")`},

// After:
Condition: &expr.Expr{Expression: `(resource.table_name == "no_table") || (resource.classification_level == 2)`},

// Before:
wantClassLevel string
// ...
wantClassLevel: "S2",

// After:
wantClassLevel int32
// ...
wantClassLevel: 2,

// Before:
a.Equal(tc.wantClassLevel, result.ClassificationLevel, tc.description)

// After:
a.Equal(tc.wantClassLevel, result.ClassificationLevel, tc.description)
// (same call, types just change)

go build -ldflags "-w -s" -p=16 -o ./bytebase-build/bytebase ./backend/bin/server/main.go
go test -v -count=1 github.com/bytebase/bytebase/backend/api/v1 -run ^TestEvalMaskingLevelOfColumn$

golangci-lint run --allow-parallel-runners

git add backend/
git commit -m "backend: change classification level from string to int32

Update CEL environment, masking evaluator, and tests to use
numeric classification levels for ordered comparisons."

export const NumberFactorList = [
  // Risk related factors
  CEL_ATTRIBUTE_STATEMENT_AFFECTED_ROWS,
  CEL_ATTRIBUTE_STATEMENT_TABLE_ROWS,

  // Request query/export factors
  CEL_ATTRIBUTE_REQUEST_EXPIRATION_DAYS,

  // Masking rule
  CEL_ATTRIBUTE_RESOURCE_CLASSIFICATION_LEVEL,
] as const;

[CEL_ATTRIBUTE_RESOURCE_CLASSIFICATION_LEVEL]: uniq([
    ...EqualityOperatorList,
    ...CompareOperatorList,
    ...CollectionOperatorList,
]),

{
  "title": "Classification Example",
  "levels": [
    { "title": "Level 1", "description": "", "level": 1 },
    { "title": "Level 2", "description": "", "level": 2 },
    { "title": "Level 3", "description": "", "level": 3 },
    { "title": "Level 4", "description": "", "level": 4 }
  ],
  "classification": {
    "1": { "id": "1", "title": "Basic", "description": "" },
    "1-1": { "id": "1-1", "title": "Basic", "description": "", "level": 1 },
    "1-2": { "id": "1-2", "title": "Contact", "description": "", "level": 2 },
    "1-3": { "id": "1-3", "title": "Health", "description": "", "level": 4 },
    "2": { "id": "2", "title": "Relationship", "description": "" },
    "2-1": { "id": "2-1", "title": "Social", "description": "", "level": 1 },
    "2-2": { "id": "2-2", "title": "Business", "description": "", "level": 3 }
  }
}

const levelColor = computed(() => {
  const lvl = columnClassification.value?.level ?? 0;
  return bgColorList[lvl - 1] ?? "bg-gray-200";
});

const level = computed(() => {
  return (props.classificationConfig?.levels ?? []).find(
    (l) => l.level === columnClassification.value?.level
  );
});

interface TreeNode extends TreeOption {
  key: string;
  label: string;
  level?: number;
  children?: TreeNode[];
}

interface ClassificationMap {
  [key: string]: {
    id: string;
    label: string;
    level?: number;
    children: ClassificationMap;
  };
}

return config.levels.map<ResourceSelectOption<unknown>>((l) => ({
  label: l.title,
  value: l.level,
}));

pnpm --dir frontend fix
pnpm --dir frontend type-check

pnpm --dir frontend test

git add frontend/
git commit -m "frontend: change classification level from string to int

Move classification_level to NumberFactorList to enable numeric
comparisons. Update components to use level number directly."

git add backend/demo/
git commit -m "demo: update classification data for int-based levels"

go build -ldflags "-w -s" -p=16 -o ./bytebase-build/bytebase ./backend/bin/server/main.go

go test -v -count=1 github.com/bytebase/bytebase/backend/api/v1 -run ^TestEvalMaskingLevelOfColumn$

golangci-lint run --allow-parallel-runners

pnpm --dir frontend fix
pnpm --dir frontend type-check
pnpm --dir frontend test

buf lint proto