Added security checks for confidence levels

app/MindWork AI Studio/Tools/Services/DataSourceEmbeddingService.cs

@@ -434,7 +434,24 @@ public sealed partial class DataSourceEmbeddingService(SettingsManager settingsM
             this.UpsertStatus(this.GetFallbackStatus(dataSource, "The selected embedding provider is not available."));
             return;
         }
-        
+
+        if (!embeddingProvider.AllowsDataSourceAccess(settingsManager, dataSource.SecurityPolicy, dataSource.ComplianceLevel))
+        {
+            var errorMessage = $"The selected embedding provider is not allowed to embed this data source. The data source requires provider confidence '{dataSource.ComplianceLevel.GetName()}'. The embedding provider has confidence '{embeddingProvider.GetConfidenceLevel(settingsManager).GetName()}'.";
+            logger.LogWarning(
+                "Skipping background embeddings for data source '{DataSourceName}' ({DataSourceId}) because embedding provider '{EmbeddingProviderName}' ({EmbeddingProviderId}) is not allowed. RequiredDataSecurity={RequiredDataSecurity}, RequiredCompliance={RequiredCompliance}, EmbeddingProviderConfidence={EmbeddingProviderConfidence}.",
+                dataSource.Name,
+                dataSource.Id,
+                embeddingProvider.Name,
+                embeddingProvider.Id,
+                dataSource.SecurityPolicy,
+                dataSource.ComplianceLevel.GetName(),
+                embeddingProvider.GetConfidenceLevel(settingsManager).GetName());
+
+            token.ThrowIfCancellationRequested();
+            this.UpsertStatus(this.GetFallbackStatus(dataSource, errorMessage));
+            return;
+        }
 
         logger.LogInformation(
             "Using embedding provider '{EmbeddingProviderId}' with model '{EmbeddingModelId}' for data source '{DataSourceName}' ({DataSourceId}).",

app/MindWork AI Studio/Tools/Services/DataSourceService.cs

@@ -42,7 +42,10 @@ public sealed class DataSourceService
             return new([], []);
         }
         
-        return await this.GetDataSources(selectedLLMProvider.IsTrustedForDataSourceSecurityChecks(this.settingsManager), previousSelectedDataSources);
+        return await this.GetDataSources(
+            selectedLLMProvider.IsTrustedForDataSourceSecurityChecks(this.settingsManager),
+            selectedLLMProvider.GetConfidenceLevel(this.settingsManager),
+            previousSelectedDataSources);
     }
     
     /// <summary>
@@ -65,10 +68,13 @@ public sealed class DataSourceService
             return new([], []);
         }
         
-        return await this.GetDataSources(selectedLLMProvider.IsTrustedForDataSourceSecurityChecks(this.settingsManager), previousSelectedDataSources);
+        return await this.GetDataSources(
+            selectedLLMProvider.IsTrustedForDataSourceSecurityChecks(this.settingsManager),
+            selectedLLMProvider.GetConfidenceLevel(this.settingsManager),
+            previousSelectedDataSources);
     }
     
-    private async Task<AllowedSelectedDataSources> GetDataSources(bool usingTrustedProvider, IReadOnlyCollection<IDataSource>? previousSelectedDataSources = null)
+    private async Task<AllowedSelectedDataSources> GetDataSources(bool usingTrustedProvider, ConfidenceLevel providerConfidenceLevel, IReadOnlyCollection<IDataSource>? previousSelectedDataSources = null)
     {
         var allDataSources = this.settingsManager.ConfigurationData.DataSources.ToList();
         var previousSelectedDataSourceIds = previousSelectedDataSources?.Select(source => source.Id).ToHashSet(StringComparer.Ordinal) ?? [];
@@ -78,7 +84,7 @@ public sealed class DataSourceService
         
         // Start all checks in parallel:
         foreach (var source in allDataSources)
-            tasks.Add(this.CheckOneDataSource(source, usingTrustedProvider));
+            tasks.Add(this.CheckOneDataSource(source, usingTrustedProvider, providerConfidenceLevel));
         
         // Wait for all checks and collect the results:
         foreach (var task in tasks)
@@ -95,8 +101,17 @@ public sealed class DataSourceService
         return new(filteredDataSources, filteredSelectedDataSources);
     }
     
-    private async Task<IDataSource?> CheckOneDataSource(IDataSource source, bool usingTrustedProvider)
+    private async Task<IDataSource?> CheckOneDataSource(IDataSource source, bool usingTrustedProvider, ConfidenceLevel providerConfidenceLevel)
     {
+        if (!providerConfidenceLevel.AllowsDataSourceComplianceLevel(source.ComplianceLevel))
+        {
+            this.logger.LogWarning($"The data source '{source.Name}' (id={source.Id}) requires provider confidence '{source.ComplianceLevel.GetName()}'. The selected provider only has confidence '{providerConfidenceLevel.GetName()}'. We skip this source.");
+            return null;
+        }
+
+        if (source is IInternalDataSource)
+            return source;
+
         //
         // Unfortunately, we have to live-check any ERI source for its security requirements.
         // Because the ERI server operator might change the security requirements at any time.
@@ -206,4 +221,4 @@ public sealed class DataSourceService
                 return null;
         }
     }
-}
+}