Outbound data restrictions after searching data sources (#1106)

app/MindWork AI Studio/Components/ChatComponent.razor.cs

@@ -2251,9 +2251,9 @@ public partial class ChatComponent : MSGComponentBase
     /// its static definition: the one a request offers lists the data sources as well, which only
     /// the request asks for.
     ///
-    /// Read Web Page, Search Confluence, and Search Mails likewise count with their registered
-    /// instructions, which assume the default settings and a chat which holds no internal content,
-    /// and warn that internal content ends web search. A request words them after the actual settings, the chat,
+    /// Read Web Page, Search Confluence, Search Mails, and Semantic Search likewise count with their
+    /// registered instructions, which assume the default settings and a chat which holds no internal
+    /// content, and warn that internal content ends web search. A request words them after the actual settings, the chat,
     /// and the tools it offers, so the count comes out a few tokens off. One case it gets wrong as a
     /// whole: a chat restricted to the configured services only, with neither a wiki nor allowed
     /// private hosts configured, leaves Read Web Page nothing to offer, and only the request finds

app/MindWork AI Studio/Components/OutboundDataRestrictionSelection.razor

@@ -0,0 +1,24 @@
+@using AIStudio.Settings
+@using AIStudio.Settings.DataModel
+@inherits MSGComponentBase
+
+<MudSelect T="OutboundDataRestriction" Value="@this.Value" ValueChanged="@this.ValueChanged" Text="@this.Value.GetName()" Label="@this.Label" Class="mb-1" OpenIcon="@Icons.Material.Filled.ExpandMore" AdornmentColor="Color.Info" Adornment="Adornment.Start" AdornmentIcon="@Icons.Material.Filled.Shield">
+    @foreach (var restriction in ConfigurationSelectDataFactory.GetOutboundDataRestrictionData(this.Minimum))
+    {
+        <MudSelectItem T="OutboundDataRestriction" Value="@restriction.Value">
+            @restriction.Name
+        </MudSelectItem>
+    }
+</MudSelect>
+<MudJustifiedText Typo="Typo.body2" Class="mb-1">
+    @this.Value.GetDescription()
+</MudJustifiedText>
+@if (this.LimitationText is { } limitationText)
+{
+    <MudJustifiedText Typo="Typo.body2" Class="mb-1">
+        @limitationText
+    </MudJustifiedText>
+}
+<MudJustifiedText Typo="Typo.body2" Class="mb-6">
+    @this.Explanation
+</MudJustifiedText>

app/MindWork AI Studio/Components/OutboundDataRestrictionSelection.razor.cs

@@ -0,0 +1,72 @@
+using AIStudio.Settings;
+using AIStudio.Settings.DataModel;
+
+using Microsoft.AspNetCore.Components;
+
+namespace AIStudio.Components;
+
+/// <summary>
+/// Lets the user choose where a chat may still send data once it has read from a mailbox or a data
+/// source, and explains the choice.
+/// </summary>
+/// <remarks>
+/// Only the levels allowed are offered: an organization may rule out the less strict ones, and so
+/// does a data source which only self-hosted providers may use, see
+/// DataSourceOutboundDataExtensions.GetMinimumOutboundDataRestriction. The dialog keeps the value it
+/// passes within those, since it stores it.
+/// </remarks>
+public partial class OutboundDataRestrictionSelection : MSGComponentBase
+{
+    /// <summary>
+    /// The level chosen.
+    /// </summary>
+    [Parameter]
+    public OutboundDataRestriction Value { get; set; }
+
+    [Parameter]
+    public EventCallback<OutboundDataRestriction> ValueChanged { get; set; }
+
+    /// <summary>
+    /// The label of the setting. The blocked message of a tool quotes it, so the user finds the
+    /// setting by the words they read there, see OutboundDataRequirementExtensions.GetToolBlockedMessage.
+    /// </summary>
+    [Parameter]
+    public string Label { get; set; } = string.Empty;
+
+    /// <summary>
+    /// Why the setting matters for this kind of source.
+    /// </summary>
+    [Parameter]
+    public string Explanation { get; set; } = string.Empty;
+
+    /// <summary>
+    /// The least strict level the organization allows for this kind of source.
+    /// </summary>
+    [Parameter]
+    public OutboundDataRestriction OrganizationMinimum { get; set; } = OutboundDataRestriction.UNRESTRICTED;
+
+    /// <summary>
+    /// The security policy of the data source, or NOT_SPECIFIED for a source which has none.
+    /// </summary>
+    [Parameter]
+    public DataSourceSecurity SecurityPolicy { get; set; } = DataSourceSecurity.NOT_SPECIFIED;
+
+    private OutboundDataRestriction Minimum => DataSourceOutboundDataExtensions.GetMinimumOutboundDataRestriction(this.SecurityPolicy, this.OrganizationMinimum);
+
+    /// <summary>
+    /// Why less strict levels are not offered, or null when every level is.
+    /// </summary>
+    private string? LimitationText
+    {
+        get
+        {
+            if (this.SecurityPolicy is DataSourceSecurity.SELF_HOSTED)
+                return T("Only self-hosted providers may use this data source. A chat which found something in it may therefore only use the services configured in AI Studio, such as the allowed private hosts of the tool 'Read Web Page'.");
+
+            if (this.OrganizationMinimum is not OutboundDataRestriction.UNRESTRICTED)
+                return T("Your organization does not allow less strict settings than the ones offered here.");
+
+            return null;
+        }
+    }
+}

app/MindWork AI Studio/Components/Settings/SettingsPanelApp.razor.cs

@@ -1,4 +1,3 @@
-using AIStudio.Provider;
 using AIStudio.Settings;
 using AIStudio.Settings.DataModel;
 using AIStudio.Tools.Rust;