feat: enforce tenant content moderation

server/kafka_config_events.go

@@ -21,6 +21,8 @@ const (
 	configEventThirdPartyUpdated     = "third_party.updated"
 	configEventRegistrationUpdated   = "registration.config.updated"
 	configEventAppReleaseUpdated     = "app.release.updated"
+	configEventSecurityPolicyUpdated = "security.policy.updated"
+	configEventSensitiveWordsUpdated = "sensitive_words.updated"
 )
 
 type configEventPayload struct {
@@ -83,17 +85,28 @@ func executeKafkaConfigEvent(envelope kafkaEnvelope) error {
 	switch strings.TrimSpace(envelope.EventType) {
 	case configEventTenantUpdated, configEventTenantStatusChanged, configEventTenantLimitsUpdated, configEventTenantFeaturesUpdated:
 		store.InvalidateTenantConfigCache(tenantCode, tenantID)
+		if strings.TrimSpace(envelope.EventType) == configEventTenantFeaturesUpdated {
+			store.InvalidateModerationConfigCache(tenantCode, false, true, false)
+		}
 	case configEventDictionaryUpdated, configEventThirdPartyUpdated:
 		store.InvalidateThirdPartyConfigCache(payload.Group)
+		if payload.Group == "moderation" {
+			store.InvalidateModerationConfigCache(tenantCode, true, false, false)
+		}
 	case configEventRegistrationUpdated:
 		store.InvalidateRegistrationConfigCache()
 	case configEventAppReleaseUpdated:
 		store.InvalidateAppReleaseConfigCache()
+	case configEventSecurityPolicyUpdated:
+		store.InvalidateModerationConfigCache(tenantCode, false, true, false)
+	case configEventSensitiveWordsUpdated:
+		store.InvalidateModerationConfigCache(tenantCode, false, false, true)
 	default:
 		store.InvalidateTenantConfigCache(tenantCode, tenantID)
 		store.InvalidateThirdPartyConfigCache(payload.Group)
 		store.InvalidateRegistrationConfigCache()
 		store.InvalidateAppReleaseConfigCache()
+		store.InvalidateModerationConfigCache(tenantCode, true, true, true)
 	}
 	logs.Info.Printf("kafka config event applied: event=%s type=%s tenant=%s group=%s", envelope.EventID, envelope.EventType, tenantCode, payload.Group)
 	return nil