```

feat(core): 添加API认证主体配置和安全验证

- 在Settings中添加api_actor字段，用于标识API调用方身份
- 创建ApiPrincipal数据类来表示服务主体
- 修改require_api_key函数返回认证的服务主体信息
- 更新配置文件引入ActorValue常量

feat(ai_agent): 增强OpenClaw工具调用的安全性检查

- 实现_openclaw_allowed_tools和openclaw_allowed_actions配置项
- 添加CSV列表解析验证器
- 实现工具和操作权限检查方法_ensure_tool_allowed
- 在工具调用前验证允许的工具和操作类型

feat(security): 强化API密钥认证和审计安全性

- 更新require_api_key函数在缺少API_KEY时抛出异常
- 在AI代理、审批、飞书等模块的路由中统一使用ApiPrincipal获取调用方信息
- 替换硬编码的ActorValue.API为动态的principal.actor

feat(audit): 实现安全审计负载脱敏处理

- 添加敏感键名集合AI_AUDIT_SENSITIVE_KEYS
- 实现审计安全负载处理函数_audit_safe_payload
- 支持深度遍历、文本截断、序列限制和敏感信息脱敏
- 在AI服务的审计日志中应用安全负载处理

feat(approval): 完善审批流程的申请人身份验证

- 更新审批创建接口使用认证主体作为申请人
- 使用utc_now替换datetime.utcnow确保时间一致性
- 修复审批逻辑中的条件判断问题

feat(business): 加强业务领域高风险操作的审批控制

- 为高风险域创建统一的审批验证方法_ensure_approved
- 在创建和更新操作中强制要求审批票证
- 为项目同步功能添加认证主体参数

feat(config): 统一时间处理使用UTC时间函数

- 创建并使用utc_now函数替代datetime.utcnow
- 在审批、审计、业务、遗留数据等模块中更新时间戳处理

feat(constants): 扩展风险事件类型和报告指标

- 添加新风险事件类型到GENERATED_RISK_EVENT_TYPES
- 为报告模块添加外部开放和高风险事件指标

refactor(feishu): 增强飞书验证令牌安全检查

- 确保飞书验证令牌配置存在时才接受请求
- 修正令牌验证逻辑以提高安全性
```

app/modules/approvals/models.py

@@ -5,6 +5,7 @@ from sqlalchemy.orm import Mapped, mapped_column
 
 from app.core.constants import ActorValue
 from app.core.database import Base
+from app.core.time import utc_now
 from app.modules.approvals.constants import ApprovalStatus
 
 
@@ -22,10 +23,10 @@ class ApprovalRequest(Base):
     reason: Mapped[str | None] = mapped_column(Text, nullable=True)
     payload: Mapped[str | None] = mapped_column(Text, nullable=True)
     decision_comment: Mapped[str | None] = mapped_column(Text, nullable=True)
-    created_at: Mapped[datetime] = mapped_column(DateTime, default=datetime.utcnow, index=True)
+    created_at: Mapped[datetime] = mapped_column(DateTime, default=utc_now, index=True)
     updated_at: Mapped[datetime] = mapped_column(
         DateTime,
-        default=datetime.utcnow,
-        onupdate=datetime.utcnow,
+        default=utc_now,
+        onupdate=utc_now,
     )
     decided_at: Mapped[datetime | None] = mapped_column(DateTime, nullable=True)

app/modules/approvals/routes.py

@@ -2,7 +2,7 @@ from fastapi import APIRouter, Depends
 from sqlalchemy.orm import Session
 
 from app.core.database import get_db
-from app.core.security import require_api_key
+from app.core.security import ApiPrincipal, require_api_key
 from app.modules.approvals.schemas import ApprovalCreate, ApprovalDecision, ApprovalRead
 from app.modules.approvals.service import ApprovalService
 
@@ -10,8 +10,12 @@ router = APIRouter(dependencies=[Depends(require_api_key)])
 
 
 @router.post("", response_model=ApprovalRead)
-def create_approval(payload: ApprovalCreate, db: Session = Depends(get_db)):
-    return ApprovalService(db).create(payload)
+def create_approval(
+    payload: ApprovalCreate,
+    db: Session = Depends(get_db),
+    principal: ApiPrincipal = Depends(require_api_key),
+):
+    return ApprovalService(db).create(payload, applicant=principal.actor)
 
 
 @router.get("", response_model=list[ApprovalRead])
@@ -29,10 +33,20 @@ def get_approval(ticket_id: str, db: Session = Depends(get_db)):
 
 
 @router.post("/{ticket_id}/approve", response_model=ApprovalRead)
-def approve(ticket_id: str, payload: ApprovalDecision, db: Session = Depends(get_db)):
-    return ApprovalService(db).decide(ticket_id, payload.approver, True, payload.comment)
+def approve(
+    ticket_id: str,
+    payload: ApprovalDecision,
+    db: Session = Depends(get_db),
+    principal: ApiPrincipal = Depends(require_api_key),
+):
+    return ApprovalService(db).decide(ticket_id, principal.actor, True, payload.comment)
 
 
 @router.post("/{ticket_id}/reject", response_model=ApprovalRead)
-def reject(ticket_id: str, payload: ApprovalDecision, db: Session = Depends(get_db)):
-    return ApprovalService(db).decide(ticket_id, payload.approver, False, payload.comment)
+def reject(
+    ticket_id: str,
+    payload: ApprovalDecision,
+    db: Session = Depends(get_db),
+    principal: ApiPrincipal = Depends(require_api_key),
+):
+    return ApprovalService(db).decide(ticket_id, principal.actor, False, payload.comment)

app/modules/approvals/service.py

@@ -5,6 +5,7 @@ from fastapi import HTTPException, status
 from sqlalchemy import select
 from sqlalchemy.orm import Session
 
+from app.core.time import utc_now
 from app.modules.approvals.constants import ApprovalActionValue, ApprovalStatus
 from app.modules.approvals.models import ApprovalRequest
 from app.modules.approvals.schemas import ApprovalCreate
@@ -20,13 +21,13 @@ class ApprovalService:
         self.db = db
         self.audit = AuditService(db)
 
-    def create(self, payload: ApprovalCreate) -> ApprovalRequest:
+    def create(self, payload: ApprovalCreate, applicant: str) -> ApprovalRequest:
         ticket = ApprovalRequest(
             ticket_id=f"APR-{uuid.uuid4().hex[:12].upper()}",
             domain=payload.domain,
             record_id=payload.record_id,
             action=payload.action,
-            applicant=payload.applicant,
+            applicant=applicant,
             reason=payload.reason,
             payload=json.dumps(payload.payload, ensure_ascii=False, default=str),
         )
@@ -35,7 +36,7 @@ class ApprovalService:
         self.db.refresh(ticket)
         self.audit.log(
             AuditLogCreate(
-                actor=payload.applicant,
+                actor=applicant,
                 source=AuditSource.APPROVAL,
                 action=AuditAction.APPROVAL_CREATE,
                 target_type=payload.domain,
@@ -77,9 +78,7 @@ class ApprovalService:
         ticket.status = ApprovalStatus.APPROVED if approved else ApprovalStatus.REJECTED
         ticket.approver = approver
         ticket.decision_comment = comment
-        from datetime import datetime
-
-        ticket.decided_at = datetime.utcnow()
+        ticket.decided_at = utc_now()
         self.db.commit()
         self.db.refresh(ticket)
         self.audit.log(
@@ -108,7 +107,9 @@ class ApprovalService:
             return False
         if ticket.domain != domain:
             return False
-        if ticket.record_id and record_id is not None and str(ticket.record_id) != str(record_id):
+        if ticket.record_id and (
+            record_id is None or str(ticket.record_id) != str(record_id)
+        ):
             return False
         return ticket.action in {
             action,