```

feat(core): 添加API认证主体配置和安全验证

- 在Settings中添加api_actor字段，用于标识API调用方身份
- 创建ApiPrincipal数据类来表示服务主体
- 修改require_api_key函数返回认证的服务主体信息
- 更新配置文件引入ActorValue常量

feat(ai_agent): 增强OpenClaw工具调用的安全性检查

- 实现_openclaw_allowed_tools和openclaw_allowed_actions配置项
- 添加CSV列表解析验证器
- 实现工具和操作权限检查方法_ensure_tool_allowed
- 在工具调用前验证允许的工具和操作类型

feat(security): 强化API密钥认证和审计安全性

- 更新require_api_key函数在缺少API_KEY时抛出异常
- 在AI代理、审批、飞书等模块的路由中统一使用ApiPrincipal获取调用方信息
- 替换硬编码的ActorValue.API为动态的principal.actor

feat(audit): 实现安全审计负载脱敏处理

- 添加敏感键名集合AI_AUDIT_SENSITIVE_KEYS
- 实现审计安全负载处理函数_audit_safe_payload
- 支持深度遍历、文本截断、序列限制和敏感信息脱敏
- 在AI服务的审计日志中应用安全负载处理

feat(approval): 完善审批流程的申请人身份验证

- 更新审批创建接口使用认证主体作为申请人
- 使用utc_now替换datetime.utcnow确保时间一致性
- 修复审批逻辑中的条件判断问题

feat(business): 加强业务领域高风险操作的审批控制

- 为高风险域创建统一的审批验证方法_ensure_approved
- 在创建和更新操作中强制要求审批票证
- 为项目同步功能添加认证主体参数

feat(config): 统一时间处理使用UTC时间函数

- 创建并使用utc_now函数替代datetime.utcnow
- 在审批、审计、业务、遗留数据等模块中更新时间戳处理

feat(constants): 扩展风险事件类型和报告指标

- 添加新风险事件类型到GENERATED_RISK_EVENT_TYPES
- 为报告模块添加外部开放和高风险事件指标

refactor(feishu): 增强飞书验证令牌安全检查

- 确保飞书验证令牌配置存在时才接受请求
- 修正令牌验证逻辑以提高安全性
```

app/modules/business/constants.py

@@ -115,3 +115,12 @@ ATTENDANCE_ABNORMAL_STATUSES = frozenset(
 )
 SUPPLIER_RISK_LEVELS = frozenset({RiskLevel.MEDIUM, RiskLevel.HIGH})
 CLOSED_RISK_STATUSES = frozenset({StatusValue.CLOSED, StatusValue.RESOLVED})
+GENERATED_RISK_EVENT_TYPES = frozenset(
+    {
+        RiskEventType.OVERDUE_TASK,
+        RiskEventType.DELAYED_PROJECT,
+        RiskEventType.OVER_BUDGET_PROJECT,
+        RiskEventType.FUND_SAFETY_LINE,
+        RiskEventType.SUPPLIER_RISK,
+    }
+)

app/modules/business/models.py

@@ -6,6 +6,7 @@ from sqlalchemy.orm import Mapped, mapped_column
 
 from app.core.constants import ActorValue
 from app.core.database import Base
+from app.core.time import utc_now
 from app.modules.business.constants import (
     AccountType,
     PriorityValue,
@@ -17,9 +18,9 @@ from app.modules.business.constants import (
 
 
 class TimestampMixin:
-    created_at: Mapped[datetime] = mapped_column(DateTime, default=datetime.utcnow)
+    created_at: Mapped[datetime] = mapped_column(DateTime, default=utc_now)
     updated_at: Mapped[datetime] = mapped_column(
-        DateTime, default=datetime.utcnow, onupdate=datetime.utcnow
+        DateTime, default=utc_now, onupdate=utc_now
     )
 
 
@@ -230,7 +231,7 @@ class RiskEvent(Base, TimestampMixin):
     source_record_id: Mapped[str | None] = mapped_column(String(128), nullable=True, index=True)
     project_code: Mapped[str | None] = mapped_column(String(64), nullable=True, index=True)
     owner: Mapped[str | None] = mapped_column(String(128), nullable=True, index=True)
-    detected_at: Mapped[datetime] = mapped_column(DateTime, default=datetime.utcnow, index=True)
+    detected_at: Mapped[datetime] = mapped_column(DateTime, default=utc_now, index=True)
     due_date: Mapped[date | None] = mapped_column(Date, nullable=True, index=True)
     description: Mapped[str | None] = mapped_column(Text, nullable=True)
     mitigation: Mapped[str | None] = mapped_column(Text, nullable=True)
@@ -245,7 +246,7 @@ class LegacySyncRun(Base, TimestampMixin):
     domain: Mapped[str] = mapped_column(String(128), index=True)
     source_table: Mapped[str | None] = mapped_column(String(128), nullable=True, index=True)
     status: Mapped[str] = mapped_column(String(32), default=StatusValue.RUNNING, index=True)
-    started_at: Mapped[datetime] = mapped_column(DateTime, default=datetime.utcnow, index=True)
+    started_at: Mapped[datetime] = mapped_column(DateTime, default=utc_now, index=True)
     finished_at: Mapped[datetime | None] = mapped_column(DateTime, nullable=True)
     created_count: Mapped[int] = mapped_column(Integer, default=0)
     updated_count: Mapped[int] = mapped_column(Integer, default=0)

app/modules/business/routes.py

@@ -2,7 +2,7 @@ from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 
 from app.core.database import get_db
-from app.core.security import require_api_key
+from app.core.security import ApiPrincipal, require_api_key
 from app.modules.business.registry import DOMAIN_MODELS
 from app.modules.business.schemas import DomainListRead, DomainRecordCreate, DomainRecordUpdate
 from app.modules.business.service import BusinessService
@@ -43,9 +43,15 @@ def create_record(
     domain: str,
     payload: DomainRecordCreate,
     db: Session = Depends(get_db),
+    principal: ApiPrincipal = Depends(require_api_key),
 ) -> dict:
     try:
-        data = BusinessService(db).create_record(domain, payload.data, payload.actor)
+        data = BusinessService(db).create_record(
+            domain,
+            payload.data,
+            principal.actor,
+            payload.approval_ticket_id,
+        )
     except KeyError as exc:
         raise HTTPException(status_code=404, detail=str(exc)) from exc
     return {"domain": domain, "data": data}
@@ -57,13 +63,14 @@ def update_record(
     record_id: int,
     payload: DomainRecordUpdate,
     db: Session = Depends(get_db),
+    principal: ApiPrincipal = Depends(require_api_key),
 ) -> dict:
     try:
         data = BusinessService(db).update_record(
             domain,
             record_id,
             payload.data,
-            actor=payload.actor,
+            actor=principal.actor,
             approval_ticket_id=payload.approval_ticket_id,
         )
     except KeyError as exc:

app/modules/business/schemas.py

@@ -8,6 +8,10 @@ from app.core.constants import ActorValue
 class DomainRecordCreate(BaseModel):
     data: dict[str, Any] = Field(..., description="Domain fields to create.")
     actor: str = ActorValue.API
+    approval_ticket_id: str | None = Field(
+        default=None,
+        description="Required by policy for high-risk creates such as funds or performance.",
+    )
 
 
 class DomainRecordUpdate(BaseModel):

app/modules/business/service.py

@@ -102,7 +102,10 @@ class BusinessService:
         domain: str,
         data: dict[str, Any],
         actor: str = ActorValue.API,
+        approval_ticket_id: str | None = None,
     ) -> dict[str, Any]:
+        if domain in HIGH_RISK_DOMAINS:
+            self._ensure_approved(approval_ticket_id, domain, None, f"create:{domain}")
         model = get_domain_model(domain)
         payload = _model_payload(model, data)
         record = model(**payload)
@@ -117,7 +120,10 @@ class BusinessService:
                 action=f"create:{domain}",
                 target_type=domain,
                 target_id=str(record.id),
-                request_payload=data,
+                risk_level=(
+                    AuditRiskLevel.HIGH if domain in HIGH_RISK_DOMAINS else AuditRiskLevel.LOW
+                ),
+                request_payload={"data": data, "approval_ticket_id": approval_ticket_id},
                 response_payload=result,
             )
         )
@@ -132,21 +138,7 @@ class BusinessService:
         approval_ticket_id: str | None = None,
     ) -> dict[str, Any]:
         if domain in HIGH_RISK_DOMAINS:
-            if not approval_ticket_id:
-                raise HTTPException(
-                    status_code=status.HTTP_409_CONFLICT,
-                    detail="High-risk domain update requires approval_ticket_id",
-                )
-            if not ApprovalService(self.db).is_approved_for(
-                approval_ticket_id,
-                domain,
-                record_id,
-                f"update:{domain}",
-            ):
-                raise HTTPException(
-                    status_code=status.HTTP_403_FORBIDDEN,
-                    detail="Approval ticket is not approved for this update",
-                )
+            self._ensure_approved(approval_ticket_id, domain, record_id, f"update:{domain}")
         model = get_domain_model(domain)
         record = self.db.get(model, record_id)
         if record is None:
@@ -174,3 +166,26 @@ class BusinessService:
             )
         )
         return result
+
+    def _ensure_approved(
+        self,
+        approval_ticket_id: str | None,
+        domain: str,
+        record_id: str | int | None,
+        action: str,
+    ) -> None:
+        if not approval_ticket_id:
+            raise HTTPException(
+                status_code=status.HTTP_409_CONFLICT,
+                detail="High-risk domain change requires approval_ticket_id",
+            )
+        if not ApprovalService(self.db).is_approved_for(
+            approval_ticket_id,
+            domain,
+            record_id,
+            action,
+        ):
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail="Approval ticket is not approved for this change",
+            )