```

feat(core): 添加API认证主体配置和安全验证

- 在Settings中添加api_actor字段，用于标识API调用方身份
- 创建ApiPrincipal数据类来表示服务主体
- 修改require_api_key函数返回认证的服务主体信息
- 更新配置文件引入ActorValue常量

feat(ai_agent): 增强OpenClaw工具调用的安全性检查

- 实现_openclaw_allowed_tools和openclaw_allowed_actions配置项
- 添加CSV列表解析验证器
- 实现工具和操作权限检查方法_ensure_tool_allowed
- 在工具调用前验证允许的工具和操作类型

feat(security): 强化API密钥认证和审计安全性

- 更新require_api_key函数在缺少API_KEY时抛出异常
- 在AI代理、审批、飞书等模块的路由中统一使用ApiPrincipal获取调用方信息
- 替换硬编码的ActorValue.API为动态的principal.actor

feat(audit): 实现安全审计负载脱敏处理

- 添加敏感键名集合AI_AUDIT_SENSITIVE_KEYS
- 实现审计安全负载处理函数_audit_safe_payload
- 支持深度遍历、文本截断、序列限制和敏感信息脱敏
- 在AI服务的审计日志中应用安全负载处理

feat(approval): 完善审批流程的申请人身份验证

- 更新审批创建接口使用认证主体作为申请人
- 使用utc_now替换datetime.utcnow确保时间一致性
- 修复审批逻辑中的条件判断问题

feat(business): 加强业务领域高风险操作的审批控制

- 为高风险域创建统一的审批验证方法_ensure_approved
- 在创建和更新操作中强制要求审批票证
- 为项目同步功能添加认证主体参数

feat(config): 统一时间处理使用UTC时间函数

- 创建并使用utc_now函数替代datetime.utcnow
- 在审批、审计、业务、遗留数据等模块中更新时间戳处理

feat(constants): 扩展风险事件类型和报告指标

- 添加新风险事件类型到GENERATED_RISK_EVENT_TYPES
- 为报告模块添加外部开放和高风险事件指标

refactor(feishu): 增强飞书验证令牌安全检查

- 确保飞书验证令牌配置存在时才接受请求
- 修正令牌验证逻辑以提高安全性
```

tests/test_ai_adapters.py

@@ -1,5 +1,8 @@
 from typing import Any
 
+import pytest
+from fastapi import HTTPException
+
 from app.core.config import Settings
 from app.modules.ai_agent import adapters
 from app.modules.ai_agent.constants import (
@@ -128,6 +131,7 @@ def test_openclaw_adapter_uses_gateway_health_and_tool_invoke(monkeypatch) -> No
     settings = Settings(
         openclaw_http_url="http://openclaw.local",
         openclaw_gateway_token="gateway-token",
+        openclaw_allowed_tools=["sessions_list"],
     )
 
     health = adapters.OpenClawAdapter(settings).health()
@@ -158,6 +162,7 @@ def test_openclaw_hermes_adapter_runs_recall_answer_and_remember(monkeypatch) ->
         model_provider="openclaw_hermes",
         openclaw_http_url="http://openclaw.local",
         openclaw_gateway_token="openclaw-key",
+        openclaw_allowed_tools=["sessions_list"],
         hermes_base_url="http://hermes.local/v1",
         hermes_api_key="hermes-key",
     )
@@ -187,3 +192,19 @@ def test_openclaw_hermes_adapter_runs_recall_answer_and_remember(monkeypatch) ->
     assert AIContextKey.OPENCLAW in DummyClient.calls[4]["json"][AIHttpPayloadKey.MESSAGES][1][
         AIHttpPayloadKey.CONTENT
     ]
+
+
+def test_openclaw_adapter_blocks_tools_not_in_allowlist(monkeypatch) -> None:
+    DummyClient.calls = []
+    monkeypatch.setattr(adapters.httpx, "Client", DummyClient)
+    settings = Settings(
+        openclaw_http_url="http://openclaw.local",
+        openclaw_gateway_token="gateway-token",
+        openclaw_allowed_tools=["sessions_list"],
+    )
+
+    with pytest.raises(HTTPException) as exc_info:
+        adapters.OpenClawAdapter(settings).invoke_tool("filesystem_write")
+
+    assert exc_info.value.status_code == 403
+    assert DummyClient.calls == []

tests/test_smoke.py

@@ -4,6 +4,9 @@ import tempfile
 from datetime import date, timedelta
 from pathlib import Path
 
+import pytest
+from fastapi import HTTPException
+
 from app.modules.ai_agent.constants import AIProviderName, AIResponseKey
 from app.modules.business.constants import StatusValue
 
@@ -14,13 +17,17 @@ os.environ["DATABASE_URL"] = "sqlite:///" + _db.name.replace("\\", "/")
 os.environ["API_KEY"] = "test-key"
 os.environ["FEISHU_APP_ID"] = ""
 os.environ["FEISHU_APP_SECRET"] = ""
+os.environ["FEISHU_VERIFICATION_TOKEN"] = "test-feishu-token"
 os.environ["MODEL_PROVIDER"] = AIProviderName.NOOP
 os.environ["SCHEDULER_ENABLED"] = "false"
 
 from fastapi.testclient import TestClient
 
+from app.core.config import get_settings
 from app.core.database import Base, engine
+from app.core.security import require_api_key
 from app.main import app
+from app.modules.legacy_mysql.service import LegacyMySQLService
 from app.modules.reports.constants import (
     LifecycleAttentionKey,
     LifecycleResponseKey,
@@ -78,7 +85,7 @@ def test_project_report_and_feishu_command_preview() -> None:
 def test_feishu_webhook_routes_message_event() -> None:
     payload = {
         "schema": "2.0",
-        "header": {"event_type": "im.message.receive_v1"},
+        "header": {"event_type": "im.message.receive_v1", "token": "test-feishu-token"},
         "event": {
             "sender": {"sender_id": {"open_id": "ou_test"}},
             "message": {
@@ -95,12 +102,70 @@ def test_feishu_webhook_routes_message_event() -> None:
     assert data["result"]["command"] == "risk_summary"
 
 
+def test_api_key_and_feishu_webhook_fail_closed(monkeypatch) -> None:
+    monkeypatch.setenv("API_KEY", "")
+    get_settings.cache_clear()
+    try:
+        with pytest.raises(HTTPException) as exc_info:
+            require_api_key("test-key")
+        assert exc_info.value.status_code == 503
+
+        monkeypatch.setenv("API_KEY", "test-key")
+        get_settings.cache_clear()
+
+        response = client.post(
+            "/api/v1/integrations/feishu/webhook",
+            json={"schema": "2.0", "header": {"event_type": "im.message.receive_v1"}},
+        )
+        assert response.status_code == 401
+    finally:
+        monkeypatch.setenv("API_KEY", "test-key")
+        get_settings.cache_clear()
+
+
 def test_approval_gate_for_high_risk_update() -> None:
+    blocked_create_response = client.post(
+        "/api/v1/business/fund-accounts",
+        headers=headers,
+        json={
+            "actor": "spoofed-user",
+            "data": {
+                "code": "FUND-SMOKE-BLOCKED",
+                "name": "Blocked Account",
+            },
+        },
+    )
+    assert blocked_create_response.status_code == 409
+
+    create_approval_response = client.post(
+        "/api/v1/approvals",
+        headers=headers,
+        json={
+            "domain": "fund-accounts",
+            "action": "create:fund-accounts",
+            "applicant": "spoofed-user",
+            "reason": "Smoke test account creation",
+            "payload": {"code": "FUND-SMOKE-001"},
+        },
+    )
+    assert create_approval_response.status_code == 200
+    assert create_approval_response.json()["applicant"] == "api"
+    create_ticket_id = create_approval_response.json()["ticket_id"]
+
+    approve_create_response = client.post(
+        f"/api/v1/approvals/{create_ticket_id}/approve",
+        headers=headers,
+        json={"approver": "spoofed-manager", "comment": "ok"},
+    )
+    assert approve_create_response.status_code == 200
+    assert approve_create_response.json()["approver"] == "api"
+
     create_response = client.post(
         "/api/v1/business/fund-accounts",
         headers=headers,
         json={
-            "actor": "pytest",
+            "actor": "spoofed-user",
+            "approval_ticket_id": create_ticket_id,
             "data": {
                 "code": "FUND-SMOKE-001",
                 "name": "Main Account",
@@ -115,7 +180,7 @@ def test_approval_gate_for_high_risk_update() -> None:
     blocked_response = client.patch(
         f"/api/v1/business/fund-accounts/{record_id}",
         headers=headers,
-        json={"actor": "pytest", "data": {"current_balance": 100}},
+        json={"actor": "spoofed-user", "data": {"current_balance": 100}},
     )
     assert blocked_response.status_code == 409
 
@@ -126,7 +191,7 @@ def test_approval_gate_for_high_risk_update() -> None:
             "domain": "fund-accounts",
             "record_id": str(record_id),
             "action": "update:fund-accounts",
-            "applicant": "pytest",
+            "applicant": "spoofed-user",
             "reason": "Smoke test balance adjustment",
             "payload": {"current_balance": 100},
         },
@@ -138,7 +203,7 @@ def test_approval_gate_for_high_risk_update() -> None:
         f"/api/v1/business/fund-accounts/{record_id}",
         headers=headers,
         json={
-            "actor": "pytest",
+            "actor": "spoofed-user",
             "approval_ticket_id": ticket_id,
             "data": {"current_balance": 100},
         },
@@ -148,16 +213,17 @@ def test_approval_gate_for_high_risk_update() -> None:
     approve_response = client.post(
         f"/api/v1/approvals/{ticket_id}/approve",
         headers=headers,
-        json={"approver": "manager", "comment": "ok"},
+        json={"approver": "spoofed-manager", "comment": "ok"},
     )
     assert approve_response.status_code == 200
     assert approve_response.json()["status"] == "approved"
+    assert approve_response.json()["approver"] == "api"
 
     update_response = client.patch(
         f"/api/v1/business/fund-accounts/{record_id}",
         headers=headers,
         json={
-            "actor": "pytest",
+            "actor": "spoofed-user",
             "approval_ticket_id": ticket_id,
             "data": {"current_balance": 100},
         },
@@ -383,3 +449,10 @@ def test_ai_noop_provider() -> None:
     )
     assert response.status_code == 200
     assert response.json()[AIResponseKey.PROVIDER] == AIProviderName.NOOP
+
+
+def test_legacy_project_payload_does_not_create_legacy_none_code() -> None:
+    payload = LegacyMySQLService(None)._project_payload({"name": "Missing Id"}, {})
+
+    assert payload["code"] is None
+    assert payload["external_id"] is None