JiuContinent/company-ai-platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

```

Browse Source 
feat: 添加审批系统和遗留查询功能支持

- 添加审批系统，包括审批请求模型、服务和路由，支持创建、批准和拒绝操作
- 实现审批API密钥验证机制，区分普通API和审批API访问权限
- 添加Alembic数据库迁移支持，更新初始schema版本并添加降级保护
- 配置遗留MySQL查询白名单机制，支持命名查询和参数化查询
- 更新业务服务以集成审批流程，高风险操作需要审批票证
- 调整安全认证使用常量定义的HTTP头，增强安全性比较
- 优化.gitignore配置，添加日志目录排除和文档文件包含规则
- 更新Dockerfile添加alembic依赖包，修复OpenClaw适配器错误处理
```
This commit is contained in:
JiuContinent
2026-07-06 09:39:25 +08:00
parent ae5990eaef
commit e3a4a6d426
28 changed files with 536 additions and 86 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
tests/test_ai_adapters.py
View File

@@ -208,3 +208,32 @@ def test_openclaw_adapter_blocks_tools_not_in_allowlist(monkeypatch) -> None:
assert exc_info.value.status_code == 403
assert DummyClient.calls == []
def test_openclaw_hermes_adapter_fails_when_requested_tool_is_blocked(monkeypatch) -> None:
DummyClient.calls = []
monkeypatch.setattr(adapters.httpx, "Client", DummyClient)
settings = Settings(
model_provider="openclaw_hermes",
openclaw_http_url="http://openclaw.local",
openclaw_gateway_token="openclaw-key",
openclaw_allowed_tools=["sessions_list"],
hermes_base_url="http://hermes.local/v1",
hermes_api_key="hermes-key",
)
with pytest.raises(HTTPException) as exc_info:
adapters.OpenClawHermesAdapter(settings).ask(
"write through gateway",
{
AIContextKey.OPENCLAW_TOOL: "filesystem_write",
AIContextKey.OPENCLAW_ARGS: {"path": "/tmp/x"},
},
)
assert exc_info.value.status_code == 403
assert [call["url"] for call in DummyClient.calls] == [
"http://hermes.local/v1/chat/completions",
"http://openclaw.local/healthz",
"http://openclaw.local/readyz",
]

150
tests/test_smoke.py
View File

@@ -15,6 +15,8 @@ _db.close()
os.environ["DATABASE_URL"] = "sqlite:///" + _db.name.replace("\\", "/")
os.environ["API_KEY"] = "test-key"
os.environ["APPROVAL_API_KEY"] = "approval-key"
os.environ["APPROVAL_API_ACTOR"] = "approval-manager"
os.environ["FEISHU_APP_ID"] = ""
os.environ["FEISHU_APP_SECRET"] = ""
os.environ["FEISHU_VERIFICATION_TOKEN"] = "test-feishu-token"
@@ -25,7 +27,7 @@ from fastapi.testclient import TestClient
from app.core.config import get_settings
from app.core.database import Base, engine
from app.core.security import require_api_key
from app.core.security import require_api_key, require_approval_api_key
from app.main import app
from app.modules.legacy_mysql.service import LegacyMySQLService
from app.modules.reports.constants import (
@@ -41,6 +43,7 @@ from app.modules.reports.constants import (
Base.metadata.create_all(bind=engine)
client = TestClient(app)
headers = {"X-API-Key": "test-key"}
approval_headers = {"X-API-Key": "test-key", "X-Approval-API-Key": "approval-key"}
def teardown_module() -> None:
@@ -118,12 +121,25 @@ def test_api_key_and_feishu_webhook_fail_closed(monkeypatch) -> None:
json={"schema": "2.0", "header": {"event_type": "im.message.receive_v1"}},
)
assert response.status_code == 401
monkeypatch.setenv("APPROVAL_API_KEY", "")
get_settings.cache_clear()
with pytest.raises(HTTPException) as approval_exc_info:
require_approval_api_key("approval-key")
assert approval_exc_info.value.status_code == 503
finally:
monkeypatch.setenv("API_KEY", "test-key")
monkeypatch.setenv("APPROVAL_API_KEY", "approval-key")
get_settings.cache_clear()
def test_approval_gate_for_high_risk_update() -> None:
create_payload = {
"code": "FUND-SMOKE-001",
"name": "Main Account",
"current_balance": 1000,
"safety_line": 500,
}
blocked_create_response = client.post(
"/api/v1/business/fund-accounts",
headers=headers,
@@ -145,7 +161,7 @@ def test_approval_gate_for_high_risk_update() -> None:
"action": "create:fund-accounts",
"applicant": "spoofed-user",
"reason": "Smoke test account creation",
"payload": {"code": "FUND-SMOKE-001"},
"payload": create_payload,
},
)
assert create_approval_response.status_code == 200
@@ -154,11 +170,11 @@ def test_approval_gate_for_high_risk_update() -> None:
approve_create_response = client.post(
f"/api/v1/approvals/{create_ticket_id}/approve",
headers=headers,
headers=approval_headers,
json={"approver": "spoofed-manager", "comment": "ok"},
)
assert approve_create_response.status_code == 200
assert approve_create_response.json()["approver"] == "api"
assert approve_create_response.json()["approver"] == "approval-manager"
create_response = client.post(
"/api/v1/business/fund-accounts",
@@ -166,17 +182,25 @@ def test_approval_gate_for_high_risk_update() -> None:
json={
"actor": "spoofed-user",
"approval_ticket_id": create_ticket_id,
"data": {
"code": "FUND-SMOKE-001",
"name": "Main Account",
"current_balance": 1000,
"safety_line": 500,
},
"data": create_payload,
},
)
assert create_response.status_code == 200
record_id = create_response.json()["data"]["id"]
reuse_create_response = client.post(
"/api/v1/business/fund-accounts",
headers=headers,
json={
"approval_ticket_id": create_ticket_id,
"data": {
"code": "FUND-SMOKE-REUSE",
"name": "Reuse Account",
},
},
)
assert reuse_create_response.status_code == 403
blocked_response = client.patch(
f"/api/v1/business/fund-accounts/{record_id}",
headers=headers,
@@ -212,12 +236,23 @@ def test_approval_gate_for_high_risk_update() -> None:
approve_response = client.post(
f"/api/v1/approvals/{ticket_id}/approve",
headers=headers,
headers=approval_headers,
json={"approver": "spoofed-manager", "comment": "ok"},
)
assert approve_response.status_code == 200
assert approve_response.json()["status"] == "approved"
assert approve_response.json()["approver"] == "api"
assert approve_response.json()["approver"] == "approval-manager"
mismatch_response = client.patch(
f"/api/v1/business/fund-accounts/{record_id}",
headers=headers,
json={
"actor": "spoofed-user",
"approval_ticket_id": ticket_id,
"data": {"current_balance": 101},
},
)
assert mismatch_response.status_code == 403
update_response = client.patch(
f"/api/v1/business/fund-accounts/{record_id}",
@@ -231,6 +266,17 @@ def test_approval_gate_for_high_risk_update() -> None:
assert update_response.status_code == 200
assert update_response.json()["data"]["current_balance"] == 100.0
reuse_update_response = client.patch(
f"/api/v1/business/fund-accounts/{record_id}",
headers=headers,
json={
"actor": "spoofed-user",
"approval_ticket_id": ticket_id,
"data": {"current_balance": 100},
},
)
assert reuse_update_response.status_code == 403
def test_new_ledgers_reports_and_risk_events() -> None:
domains_response = client.get("/api/v1/business/domains", headers=headers)
@@ -437,6 +483,59 @@ def test_project_lifecycle_report_summarizes_progress_cost_and_risk() -> None:
)
def test_work_report_counts_pending_approval_backlog_outside_period() -> None:
today = date.today()
project_code = "P-BACKLOG-001"
old_created_at = (today - timedelta(days=30)).isoformat() + "T00:00:00"
procurement_response = client.post(
"/api/v1/business/procurements",
headers=headers,
json={
"data": {
"code": "PROC-BACKLOG-001",
"name": "Backlog procurement",
"project_code": project_code,
"approval_status": StatusValue.PENDING_APPROVAL,
"created_at": old_created_at,
},
},
)
assert procurement_response.status_code == 200
expense_response = client.post(
"/api/v1/business/expenses",
headers=headers,
json={
"data": {
"code": "EXP-BACKLOG-001",
"expense_type": "办公",
"amount": 50,
"project_code": project_code,
"approval_status": StatusValue.PENDING_APPROVAL,
"created_at": old_created_at,
},
},
)
assert expense_response.status_code == 200
report_response = client.post(
"/api/v1/reports/work-reports/generate",
headers=headers,
json={
"report_type": ReportType.DAILY,
"project_code": project_code,
"period_start": today.isoformat(),
"period_end": today.isoformat(),
"persist": False,
},
)
assert report_response.status_code == 200
metrics = report_response.json()["report"]["metrics"]
assert metrics["procurements_pending"] == 1
assert metrics["expenses_pending"] == 1
def test_ai_noop_provider() -> None:
response = client.post(
"/api/v1/ai/ask",
@@ -456,3 +555,30 @@ def test_legacy_project_payload_does_not_create_legacy_none_code() -> None:
assert payload["code"] is None
assert payload["external_id"] is None
def test_legacy_readonly_query_requires_allowlist(monkeypatch) -> None:
monkeypatch.delenv("LEGACY_PROJECT_QUERY", raising=False)
get_settings.cache_clear()
try:
with pytest.raises(HTTPException) as blocked_exc_info:
LegacyMySQLService(None).execute_readonly("SELECT id FROM secret_projects")
assert blocked_exc_info.value.status_code == 403
monkeypatch.setenv("LEGACY_PROJECT_QUERY", "SELECT id FROM projects")
get_settings.cache_clear()
def unavailable_engine():
raise HTTPException(status_code=503, detail="legacy unavailable")
monkeypatch.setattr(
LegacyMySQLService,
"_ensure_engine",
staticmethod(unavailable_engine),
)
with pytest.raises(HTTPException) as engine_exc_info:
LegacyMySQLService(None).execute_readonly("SELECT id FROM projects")
assert engine_exc_info.value.status_code == 503
finally:
monkeypatch.delenv("LEGACY_PROJECT_QUERY", raising=False)
get_settings.cache_clear()