JiuContinent
ae5990eaef
feat(core): 添加API认证主体配置和安全验证 - 在Settings中添加api_actor字段，用于标识API调用方身份 - 创建ApiPrincipal数据类来表示服务主体 - 修改require_api_key函数返回认证的服务主体信息 - 更新配置文件引入ActorValue常量 feat(ai_agent): 增强OpenClaw工具调用的安全性检查 - 实现_openclaw_allowed_tools和openclaw_allowed_actions配置项 - 添加CSV列表解析验证器 - 实现工具和操作权限检查方法_ensure_tool_allowed - 在工具调用前验证允许的工具和操作类型 feat(security): 强化API密钥认证和审计安全性 - 更新require_api_key函数在缺少API_KEY时抛出异常 - 在AI代理、审批、飞书等模块的路由中统一使用ApiPrincipal获取调用方信息 - 替换硬编码的ActorValue.API为动态的principal.actor feat(audit): 实现安全审计负载脱敏处理 - 添加敏感键名集合AI_AUDIT_SENSITIVE_KEYS - 实现审计安全负载处理函数_audit_safe_payload - 支持深度遍历、文本截断、序列限制和敏感信息脱敏 - 在AI服务的审计日志中应用安全负载处理 feat(approval): 完善审批流程的申请人身份验证 - 更新审批创建接口使用认证主体作为申请人 - 使用utc_now替换datetime.utcnow确保时间一致性 - 修复审批逻辑中的条件判断问题 feat(business): 加强业务领域高风险操作的审批控制 - 为高风险域创建统一的审批验证方法_ensure_approved - 在创建和更新操作中强制要求审批票证 - 为项目同步功能添加认证主体参数 feat(config): 统一时间处理使用UTC时间函数 - 创建并使用utc_now函数替代datetime.utcnow - 在审批、审计、业务、遗留数据等模块中更新时间戳处理 feat(constants): 扩展风险事件类型和报告指标 - 添加新风险事件类型到GENERATED_RISK_EVENT_TYPES - 为报告模块添加外部开放和高风险事件指标 refactor(feishu): 增强飞书验证令牌安全检查 - 确保飞书验证令牌配置存在时才接受请求 - 修正令牌验证逻辑以提高安全性 ```
150 lines
3.6 KiB
Python
150 lines
3.6 KiB
Python
from enum import StrEnum
|
|
|
|
|
|
class AIProviderName(StrEnum):
|
|
NOOP = "noop"
|
|
OPENCLAW = "openclaw"
|
|
HERMES = "hermes"
|
|
OPENCLAW_HERMES = "openclaw_hermes"
|
|
OPENCLAW_HERMES_DASH = "openclaw-hermes"
|
|
HYBRID = "hybrid"
|
|
DIRECT_LLM = "direct_llm"
|
|
|
|
|
|
class AIResponseKey(StrEnum):
|
|
PROVIDER = "provider"
|
|
ANSWER = "answer"
|
|
RAW = "raw"
|
|
RESULT = "result"
|
|
OK = "ok"
|
|
ERROR = "error"
|
|
MESSAGE = "message"
|
|
TYPE = "type"
|
|
BASE_URL = "base_url"
|
|
HEALTH = "health"
|
|
HEALTHZ = "healthz"
|
|
READYZ = "readyz"
|
|
DATA = "data"
|
|
STATUS_CODE = "status_code"
|
|
TEXT = "text"
|
|
PIPELINE = "pipeline"
|
|
HERMES_RECALL = "hermes_recall"
|
|
HERMES_ANSWER = "hermes_answer"
|
|
HERMES_REMEMBER = "hermes_remember"
|
|
OPENCLAW = "openclaw"
|
|
TOOL = "tool"
|
|
TOOL_INVOKED = "tool_invoked"
|
|
TOOL_ERROR = "tool_error"
|
|
|
|
|
|
class AIRequestKey(StrEnum):
|
|
PROMPT = "prompt"
|
|
CONTEXT = "context"
|
|
|
|
|
|
class AIContextKey(StrEnum):
|
|
OPENCLAW_TOOL = "openclaw_tool"
|
|
OPENCLAW_ACTION = "openclaw_action"
|
|
OPENCLAW_ARGS = "openclaw_args"
|
|
OPENCLAW_SESSION_KEY = "openclaw_session_key"
|
|
AGENT_PIPELINE = "agent_pipeline"
|
|
HERMES_MEMORY = "hermes_memory"
|
|
OPENCLAW = "openclaw"
|
|
MODE = "mode"
|
|
USER_PROMPT = "user_prompt"
|
|
REQUEST_CONTEXT = "request_context"
|
|
ASSISTANT_ANSWER = "assistant_answer"
|
|
|
|
|
|
class AIMemoryMode(StrEnum):
|
|
RECALL = "memory_recall"
|
|
WRITE = "memory_write"
|
|
|
|
|
|
class AIHttpPath(StrEnum):
|
|
CHAT_COMPLETIONS = "/chat/completions"
|
|
HEALTH = "/health"
|
|
HEALTHZ = "/healthz"
|
|
READYZ = "/readyz"
|
|
TOOLS_INVOKE = "/tools/invoke"
|
|
V1 = "/v1"
|
|
|
|
|
|
class AIHttpHeader(StrEnum):
|
|
AUTHORIZATION = "Authorization"
|
|
HERMES_SESSION_ID = "X-Hermes-Session-Id"
|
|
|
|
|
|
class AIHttpPayloadKey(StrEnum):
|
|
MODEL = "model"
|
|
MESSAGES = "messages"
|
|
ROLE = "role"
|
|
CONTENT = "content"
|
|
STREAM = "stream"
|
|
TOOL = "tool"
|
|
ACTION = "action"
|
|
ARGS = "args"
|
|
SESSION_KEY = "sessionKey"
|
|
CHOICES = "choices"
|
|
MESSAGE = "message"
|
|
|
|
|
|
class AIChatRole(StrEnum):
|
|
SYSTEM = "system"
|
|
USER = "user"
|
|
|
|
|
|
class AIDefault(StrEnum):
|
|
ACTION_JSON = "json"
|
|
SESSION_KEY_MAIN = "main"
|
|
|
|
|
|
class AIRiskPreference(StrEnum):
|
|
BALANCED = "balanced"
|
|
|
|
|
|
class AIErrorKey(StrEnum):
|
|
OPENCLAW = "openclaw_error"
|
|
HERMES = "hermes_error"
|
|
DIRECT_LLM = "llm_error"
|
|
|
|
|
|
OPENCLAW_HERMES_PIPELINE = (
|
|
"hermes_recall -> openclaw_gateway -> hermes_answer -> hermes_remember"
|
|
)
|
|
COMPANY_MANAGEMENT_SYSTEM_INSTRUCTIONS = (
|
|
"You are a company management AI. Be concise, cite data from context, "
|
|
"and never approve payments, performance changes, or trades automatically."
|
|
)
|
|
CHAT_USER_CONTENT_TEMPLATE = "Context:\n{context}\n\nTask:\n{task}"
|
|
AUTHORIZATION_BEARER_TEMPLATE = "Bearer {token}"
|
|
NOOP_PROVIDER_ANSWER = (
|
|
"AI provider is not configured yet. This is a deterministic placeholder. "
|
|
"Set MODEL_PROVIDER to openclaw_hermes, openclaw, hermes, or direct_llm "
|
|
"after credentials are ready."
|
|
)
|
|
OPENCLAW_TOOL_COMPLETED_ANSWER = "OpenClaw tool invocation completed."
|
|
DIRECT_LLM_API_KEY_MISSING = "DIRECT_LLM_API_KEY is not configured"
|
|
UNEXPECTED_HERMES_RESPONSE = "Unexpected chat completion response"
|
|
|
|
AI_AUDIT_REDACTED_VALUE = "[REDACTED]"
|
|
AI_AUDIT_TRUNCATED_VALUE = "[TRUNCATED]"
|
|
AI_AUDIT_MAX_TEXT_LENGTH = 1000
|
|
AI_AUDIT_MAX_SEQUENCE_ITEMS = 20
|
|
AI_AUDIT_MAX_DEPTH = 4
|
|
AI_AUDIT_SENSITIVE_KEYS = frozenset(
|
|
{
|
|
"authorization",
|
|
"api_key",
|
|
"apikey",
|
|
"access_token",
|
|
"tenant_access_token",
|
|
"token",
|
|
"secret",
|
|
"password",
|
|
"openclaw_gateway_token",
|
|
"hermes_api_key",
|
|
"direct_llm_api_key",
|
|
}
|
|
)
|