JiuContinent
ae5990eaef
feat(core): 添加API认证主体配置和安全验证 - 在Settings中添加api_actor字段，用于标识API调用方身份 - 创建ApiPrincipal数据类来表示服务主体 - 修改require_api_key函数返回认证的服务主体信息 - 更新配置文件引入ActorValue常量 feat(ai_agent): 增强OpenClaw工具调用的安全性检查 - 实现_openclaw_allowed_tools和openclaw_allowed_actions配置项 - 添加CSV列表解析验证器 - 实现工具和操作权限检查方法_ensure_tool_allowed - 在工具调用前验证允许的工具和操作类型 feat(security): 强化API密钥认证和审计安全性 - 更新require_api_key函数在缺少API_KEY时抛出异常 - 在AI代理、审批、飞书等模块的路由中统一使用ApiPrincipal获取调用方信息 - 替换硬编码的ActorValue.API为动态的principal.actor feat(audit): 实现安全审计负载脱敏处理 - 添加敏感键名集合AI_AUDIT_SENSITIVE_KEYS - 实现审计安全负载处理函数_audit_safe_payload - 支持深度遍历、文本截断、序列限制和敏感信息脱敏 - 在AI服务的审计日志中应用安全负载处理 feat(approval): 完善审批流程的申请人身份验证 - 更新审批创建接口使用认证主体作为申请人 - 使用utc_now替换datetime.utcnow确保时间一致性 - 修复审批逻辑中的条件判断问题 feat(business): 加强业务领域高风险操作的审批控制 - 为高风险域创建统一的审批验证方法_ensure_approved - 在创建和更新操作中强制要求审批票证 - 为项目同步功能添加认证主体参数 feat(config): 统一时间处理使用UTC时间函数 - 创建并使用utc_now函数替代datetime.utcnow - 在审批、审计、业务、遗留数据等模块中更新时间戳处理 feat(constants): 扩展风险事件类型和报告指标 - 添加新风险事件类型到GENERATED_RISK_EVENT_TYPES - 为报告模块添加外部开放和高风险事件指标 refactor(feishu): 增强飞书验证令牌安全检查 - 确保飞书验证令牌配置存在时才接受请求 - 修正令牌验证逻辑以提高安全性 ```
100 lines
3.4 KiB
Python
100 lines
3.4 KiB
Python
from typing import Any
|
|
|
|
from fastapi import HTTPException, status
|
|
from sqlalchemy.orm import Session
|
|
|
|
from app.core.constants import ActorValue
|
|
from app.core.config import get_settings
|
|
from app.modules.audit.constants import AuditAction, AuditSource
|
|
from app.modules.audit.schemas import AuditLogCreate
|
|
from app.modules.audit.service import AuditService
|
|
from app.modules.feishu.client import FeishuClient
|
|
from app.modules.feishu.constants import FeishuPayloadKey, FeishuReceiveIdType
|
|
|
|
|
|
class FeishuService:
|
|
"""Send Feishu messages and record audit entries for outbound actions."""
|
|
|
|
def __init__(self, db: Session):
|
|
self.db = db
|
|
self.audit = AuditService(db)
|
|
self.client = FeishuClient()
|
|
|
|
def verify_event(self, payload: dict[str, Any]) -> None:
|
|
settings = get_settings()
|
|
expected = settings.feishu_verification_token
|
|
header = payload.get("header") or {}
|
|
token = payload.get("token") or header.get("token")
|
|
if not expected:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
|
|
detail="FEISHU_VERIFICATION_TOKEN is required",
|
|
)
|
|
if not token or token != expected:
|
|
raise HTTPException(
|
|
status_code=status.HTTP_401_UNAUTHORIZED,
|
|
detail="Invalid Feishu token",
|
|
)
|
|
|
|
def send_text(
|
|
self,
|
|
text: str,
|
|
receive_id: str | None = None,
|
|
receive_id_type: str = FeishuReceiveIdType.CHAT_ID,
|
|
actor: str = ActorValue.SYSTEM,
|
|
) -> dict[str, Any]:
|
|
result = self.client.send_text(text, receive_id, receive_id_type)
|
|
self.audit.log(
|
|
AuditLogCreate(
|
|
actor=actor,
|
|
source=AuditSource.FEISHU,
|
|
action=AuditAction.FEISHU_SEND_TEXT,
|
|
request_payload={
|
|
FeishuPayloadKey.RECEIVE_ID: receive_id,
|
|
FeishuPayloadKey.RECEIVE_ID_TYPE: receive_id_type,
|
|
FeishuPayloadKey.TEXT: text,
|
|
},
|
|
response_payload=result,
|
|
)
|
|
)
|
|
return result
|
|
|
|
def send_card(
|
|
self,
|
|
card: dict[str, Any],
|
|
receive_id: str | None = None,
|
|
receive_id_type: str = FeishuReceiveIdType.CHAT_ID,
|
|
actor: str = ActorValue.SYSTEM,
|
|
) -> dict[str, Any]:
|
|
result = self.client.send_card(card, receive_id, receive_id_type)
|
|
self.audit.log(
|
|
AuditLogCreate(
|
|
actor=actor,
|
|
source=AuditSource.FEISHU,
|
|
action=AuditAction.FEISHU_SEND_CARD,
|
|
request_payload={
|
|
FeishuPayloadKey.RECEIVE_ID: receive_id,
|
|
FeishuPayloadKey.RECEIVE_ID_TYPE: receive_id_type,
|
|
FeishuPayloadKey.CARD: card,
|
|
},
|
|
response_payload=result,
|
|
)
|
|
)
|
|
return result
|
|
|
|
@staticmethod
|
|
def build_basic_card(title: str, lines: list[str]) -> dict[str, Any]:
|
|
return {
|
|
"config": {"wide_screen_mode": True},
|
|
"header": {"title": {"tag": "plain_text", "content": title}},
|
|
"elements": [
|
|
{
|
|
"tag": "div",
|
|
"text": {
|
|
"tag": "lark_md",
|
|
"content": "\n".join(lines) or "暂无数据",
|
|
},
|
|
}
|
|
],
|
|
}
|