Files
company-ai-platform/tests/test_ai_adapters.py
JiuContinent ae5990eaef ```
feat(core): 添加API认证主体配置和安全验证

- 在Settings中添加api_actor字段,用于标识API调用方身份
- 创建ApiPrincipal数据类来表示服务主体
- 修改require_api_key函数返回认证的服务主体信息
- 更新配置文件引入ActorValue常量

feat(ai_agent): 增强OpenClaw工具调用的安全性检查

- 实现_openclaw_allowed_tools和openclaw_allowed_actions配置项
- 添加CSV列表解析验证器
- 实现工具和操作权限检查方法_ensure_tool_allowed
- 在工具调用前验证允许的工具和操作类型

feat(security): 强化API密钥认证和审计安全性

- 更新require_api_key函数在缺少API_KEY时抛出异常
- 在AI代理、审批、飞书等模块的路由中统一使用ApiPrincipal获取调用方信息
- 替换硬编码的ActorValue.API为动态的principal.actor

feat(audit): 实现安全审计负载脱敏处理

- 添加敏感键名集合AI_AUDIT_SENSITIVE_KEYS
- 实现审计安全负载处理函数_audit_safe_payload
- 支持深度遍历、文本截断、序列限制和敏感信息脱敏
- 在AI服务的审计日志中应用安全负载处理

feat(approval): 完善审批流程的申请人身份验证

- 更新审批创建接口使用认证主体作为申请人
- 使用utc_now替换datetime.utcnow确保时间一致性
- 修复审批逻辑中的条件判断问题

feat(business): 加强业务领域高风险操作的审批控制

- 为高风险域创建统一的审批验证方法_ensure_approved
- 在创建和更新操作中强制要求审批票证
- 为项目同步功能添加认证主体参数

feat(config): 统一时间处理使用UTC时间函数

- 创建并使用utc_now函数替代datetime.utcnow
- 在审批、审计、业务、遗留数据等模块中更新时间戳处理

feat(constants): 扩展风险事件类型和报告指标

- 添加新风险事件类型到GENERATED_RISK_EVENT_TYPES
- 为报告模块添加外部开放和高风险事件指标

refactor(feishu): 增强飞书验证令牌安全检查

- 确保飞书验证令牌配置存在时才接受请求
- 修正令牌验证逻辑以提高安全性
```
2026-07-06 00:11:44 +08:00

211 lines
7.5 KiB
Python

from typing import Any
import pytest
from fastapi import HTTPException
from app.core.config import Settings
from app.modules.ai_agent import adapters
from app.modules.ai_agent.constants import (
OPENCLAW_HERMES_PIPELINE,
AIChatRole,
AIContextKey,
AIHttpHeader,
AIHttpPath,
AIHttpPayloadKey,
AIMemoryMode,
AIResponseKey,
)
class DummyResponse:
def __init__(self, data: dict[str, Any], status_code: int = 200):
self._data = data
self.status_code = status_code
self.text = str(data)
def json(self) -> dict[str, Any]:
return self._data
def chat_response(content: str) -> DummyResponse:
return DummyResponse(
{
AIHttpPayloadKey.CHOICES: [
{
AIHttpPayloadKey.MESSAGE: {
AIHttpPayloadKey.CONTENT: content,
}
}
]
}
)
class DummyClient:
calls: list[dict[str, Any]] = []
def __init__(self, timeout: int, trust_env: bool = True):
self.timeout = timeout
self.trust_env = trust_env
def __enter__(self) -> "DummyClient":
return self
def __exit__(self, exc_type, exc, traceback) -> None:
return None
def post(
self,
url: str,
json: dict[str, Any],
headers: dict[str, str],
) -> DummyResponse:
self.calls.append({"method": "POST", "url": url, "json": json, "headers": headers})
if url.endswith(AIHttpPath.CHAT_COMPLETIONS):
user_content = json[AIHttpPayloadKey.MESSAGES][-1][AIHttpPayloadKey.CONTENT]
if AIMemoryMode.RECALL in user_content:
return chat_response("remembered project preference")
if AIMemoryMode.WRITE in user_content:
return chat_response("stored")
if AIContextKey.AGENT_PIPELINE in user_content:
return chat_response("hermes final answer")
return chat_response("hermes direct answer")
if url.endswith(AIHttpPath.TOOLS_INVOKE):
return DummyResponse(
{
AIResponseKey.OK: True,
AIHttpPayloadKey.TOOL: json[AIHttpPayloadKey.TOOL],
AIHttpPayloadKey.ACTION: json[AIHttpPayloadKey.ACTION],
AIHttpPayloadKey.ARGS: json[AIHttpPayloadKey.ARGS],
AIHttpPayloadKey.SESSION_KEY: json[AIHttpPayloadKey.SESSION_KEY],
}
)
raise AssertionError(f"unexpected URL: {url}")
def get(self, url: str, headers: dict[str, str]) -> DummyResponse:
self.calls.append({"method": "GET", "url": url, "headers": headers})
if url.endswith(AIHttpPath.HEALTHZ):
return DummyResponse({"status": "ok"})
if url.endswith(AIHttpPath.READYZ):
return DummyResponse({"status": "ready"})
if url.endswith(AIHttpPath.HEALTH):
return DummyResponse({"status": "ok", "platform": "hermes-agent"})
raise AssertionError(f"unexpected URL: {url}")
def test_hermes_adapter_uses_openai_chat_completions(monkeypatch) -> None:
DummyClient.calls = []
monkeypatch.setattr(adapters.httpx, "Client", DummyClient)
settings = Settings(
hermes_base_url="http://hermes.local/v1",
hermes_api_key="hermes-key",
hermes_model="hermes-agent",
hermes_session_id="company-ai-platform-test",
)
result = adapters.HermesAdapter(settings).ask(
"summarize project risk",
{"project_code": "P-001"},
)
assert result[AIResponseKey.ANSWER] == "hermes direct answer"
assert DummyClient.calls[0]["url"] == "http://hermes.local/v1/chat/completions"
assert DummyClient.calls[0]["headers"][AIHttpHeader.AUTHORIZATION] == "Bearer hermes-key"
assert (
DummyClient.calls[0]["headers"][AIHttpHeader.HERMES_SESSION_ID]
== "company-ai-platform-test"
)
assert DummyClient.calls[0]["json"][AIHttpPayloadKey.MODEL] == "hermes-agent"
assert (
DummyClient.calls[0]["json"][AIHttpPayloadKey.MESSAGES][0][AIHttpPayloadKey.ROLE]
== AIChatRole.SYSTEM
)
assert "P-001" in DummyClient.calls[0]["json"][AIHttpPayloadKey.MESSAGES][1][
AIHttpPayloadKey.CONTENT
]
def test_openclaw_adapter_uses_gateway_health_and_tool_invoke(monkeypatch) -> None:
DummyClient.calls = []
monkeypatch.setattr(adapters.httpx, "Client", DummyClient)
settings = Settings(
openclaw_http_url="http://openclaw.local",
openclaw_gateway_token="gateway-token",
openclaw_allowed_tools=["sessions_list"],
)
health = adapters.OpenClawAdapter(settings).health()
result = adapters.OpenClawAdapter(settings).ask(
"list sessions",
{
AIContextKey.OPENCLAW_TOOL: "sessions_list",
AIContextKey.OPENCLAW_ARGS: {},
AIContextKey.OPENCLAW_SESSION_KEY: "main",
},
)
assert health[AIResponseKey.OK] is True
assert result[AIResponseKey.RAW][AIResponseKey.DATA][AIHttpPayloadKey.TOOL] == "sessions_list"
assert [call["url"] for call in DummyClient.calls] == [
"http://openclaw.local/healthz",
"http://openclaw.local/readyz",
"http://openclaw.local/tools/invoke",
]
assert DummyClient.calls[0]["headers"][AIHttpHeader.AUTHORIZATION] == "Bearer gateway-token"
assert DummyClient.calls[2]["json"][AIHttpPayloadKey.SESSION_KEY] == "main"
def test_openclaw_hermes_adapter_runs_recall_answer_and_remember(monkeypatch) -> None:
DummyClient.calls = []
monkeypatch.setattr(adapters.httpx, "Client", DummyClient)
settings = Settings(
model_provider="openclaw_hermes",
openclaw_http_url="http://openclaw.local",
openclaw_gateway_token="openclaw-key",
openclaw_allowed_tools=["sessions_list"],
hermes_base_url="http://hermes.local/v1",
hermes_api_key="hermes-key",
)
result = adapters.OpenClawHermesAdapter(settings).ask(
"summarize project risk",
{
"project_code": "P-001",
AIContextKey.OPENCLAW_TOOL: "sessions_list",
AIContextKey.OPENCLAW_ARGS: {},
},
)
assert result[AIResponseKey.ANSWER] == "hermes final answer"
assert result[AIResponseKey.RAW][AIResponseKey.PIPELINE] == OPENCLAW_HERMES_PIPELINE
assert [call["url"] for call in DummyClient.calls] == [
"http://hermes.local/v1/chat/completions",
"http://openclaw.local/healthz",
"http://openclaw.local/readyz",
"http://openclaw.local/tools/invoke",
"http://hermes.local/v1/chat/completions",
"http://hermes.local/v1/chat/completions",
]
assert DummyClient.calls[0]["headers"][AIHttpHeader.AUTHORIZATION] == "Bearer hermes-key"
assert DummyClient.calls[1]["headers"][AIHttpHeader.AUTHORIZATION] == "Bearer openclaw-key"
assert DummyClient.calls[3]["json"][AIHttpPayloadKey.TOOL] == "sessions_list"
assert AIContextKey.OPENCLAW in DummyClient.calls[4]["json"][AIHttpPayloadKey.MESSAGES][1][
AIHttpPayloadKey.CONTENT
]
def test_openclaw_adapter_blocks_tools_not_in_allowlist(monkeypatch) -> None:
DummyClient.calls = []
monkeypatch.setattr(adapters.httpx, "Client", DummyClient)
settings = Settings(
openclaw_http_url="http://openclaw.local",
openclaw_gateway_token="gateway-token",
openclaw_allowed_tools=["sessions_list"],
)
with pytest.raises(HTTPException) as exc_info:
adapters.OpenClawAdapter(settings).invoke_tool("filesystem_write")
assert exc_info.value.status_code == 403
assert DummyClient.calls == []