group_fqcd_jr/app/service/risk_evidence_archive_service.py

"""风控证据文件归档 Service。

文件只写入项目受控目录；数据库只更新已有 `fin_risk_alert.evidence_snapshot`，
不假设存在独立的 `evidence_archived` 字段。
"""

from __future__ import annotations

import io
import os
import re
from datetime import UTC, datetime
from hashlib import sha256
from pathlib import Path
from uuid import uuid4
from zipfile import BadZipFile, ZipFile

from fastapi import UploadFile
from sqlalchemy import ColumnElement, false, select
from sqlalchemy.ext.asyncio import AsyncSession

from app.core.contracts import RequestContext
from app.core.errors import ConflictAgentError, RecoverableAgentError, ValidationAgentError
from app.model.audit import InteractionAudit
from app.model.fund import FundRiskAlert
from app.service.authorization_service import AuthorizationService

ALERT_NO_PATTERN = re.compile(r"^[A-Za-z0-9_-]{1,64}$")
ALLOWED_EXTENSIONS = {
    ".jpg",
    ".jpeg",
    ".png",
    ".webp",
    ".pdf",
    ".doc",
    ".docx",
    ".xls",
    ".xlsx",
    ".ppt",
    ".pptx",
    ".txt",
}
OFFICE_ZIP_ROOTS = {".docx": "word/", ".xlsx": "xl/", ".pptx": "ppt/"}
OLE_SIGNATURE = bytes.fromhex("D0CF11E0A1B11AE1")


class RiskEvidenceValidationError(ValidationAgentError):
    """证据文件不符合归档要求。"""


class RiskEvidenceSizeError(RiskEvidenceValidationError):
    """证据文件超过大小限制。"""

    status_code = 413


class RiskEvidenceAlreadyArchivedError(ConflictAgentError):
    """当前预警已经归档证据。"""


class RiskEvidenceStorageError(RecoverableAgentError):
    """证据文件无法安全写入。"""


class RiskEvidenceArchiveService:
    def __init__(
        self,
        session: AsyncSession,
        *,
        root: Path | None = None,
        max_bytes: int | None = None,
    ) -> None:
        self.session = session
        self.root = root or _default_root()
        self.max_bytes = max_bytes or _default_max_bytes()

    async def archive(
        self,
        alert_no: str,
        upload: UploadFile,
        context: RequestContext,
    ) -> dict[str, object]:
        await AuthorizationService.require(context, "risk:alert:write")
        statement = (
            select(FundRiskAlert)
            .where(FundRiskAlert.alert_no == alert_no)
            .with_for_update()
        )
        scope = _scope_condition(context)
        if scope is not None:
            statement = statement.where(scope)
        alert = await self.session.scalar(statement)
        if alert is None:
            raise RiskEvidenceValidationError("预警不存在")
        if alert.ack_at is None or alert.ack_status != "已确认":
            raise RiskEvidenceAlreadyArchivedError("请先确认接收预警")
        if alert.status != "调查中":
            raise RiskEvidenceAlreadyArchivedError("只有调查中的预警可以归档证据")
        if not ALERT_NO_PATTERN.fullmatch(alert.alert_no):
            raise RiskEvidenceStorageError("预警编号不符合文件归档要求")
        snapshot = dict(alert.evidence_snapshot or {})
        if snapshot.get("evidence_archive"):
            raise RiskEvidenceAlreadyArchivedError("当前预警已经归档证据，不能重复上传")

        extension, content = await self._read_and_validate(upload)
        root = self._safe_root()
        target = root / f"{alert.alert_no}{extension}"
        if any(root.glob(f"{alert.alert_no}.*")):
            raise RiskEvidenceAlreadyArchivedError("当前预警证据文件已存在，不能覆盖")
        temporary = root / f".{alert.alert_no}.{uuid4().hex}.tmp"
        committed = False
        try:
            temporary.write_bytes(content)
            temporary.replace(target)
            snapshot["evidence_archive"] = {
                "stored_name": target.name,
                "file_size": len(content),
                "sha256": sha256(content).hexdigest(),
            }
            alert.evidence_snapshot = snapshot
            self.session.add(InteractionAudit(
                actor_type="user",
                actor_id=int(context.user_id),
                target_customer_id=alert.customer_id,
                portal="api",
                action_type="risk_evidence_archived",
                detail={
                    "alert_no": alert.alert_no,
                    "stored_name": target.name,
                    "file_size": len(content),
                    "sha256": sha256(content).hexdigest(),
                },
                created_at=datetime.now(UTC).replace(tzinfo=None),
            ))
            await self.session.commit()
            committed = True
        except OSError as error:
            await self.session.rollback()
            raise RiskEvidenceStorageError("证据文件写入失败") from error
        except Exception:
            await self.session.rollback()
            raise
        finally:
            temporary.unlink(missing_ok=True)
            if not committed:
                target.unlink(missing_ok=True)
        return {
            "alert_no": alert.alert_no,
            "evidence_archived": True,
            "stored_name": target.name,
            "file_size": len(content),
        }

    async def _read_and_validate(self, upload: UploadFile) -> tuple[str, bytes]:
        filename = Path(upload.filename or "").name
        extension = Path(filename).suffix.lower()
        if extension not in ALLOWED_EXTENSIONS:
            raise RiskEvidenceValidationError("仅支持图片、PDF、Office 文档和 TXT 文件")
        content = await upload.read(self.max_bytes + 1)
        if not content:
            raise RiskEvidenceValidationError("证据文件不能为空")
        if len(content) > self.max_bytes:
            raise RiskEvidenceSizeError("证据文件超过大小限制")
        self._validate_signature(extension, content)
        return extension, content

    def _safe_root(self) -> Path:
        project_root = Path(__file__).resolve().parents[2]
        root = self.root if self.root.is_absolute() else project_root / self.root
        root = root.resolve()
        try:
            root.relative_to(project_root.resolve())
        except ValueError as error:
            raise RiskEvidenceStorageError("证据目录必须位于项目目录内") from error
        try:
            root.mkdir(parents=True, exist_ok=True)
        except OSError as error:
            raise RiskEvidenceStorageError("证据目录不可用") from error
        return root

    @staticmethod
    def _validate_signature(extension: str, content: bytes) -> None:
        signatures = {
            ".jpg": b"\xff\xd8\xff",
            ".jpeg": b"\xff\xd8\xff",
            ".png": b"\x89PNG\r\n\x1a\n",
            ".pdf": b"%PDF-",
        }
        if extension in signatures and not content.startswith(signatures[extension]):
            raise RiskEvidenceValidationError("文件内容与扩展名不一致")
        if extension == ".webp" and not (
            content.startswith(b"RIFF") and content[8:12] == b"WEBP"
        ):
            raise RiskEvidenceValidationError("文件内容与扩展名不一致")
        if extension in {".doc", ".xls", ".ppt"} and not content.startswith(OLE_SIGNATURE):
            raise RiskEvidenceValidationError("文件内容与扩展名不一致")
        if extension in OFFICE_ZIP_ROOTS:
            try:
                with ZipFile(io.BytesIO(content)) as archive:
                    names = archive.namelist()
            except BadZipFile as error:
                raise RiskEvidenceValidationError("Office 文件结构无效") from error
            if (
                "[Content_Types].xml" not in names
                or not any(name.startswith(OFFICE_ZIP_ROOTS[extension]) for name in names)
            ):
                raise RiskEvidenceValidationError("文件内容与扩展名不一致")
        if extension == ".txt":
            try:
                text = content.decode("utf-8-sig")
            except UnicodeDecodeError as error:
                raise RiskEvidenceValidationError("TXT 文件必须使用 UTF-8 编码") from error
            if "\x00" in text:
                raise RiskEvidenceValidationError("TXT 文件内容无效")


def _scope_condition(context: RequestContext) -> ColumnElement[bool] | None:
    if context.data_scope == "all":
        return None
    if not context.customer_ids:
        return false()
    return FundRiskAlert.customer_id.in_(
        tuple(int(customer_id) for customer_id in context.customer_ids)
    )


def _default_root() -> Path:
    return Path(os.getenv("RISK_EVIDENCE_DIR", "storage/risk_evidence"))


def _default_max_bytes() -> int:
    megabytes = int(os.getenv("RISK_EVIDENCE_MAX_FILE_SIZE_MB", "10"))
    return max(1, megabytes) * 1024 * 1024