diff --git a/app/api/controllers/risk.py b/app/api/controllers/risk.py index b938357..18aec6a 100644 --- a/app/api/controllers/risk.py +++ b/app/api/controllers/risk.py @@ -209,10 +209,11 @@ async def send_risk_daily_report_mail( payload: RiskDailyReportMailRequest, context: RequestContext = Depends(build_request_context), # noqa: B008 ) -> dict[str, object]: - data = RiskDailyReportMailService().send( + data = await RiskDailyReportMailService().send( payload.recipients, payload.subject, payload.content, + context=context, ) return _envelope(data, context) diff --git a/app/service/risk_daily_report_mail_service.py b/app/service/risk_daily_report_mail_service.py index 76cae56..3bff8a0 100644 --- a/app/service/risk_daily_report_mail_service.py +++ b/app/service/risk_daily_report_mail_service.py @@ -8,12 +8,30 @@ from collections.abc import Mapping from email.message import EmailMessage from email.utils import formatdate, make_msgid +from app.core.contracts import RequestContext +from app.service.authorization_service import AuthorizationService + class RiskDailyReportMailService: def __init__(self, *, environment: Mapping[str, str] | None = None) -> None: self.environment = environment or os.environ - def send(self, recipients: list[str], subject: str, content: str) -> dict[str, object]: + async def send( + self, + recipients: list[str], + subject: str, + content: str, + *, + context: RequestContext, + ) -> dict[str, object]: + """发送风控日报邮件。 + + **权限校验放在这里，而不是 controller**：本项目风控端点的授权一律落在 service 层 + （`risk_query_service` / `risk_action_service` / `risk_scan_service` 等都是这样）， + controller 只负责取 context。这个端点是此前**唯一没有校验的** —— 收件人、标题、 + 正文全由客户端决定，一旦运维开启 SMTP，它就是一个未授权的邮件发送器。 + """ + await AuthorizationService.require(context, "risk:report:mail") if not _enabled(self.environment, "RISK_DAILY_REPORT_MAIL_ENABLED"): return {"status": "disabled", "recipient_count": len(recipients)} if _enabled(self.environment, "RISK_DAILY_REPORT_MAIL_DRY_RUN", default=True): diff --git a/tests/unit/api/test_risk_controller.py b/tests/unit/api/test_risk_controller.py index 8b7d700..60d8f2e 100644 --- a/tests/unit/api/test_risk_controller.py +++ b/tests/unit/api/test_risk_controller.py @@ -103,7 +103,17 @@ class StubRiskDailyReportService: class StubRiskDailyReportMailService: - def send(self, recipients: list[str], _subject: str, _content: str) -> dict[str, Any]: + async def send( + self, + recipients: list[str], + _subject: str, + _content: str, + *, + context: RequestContext, + ) -> dict[str, Any]: + # 真实实现会先 `require("risk:report:mail")`；这里只复现调用形状， + # 权限本身由 test_risk_daily_report_service 里那组用例覆盖。 + del context return {"status": "dry_run", "recipient_count": len(recipients)} diff --git a/tests/unit/service/test_risk_daily_report_service.py b/tests/unit/service/test_risk_daily_report_service.py index e6a87e9..650600f 100644 --- a/tests/unit/service/test_risk_daily_report_service.py +++ b/tests/unit/service/test_risk_daily_report_service.py @@ -4,6 +4,7 @@ from types import MappingProxyType, SimpleNamespace import pytest from app.core.contracts import RequestContext +from app.core.errors import ForbiddenAgentError from app.repository.fund_query_repository import FundRecord from app.repository.risk_repository import RiskReportSnapshot from app.service.risk_daily_report_mail_service import RiskDailyReportMailService @@ -170,33 +171,73 @@ async def test_daily_report_lazily_initializes_model_service(monkeypatch) -> Non assert report["optimization_suggestions"] == "1. 根据模型生成日报建议" -def test_mail_service_is_disabled_by_default() -> None: - result = RiskDailyReportMailService(environment={}).send( +def _mail_context(*permissions: str) -> RequestContext: + """邮件端点的调用上下文。真实实现在发送前会 `require("risk:report:mail")`。""" + return RequestContext( + user_id="900000002", + trace_id="risk-mail-test", + permissions=permissions, + data_scope="all", + ) + + +@pytest.mark.asyncio +async def test_mail_service_is_disabled_by_default() -> None: + result = await RiskDailyReportMailService(environment={}).send( ["risk@example.com"], "日报", "正文", + context=_mail_context("risk:report:mail"), ) assert result == {"status": "disabled", "recipient_count": 1} -def test_mail_service_uses_dry_run_without_connecting() -> None: - result = RiskDailyReportMailService( +@pytest.mark.asyncio +async def test_mail_service_requires_the_permission() -> None: + """没有 `risk:report:mail` 的身份必须被拒。 + + 这个端点此前是风控里**唯一没有授权校验**的：收件人、标题、正文全由客户端决定， + 一旦运维开启 SMTP，它就是一个未授权的邮件发送器。这条用例把它钉住。 + """ + with pytest.raises(ForbiddenAgentError): + await RiskDailyReportMailService(environment={}).send( + ["attacker@example.com"], + "任意标题", + "任意正文", + context=_mail_context(), + ) + + +@pytest.mark.asyncio +async def test_mail_service_uses_dry_run_without_connecting() -> None: + result = await RiskDailyReportMailService( environment={ "RISK_DAILY_REPORT_MAIL_ENABLED": "true", "RISK_DAILY_REPORT_MAIL_DRY_RUN": "true", } - ).send(["risk@example.com"], "日报", "正文") + ).send( + ["risk@example.com"], + "日报", + "正文", + context=_mail_context("risk:report:mail"), + ) assert result == {"status": "dry_run", "recipient_count": 1} -def test_mail_service_reports_missing_configuration() -> None: - result = RiskDailyReportMailService( +@pytest.mark.asyncio +async def test_mail_service_reports_missing_configuration() -> None: + result = await RiskDailyReportMailService( environment={ "RISK_DAILY_REPORT_MAIL_ENABLED": "true", "RISK_DAILY_REPORT_MAIL_DRY_RUN": "false", } - ).send(["risk@example.com"], "日报", "正文") + ).send( + ["risk@example.com"], + "日报", + "正文", + context=_mail_context("risk:report:mail"), + ) assert result == {"status": "configuration_error", "recipient_count": 1}