wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 3 Packages Projects Releases Wiki Activity

docs(security): add Telegram egress owner request draft [skip ci]

Browse Source
This commit is contained in:
Your Name
2026-06-18 19:27:57 +08:00
parent d886212398
commit f171ffc2b4
11 changed files with 2409 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

143
scripts/security/security-mirror-progress-guard.py
View File

@@ -231,6 +231,9 @@ def validate(root: Path) -> None:
telegram_notification_egress_inventory = load_json(
security_dir / "telegram-notification-egress-inventory.snapshot.json"
)
telegram_notification_egress_owner_request_draft = load_json(
security_dir / "telegram-notification-egress-owner-request-draft.snapshot.json"
)
public_runtime_config_change_evidence_acceptance = load_json(
security_dir / "public-runtime-config-change-evidence-acceptance.snapshot.json"
)
@@ -21630,6 +21633,146 @@ def validate(root: Path) -> None:
f"telegram_notification_egress_inventory.{item['egress_surface_id']}.{false_key}",
item[false_key],
)
assert_equal(
"telegram_notification_egress_owner_request_draft.schema",
telegram_notification_egress_owner_request_draft["schema_version"],
"telegram_notification_egress_owner_request_draft_v1",
)
assert_equal(
"telegram_notification_egress_owner_request_draft.status",
telegram_notification_egress_owner_request_draft["status"],
"owner_request_draft_ready_no_dispatch_no_runtime_action",
)
assert_equal(
"telegram_notification_egress_owner_request_draft.mode",
telegram_notification_egress_owner_request_draft["mode"],
"metadata_only_no_secret_value_no_telegram_send_no_workflow_change",
)
expected_telegram_egress_owner_request_summary = {
"source_direct_bot_api_call_count": 18,
"source_direct_bot_api_file_count": 11,
"request_draft_count": 11,
"workflow_request_draft_count": 6,
"ops_script_request_draft_count": 4,
"ci_script_request_draft_count": 0,
"api_direct_request_draft_count": 1,
"request_field_count": 27,
"required_owner_field_count": 19,
"preflight_check_count": 16,
"outcome_lane_count": 9,
"forbidden_payload_count": 14,
"blocked_action_count": 26,
"request_sent_count": 0,
"recipient_confirmed_count": 0,
"audit_event_emitted_count": 0,
"owner_response_received_count": 0,
"owner_response_accepted_count": 0,
"formatter_convergence_accepted_count": 0,
"redaction_contract_accepted_count": 0,
"delivery_receipt_accepted_count": 0,
"break_glass_fallback_accepted_count": 0,
"direct_bot_api_migration_authorized_count": 0,
"telegram_send_authorized_count": 0,
"bot_api_call_authorized_count": 0,
"workflow_modification_authorized_count": 0,
"script_modification_authorized_count": 0,
"api_sender_refactor_authorized_count": 0,
"secret_value_collection_allowed_count": 0,
"raw_payload_storage_allowed_count": 0,
"production_write_authorized_count": 0,
"runtime_gate_count": 0,
"action_button_count": 0,
}
for key, expected in expected_telegram_egress_owner_request_summary.items():
assert_equal(
f"telegram_notification_egress_owner_request_draft.summary.{key}",
telegram_notification_egress_owner_request_draft["summary"][key],
expected,
)
expected_telegram_egress_request_paths = [
".gitea/workflows/cd-dev.yaml",
".gitea/workflows/cd.yaml",
".gitea/workflows/code-review.yaml",
".gitea/workflows/deploy-alerts.yaml",
".gitea/workflows/e2e-health.yaml",
".gitea/workflows/run-migration.yml",
"apps/api/src/services/channel_hub.py",
"scripts/ops/backup-from-110.sh",
"scripts/ops/docker-health-monitor.sh",
"scripts/ops/dr-drill.sh",
"scripts/ops/pg-backup.sh",
]
assert_equal(
"telegram_notification_egress_owner_request_draft.source_paths",
[item["source_path"] for item in telegram_notification_egress_owner_request_draft["request_drafts"]],
expected_telegram_egress_request_paths,
)
for key, value in telegram_notification_egress_owner_request_draft["execution_boundaries"].items():
if key == "not_authorization":
assert_true(f"telegram_notification_egress_owner_request_draft.execution_boundaries.{key}", value)
else:
assert_false(f"telegram_notification_egress_owner_request_draft.execution_boundaries.{key}", value)
for item in telegram_notification_egress_owner_request_draft["request_drafts"]:
assert_equal(
f"telegram_notification_egress_owner_request_draft.{item['request_draft_id']}.request_fields",
len(item["request_fields"]),
27,
)
assert_equal(
f"telegram_notification_egress_owner_request_draft.{item['request_draft_id']}.required_owner_fields",
len(item["required_owner_fields"]),
19,
)
assert_equal(
f"telegram_notification_egress_owner_request_draft.{item['request_draft_id']}.preflight_checks",
len(item["preflight_checks"]),
16,
)
assert_equal(
f"telegram_notification_egress_owner_request_draft.{item['request_draft_id']}.outcome_lanes",
len(item["outcome_lanes"]),
9,
)
assert_equal(
f"telegram_notification_egress_owner_request_draft.{item['request_draft_id']}.forbidden_payloads",
len(item["forbidden_payloads"]),
14,
)
assert_equal(
f"telegram_notification_egress_owner_request_draft.{item['request_draft_id']}.blocked_actions",
len(item["blocked_actions"]),
26,
)
assert_true(
f"telegram_notification_egress_owner_request_draft.{item['request_draft_id']}.not_authorization",
item["not_authorization"],
)
for false_key in [
"request_sent",
"recipient_confirmed",
"audit_event_emitted",
"owner_response_received",
"owner_response_accepted",
"formatter_convergence_accepted",
"redaction_contract_accepted",
"delivery_receipt_accepted",
"break_glass_fallback_accepted",
"direct_bot_api_migration_authorized",
"telegram_send_authorized",
"bot_api_call_authorized",
"workflow_modification_authorized",
"script_modification_authorized",
"api_sender_refactor_authorized",
"secret_value_collection_allowed",
"raw_payload_storage_allowed",
"production_write_authorized",
"runtime_gate",
"action_buttons_allowed",
]:
assert_false(
f"telegram_notification_egress_owner_request_draft.{item['request_draft_id']}.{false_key}",
item[false_key],
)
assert_equal(
"public_runtime_config_change_evidence_acceptance.schema",
public_runtime_config_change_evidence_acceptance["schema_version"],