kitos
1d0d880929
Aegis CI / lint-and-test (push) Has been cancelled
Snyk Security Scan / Python vulnerabilities (backend) (push) Has been cancelled
Snyk Security Scan / npm vulnerabilities (frontend) (push) Has been cancelled
Snyk Security Scan / Docker image vulnerabilities (backend) (push) Has been cancelled
- Renamed the password-setup webhook (email_webhook.*, /system/email-webhook-config) and made it the single transport for all notification emails. - New webhook_email_service.py shared by password_setup_service and notification_service. - Wired test validated/rejected, campaign completed, and new-MITRE-technique notifications through the webhook (previously dead SMTP code, never triggered). - Added POST /system/email-webhook-test to send a real test email. - Hid the Email/SMTP settings tab from the UI (SMTP code kept intact, unused). - Redact email_webhook.api_key on config export.
113 lines
3.9 KiB
Python
113 lines
3.9 KiB
Python
"""Generic outbound-email sender — POSTs to an admin-configured webhook.
|
|
|
|
Replaces the old SMTP-based email system. Every notification email in the
|
|
platform (password setup/reset, test validated, campaign completed, new
|
|
MITRE techniques synced, etc.) goes through ``send_webhook_email`` here,
|
|
which POSTs a ``{to, subject, body}`` JSON payload to a single configured
|
|
webhook URL — intended for a Power Automate flow that actually delivers
|
|
the email. An optional API key, if configured, is sent as an
|
|
``x-api-key`` header.
|
|
|
|
SMTP (``app.services.email_service``) is intentionally left in place but
|
|
unused and unreachable from the UI — see that module's docstring.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import logging
|
|
|
|
import requests
|
|
from sqlalchemy.orm import Session
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
_WEBHOOK_URL_CONFIG_KEY = "email_webhook.url"
|
|
_WEBHOOK_API_KEY_CONFIG_KEY = "email_webhook.api_key"
|
|
|
|
# Standard greeting + footer wrapped around every notification email's
|
|
# actual message, matching the platform's established template.
|
|
_EMAIL_SIGNATURE = (
|
|
"\n\nRegards,\n"
|
|
"AEGIS Security Platform\n"
|
|
"Purple Team Engineering\n"
|
|
"Owned and operated by Enterprise Corp.\n\n"
|
|
"Assume breach. Validate controls. Improve continuously.\n\n"
|
|
"This is an automated notification. Please do not reply."
|
|
)
|
|
|
|
|
|
def build_email_body(full_name: str | None, message: str) -> str:
|
|
"""Wrap *message* in the standard greeting + signature template."""
|
|
greeting = full_name or "there"
|
|
return f"HI {greeting}\n\n{message}{_EMAIL_SIGNATURE}"
|
|
|
|
|
|
def _read_system_config(db: Session, key: str) -> str | None:
|
|
from app.models.system_config import SystemConfig # avoid circular at import time
|
|
|
|
row = db.query(SystemConfig).filter(SystemConfig.key == key).first()
|
|
return row.value if row else None
|
|
|
|
|
|
def _write_system_config(db: Session, key: str, value: str) -> None:
|
|
from app.models.system_config import SystemConfig
|
|
|
|
row = db.query(SystemConfig).filter(SystemConfig.key == key).first()
|
|
if row:
|
|
row.value = value
|
|
else:
|
|
db.add(SystemConfig(key=key, value=value))
|
|
|
|
|
|
def get_webhook_url(db: Session) -> str | None:
|
|
"""Return the configured Power-Automate-style webhook URL, or None."""
|
|
return _read_system_config(db, _WEBHOOK_URL_CONFIG_KEY) or None
|
|
|
|
|
|
def set_webhook_url(db: Session, url: str) -> None:
|
|
"""Persist the webhook URL. Does not commit; caller commits."""
|
|
_write_system_config(db, _WEBHOOK_URL_CONFIG_KEY, url)
|
|
|
|
|
|
def get_webhook_api_key(db: Session) -> str | None:
|
|
"""Return the configured webhook API key, or None."""
|
|
return _read_system_config(db, _WEBHOOK_API_KEY_CONFIG_KEY) or None
|
|
|
|
|
|
def set_webhook_api_key(db: Session, api_key: str) -> None:
|
|
"""Persist the webhook API key. Does not commit; caller commits."""
|
|
_write_system_config(db, _WEBHOOK_API_KEY_CONFIG_KEY, api_key)
|
|
|
|
|
|
def send_webhook_email(
|
|
db: Session, *, to: str | None, subject: str, message: str, full_name: str | None = None,
|
|
) -> bool:
|
|
"""POST a notification email to the configured webhook.
|
|
|
|
Best-effort: returns False (and logs a warning) if no webhook is
|
|
configured, *to* is empty, or the request fails — never raises, since
|
|
a webhook outage must not break whatever triggered the notification.
|
|
"""
|
|
if not to:
|
|
return False
|
|
|
|
webhook_url = get_webhook_url(db)
|
|
if not webhook_url:
|
|
logger.warning("Email webhook is not configured — dropping email to %s", to)
|
|
return False
|
|
|
|
api_key = get_webhook_api_key(db)
|
|
headers = {"x-api-key": api_key} if api_key else {}
|
|
|
|
try:
|
|
requests.post(
|
|
webhook_url,
|
|
json={"to": to, "subject": subject, "body": build_email_body(full_name, message)},
|
|
headers=headers,
|
|
timeout=10,
|
|
)
|
|
return True
|
|
except requests.RequestException:
|
|
logger.warning("Email webhook call failed for %s", to, exc_info=True)
|
|
return False
|