NOTIFY_CONFIG — Per-Tenant 通知設定 Design Spec

grep -rE "system_config.*get|SystemConfig.*from_entity" \
  api/ app/ --include="*.py"

class NotificationService:
    def __init__(self, system_config_service):
        # ❌ os.getenv 在 __init__ 跑一次後 cache 在 instance 上
        self.telegram_bot_token = os.getenv("TELEGRAM_BOT_TOKEN", None)
        self.telegram_chat_id = os.getenv("TELEGRAM_CHAT_ID", None)
        self.discord_webhook_url = os.getenv("DISCORD_WEBHOOK_URL", None)
        self.system_config_service = system_config_service

from jedi_common.session.auth.auth_context import get_user_context
from jedi_common.handler.exception import ServerError, NotFound
from common.code.error_code import ErrorCode

class NotificationService:
    def __init__(self, system_config_service: SystemConfigService):
        self.system_config_service = system_config_service

    def get_channel_config(self, channel: str) -> dict | None:
        """讀當前 tenant 的 NOTIFY_CONFIG/<channel>。
        Caller 必須在 user_context 內呼叫（通常是主 request thread）。
        Thread fan-out 場景：caller 應在主 thread 先呼叫此 method 拿 cfg dict，
        再把 cfg 作為 kwarg 傳入 send_xxx_notification 的 thread target。
        """
        if get_user_context() is None:
            # ⚠️ jedi_common 沒有 InternalServerError 子類，直接用 base ServerError(message, error_code, status_code)
            raise RuntimeError(
                f"NOTIFY_CONFIG read requires user_context (channel={channel})"
            )  # jedi-handler @app.errorhandler(Exception) fallback → 500
        try:
            cfg = self.system_config_service.get_system_config_by_key(
                "NOTIFY_CONFIG", channel
            )
            return cfg.value if cfg else None
        except NotFound:
            return None

    def send_mail_notification(self, to, subject, content, is_html=False):
        """MAIL 不在 NOTIFY_CONFIG 範圍 — 維持既有 SMTP/* 邏輯。
        ⚠️ 既有 SMTP/* 也有相同 thread-local 問題（thread 內 get_system_config_by_key
        會走 super_admin RLS bypass），multi-tenant 下會撈到任意 tenant 的 SMTP — 既存 bug，OOS。
        """
        # ... 既有實作不動

    def send_discord_notification(self, message, cfg: dict | None = None):
        """cfg：caller 在主 thread 預解析後傳入；省略則嘗試從 user_context 讀（同步呼叫）。"""
        if cfg is None:
            cfg = self.get_channel_config("DISCORD")
        if not cfg or not cfg.get("enabled") or not cfg.get("secret"):
            logger.warning(
                "Discord notification skipped: "
                "channel disabled or missing config (tenant_id=%s)",
                self._tenant_id_for_log(),
            )
            return None
        config = DiscordConfigDTO(webhook_url=cfg["secret"])
        Notifier("DISCORD", config.dict()).send_notification(
            DiscordRequestDTO(content=message)
        )

    def send_telegram_notification(self, content, cfg: dict | None = None):
        if cfg is None:
            cfg = self.get_channel_config("TELEGRAM")
        if (not cfg or not cfg.get("enabled")
                or not cfg.get("secret") or not cfg.get("chat_id")):
            logger.warning(
                "Telegram notification skipped: "
                "channel disabled or missing config (tenant_id=%s)",
                self._tenant_id_for_log(),
            )
            return None
        config = TelegramConfigDTO(
            bot_token=cfg["secret"],
            chat_id=cfg["chat_id"],
        )
        Notifier("TELEGRAM", config.dict()).send_notification(
            TelegramRequestDTO(message=content)
        )

    def _tenant_id_for_log(self) -> str:
        """log 用 tenant_id（拿不到回 'unknown'，不 raise）。"""
        try:
            ctx = get_user_context()
            return str(ctx.tenant_id) if ctx else "unknown(thread)"
        except Exception:
            return "unknown"

@transaction
def notify_users_batch_assigned(self, user_job_counts: list) -> bool:
    # 主 thread（仍在 @transaction + user_context 內）預解析三 channel
    discord_cfg = self.notification_service.get_channel_config("DISCORD")
    telegram_cfg = self.notification_service.get_channel_config("TELEGRAM")
    # MAIL 不需要預解析（既有 SMTP/* 邏輯不變）

    system_name = os.getenv("SYSTEM_NAME", "Guidant.AI")
    for user, count in user_job_counts:
        subject = _("batch_task_notification_subject") % {"system": system_name, "count": count}
        message = _("batch_task_notification_content") % {
            "username": user.nickname,
            "count": count,
        }

        # MAIL 永遠送（依比照 .env 的決策）
        threading.Thread(
            target=self.notification_service.send_mail_notification,
            kwargs={
                "to": user.email,
                "subject": subject,
                "content": message,
                "is_html": True,
            },
        ).start()

        if discord_cfg and discord_cfg.get("enabled"):
            threading.Thread(
                target=self.notification_service.send_discord_notification,
                kwargs={
                    "message": message.replace("<br>", "\n"),
                    "cfg": discord_cfg,    # ← 重點：cfg 跨 thread 傳入
                },
            ).start()

        if telegram_cfg and telegram_cfg.get("enabled"):
            threading.Thread(
                target=self.notification_service.send_telegram_notification,
                kwargs={
                    "content": message.replace("<br>", "\n"),
                    "cfg": telegram_cfg,
                },
            ).start()

    return True

# workflow_execution_service.py 改 complete_job 與 revert_job signature
@transaction
def complete_job(
    self,
    workflow_execution_uid,
    job_id,
    user,
    comment,
    user_nickname,
    suppress_notify: bool = False,   # ← 新增（default False 保留既有行為）
):
    ...
    # line 572 改成
    if not suppress_notify:
        self.notify_user_todo_job(job_execution.id)

@transaction
def revert_job(
    self, workflow_execution_uid, job_id, revert_to_job_id, comment, user, user_nickname,
    suppress_notify: bool = False,
):
    ...
    if not suppress_notify:
        self.notify_user_todo_job(revert_job_execution.id)

# job_batch_complete_service.py:38-90 整段拔掉 os.environ 騷操作
# 60 行改成
self._wf_svc.complete_job(
    workflow_execution_uid=wf_uid,
    job_id=template_job_id,
    user=login_name,
    comment=comment,
    user_nickname=nickname,
    suppress_notify=True,    # ← 新增
)
# finally 區塊整段移除（不再需要還原 os.environ）

from jedi_common.session.auth.auth_context import get_user_context
from jedi_common.handler.exception import BadRequestError, ForbiddenError, NotFound
from common.code.error_code import ErrorCode

class NotifyConfigTestService:
    """送測試訊息給指定 channel。
    - resolve 階段（@transaction 內）：讀 DB 沿用既存 secret（changePwd=false 時）
    - send 階段（@transaction 外）：對外打 HTTP，避免 hold DB connection
    """

    def __init__(self, system_config_service):
        self.system_config_service = system_config_service

    @transaction
    def _resolve_value(self, channel: str, value: dict, change_pwd: bool) -> dict:
        """純讀 DB：若 changePwd=False，從既存 row 拿 secret 補進 value。"""
        if change_pwd:
            return value
        try:
            existing = self.system_config_service.get_system_config_by_key(
                "NOTIFY_CONFIG", channel
            )
        except NotFound:
            existing = None
        if not existing or not existing.value.get("secret"):
            raise BadRequestError(ErrorCode.NOTIFY_CHANNEL_TEST_NO_EXISTING_SECRET)
        return {**value, "secret": existing.value["secret"]}

    def test_channel(self, channel: str, value: dict, change_pwd: bool = True) -> dict:
        # 1. 驗 admin（業務邏輯層擋，不依賴 capability decorator）
        user = get_user_context()
        if not user or not user.is_admin:
            raise ForbiddenError(ErrorCode.NOTIFY_CHANNEL_TEST_FORBIDDEN)

        # 2. 驗 channel
        if channel not in ("DISCORD", "TELEGRAM"):
            raise BadRequestError(ErrorCode.NOTIFY_CHANNEL_NOT_SUPPORTED)

        # 3. resolve（讀 DB）
        resolved = self._resolve_value(channel, value, change_pwd)

        # 4. send（不 hold DB connection）— 失敗以 4xx envelope 回傳，對齊 codebase 慣例
        try:
            if channel == "DISCORD":
                self._test_discord(resolved)
            else:
                self._test_telegram(resolved)
            return {"channel": channel, "sent_at": datetime.utcnow().isoformat() + "Z"}
        except Exception as e:
            # BadRequestError 不支援 detail kwarg；具體錯誤寫 BE log，前端只顯示固定 message
            logger.exception("Notify channel test failed: channel=%s detail=%s", channel, str(e))
            raise BadRequestError(ErrorCode.NOTIFY_CHANNEL_TEST_FAILED)

class NotifyConfigContainer(containers.DeclarativeContainer):
    system_config_service = providers.Dependency()
    notify_config_test_service = providers.Singleton(
        NotifyConfigTestService,
        system_config_service=system_config_service,
    )

notify_config_container = providers.Container(
    NotifyConfigContainer,
    system_config_service=system_config_container.system_config_service,
)

NOTIFY_CHANNEL_TEST_FAILED              = ("通知測試失敗", "NOTIFY_400001")
NOTIFY_CHANNEL_TEST_NO_EXISTING_SECRET  = ("無既存 secret 可沿用，請填入完整 token", "NOTIFY_400002")
NOTIFY_CHANNEL_NOT_SUPPORTED            = ("不支援的通知頻道", "NOTIFY_400003")
NOTIFY_CHANNEL_TEST_FORBIDDEN           = ("僅系統管理員可執行通知測試", "NOTIFY_403001")
NOTIFY_NO_TENANT_CONTEXT                = ("缺少 tenant context，無法讀取通知設定", "NOTIFY_500001")

NOTIFICATION_SMTP_CONFIG_NOT_FOUND      = (..., "NOTIFICATION_404001")  # ❌
NOTIFICATION_DISCORD_CONFIG_NOT_FOUND   = (..., "NOTIFICATION_404001")  # ❌
NOTIFICATION_TELEGRAM_CONFIG_NOT_FOUND  = (..., "NOTIFICATION_404001")  # ❌

{
  "value": {"enabled": true, "secret": "https://discord.com/api/webhooks/...", "chat_id": "..."},
  "changePwd": true
}

grep -nE "tenant_id|TenantScopedMixinModel" \
  ~/Projects/Jedicogy/module/jedi-python-package/jedi-system-config/jedi_system_config/infra/repository/system_config_repo_impl.py

NOTIFY_CONFIG_TEST: getUrl('/notify-config'),  // 後接 /<channel>/test

{
    path: '/system/notify-config',
    name: 'notify-config',
    component: () => import('@/views/notify-config/NotifyConfigForm.vue'),
    meta: { breadcrumb: [{ label: 'notify-config' }], requiresAuth: true }
}

pybabel compile -d config/translations

-- Date: 2026-04-27
-- 將「通知設定」納入權限管理系統（per-tenant Discord / Telegram channel 設定）
-- 設計依據：docs/features/FR-020-2604-notify-config/design.md
--
-- 執行身份：建議用 cmmgr（DB 擁有者）跑，避免 RLS 擋住系統層級資料：
--   PGPASSWORD='...' psql -h <host> -p 25432 -U cmmgr -d <db> -f <this_file>
-- 若用 cm_app（應用層 user）跑，會被 RLS 擋；SQL 內已加 SET LOCAL app.is_super_admin='t' 旁路
--
-- Idempotent：可重複執行，已存在的資料以 ON CONFLICT DO NOTHING 跳過

BEGIN;

-- ⚠️ 重要：本 migration 會寫入 role_capabilities 給 Administrator 系統角色
-- (roles.tenant_id IS NULL)，未設 super_admin context 會被 RLS 擋住，
-- 導致 INSERT 0 rows。必須先 bypass RLS。
SET LOCAL app.is_super_admin = 't';

-- 1. 新增 notify_config 模組能力點 (2026-04-27)
INSERT INTO public.capabilities (name, resource_type, action, description) VALUES
    ('notify_config.read',   'notify_config', 'read',   '檢視通知設定'),
    ('notify_config.update', 'notify_config', 'update', '修改通知設定（含測試送訊息）')
ON CONFLICT (name) DO NOTHING;

-- 2. 新增 notify-config 路由 (2026-04-27)
-- ⚠️ ui_routes.name 無 UNIQUE constraint（驗證自 jedi_auth/infra/models/ui_route.py），
--     不能用 ON CONFLICT (name)；改用 INSERT ... SELECT WHERE NOT EXISTS 確保 idempotent
INSERT INTO public.ui_routes (uid, pid, name, url, icon, enable, description, sort)
SELECT gen_random_uuid(), 0, 'notify-config', '/system/notify-config', 'pi-bell', 1, '通知設定', 175
WHERE NOT EXISTS (
    SELECT 1 FROM public.ui_routes WHERE name = 'notify-config'
);

-- 3. 綁定 notify-config ↔ capabilities (read=ALL, update=ANY) (2026-04-27)
WITH r AS (SELECT id FROM public.ui_routes WHERE name = 'notify-config'),
     caps AS (
         SELECT id, name FROM public.capabilities
         WHERE resource_type = 'notify_config'
     )
INSERT INTO public.route_capabilities (route_id, capability_id, requirement)
SELECT r.id, caps.id,
       CASE WHEN caps.name LIKE '%.read' THEN 'ALL' ELSE 'ANY' END
FROM r, caps
ON CONFLICT (route_id, capability_id) DO NOTHING;

-- 4. 系統管理員 (Administrator) 角色預設擁有 notify_config.* 全部能力 (2026-04-27)
INSERT INTO public.role_capabilities (role_id, capability_id)
SELECT r.id, c.id
FROM public.roles r
JOIN public.capabilities c ON c.resource_type = 'notify_config'
WHERE r.name = 'Administrator' AND r.tenant_id IS NULL
ON CONFLICT (role_id, capability_id) DO NOTHING;

COMMIT;

-- 驗證查詢（COMMIT 後可跑）：
-- SELECT * FROM public.capabilities WHERE resource_type = 'notify_config';
-- SELECT * FROM public.ui_routes WHERE name = 'notify-config';
-- SELECT rc.*, c.name AS cap_name, r.name AS route_name
--   FROM public.route_capabilities rc
--   JOIN public.capabilities c ON c.id = rc.capability_id
--   JOIN public.ui_routes r ON r.id = rc.route_id
--   WHERE c.resource_type = 'notify_config';
-- SELECT rc.*, c.name AS cap_name
--   FROM public.role_capabilities rc
--   JOIN public.capabilities c ON c.id = rc.capability_id
--   JOIN public.roles r ON r.id = rc.role_id
--   WHERE c.resource_type = 'notify_config' AND r.name = 'Administrator';

-- Rollback (commented):
-- BEGIN;
-- SET LOCAL app.is_super_admin = 't';
-- DELETE FROM public.role_capabilities
--   WHERE capability_id IN (SELECT id FROM public.capabilities WHERE resource_type = 'notify_config');
-- DELETE FROM public.route_capabilities
--   WHERE capability_id IN (SELECT id FROM public.capabilities WHERE resource_type = 'notify_config');
-- DELETE FROM public.capabilities WHERE resource_type = 'notify_config';
-- DELETE FROM public.ui_routes WHERE name = 'notify-config';
-- DELETE FROM public.system_configs WHERE "group" = 'NOTIFY_CONFIG';  -- ⚠️ 會清掉 tenant 已建設定
-- COMMIT;

pytest test/ -k "workflow or oscal_audit or notification or batch_complete or task_survey"

pytest test/test_notification_service.py test/test_notify_config_route.py -v
pytest test/ -k "workflow or batch_complete or task_survey or oscal_audit"  # 既有回歸

# ❌ 危險範例
def daily_report_tick():
    with session_scope():  # 無 user_context → super_admin='t' → RLS bypass
        notification_service.send_discord_notification("...")
        # → 撈到任意 tenant 的 webhook → 跨 tenant leak

grep -rE "TELEGRAM_BOT_TOKEN|DISCORD_WEBHOOK_URL|SEND_NOTIFY_MODULES" \
  config/ app/ api/ common/ --include="*.py"