X-Financial/server/tests/test_risk_observations_service.py

from __future__ import annotations

from collections.abc import Generator
from datetime import UTC, datetime, timedelta
from decimal import Decimal
from types import SimpleNamespace

import pytest
from auth_helpers import install_legacy_header_auth_override
from fastapi import FastAPI
from fastapi.testclient import TestClient
from sqlalchemy import create_engine
from sqlalchemy.orm import Session, sessionmaker
from sqlalchemy.pool import StaticPool

from app.algorithem.risk_graph.replay import AlgorithmReplaySetBuilder
from app.api.deps import get_db
from app.api.v1.endpoints.risk_observations import router as risk_observations_router
from app.db.base import Base
from app.models.employee import Employee
from app.models.expense_case import ExpenseCase, ExpenseCaseLink
from app.models.financial_record import ExpenseClaim
from app.models.risk_observation import RiskObservation
from app.schemas.risk_observation import RiskObservationFeedbackCreate
from app.services.expense_claims import ExpenseClaimService
from app.services.hermes_risk_scanner import HermesRiskScannerService
from app.services.risk_observations import RiskObservationService


def test_risk_observation_service_upserts_and_summarizes_dashboard() -> None:
    with _build_session() as db:
        db.add(_employee_orm())
        db.add_all([_claim_orm("c1", "BX-001"), _claim_orm("c2", "BX-002")])
        db.flush()
        service = RiskObservationService(db)
        service.upsert_observation(_observation_payload("risk:c1:duplicate_invoice"))
        service.upsert_observation(
            {
                **_observation_payload("risk:c2:preapproval_absent"),
                "claim_id": "c2",
                "claim_no": "BX-002",
                "risk_signal": "preapproval_absent",
                "risk_type": "preapproval_absent",
                "risk_score": 72,
                "risk_level": "high",
            }
        )
        db.commit()

        feedback = service.create_feedback(
            "risk:c1:duplicate_invoice",
            RiskObservationFeedbackCreate(feedback_type="confirm", actor="auditor"),
        )
        dashboard = service.summarize_dashboard(window_days=30)
        history = service.build_history_stats(risk_signals={"duplicate_invoice"})
        refreshed = service.get_observation("risk:c1:duplicate_invoice")

        assert feedback.feedback_type == "confirm"
        assert refreshed is not None
        assert refreshed.status == "confirmed"
        assert refreshed.source == "financial_risk_graph"
        assert refreshed.algorithm_version == "financial_risk_graph.v1"
        assert refreshed.sampling_strategy["strategy"] == "focused_review"
        assert refreshed.evaluation_case_id == "case-duplicate-invoice"
        assert refreshed.ontology_parse_id == "parse-1"
        assert refreshed.ontology_version == "ontology.v1"
        assert refreshed.domain == "expense"
        assert refreshed.scenario == "reimbursement"
        assert refreshed.intent == "risk_check"
        assert refreshed.ontology_entities_json == [{"type": "claim", "value": "c1"}]
        assert refreshed.risk_signals_json == [{"code": "duplicate_invoice"}]
        assert refreshed.canonical_subject_key == "claim:c1"
        assert dashboard.total_observations == 2
        assert dashboard.high_or_above_count == 2
        assert dashboard.risk_clue_count == 1
        assert dashboard.confirmed_count == 1
        assert dashboard.feedback_sample_count == 1
        assert dashboard.total_amount == 2400.0
        assert dashboard.level_distribution["high"] == 2
        assert dashboard.signal_distribution["duplicate_invoice"] == 1
        assert dashboard.department_distribution["风控部"] == 2
        assert dashboard.expense_type_distribution["travel"] == 2
        assert dashboard.employee_grade_distribution["P6"] == 2
        assert dashboard.supplier_distribution["上海差旅供应商"] == 2
        assert dashboard.top_departments[0]["name"] == "风控部"
        assert dashboard.top_departments[0]["amount"] == 2400.0
        assert dashboard.top_employees[0]["name"] == "风险员工"
        assert dashboard.top_suppliers[0]["name"] == "上海差旅供应商"
        assert dashboard.top_expense_types[0]["name"] == "travel"
        assert dashboard.top_rules[0]["name"] == "policy.duplicate_invoice"
        assert dashboard.top_risk_signals[0]["name"] in {
            "duplicate_invoice",
            "preapproval_absent",
        }
        assert dashboard.daily_trend
        assert history[0].risk_signal == "duplicate_invoice"
        assert history[0].confirmed_count == 1


def test_platform_rule_flags_are_persisted_as_risk_observations() -> None:
    with _build_session() as db:
        claim = _claim_orm("c-platform", "BX-PLATFORM")
        db.add(claim)
        db.flush()

        observations = RiskObservationService(db).upsert_platform_risk_flags(
            claim,
            [
                {
                    "hit_source": "rule_center",
                    "rule_type": "risk",
                    "rule_code": "risk.invoice.duplicate_invoice",
                    "rule_version": "v1.2.0",
                    "severity": "critical",
                    "action": "block",
                    "label": "重复发票校验",
                    "message": "票据号码已在其他报销单中出现。",
                    "evidence": {"invoice_no": "INV-001"},
                }
            ],
        )
        db.commit()

        assert len(observations) == 1
        persisted = db.query(RiskObservation).filter_by(claim_id="c-platform").one()
        assert persisted.risk_signal == "duplicate_invoice"
        assert persisted.risk_level == "critical"
        assert persisted.source == "rule_center"
        assert persisted.algorithm_version == "v1.2.0"
        assert persisted.contribution_scores_json == {"S_rule": 100}


def test_high_platform_risk_persistence_failure_is_fail_closed(
    monkeypatch: pytest.MonkeyPatch,
) -> None:
    with _build_session() as db:
        claim = _claim_orm("c-platform-fail-closed", "BX-PLATFORM-FAIL-CLOSED")
        db.add(claim)
        db.flush()
        service = ExpenseClaimService(db)
        monkeypatch.setattr(
            service,
            "evaluate_platform_risk_rules",
            lambda _claim, **_kwargs: {
                "flags": [
                    {
                        "source": "platform_risk",
                        "hit_source": "rule_center",
                        "rule_type": "risk",
                        "rule_code": "risk.invoice.blocking",
                        "severity": "high",
                        "action": "block",
                        "label": "高风险票据",
                        "message": "票据需要人工核验。",
                    }
                ],
                "rule_set_fingerprint": "rules-v1",
            },
        )

        def fail_persistence(*_args, **_kwargs):
            raise RuntimeError("database unavailable")

        monkeypatch.setattr(
            RiskObservationService,
            "upsert_platform_risk_flags",
            fail_persistence,
        )

        with pytest.raises(RuntimeError, match="高风险观察持久化失败"):
            service._run_ai_submission_review(claim)


def test_risk_observation_storage_ready_is_cached_per_bind(monkeypatch: pytest.MonkeyPatch) -> None:
    with _build_session() as db:
        RiskObservationService._storage_ready_cache.clear()
        create_all_calls = []
        original_create_all = Base.metadata.create_all

        def spy_create_all(*args, **kwargs):
            create_all_calls.append(kwargs.get("bind"))
            return original_create_all(*args, **kwargs)

        monkeypatch.setattr(Base.metadata, "create_all", spy_create_all)

        service = RiskObservationService(db)
        service.ensure_storage_ready()
        service.ensure_storage_ready()
        RiskObservationService(db).ensure_storage_ready()

        assert len(create_all_calls) == 1
        RiskObservationService._storage_ready_cache.clear()


def test_risk_observation_endpoints_return_list_detail_dashboard_and_feedback() -> None:
    client, session_factory = _build_client()
    with session_factory() as db:
        service = RiskObservationService(db)
        service.upsert_observation(
            _observation_payload("risk:c1:duplicate_invoice"),
            execution_log_id="exec-1",
        )
        db.commit()

    list_response = client.get("/api/v1/risk-observations", params={"risk_level": "high"})
    execution_log_response = client.get("/api/v1/risk-observations/execution-log/exec-1")
    detail_response = client.get("/api/v1/risk-observations/risk:c1:duplicate_invoice")
    dashboard_response = client.get("/api/v1/risk-observations/dashboard")
    feedback_response = client.post(
        "/api/v1/risk-observations/risk:c1:duplicate_invoice/feedback",
        json={"feedback_type": "false_positive", "actor": "auditor", "comment": "误报"},
    )

    assert list_response.status_code == 200
    assert list_response.json()["total"] == 1
    assert execution_log_response.status_code == 200
    assert len(execution_log_response.json()) == 1
    assert detail_response.status_code == 200
    assert detail_response.json()["risk_signal"] == "duplicate_invoice"
    assert dashboard_response.status_code == 200
    assert dashboard_response.json()["total_observations"] == 1
    assert dashboard_response.json()["risk_clue_count"] == 1
    assert dashboard_response.json()["feedback_sample_count"] == 0
    assert "top_departments" in dashboard_response.json()
    assert feedback_response.status_code == 200
    assert feedback_response.json()["feedback_type"] == "false_positive"
    assert feedback_response.json()["actor"] == "Test Admin"

    updated_detail_response = client.get("/api/v1/risk-observations/risk:c1:duplicate_invoice")
    assert updated_detail_response.status_code == 200
    assert updated_detail_response.json()["feedback_items"][0]["feedback_type"] == "false_positive"

    with session_factory() as db:
        observation = (
            db.query(RiskObservation).filter_by(observation_key="risk:c1:duplicate_invoice").one()
        )
        assert observation.status == "false_positive"
        assert observation.feedback_status == "false_positive"


def test_risk_observation_endpoints_enforce_tenant_scope_and_authenticated_actor() -> None:
    client, session_factory = _build_client()
    with session_factory() as db:
        service = RiskObservationService(db)
        tenant_a = service.upsert_observation(
            {
                **_observation_payload("risk:tenant-a:duplicate_invoice"),
                "claim_id": "shared-claim",
            },
            tenant_id="tenant-a",
            execution_log_id="shared-execution-log",
        )
        tenant_b = service.upsert_observation(
            {
                **_observation_payload("risk:tenant-b:duplicate_invoice"),
                "claim_id": "shared-claim",
            },
            tenant_id="tenant-b",
            execution_log_id="shared-execution-log",
        )
        tenant_a_id = tenant_a.id
        tenant_b_id = tenant_b.id
        db.commit()

    tenant_a_headers = {
        "X-Auth-Username": "auditor-a",
        "X-Auth-Name": "Tenant A Auditor",
        "X-Auth-Role-Codes": "finance",
        "X-Auth-Is-Admin": "true",
        "X-Auth-Tenant-Id": "tenant-a",
    }
    tenant_b_headers = {
        "X-Auth-Username": "auditor-b",
        "X-Auth-Name": "Tenant B Auditor",
        "X-Auth-Role-Codes": "finance",
        "X-Auth-Is-Admin": "true",
        "X-Auth-Tenant-Id": "tenant-b",
    }

    list_response = client.get("/api/v1/risk-observations", headers=tenant_a_headers)
    detail_response = client.get(
        f"/api/v1/risk-observations/{tenant_a_id}",
        headers=tenant_a_headers,
    )
    foreign_detail_response = client.get(
        f"/api/v1/risk-observations/{tenant_b_id}",
        headers=tenant_a_headers,
    )
    claim_response = client.get(
        "/api/v1/risk-observations/claim/shared-claim",
        headers=tenant_a_headers,
    )
    execution_log_response = client.get(
        "/api/v1/risk-observations/execution-log/shared-execution-log",
        headers=tenant_a_headers,
    )
    dashboard_response = client.get(
        "/api/v1/risk-observations/dashboard",
        headers=tenant_a_headers,
    )
    foreign_feedback_response = client.post(
        f"/api/v1/risk-observations/{tenant_b_id}/feedback",
        headers=tenant_a_headers,
        json={"feedback_type": "confirm", "actor": "伪造管理员"},
    )
    own_feedback_response = client.post(
        f"/api/v1/risk-observations/{tenant_a_id}/feedback",
        headers=tenant_a_headers,
        json={"feedback_type": "confirm", "actor": "伪造管理员"},
    )

    assert list_response.status_code == 200
    assert list_response.json()["total"] == 1
    assert list_response.json()["items"][0]["tenant_id"] == "tenant-a"
    assert detail_response.status_code == 200
    assert detail_response.json()["tenant_id"] == "tenant-a"
    assert foreign_detail_response.status_code == 404
    # 单据风险入口必须先通过单据自身可见范围；不存在的历史 claim 不再旁路读取。
    assert claim_response.status_code == 404
    assert execution_log_response.status_code == 200
    assert [item["tenant_id"] for item in execution_log_response.json()] == ["tenant-a"]
    assert dashboard_response.status_code == 200
    assert dashboard_response.json()["total_observations"] == 1
    assert foreign_feedback_response.status_code == 404
    assert own_feedback_response.status_code == 200
    assert own_feedback_response.json()["actor"] == "Tenant A Auditor"

    tenant_b_detail = client.get(
        f"/api/v1/risk-observations/{tenant_b_id}",
        headers=tenant_b_headers,
    )
    assert tenant_b_detail.status_code == 200
    assert tenant_b_detail.json()["status"] == "pending_review"
    assert tenant_b_detail.json()["feedback_items"] == []


def test_risk_observation_service_scopes_history_and_same_key_upserts_by_tenant() -> None:
    with _build_session() as db:
        service = RiskObservationService(db)
        tenant_a = service.upsert_observation(
            _observation_payload("risk:shared:duplicate_invoice"),
            tenant_id="tenant-a",
        )
        tenant_b = service.upsert_observation(
            _observation_payload("risk:shared:duplicate_invoice"),
            tenant_id="tenant-b",
        )
        service.create_feedback(
            tenant_a.id,
            RiskObservationFeedbackCreate(feedback_type="confirm", actor="untrusted"),
            tenant_id="tenant-a",
            actor="trusted-auditor",
        )

        tenant_a_items, tenant_a_total = service.list_observations(tenant_id="tenant-a")
        tenant_b_items, tenant_b_total = service.list_observations(tenant_id="tenant-b")
        tenant_a_history = service.build_history_stats(
            tenant_id="tenant-a",
            risk_signals={"duplicate_invoice"},
        )
        tenant_b_history = service.build_history_stats(
            tenant_id="tenant-b",
            risk_signals={"duplicate_invoice"},
        )

        assert tenant_a.id != tenant_b.id
        assert tenant_a_total == tenant_b_total == 1
        assert [item.tenant_id for item in tenant_a_items] == ["tenant-a"]
        assert [item.tenant_id for item in tenant_b_items] == ["tenant-b"]
        assert tenant_a_history[0].confirmed_count == 1
        assert tenant_b_history[0].confirmed_count == 0
        assert tenant_a.feedback_items[0].actor == "trusted-auditor"
        assert service.get_observation(tenant_b.id, tenant_id="tenant-a") is None


def test_risk_observation_rejects_explicit_tenant_mismatching_claim_link() -> None:
    with _build_session() as db:
        claim = _claim_orm("claim-tenant-boundary", "BX-TENANT-BOUNDARY")
        expense_case = ExpenseCase(
            id="case-tenant-boundary",
            tenant_id="tenant-a",
            case_no="CASE-TENANT-BOUNDARY",
            scene_code="reimbursement",
            title="租户边界测试",
            current_stage="claiming",
            status="active",
        )
        link = ExpenseCaseLink(
            id="link-tenant-boundary",
            tenant_id="tenant-a",
            expense_case_id=expense_case.id,
            resource_type="expense_claim",
            resource_id=claim.id,
            relation_type="claim",
        )
        db.add_all([claim, expense_case, link])
        db.flush()

        with pytest.raises(PermissionError, match="tenant does not match"):
            RiskObservationService(db).upsert_observation(
                {
                    **_observation_payload("risk:tenant-boundary"),
                    "claim_id": claim.id,
                },
                tenant_id="tenant-b",
            )

        assert (
            db.query(RiskObservation)
            .filter_by(observation_key="risk:tenant-boundary")
            .one_or_none()
            is None
        )


def test_hermes_global_scan_builds_graphs_inside_each_tenant(
    monkeypatch: pytest.MonkeyPatch,
) -> None:
    with _build_session() as db:
        claims = [
            _claim_orm("claim-tenant-a", "BX-TENANT-A"),
            _claim_orm("claim-tenant-b", "BX-TENANT-B"),
        ]
        cases = [
            ExpenseCase(
                id=f"case-tenant-{suffix}",
                tenant_id=f"tenant-{suffix}",
                case_no=f"CASE-TENANT-{suffix.upper()}",
                scene_code="reimbursement",
                title="租户隔离图扫描",
                current_stage="claiming",
                status="active",
            )
            for suffix in ("a", "b")
        ]
        links = [
            ExpenseCaseLink(
                id=f"link-tenant-{suffix}",
                tenant_id=f"tenant-{suffix}",
                expense_case_id=cases[index].id,
                resource_type="expense_claim",
                resource_id=claims[index].id,
                relation_type="claim",
            )
            for index, suffix in enumerate(("a", "b"))
        ]
        db.add_all([*claims, *cases, *links])
        db.flush()

        evaluated_claim_sets: list[set[str]] = []
        history_tenants: list[str] = []

        def fake_evaluate(context):
            evaluated_claim_sets.append(set(context.target_claim_ids))
            return SimpleNamespace(observations=[], nodes=[], edges=[])

        def fake_history(_self, *, tenant_id=None, **_kwargs):
            history_tenants.append(str(tenant_id))
            return []

        scanner = HermesRiskScannerService(db)
        monkeypatch.setattr(scanner, "_fetch_unscanned_claims", lambda: claims)
        monkeypatch.setattr(
            "app.services.hermes_risk_scanner.evaluate_financial_risk_graph",
            fake_evaluate,
        )
        monkeypatch.setattr(RiskObservationService, "build_history_stats", fake_history)

        summary = scanner.scan_global_risks()

        assert evaluated_claim_sets == [
            {"claim-tenant-a"},
            {"claim-tenant-b"},
        ]
        assert history_tenants == ["tenant-a", "tenant-b"]
        assert summary["scanned_claim_count"] == 2


def test_risk_scan_discards_snapshot_after_claim_changes_during_evaluation(
    monkeypatch: pytest.MonkeyPatch,
) -> None:
    with _build_session() as db:
        claim = _claim_orm("claim-scan-stale", "BX-SCAN-STALE")
        db.add(claim)
        db.commit()
        original_updated_at = claim.updated_at

        def fake_evaluate(_context):
            claim.status = "pending_payment"
            claim.approval_stage = "待付款"
            claim.updated_at = original_updated_at + timedelta(seconds=1)
            db.flush()
            return SimpleNamespace(observations=[], nodes=[], edges=[])

        scanner = HermesRiskScannerService(db)
        monkeypatch.setattr(scanner, "_fetch_unscanned_claims", lambda: [claim])
        monkeypatch.setattr(
            "app.services.hermes_risk_scanner.evaluate_financial_risk_graph",
            fake_evaluate,
        )

        summary = scanner.scan_global_risks()

        db.refresh(claim)
        assert summary["scanned_claim_count"] == 0
        assert claim.status == "pending_payment"
        assert claim.hermes_scanned_at is None


def test_risk_observation_feedback_pool_fields_and_replay_set_contract() -> None:
    with _build_session() as db:
        service = RiskObservationService(db)
        service.upsert_observation(_observation_payload("risk:c1:duplicate_invoice"))
        db.commit()

        feedback = service.create_feedback(
            "risk:c1:duplicate_invoice",
            RiskObservationFeedbackCreate(
                feedback_type="comment",
                action="rewrite",
                actor="auditor",
                comment="建议生成候选规则",
                payload_json={
                    "decision": "candidate_rule_rewrite",
                    "candidate_rule_source": "risk_observation_feedback",
                    "confidence_score": 0.76,
                    "escalation_target": "finance_manager",
                    "supplement_required": True,
                },
            ),
        )
        observation = service.get_observation("risk:c1:duplicate_invoice")
        assert observation is not None

        replay_set = AlgorithmReplaySetBuilder().build_from_observations(
            "replay-set-1",
            [
                {
                    "observation_key": observation.observation_key,
                    "claim_id": observation.claim_id,
                    "risk_signal": observation.risk_signal,
                    "risk_score": observation.risk_score,
                    "risk_level": observation.risk_level,
                    "algorithm_version": observation.algorithm_version,
                    "feedback_status": observation.feedback_status,
                    "ontology_json": observation.ontology_json,
                    "decision_trace": observation.decision_trace_json,
                }
            ],
            created_at=datetime(2026, 5, 30, tzinfo=UTC),
        )

        assert feedback.decision == "candidate_rule_rewrite"
        assert feedback.candidate_rule_source == "risk_observation_feedback"
        assert feedback.confidence_score == 0.76
        assert feedback.escalation_target == "finance_manager"
        assert feedback.supplement_required is True
        assert replay_set.replay_set_id == "replay-set-1"
        assert replay_set.cases[0].claim_id == "c1"
        assert replay_set.cases[0].ontology_version == "ontology.v1"
        assert replay_set.cases[0].algorithm_version == "financial_risk_graph.v1"


def _build_session() -> Session:
    engine = create_engine(
        "sqlite+pysqlite:///:memory:",
        connect_args={"check_same_thread": False},
        poolclass=StaticPool,
    )
    Base.metadata.create_all(bind=engine)
    session_factory = sessionmaker(bind=engine, autoflush=False, autocommit=False)
    return session_factory()


def _build_client() -> tuple[TestClient, sessionmaker[Session]]:
    engine = create_engine(
        "sqlite+pysqlite:///:memory:",
        connect_args={"check_same_thread": False},
        poolclass=StaticPool,
    )
    Base.metadata.create_all(bind=engine)
    session_factory = sessionmaker(bind=engine, autoflush=False, autocommit=False)
    app = FastAPI()
    app.include_router(risk_observations_router, prefix="/api/v1")
    install_legacy_header_auth_override(app)

    def override_db() -> Generator[Session, None, None]:
        db = session_factory()
        try:
            yield db
        finally:
            db.close()

    app.dependency_overrides[get_db] = override_db
    return TestClient(app), session_factory


def _observation_payload(observation_key: str) -> dict:
    return {
        "observation_key": observation_key,
        "subject_type": "expense_claim",
        "subject_key": "claim:c1",
        "subject_label": "BX-001",
        "claim_id": "c1",
        "claim_no": "BX-001",
        "risk_type": "duplicate_invoice",
        "risk_signal": "duplicate_invoice",
        "title": "Duplicate invoice risk",
        "description": "Same invoice appears in multiple claims.",
        "risk_score": 86,
        "risk_level": "high",
        "confidence_score": "0.81",
        "control_stage": "reimbursement",
        "control_mode": "risk_observation",
        "automation_mode": "semi_auto_review",
        "source": "financial_risk_graph",
        "algorithm_version": "financial_risk_graph.v1",
        "contribution_scores": {"S_rule": 82, "S_graph": 95},
        "baseline": {"scope": "expense_type", "sample_size": 4},
        "evidence": [
            {
                "code": "duplicate_invoice_graph",
                "source": "graph",
                "metadata": {"vendor_name": "上海差旅供应商"},
            }
        ],
        "graph_node_keys": ["claim:c1", "vendor:上海差旅供应商"],
        "graph_edge_keys": [],
        "policy_refs": ["policy.duplicate_invoice"],
        "similar_case_claim_ids": ["c2"],
        "ontology_json": {
            "gate": "review",
            "ontology_parse_id": "parse-1",
            "ontology_version": "ontology.v1",
            "domain": "expense",
            "scenario": "reimbursement",
            "intent": "risk_check",
            "ontology_entities_json": [{"type": "claim", "value": "c1"}],
            "risk_signals_json": [{"code": "duplicate_invoice"}],
            "canonical_subject_key": "claim:c1",
        },
        "decision_trace": {
            "formula": "weighted",
            "sampling_strategy": {"strategy": "focused_review", "threshold": 70},
            "evaluation_case_id": "case-duplicate-invoice",
        },
    }


def _employee_orm() -> Employee:
    return Employee(
        id="emp-risk",
        employee_no="E-RISK",
        name="风险员工",
        email="risk.employee@example.com",
        position="高级专员",
        grade="P6",
    )


def _claim_orm(claim_id: str, claim_no: str) -> ExpenseClaim:
    now = datetime(2026, 5, 20, tzinfo=UTC)
    return ExpenseClaim(
        id=claim_id,
        claim_no=claim_no,
        employee_id="emp-risk",
        employee_name="风险员工",
        department_id="dept-risk",
        department_name="风控部",
        expense_type="travel",
        reason="客户拜访",
        location="上海",
        amount=Decimal("1200"),
        currency="CNY",
        invoice_count=1,
        occurred_at=now,
        submitted_at=now,
        status="submitted",
        approval_stage="manager_review",
        risk_flags_json=[],
    )