feat(P23IM2-1,P23IM2-2,P23IM2-3): 密钥加密持久化/遮罩读模型/企微可重试语义/迁移脚本

server/src/services/integrations/im/wecom.js

@@ -1,5 +1,7 @@
 const crypto = require('node:crypto');
 
+const { resolveChannelSecret } = require('../../notifications/channelConfig');
+
 function toSafeString(value, maxLength = 2000) {
   if (value == null) {
     return '';
@@ -47,7 +49,31 @@ function buildSignedWebhookUrl(webhookUrl, secret) {
   return `${rawUrl}${separator}timestamp=${timestamp}&sign=${sign}`;
 }
 
-async function sendWecomMessage({ channel, message }) {
+function mapSecretError(result, previewMessage) {
+  if (result?.errorCode === 'secret_missing_field_encryption_key') {
+    return {
+      ok: false,
+      skipped: false,
+      retryable: false,
+      code: 'wecom_secret_missing_field_encryption_key',
+      message: result.errorMessage ?? 'Missing FIELD_ENCRYPTION_KEY for encrypted WeCom secret',
+      response: null,
+      previewMessage,
+    };
+  }
+
+  return {
+    ok: false,
+    skipped: false,
+    retryable: false,
+    code: 'wecom_secret_decrypt_failed',
+    message: result?.errorMessage ?? 'Failed to decrypt WeCom secret',
+    response: null,
+    previewMessage,
+  };
+}
+
+async function sendWecomMessage({ config, channel, message }) {
   const configJson = channel?.config_json && typeof channel.config_json === 'object' ? channel.config_json : {};
   const mode = String(configJson.mode ?? 'mock').trim() || 'mock';
   const previewMessage = buildWecomMarkdownMessage(message);
@@ -56,7 +82,9 @@ async function sendWecomMessage({ channel, message }) {
     return {
       ok: true,
       skipped: false,
+      retryable: false,
       code: 'mock_sent',
+      message: null,
       response: {
         channelType: 'wecom',
         mode,
@@ -90,12 +118,20 @@ async function sendWecomMessage({ channel, message }) {
     };
   }
 
+  const secretResult = resolveChannelSecret({
+    config,
+    configJson,
+  });
+  if (secretResult.configured && !secretResult.secret) {
+    return mapSecretError(secretResult, previewMessage);
+  }
+
   const timeoutMs = Math.max(100, Number(configJson.timeoutMs ?? 5000));
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
 
   try {
-    const response = await fetch(buildSignedWebhookUrl(webhookUrl, configJson.secret ?? null), {
+    const response = await fetch(buildSignedWebhookUrl(webhookUrl, secretResult.secret), {
       method: 'POST',
       headers: {
         'content-type': 'application/json',
@@ -146,7 +182,9 @@ async function sendWecomMessage({ channel, message }) {
     return {
       ok: true,
       skipped: false,
+      retryable: false,
       code: 'wecom_sent',
+      message: null,
       response: responseBody,
       previewMessage,
     };
@@ -178,6 +216,7 @@ async function sendWecomMessage({ channel, message }) {
 }
 
 module.exports = {
+  buildSignedWebhookUrl,
   buildWecomMarkdownMessage,
   sendWecomMessage,
 };