security: harden Campaign delivery effects and reconciliation

src/govoplan_campaign/backend/reports/emailing.py

@@ -9,11 +9,12 @@ from typing import Any
 from sqlalchemy.orm import Session
 
 from govoplan_campaign.backend.db.models import Campaign, CampaignVersion
-from govoplan_campaign.backend.campaign.loader import load_campaign_config
-from govoplan_campaign.backend.campaign.models import CampaignConfig, SmtpConfig
-from govoplan_campaign.backend.persistence.campaigns import _write_campaign_snapshot
+from govoplan_campaign.backend.campaign.models import CampaignConfig
+from govoplan_campaign.backend.campaign.mail_profile_boundary import campaign_mail_profile_id
+from govoplan_campaign.backend.persistence.campaigns import load_version_config
 from govoplan_campaign.backend.reports.campaigns import CampaignReportError, generate_campaign_report, generate_jobs_csv
-from govoplan_campaign.backend.integrations import SmtpConfigurationError, mail_integration
+from govoplan_campaign.backend.integrations import SmtpConfigurationError
+from govoplan_campaign.backend.sending.execution import ExecutionSnapshotError, ensure_execution_snapshot
 
 
 class CampaignReportEmailError(RuntimeError):
@@ -30,8 +31,6 @@ class CampaignReportEmailResult:
     sent: bool
     attached_jobs_csv: bool
     attached_report_json: bool
-    smtp_host: str | None = None
-    smtp_port: int | None = None
     accepted_count: int | None = None
 
     def as_dict(self) -> dict[str, Any]:
@@ -44,8 +43,6 @@ class CampaignReportEmailResult:
             "sent": self.sent,
             "attached_jobs_csv": self.attached_jobs_csv,
             "attached_report_json": self.attached_report_json,
-            "smtp_host": self.smtp_host,
-            "smtp_port": self.smtp_port,
             "accepted_count": self.accepted_count,
         }
 
@@ -62,18 +59,15 @@ def _selected_version(
     return version
 
 
-def _load_config(version: CampaignVersion) -> CampaignConfig:
-    snapshot_path = _write_campaign_snapshot(version)
-    return load_campaign_config(snapshot_path)
+def _load_config(session: Session, version: CampaignVersion) -> CampaignConfig:
+    _campaign, _version, config = load_version_config(session, version.id)
+    return config
 
 
 def _effective_from(config: CampaignConfig) -> tuple[str, str | None]:
     if config.recipients.from_:
         return config.recipients.from_[0].email, config.recipients.from_[0].name
-    smtp_config = config.server.runtime_smtp_config()
-    if smtp_config and smtp_config.username and "@" in smtp_config.username:
-        return smtp_config.username, None
-    raise SmtpConfigurationError("Report email requires a recipients.from address or an SMTP username that is an email address")
+    raise SmtpConfigurationError("Report email requires a Campaign-owned recipients.from address")
 
 
 def _text_summary(report: dict[str, Any]) -> str:
@@ -150,7 +144,7 @@ def send_campaign_report_email(
     version_id: str | None = None,
     to: list[str],
     include_jobs: bool = False,
-    attach_jobs_csv: bool = True,
+    attach_jobs_csv: bool = False,
     attach_report_json: bool = False,
     dry_run: bool = False,
 ) -> CampaignReportEmailResult:
@@ -161,10 +155,28 @@ def send_campaign_report_email(
         raise CampaignReportEmailError("At least one report recipient is required")
 
     version = _selected_version(session, campaign, version_id)
-    config = _load_config(version)
-    smtp_config: SmtpConfig | None = config.server.runtime_smtp_config()
-    if smtp_config is None:
+    config = _load_config(session, version)
+    if not config.server.profile_capabilities.smtp_available:
         raise SmtpConfigurationError("Campaign has no SMTP configuration")
+    profile_id = campaign_mail_profile_id(version.raw_json if isinstance(version.raw_json, dict) else {})
+    if not profile_id:
+        raise SmtpConfigurationError("Campaign has no Mail profile reference")
+    if not isinstance(version.execution_snapshot, dict):
+        raise CampaignReportEmailError(
+            "Report email requires a validated and built campaign version with stored Mail-profile evidence."
+        )
+    try:
+        snapshot = ensure_execution_snapshot(session, version)
+    except ExecutionSnapshotError as exc:
+        raise CampaignReportEmailError(
+            "Report email requires a validated and built campaign version with current Mail-profile evidence."
+        ) from exc
+    if not snapshot.smtp_transport_revision:
+        raise CampaignReportEmailError("Campaign build evidence has no SMTP transport revision")
+    if not dry_run:
+        raise CampaignReportEmailError(
+            "Report email delivery is disabled until it uses a durable, idempotent Mail-owned outbox with unknown-outcome reconciliation."
+        )
 
     report = generate_campaign_report(
         session,
@@ -172,6 +184,7 @@ def send_campaign_report_email(
         campaign_id=campaign_id,
         version_id=version.id,
         include_jobs=include_jobs,
+        include_recent_failures=include_jobs,
     )
     jobs_csv = (
         generate_jobs_csv(session, tenant_id=tenant_id, campaign_id=campaign_id, version_id=version.id)
@@ -187,38 +200,13 @@ def send_campaign_report_email(
         jobs_csv=jobs_csv,
         report_json=report_json,
     )
-    envelope_from, _ = _effective_from(config)
-
-    if dry_run:
-        return CampaignReportEmailResult(
-            campaign_id=campaign.id,
-            version_id=version.id,
-            to=to,
-            subject=str(message["Subject"]),
-            dry_run=True,
-            sent=False,
-            attached_jobs_csv=jobs_csv is not None,
-            attached_report_json=report_json is not None,
-            smtp_host=smtp_config.host,
-            smtp_port=smtp_config.port,
-        )
-
-    result = mail_integration().send_email_message(
-        message,
-        smtp_config=smtp_config,
-        envelope_from=envelope_from,
-        envelope_recipients=to,
-    )
     return CampaignReportEmailResult(
         campaign_id=campaign.id,
         version_id=version.id,
         to=to,
         subject=str(message["Subject"]),
-        dry_run=False,
-        sent=True,
+        dry_run=True,
+        sent=False,
         attached_jobs_csv=jobs_csv is not None,
         attached_report_json=report_json is not None,
-        smtp_host=result.host,
-        smtp_port=result.port,
-        accepted_count=result.accepted_count,
     )