Add endpoint to report via email

src/reporter/app.py

@@ -1,11 +1,18 @@
-from fastapi import FastAPI
+from typing import Annotated
+from fastapi import Depends, FastAPI
+from msgraph import GraphServiceClient
+from reporter.schemas import ReportPayload
+from reporter.constants import Mail
 import sentry_sdk
 
 from reporter.constants import GIT_SHA, Sentry
 from reporter.http_client import HTTPClientDependency
 from reporter.models import Observation, ServerMetadata
 from reporter.observations import send_observation
 
+from reporter.dependencies import build_graph_client
+from reporter.mailer import build_report_email_content, send_mail
+
 sentry_sdk.init(
     dsn=Sentry.dsn,
     environment=Sentry.environment,
@@ -29,3 +36,23 @@ async def metadata() -> ServerMetadata:
 @app.post("/report/{project_name}")
 async def report_endpoint(project_name: str, observation: Observation, http_client: HTTPClientDependency):
     await send_observation(project_name=project_name, observation=observation, http_client=http_client)
+
+
+@app.post("/report/email")
+async def report_email_endpoint(
+    payload: ReportPayload, graph_client: Annotated[GraphServiceClient, Depends(build_graph_client)]
+):
+    content = build_report_email_content(
+        name=payload.name,
+        version=payload.version,
+        inspector_url=payload.inspector_url,
+        rules_matched=payload.rules_matched,
+        additional_information=payload.additional_information,
+    )
+    await send_mail(
+        graph_client,
+        to_addresses=[payload.recipient or Mail.recipient],
+        bcc_addresses=[],
+        subject=f"Automated PyPI Malware Report: {payload.name}@{payload.version}",
+        content=content,
+    )

src/reporter/mailer.py

@@ -1,6 +1,7 @@
 """Sending emails."""
 
 from logging import getLogger
+from typing import Optional
 
 from msgraph import GraphServiceClient
 from msgraph.generated.models.attachment import Attachment
@@ -12,12 +13,35 @@
 from msgraph.generated.users.item.send_mail.send_mail_post_request_body import (
     SendMailPostRequestBody,
 )
-
+from textwrap import dedent
 from reporter.constants import Mail
+from reporter.utils.pypi import file_path_from_inspector_url
 
 logger = getLogger(__name__)
 
 
+def build_report_email_content(
+    *,
+    name: str,
+    version: str,
+    inspector_url: str,
+    rules_matched: list[str],
+    additional_information: Optional[str],
+) -> str:
+    content = f"""
+        PyPI Malicious Package Report
+        -
+        Package Name: {name}
+        Version: {version}
+        File path: {file_path_from_inspector_url(inspector_url)}
+        Inspector URL: {inspector_url}
+        Additional Information: {additional_information or "No user description provided"}
+        Yara rules matched: {", ".join(rules_matched) or "No rules matched"}
+    """
+
+    return dedent(content)
+
+
 async def send_mail(
     graph_client: GraphServiceClient,
     to_addresses: list[str],

src/reporter/schemas.py

@@ -0,0 +1,11 @@
+from pydantic import BaseModel
+from typing import Optional
+
+
+class ReportPayload(BaseModel):
+    name: str
+    version: str
+    rules_matched: list[str]
+    inspector_url: str
+    additional_information: Optional[str] = None
+    recipient: Optional[str] = None

src/reporter/utils/pypi.py

@@ -0,0 +1,14 @@
+"""Utilities related to PyPI"""
+
+from urllib.parse import urlparse
+
+
+def file_path_from_inspector_url(inspector_url: str) -> str:
+    """Parse the file path out of a PyPI inspector URL"""
+
+    parsed_url = urlparse(inspector_url)
+    path = parsed_url.path.strip("/")
+    segments = path.split("/")
+
+    # The 8th element of path is when the file path starts
+    return "/".join(segments[8:])