feat(notification): add WeChat Work app message notification channel

[chqchshj]

Summary

Add WeComAppClient for sending notifications via WeCom (企业微信) application message API, as opposed to the existing group bot webhook.

Motivation

The existing wecom channel uses group bot webhooks, which only support posting to group chats. Application messages (wecom_app) push directly to individual users via the WeCom app, which is more suitable for personal monitoring alerts.

Changes

• src/infrastructure/external/notification_clients/wecom_app_client.py — new client
• src/infrastructure/config/settings.py — add 4 env fields
• src/infrastructure/external/notification_clients/factory.py — register client
• src/infrastructure/external/notification_clients/__init__.py — export
• src/services/notification_config_service.py — field map, channel detection, status flags

Configuration

WECOM_APP_CORPID=企业ID
WECOM_APP_SECRET=应用Secret
WECOM_APP_AGENTID=应用AgentID
WECOM_APP_TOUSER=接收用户ID（可选，默认@all）

Features

• Access token caching with auto-refresh (expires 5min early)
• Auto-retry on token expiration (errcode 40014/42001)
• TextCard message format with clickable product links
• Coexists with existing wecom bot channel (separate channel key wecom_app)
• Follows the same architecture pattern as other notification clients

[gemini-code-assist]

Code Review

This pull request adds support for WeChat Work App notifications by implementing a new WeComAppClient, updating configuration settings, and integrating the client into the notification factory. Key feedback involves improving security by escaping HTML in messages and masking secrets in the UI, fixing missing configuration logic in the service layer, and refining type hints and return values for consistency with the base notification class.

[gemini-code-assist]

User-provided data such as price and reason should be HTML-escaped before being embedded in the textcard description. WeChat Work's textcard supports a subset of HTML, and unescaped characters (like < or &) in the product data could break the message structure or lead to injection issues.

Suggested change

	f"<div class=\"normal\">💰 价格: {message.price}</div>",
	f"<div class=\"normal\">📝 原因: {message.reason}</div>",
	f"<div class=\"normal\">💰 价格: {html.escape(message.price)}</div>",
	f"<div class=\"normal\">📝 原因: {html.escape(message.reason)}</div>",

[gemini-code-assist]

The new WeChat Work App configuration fields (CORPID, SECRET, AGENTID, TOUSER) are missing from the build_notification_settings_response function (around line 95). Without this update, the web UI will not be able to retrieve and display the current configuration values for this channel.

[gemini-code-assist]

The WECOM_APP_SECRET field must be added to the SECRET_NOTIFICATION_FIELDS set (around line 57). This ensures the secret is masked in the UI and not transmitted in plain text in API responses.

[gemini-code-assist]

It is recommended to use Optional[int] for the wecom_app_agentid field. This allows Pydantic to automatically handle type conversion and validation from environment variables, ensuring the value is a valid integer as required by the WeChat Work API.

Suggested change

	wecom_app_agentid: Optional[str] = _env_field(None, "WECOM_APP_AGENTID")
	wecom_app_agentid: Optional[int] = _env_field(None, "WECOM_APP_AGENTID")

[gemini-code-assist]

Add the html module to the imports to support escaping user-provided content in the notification message.

Suggested change

	import asyncio
	import time
	import asyncio
	import html
	import time

[gemini-code-assist]

Update the type hint for agentid to include int, as it is expected to be an integer by the API and can be provided as such via the settings.

Suggested change

	agentid: str | None = None,
	agentid: int | str | None = None,

[gemini-code-assist]

The send method signature should return a bool to remain consistent with the NotificationClient base class definition and its docstring.

Suggested change

	async def send(self, product_data: Dict, reason: str) -> None:
	async def send(self, product_data: Dict, reason: str) -> bool:

[gemini-code-assist]

The method should return True upon successful completion to satisfy the expected return type of the base class.

Suggested change

	else:
	raise RuntimeError(
	f"企微应用消息发送失败: {result.get('errmsg', '未知错误')}"
	)
	else:
	raise RuntimeError(
	f"企微应用消息发送失败: {result.get('errmsg', '未知错误')}"
	)
	return True