Add endpoint to report via email

src/reporter/app.py

@@ -1,9 +1,15 @@
-from fastapi import FastAPI
-
+from typing import Annotated
+from fastapi import Depends, FastAPI
+from msgraph import GraphServiceClient
+from reporter.schemas import ReportPayload
+from reporter.constants import Mail
 from reporter.http_client import HTTPClientDependency
 from reporter.models import Observation
 from reporter.observations import send_observation
 
+from reporter.dependencies import build_graph_client
+from reporter.mailer import build_report_email_content, send_mail
+
 app = FastAPI()
 
 
@@ -21,3 +27,16 @@ async def report_endpoint(
     await send_observation(
         project_name=project_name, observation=observation, http_client=http_client
     )
+
+
+
+@app.post("/report/email")
+async def report_email_endpoint(payload: ReportPayload, graph_client: Annotated[GraphServiceClient, Depends(build_graph_client)]):
+    content=build_report_email_content(name=payload.name, version=payload.version, inspector_url=payload.inspector_url, rules_matched=payload.rules_matched, additional_information=payload.additional_information)
+    await send_mail(
+        graph_client,
+        to_addresses=[payload.recipient or Mail.recipient],
+        bcc_addresses=[],
+        subject=f"Automated PyPI Malware Report: {payload.name}@{payload.version}",
+        content=content,
+    )

src/reporter/mailer.py

@@ -1,6 +1,7 @@
 """Sending emails."""
 
 from logging import getLogger
+from typing import Optional
 
 from msgraph import GraphServiceClient
 from msgraph.generated.models.attachment import Attachment
@@ -12,11 +13,33 @@
 from msgraph.generated.users.item.send_mail.send_mail_post_request_body import (
     SendMailPostRequestBody,
 )
-
+from textwrap import dedent
 from reporter.constants import Mail
+from reporter.utils.pypi import file_path_from_inspector_url
 
 logger = getLogger(__name__)
 
+def build_report_email_content(
+    *,
+    name: str,
+    version: str,
+    inspector_url: str,
+    rules_matched: list[str],
+    additional_information: Optional[str],
+) -> str:
+    content = f"""
+        PyPI Malicious Package Report
+        -
+        Package Name: {name}
+        Version: {version}
+        File path: {file_path_from_inspector_url(inspector_url)}
+        Inspector URL: {inspector_url}
+        Additional Information: {additional_information or "No user description provided"}
+        Yara rules matched: {", ".join(rules_matched) or "No rules matched"}
+    """
+
+    return dedent(content)
+
 
 async def send_mail(
     graph_client: GraphServiceClient,

src/reporter/schemas.py

@@ -0,0 +1,10 @@
+from pydantic import BaseModel
+from typing import Optional
+
+class ReportPayload(BaseModel):
+    name: str
+    version: str
+    rules_matched: list[str]
+    inspector_url: str
+    additional_information: Optional[str] = None
+    recipient: Optional[str] = None

src/reporter/utils/pypi.py

@@ -0,0 +1,13 @@
+"""Utilities related to PyPI"""
+
+from urllib.parse import urlparse
+
+def file_path_from_inspector_url(inspector_url: str) -> str:
+    """Parse the file path out of a PyPI inspector URL"""
+
+    parsed_url = urlparse(inspector_url)
+    path = parsed_url.path.strip("/")
+    segments = path.split("/")
+
+    # The 8th element of path is when the file path starts
+    return "/".join(segments[8:])