"""Emails Steward sends read as designed messages (#5335): an HTML part and
a plain-text twin carrying the same facts, names escaped in the HTML, times
in the saved zone beside UTC, and nothing fetched when the mail is opened."""
import re
from datetime import datetime, timezone
from zoneinfo import ZoneInfo
from steward.core import mail
from steward.core import notifications as n
from steward.core import reports
ALERT = {"rule_name": 'Disk "root" on web01', "state": "FIRING", "metric": "disk_used_pct",
"value": 93.5, "operator": ">=", "threshold": 90.0, "resource": "web01",
"source_module": "host_agent", "note": None, "timestamp": "2026-10-08T17:58:00+00:00"}
CFG = {"host": "mx", "port": 587, "recipients": ["a@example.com"], "from": "alerts@example.com",
"tz": "America/New_York", "base_url": "https://steward.example/"}
REPORT = {"generated_at": datetime(2026, 10, 11, 12, 0, tzinfo=timezone.utc),
"uptime_summary": [{"name": "web01", "pct_7d": 99.95}, {"name": "nas ", "pct_7d": None}],
"active_alerts": [{"state": "firing", "name": "Disk root", "resource": "web01",
"condition": "Disk used >= 90%"}],
"alert_events": {"fired": 3, "resolved": 1},
"top_routers": [{"name": "api@docker", "avg_rate": 12.345}], "hosts_down": ["nas"]}
_URL = re.compile(r"""https?://[^\s"'<>)]+""")
_FETCHES = re.compile(r"""\ssrc\s*=|url\(| list[str]:
"""What in an email's HTML would reach outside Steward, or load at all."""
return ([u for u in _URL.findall(html) if not u.startswith(base)]
+ _FETCHES.findall(html))
def test_the_asset_guard_can_fail():
assert foreign_or_fetched('', "https://steward.example")
assert foreign_or_fetched('