robusta-api 0.51.0__tar.gz → 0.52.0__tar.gz

{robusta_api-0.51.0 → robusta_api-0.52.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: robusta-api
-Version: 0.51.0
+Version: 0.52.0
 Summary: 
 Author: Arik Alon
 Author-email: arikalon1@users.noreply.github.com
@@ -45,7 +45,7 @@ Requires-Dist: prometrix (==0.2.11)
 Requires-Dist: pyasn1 (>=0.6.4)
 Requires-Dist: pydantic (>=2.11.7,<3.0.0)
 Requires-Dist: pydash (==8.0.0)
-Requires-Dist: pyjwt (>=2.13.0,<3.0.0)
+Requires-Dist: pyjwt (>=2.14.0,<3.0.0)
 Requires-Dist: pymsteams (>=0.1.16,<0.2.0)
 Requires-Dist: python-json-logger (>=3.0.0,<4.0.0)
 Requires-Dist: pytz (>=2021.3,<2022.0)
@@ -56,14 +56,14 @@ Requires-Dist: requests (>=2.33.0,<3.0.0)
 Requires-Dist: resvg-py (==0.3.4)
 Requires-Dist: rocketchat-api (>=1.30.0,<2.0.0)
 Requires-Dist: sentry-sdk[flask] (>=2.13.0,<3.0.0) ; extra == "all"
-Requires-Dist: setuptools (>=80.9.0,<81.0.0)
+Requires-Dist: setuptools (>=83.0.0,<84.0.0)
 Requires-Dist: slack-sdk (>=3.23.0,<4.0.0)
 Requires-Dist: supabase (==2.28.1) ; extra == "all"
 Requires-Dist: tabulate (>=0.8.10,<0.9.0) ; extra == "all"
 Requires-Dist: tenacity (>=9.1.2,<10.0.0)
 Requires-Dist: toml (>=0.10.2,<0.11.0)
-Requires-Dist: urllib3 (>=2.7.0,<3.0.0)
-Requires-Dist: virtualenv (>=20.36.1,<21.0.0)
+Requires-Dist: urllib3 (>=2.8.0,<3.0.0)
+Requires-Dist: virtualenv (>=21.7.13,<22.0.0)
 Requires-Dist: watchdog (>=2.1.0,<3.0.0) ; extra == "all"
 Requires-Dist: watchgod (>=0.7,<0.8)
 Requires-Dist: webexteamssdk (>=1.6.1,<2.0.0)

{robusta_api-0.51.0 → robusta_api-0.52.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "robusta-api"
-version = "0.51.0"
+version = "0.52.0"
 description = ""
 authors = ["Arik Alon <arikalon1@users.noreply.github.com>"]
 packages = [
@@ -18,7 +18,7 @@ include_trailing_comma = true
 
 [tool.poetry.dependencies]
 python = ">=3.10, <3.12"
-setuptools = "^80.9.0"
+setuptools = "^83.0.0"
 colorlog = "^5.0.1"
 python-json-logger = "^3.0.0"
 pydantic = "^2.11.7"
@@ -83,9 +83,9 @@ requests = "^2.33.0"
 # Bump to fix certifi CVE flagged by customer scan; date-versioned, so use >= rather than caret
 certifi = ">=2026.4.22"
 regex = "2024.5.15"
-# Pin to fix CVE-2026-48526 (High) + CVE-2026-48522/48523/48525 (Medium): PyJWT
-pyjwt = "^2.13.0"
-urllib3 = "^2.7.0"
+# Pin to fix CVE-2026-102268 (Critical) + CVE-2026-102266/102267/102271-102273 (High): PyJWT
+pyjwt = "^2.14.0"
+urllib3 = "^2.8.0"
 httpx = "0.27.2"
 # realtime (supabase dependency) requires websockets.asyncio, added in websockets 13
 websockets = ">=13"
@@ -98,8 +98,8 @@ pyasn1 = ">=0.6.4"
 anyio = "^4.14.2"
 # Pin to fix CVE-2026-22701 (transitive via virtualenv/pre-commit)
 filelock = ">=3.20.3"
-# Pin to fix CVE-2026-22702 (transitive via pre-commit)
-virtualenv = "^20.36.1"
+# Pin to fix CVE-2026-102925/102930/102937 (transitive via pre-commit)
+virtualenv = "^21.7.13"
 # Pillow is used directly (MS Teams PNG->JPEG image conversion) and by reportlab.
 # Pin to fix CVE-2026-54058,
 # CVE-2026-54059, CVE-2026-54060, CVE-2026-55379, CVE-2026-55380, CVE-2026-59197,

{robusta_api-0.51.0 → robusta_api-0.52.0}/src/robusta/_version.py

@@ -1,2 +1,2 @@
 # this is updated by .github/workflows/release.yaml
-__version__ = "0.51.0"
+__version__ = "0.52.0"

{robusta_api-0.51.0 → robusta_api-0.52.0}/src/robusta/core/model/runner_config.py

@@ -12,6 +12,7 @@ from robusta.core.sinks.jira.jira_sink_params import JiraSinkConfigWrapper
 from robusta.core.sinks.kafka.kafka_sink_params import KafkaSinkConfigWrapper
 from robusta.core.sinks.mattermost.mattermost_sink_params import MattermostSinkConfigWrapper
 from robusta.core.sinks.msteams.msteams_sink_params import MsTeamsSinkConfigWrapper
+from robusta.core.sinks.msteams_graph.msteams_graph_sink_params import MsTeamsGraphSinkConfigWrapper
 from robusta.core.sinks.opsgenie.opsgenie_sink_params import OpsGenieSinkConfigWrapper
 from robusta.core.sinks.pagerduty.pagerduty_sink_params import PagerdutyConfigWrapper
 from robusta.core.sinks.robusta.robusta_sink_params import RobustaSinkConfigWrapper
@@ -60,6 +61,7 @@ class RunnerConfig(BaseModel):
                 DataDogSinkConfigWrapper,
                 KafkaSinkConfigWrapper,
                 MsTeamsSinkConfigWrapper,
+                MsTeamsGraphSinkConfigWrapper,
                 RocketchatSinkConfigWrapper,
                 OpsGenieSinkConfigWrapper,
                 TelegramSinkConfigWrapper,

robusta_api-0.52.0/src/robusta/core/sinks/common/destination_override.py

@@ -0,0 +1,67 @@
+import logging
+from typing import Dict, Optional, Tuple
+
+from robusta.core.reporting.base import Finding
+from robusta.core.sinks.common.channel_transformer import ChannelTransformer
+from robusta.integrations.kubernetes.api_client_utils import get_namespace_annotations, get_namespace_labels
+
+# Sentinel passed as default_channel to ChannelTransformer.template() so we can detect
+# the "any token missing" case from the outside. ChannelTransformer returns the default
+# we pass in only when the override is empty (we filter that case ourselves) or when a
+# referenced label/annotation key is missing — both of which we treat as unresolved here.
+_UNRESOLVED = "__robusta_destination_unresolved__"
+
+
+def resolve_destination_override(
+    finding: Finding,
+    cluster_name: str,
+    default_destination: str,
+    destination_override: Optional[str],
+    namespace_destination_override: Optional[str],
+    send_to_default_if_missing: bool,
+) -> Optional[str]:
+    """Pick the destination (room, channel, ...) for a finding.
+
+    Evaluated in order:
+    1. namespace_destination_override, resolved against the finding namespace's labels/annotations
+    2. destination_override, resolved against the finding subject's labels/annotations
+    3. default_destination, or None (drop) when an override is configured, didn't resolve,
+       and send_to_default_if_missing is False
+    """
+    if namespace_destination_override and finding.subject.namespace:
+        ns_labels, ns_annotations = _get_namespace_metadata(finding.subject.namespace)
+        resolved = ChannelTransformer.template(
+            namespace_destination_override,
+            _UNRESOLVED,
+            cluster_name,
+            ns_labels,
+            ns_annotations,
+        )
+        if resolved != _UNRESOLVED:
+            return resolved
+
+    if destination_override:
+        resolved = ChannelTransformer.template(
+            destination_override,
+            _UNRESOLVED,
+            cluster_name,
+            finding.subject.labels or {},
+            finding.subject.annotations or {},
+        )
+        if resolved != _UNRESOLVED:
+            return resolved
+
+    if not destination_override and not namespace_destination_override:
+        return default_destination
+
+    return default_destination if send_to_default_if_missing else None
+
+
+def _get_namespace_metadata(namespace: str) -> Tuple[Dict[str, str], Dict[str, str]]:
+    try:
+        labels = get_namespace_labels(namespace) or {}
+        annotations = get_namespace_annotations(namespace) or {}
+    except KeyError:
+        logging.debug("namespace %s not found in cache", namespace)
+        return {}, {}
+    return labels, annotations

robusta_api-0.52.0/src/robusta/core/sinks/msteams_graph/__init__.py

@@ -0,0 +1,5 @@
+from robusta.core.sinks.msteams_graph.msteams_graph_sink import MsTeamsGraphSink
+from robusta.core.sinks.msteams_graph.msteams_graph_sink_params import (
+    MsTeamsGraphSinkConfigWrapper,
+    MsTeamsGraphSinkParams,
+)

robusta_api-0.52.0/src/robusta/core/sinks/msteams_graph/msteams_graph_sink.py

@@ -0,0 +1,64 @@
+import logging
+from typing import Optional, Tuple
+
+from robusta.core.reporting import Finding
+from robusta.core.sinks.common.destination_override import resolve_destination_override
+from robusta.core.sinks.msteams_graph.msteams_graph_sink_params import MsTeamsGraphSinkConfigWrapper
+from robusta.core.sinks.sink_base import SinkBase
+from robusta.integrations.msteams.graph.graph_client import MsTeamsGraphClient
+from robusta.integrations.msteams.graph.sender import MsTeamsGraphSender
+
+
+class MsTeamsGraphSink(SinkBase):
+    def __init__(self, sink_config: MsTeamsGraphSinkConfigWrapper, registry):
+        super().__init__(sink_config.ms_teams_graph_sink, registry)
+        params = sink_config.ms_teams_graph_sink
+
+        client = MsTeamsGraphClient(
+            tenant_id=params.tenant_id,
+            client_id=params.client_id,
+            username=params.username,
+            password=params.password.get_secret_value(),
+            client_secret=params.client_secret.get_secret_value() if params.client_secret else None,
+            scope=params.oauth_scope,
+            authority_host=params.authority_host,
+            graph_endpoint=params.graph_endpoint,
+        )
+        self.sender = MsTeamsGraphSender(
+            client=client,
+            account_id=self.account_id,
+            cluster_name=self.cluster_name,
+            prefer_redirect_to_platform=params.prefer_redirect_to_platform,
+            send_files=params.send_files,
+        )
+
+    def write_finding(self, finding: Finding, platform_enabled: bool):
+        destination = self._resolve_destination(finding)
+        if destination is None:
+            logging.debug(f"no Teams channel resolved for {finding.title}, dropping it")
+            return
+        team_id, channel_id = destination
+        if self.params.disable_platform_links:
+            platform_enabled = False
+        self.sender.send_finding(finding, platform_enabled, team_id=team_id, channel_id=channel_id)
+
+    def _resolve_destination(self, finding: Finding) -> Optional[Tuple[str, str]]:
+        channel = resolve_destination_override(
+            finding,
+            self.cluster_name,
+            self.params.channel_id,
+            self.params.channel_override,
+            self.params.namespace_channel_override,
+            self.params.send_to_default_if_missing,
+        )
+        if channel is None:
+            return None
+        return self.split_team_and_channel(channel.strip(), self.params.team_id)
+
+    @staticmethod
+    def split_team_and_channel(destination: str, default_team_id: str) -> Tuple[str, str]:
+        # team ids are GUIDs and channel ids (19:...@thread.tacv2) never contain "/"
+        if "/" in destination:
+            team_id, channel_id = destination.split("/", 1)
+            return team_id.strip(), channel_id.strip()
+        return default_team_id, destination

robusta_api-0.52.0/src/robusta/core/sinks/msteams_graph/msteams_graph_sink_params.py

@@ -0,0 +1,42 @@
+from typing import Optional
+
+from pydantic.v1 import SecretStr, validator
+
+from robusta.core.sinks.common.channel_transformer import ChannelTransformer
+from robusta.core.sinks.sink_base_params import SinkBaseParams
+from robusta.core.sinks.sink_config import SinkConfigBase
+from robusta.integrations.msteams.graph.graph_client import DEFAULT_AUTHORITY_HOST, DEFAULT_GRAPH_ENDPOINT
+
+
+class MsTeamsGraphSinkParams(SinkBaseParams):
+    tenant_id: str
+    client_id: str
+    client_secret: Optional[SecretStr] = None
+    username: str
+    password: SecretStr
+    # Default destination. Overrides may resolve to "<channel_id>" (in team_id) or "<team_id>/<channel_id>"
+    team_id: str
+    channel_id: str
+    channel_override: Optional[str] = None
+    namespace_channel_override: Optional[str] = None
+    send_to_default_if_missing: bool = True
+    disable_platform_links: bool = False
+    send_files: bool = True
+    oauth_scope: Optional[str] = None  # defaults to <graph_endpoint>/.default
+    authority_host: str = DEFAULT_AUTHORITY_HOST
+    graph_endpoint: str = DEFAULT_GRAPH_ENDPOINT
+
+    @classmethod
+    def _get_sink_type(cls):
+        return "msteams_graph"
+
+    @validator("channel_override", "namespace_channel_override")
+    def validate_overrides(cls, v):
+        return ChannelTransformer.validate_channel_override(v)
+
+
+class MsTeamsGraphSinkConfigWrapper(SinkConfigBase):
+    ms_teams_graph_sink: MsTeamsGraphSinkParams
+
+    def get_params(self) -> SinkBaseParams:
+        return self.ms_teams_graph_sink

{robusta_api-0.51.0 → robusta_api-0.52.0}/src/robusta/core/sinks/sink_factory.py

@@ -12,6 +12,7 @@ from robusta.core.sinks.mail.mail_sink import MailSink
 from robusta.core.sinks.mail.mail_sink_params import MailSinkConfigWrapper
 from robusta.core.sinks.mattermost import MattermostSink, MattermostSinkConfigWrapper
 from robusta.core.sinks.msteams import MsTeamsSink, MsTeamsSinkConfigWrapper
+from robusta.core.sinks.msteams_graph import MsTeamsGraphSink, MsTeamsGraphSinkConfigWrapper
 from robusta.core.sinks.opsgenie import OpsGenieSink, OpsGenieSinkConfigWrapper
 from robusta.core.sinks.pagerduty import PagerdutyConfigWrapper, PagerdutySink
 from robusta.core.sinks.robusta import RobustaSink, RobustaSinkConfigWrapper
@@ -41,6 +42,7 @@ class SinkFactory:
         RocketchatSinkConfigWrapper: RocketchatSink,
         RobustaSinkConfigWrapper: RobustaSink,
         MsTeamsSinkConfigWrapper: MsTeamsSink,
+        MsTeamsGraphSinkConfigWrapper: MsTeamsGraphSink,
         KafkaSinkConfigWrapper: KafkaSink,
         DataDogSinkConfigWrapper: DataDogSink,
         DiscordSinkConfigWrapper: DiscordSink,

robusta_api-0.52.0/src/robusta/core/sinks/webex/webex_sink.py

@@ -0,0 +1,38 @@
+from typing import Optional
+
+from robusta.core.reporting.base import Finding
+from robusta.core.sinks.common.destination_override import resolve_destination_override
+from robusta.core.sinks.sink_base import SinkBase
+from robusta.core.sinks.webex.webex_sink_params import WebexSinkConfigWrapper
+from robusta.integrations.webex.sender import WebexSender
+
+
+class WebexSink(SinkBase):
+    def __init__(self, sink_config: WebexSinkConfigWrapper, registry):
+        super().__init__(sink_config.webex_sink, registry)
+
+        self.sender = WebexSender(
+            bot_access_token=sink_config.webex_sink.bot_access_token,
+            room_id=sink_config.webex_sink.room_id,
+            account_id=self.account_id,
+            cluster_name=self.cluster_name,
+            webex_params=self.params,
+        )
+
+    def write_finding(self, finding: Finding, platform_enabled: bool):
+        room_id = self._resolve_room_id(finding)
+        if room_id is None:
+            return
+        if self.params.disable_platform_links:
+            platform_enabled = False
+        self.sender.send_finding_to_webex(finding, platform_enabled, room_id=room_id)
+
+    def _resolve_room_id(self, finding: Finding) -> Optional[str]:
+        return resolve_destination_override(
+            finding,
+            self.cluster_name,
+            self.params.room_id,
+            self.params.room_id_override,
+            self.params.namespace_room_id_override,
+            self.params.send_to_default_if_missing,
+        )

robusta_api-0.52.0/src/robusta/integrations/msteams/graph/graph_client.py

@@ -0,0 +1,119 @@
+import logging
+import threading
+import time
+from typing import Optional
+from urllib.parse import quote, unquote
+
+import requests
+
+DEFAULT_AUTHORITY_HOST = "https://login.microsoftonline.com"
+DEFAULT_GRAPH_ENDPOINT = "https://graph.microsoft.com"
+REQUEST_TIMEOUT_SEC = 30
+# refresh the access token a bit before it expires, so a message is never sent with an expiring token
+TOKEN_EXPIRY_MARGIN_SEC = 300
+# after a failed sign-in, don't retry on every alert: repeated bad passwords trigger Entra ID smart lockout
+SIGN_IN_FAILURE_BACKOFF_SEC = 300
+
+
+class MsTeamsGraphError(Exception):
+    pass
+
+
+class MsTeamsGraphClient:
+    """Posts Teams channel messages via the Microsoft Graph API.
+
+    Graph only supports posting channel messages with delegated permissions (application permissions are
+    limited to message migration), so the token is acquired on behalf of a service user with the
+    Resource Owner Password Credentials (ROPC) flow. The user must be a member of every target team,
+    and must not require interactive MFA.
+    """
+
+    def __init__(
+        self,
+        tenant_id: str,
+        client_id: str,
+        username: str,
+        password: str,
+        client_secret: Optional[str] = None,
+        scope: Optional[str] = None,
+        authority_host: str = DEFAULT_AUTHORITY_HOST,
+        graph_endpoint: str = DEFAULT_GRAPH_ENDPOINT,
+    ):
+        self.tenant_id = tenant_id
+        self.client_id = client_id
+        self.username = username
+        self.password = password
+        self.client_secret = client_secret
+        self.authority_host = authority_host.rstrip("/")
+        self.graph_endpoint = graph_endpoint.rstrip("/")
+        self.scope = scope or f"{self.graph_endpoint}/.default"
+
+        self._lock = threading.Lock()
+        self._access_token: Optional[str] = None
+        self._expires_at: float = 0
+        self._next_sign_in_attempt: float = 0
+
+    def _get_access_token(self, force_refresh: bool = False) -> str:
+        with self._lock:
+            if not force_refresh and self._access_token and time.time() < self._expires_at - TOKEN_EXPIRY_MARGIN_SEC:
+                return self._access_token
+            if time.time() < self._next_sign_in_attempt:
+                raise MsTeamsGraphError(
+                    f"Skipping Graph sign-in for {self.username}, it failed recently. "
+                    f"Retrying in {int(self._next_sign_in_attempt - time.time())}s"
+                )
+
+            data = {
+                "grant_type": "password",
+                "client_id": self.client_id,
+                "username": self.username,
+                "password": self.password,
+                "scope": self.scope,
+            }
+            if self.client_secret:
+                data["client_secret"] = self.client_secret
+
+            response = requests.post(
+                f"{self.authority_host}/{self.tenant_id}/oauth2/v2.0/token", data=data, timeout=REQUEST_TIMEOUT_SEC
+            )
+            if not response.ok:
+                self._next_sign_in_attempt = time.time() + SIGN_IN_FAILURE_BACKOFF_SEC
+                raise MsTeamsGraphError(
+                    f"Failed to get a Graph access token for {self.username}: "
+                    f"{response.status_code} {self.error_message(response)}"
+                )
+
+            body = response.json()
+            self._access_token = body["access_token"]
+            self._expires_at = time.time() + int(body.get("expires_in", 3600))
+            return self._access_token
+
+    def post_channel_message(self, team_id: str, channel_id: str, message: dict) -> requests.Response:
+        # channel ids look like 19:abc@thread.tacv2, and are often copied URL-encoded from the Teams channel link
+        url = (
+            f"{self.graph_endpoint}/v1.0/teams/{quote(unquote(team_id), safe='')}"
+            f"/channels/{quote(unquote(channel_id), safe='')}/messages"
+        )
+        response = self._post(url, message, force_refresh=False)
+        if response.status_code == 401:
+            response = self._post(url, message, force_refresh=True)
+        return response
+
+    def _post(self, url: str, message: dict, force_refresh: bool) -> requests.Response:
+        headers = {"Authorization": f"Bearer {self._get_access_token(force_refresh)}"}
+        return requests.post(url, json=message, headers=headers, timeout=REQUEST_TIMEOUT_SEC)
+
+    @staticmethod
+    def error_message(response: requests.Response) -> str:
+        try:
+            body = response.json()
+        except ValueError:
+            return response.text
+        error = body.get("error")
+        if isinstance(error, dict):  # Graph errors
+            return error.get("message", response.text)
+        if body.get("error_description"):  # Entra ID token errors
+            return f"{error}: {body['error_description']}"
+        logging.debug("unexpected Graph error body %s", body)
+        return response.text
+

robusta_api-0.52.0/src/robusta/integrations/msteams/graph/graph_msg.py

@@ -0,0 +1,167 @@
+import base64
+import json
+import logging
+import uuid
+from typing import List, Optional
+
+from robusta.core.reporting import FileBlock, Finding, FindingSeverity
+from robusta.core.reporting.base import Emojis, FindingStatus, LinkType
+from robusta.core.reporting.consts import FindingSource
+from robusta.core.reporting.url_helpers import convert_prom_graph_url_to_robusta_metrics_explorer
+from robusta.core.reporting.utils import JPG_SUFFIX, PNG_SUFFIX, convert_svg_to_png, file_suffix_match, is_image
+from robusta.integrations.msteams.msteams_elements.msteams_base import MsTeamsBase
+from robusta.integrations.msteams.msteams_elements.msteams_images import MsTeamsImages
+from robusta.integrations.msteams.msteams_elements.msteams_text_block import MsTeamsTextBlock
+from robusta.integrations.msteams.msteams_msg import MsTeamsMsg
+
+ADAPTIVE_CARD_CONTENT_TYPE = "application/vnd.microsoft.card.adaptive"
+# Teams only shows a handful of card buttons, keep the first ones (Investigate, Silence, the finding links)
+MAX_CARD_ACTIONS = 6
+
+
+class MsTeamsGraphMsg(MsTeamsMsg):
+    """Builds a Teams channel message (chatMessage) for the Graph API.
+
+    Reuses the adaptive card rendering of the webhook sink for the enrichment blocks, with a Slack like header:
+    a status line, a colored title container, the source cluster, the description, and link buttons.
+    Images are sent as message hostedContents rather than inline base64, which keeps them out of the
+    ~28KB message size limit.
+    """
+
+    def __init__(self, prefer_redirect_to_platform: bool):
+        super().__init__(prefer_redirect_to_platform)
+        self.hosted_contents: List[dict] = []
+
+    def write_title_and_desc(self, platform_enabled: bool, finding: Finding, cluster_name: str, account_id: str):
+        status = FindingStatus.RESOLVED if finding.title.startswith("[RESOLVED]") else FindingStatus.FIRING
+        title = finding.title.removeprefix("[RESOLVED] ")
+        severity = finding.severity
+
+        header_items = [
+            MsTeamsTextBlock(
+                f"{self.__status_name(finding.source, status)} "
+                f"{severity.to_emoji()} **{severity.name.capitalize()}**"
+            ).get_map_value(),
+            MsTeamsTextBlock(title, weight="bolder", font_size="large").get_map_value(),
+        ]
+        self._write_to_entire_msg(
+            [
+                MsTeamsBase(
+                    {
+                        "type": "Container",
+                        "style": self.__card_style(status, severity),
+                        "bleed": True,
+                        "items": header_items,
+                    }
+                )
+            ]
+        )
+        # link buttons right under the title, like Slack
+        actions = self.__actions(platform_enabled, finding, cluster_name, account_id)
+        if actions:
+            self._write_to_entire_msg([MsTeamsBase({"type": "ActionSet", "actions": actions})])
+        self._write_to_entire_msg([MsTeamsTextBlock(f"**Source:** {cluster_name}")])
+
+        if finding.description:
+            if finding.source == FindingSource.PROMETHEUS:
+                description = f"{Emojis.Alert.value} **Alert:** {finding.description}"
+            elif finding.source == FindingSource.KUBERNETES_API_SERVER:
+                description = f"{Emojis.K8Notification.value} **K8s event detected:** {finding.description}"
+            else:
+                description = f"{Emojis.K8Notification.value} **Notification:** {finding.description}"
+            self._write_to_entire_msg([MsTeamsTextBlock(description)])
+
+    def __actions(self, platform_enabled: bool, finding: Finding, cluster_name: str, account_id: str) -> List[dict]:
+        links = []
+        if platform_enabled:
+            links.append(("Investigate 🔎", finding.get_investigate_uri(account_id, cluster_name)))
+            if finding.add_silence_url:
+                links.append(("Configure Silences 🔕", finding.get_prometheus_silence_url(account_id, cluster_name)))
+
+        for link in finding.links:
+            link_url = link.url
+            if link.type == LinkType.PROMETHEUS_GENERATOR_URL and self.prefer_redirect_to_platform and platform_enabled:
+                link_url = convert_prom_graph_url_to_robusta_metrics_explorer(link.url, cluster_name, account_id)
+            links.append((link.link_text, link_url))
+
+        if len(links) > MAX_CARD_ACTIONS:
+            logging.debug(f"Teams card for {finding.title} has {len(links)} links, keeping the first {MAX_CARD_ACTIONS}")
+        return [{"type": "Action.OpenUrl", "title": title, "url": url} for title, url in links[:MAX_CARD_ACTIONS]]
+
+    def upload_files(self, file_blocks: List[FileBlock]):
+        # text files are rendered in the card, the same as the webhook sink
+        super().upload_files([block for block in file_blocks if not is_image(block.filename)])
+
+        image_urls = [self.__add_hosted_image(block) for block in file_blocks if is_image(block.filename)]
+        image_urls = [url for url in image_urls if url]
+        if image_urls:
+            self._sub_section_separator()
+            self._write_to_current_section([MsTeamsImages(image_urls)])
+
+    def __add_hosted_image(self, block: FileBlock) -> Optional[str]:
+        if file_suffix_match(block.filename, PNG_SUFFIX):
+            content_type, contents = "image/png", block.contents
+        elif file_suffix_match(block.filename, JPG_SUFFIX):
+            content_type, contents = "image/jpeg", block.contents
+        else:
+            content_type, contents = "image/png", convert_svg_to_png(block.contents)
+            if contents is None:
+                logging.warning(f"failed to convert {block.filename} to png, not sending it to Teams")
+                return None
+
+        temporary_id = str(len(self.hosted_contents) + 1)
+        self.hosted_contents.append(
+            {
+                "@microsoft.graph.temporaryId": temporary_id,
+                "contentBytes": base64.b64encode(contents).decode("utf-8"),
+                "contentType": content_type,
+            }
+        )
+        return f"../hostedContents/{temporary_id}/$value"
+
+    def build_message(self) -> dict:
+        card = self.build_card()["attachments"][0]["content"]
+        attachment_id = uuid.uuid4().hex
+        message = {
+            "body": {"contentType": "html", "content": f'<attachment id="{attachment_id}"></attachment>'},
+            "attachments": [
+                {
+                    "id": attachment_id,
+                    "contentType": ADAPTIVE_CARD_CONTENT_TYPE,
+                    "contentUrl": None,
+                    "content": json.dumps(card),
+                }
+            ],
+        }
+        if self.hosted_contents:
+            message["hostedContents"] = self.hosted_contents
+        return message
+
+    @staticmethod
+    def without_images(message: dict) -> dict:
+        """A copy of the message without its hosted images, used when Teams rejects them."""
+        card = json.loads(message["attachments"][0]["content"])
+        card["body"] = [element for element in card["body"] if element.get("type") != "ImageSet"]
+        message = {k: v for k, v in message.items() if k != "hostedContents"}
+        message["attachments"] = [{**message["attachments"][0], "content": json.dumps(card)}]
+        return message
+
+    @staticmethod
+    def __status_name(source: FindingSource, status: FindingStatus) -> str:
+        if source == FindingSource.PROMETHEUS:
+            if status == FindingStatus.FIRING:
+                return f"{status.to_emoji()} **Prometheus Alert Firing** {status.to_emoji()}"
+            return f"{status.to_emoji()} **Prometheus resolved**"
+        if source == FindingSource.KUBERNETES_API_SERVER:
+            return "👀 **K8s event detected**"
+        return "👀 **Notification**"
+
+    @staticmethod
+    def __card_style(status: FindingStatus, severity: FindingSeverity) -> str:
+        if status == FindingStatus.RESOLVED:
+            return "good"
+        if severity == FindingSeverity.HIGH:
+            return "attention"
+        if severity == FindingSeverity.LOW:
+            return "warning"
+        return "accent"

robusta_api-0.52.0/src/robusta/integrations/msteams/graph/sender.py

@@ -0,0 +1,41 @@
+import logging
+
+from robusta.core.reporting import Finding
+from robusta.integrations.msteams.graph.graph_client import MsTeamsGraphClient
+from robusta.integrations.msteams.graph.graph_msg import MsTeamsGraphMsg
+
+
+class MsTeamsGraphSender:
+    def __init__(
+        self,
+        client: MsTeamsGraphClient,
+        account_id: str,
+        cluster_name: str,
+        prefer_redirect_to_platform: bool,
+        send_files: bool,
+    ):
+        self.client = client
+        self.account_id = account_id
+        self.cluster_name = cluster_name
+        self.prefer_redirect_to_platform = prefer_redirect_to_platform
+        self.send_files = send_files
+
+    def send_finding(self, finding: Finding, platform_enabled: bool, team_id: str, channel_id: str):
+        msg = MsTeamsGraphMsg(self.prefer_redirect_to_platform)
+        msg.write_title_and_desc(platform_enabled, finding, self.cluster_name, self.account_id)
+        msg.write_enrichments(finding.enrichments, self.send_files)
+        message = msg.build_message()
+
+        response = self.client.post_channel_message(team_id, channel_id, message)
+        if response.status_code in (400, 413) and "hostedContents" in message:
+            logging.warning(
+                f"Teams rejected finding {finding.title} with images ({response.status_code} "
+                f"{self.client.error_message(response)}), sending it without them"
+            )
+            response = self.client.post_channel_message(team_id, channel_id, MsTeamsGraphMsg.without_images(message))
+
+        if not response.ok:
+            logging.error(
+                f"Failed to send finding {finding.title} to Teams channel {channel_id} in team {team_id}: "
+                f"{response.status_code} {self.client.error_message(response)}"
+            )