"""漏洞赏金域通知模板。

五条推送,收件面刻意很窄:

* ``bounty.owner_confirm_requested`` / ``bounty.owner_confirm_reminder``
  —— 发给**被点名指派的那一位**业务负责人。这是本域唯一面向普通员工的
  推送:安全团队人工指派一次触发一次,没有 cron、没有经理链 walk-up、
  没有隔级升级。催办另有 12 小时节流。
* ``bounty.owner_responded`` —— 业务负责人给出结论后回推给安全团队
  (IT-only),否则操作者只能靠刷控制台发现有人回了。
* ``bounty.mail_queued`` / ``bounty.researcher_followup`` —— 收件面同样是
  安全团队(IT-only):前者每轮邮件轮询最多一条(不是每封信一条,否则这
  个频道会被 15 分钟一次的节奏训练成静音),后者是白帽子在已有报告上回信
  时的催办。两者都不发给业务负责人,因为来信原文里带着提交者的邮箱。

文案给的是「你要判断什么」,不是「有一条记录」:业务负责人多半不熟悉
漏洞术语,卡片里给系统、内部摘要、要回答的三个问题和一个按钮。
**白帽子的邮箱、姓名和赏金金额永远不进这些模板** —— 收件人无需知道,
写进去等于把外部提交者的联系方式扩散给一位只是被拉来答一个问题的同事。
"""
from __future__ import annotations

TEMPLATES: dict[str, dict[str, str]] = {
    # ── 指派给业务负责人 ────────────────────────────────────────────
    "bounty.owner_confirm_requested": {
        "subject": "请确认一个安全漏洞报告:{report_code} · {affected_system}",
        "subject_en": (
            "Please confirm a security finding: {report_code} · "
            "{affected_system}"
        ),
        "subject_ja": (
            "セキュリティ報告の確認をお願いします:{report_code} · "
            "{affected_system}"
        ),
        "body_text": (
            "外部安全研究者向我们报告了一个可能的漏洞,涉及 "
            "[b]{affected_system}[/b],现在需要你判断它是否真实存在。\n\n"
            "  · 编号: [r]{report_code}[/r]\n"
            "  · 标题: {report_title}\n"
            "  · 初步判断的级别: {suggested_severity}\n\n"
            "{summary_block}"
            "请在确认页回答三件事:是不是真的问题、影响面有多大、"
            "预计什么时候能修完。判断为误报也请说明理由 —— "
            "我们要据此回复对方。\n\n"
            "  {portal_url}\n\n"
            "{cta_line}\n\n"
            "— Helix 安全团队"
        ),
        "body_text_en": (
            "An external security researcher reported a possible "
            "vulnerability affecting [b]{affected_system}[/b]. We need you "
            "to judge whether it is real.\n\n"
            "  · Report: [r]{report_code}[/r]\n"
            "  · Title: {report_title}\n"
            "  · Preliminary severity: {suggested_severity}\n\n"
            "{summary_block}"
            "Please answer three things on the confirmation page: is it a "
            "real issue, how large is the impact, and when can it be fixed. "
            "If you believe it is a false positive, say why — we reply to "
            "the researcher based on your answer.\n\n"
            "  {portal_url}\n\n"
            "{cta_line}\n\n"
            "— Helix Security Team"
        ),
        "body_text_ja": (
            "外部のセキュリティリサーチャーから "
            "[b]{affected_system}[/b] に関する脆弱性の可能性が報告されました。"
            "実際に存在するかどうかのご判断をお願いします。\n\n"
            "  · 番号: [r]{report_code}[/r]\n"
            "  · タイトル: {report_title}\n"
            "  · 暫定の重大度: {suggested_severity}\n\n"
            "{summary_block}"
            "確認ページで次の3点にご回答ください:実際の問題か、影響範囲、"
            "修正見込み時期。誤検知とお考えの場合は理由もお書きください"
            "(その内容をもとにリサーチャーへ返信します)。\n\n"
            "  {portal_url}\n\n"
            "{cta_line}\n\n"
            "— Helix セキュリティチーム"
        ),
        "card_button_label": "打开确认页",
        "card_button_label_en": "Open confirmation page",
        "card_button_label_ja": "確認ページを開く",
    },

    # ── 催办(手动触发,12h 节流)──────────────────────────────────
    "bounty.owner_confirm_reminder": {
        "subject": "待确认的安全漏洞报告:{report_code} · {affected_system}",
        "subject_en": (
            "Still waiting on your security confirmation: {report_code} · "
            "{affected_system}"
        ),
        "subject_ja": (
            "確認待ちのセキュリティ報告:{report_code} · {affected_system}"
        ),
        "body_text": (
            "编号 [r]{report_code}[/r]([b]{affected_system}[/b])"
            "还在等你的确认,已经等了 {waiting_days} 天。\n\n"
            "外部研究者也在等我们的答复,所以这条会一直挂着。"
            "如果这块业务不该由你负责,在确认页留言告诉我们该找谁。\n\n"
            "  {portal_url}\n\n"
            "{cta_line}\n\n"
            "— Helix 安全团队"
        ),
        "body_text_en": (
            "[r]{report_code}[/r] ([b]{affected_system}[/b]) is still "
            "waiting on your confirmation — {waiting_days} day(s) so far.\n\n"
            "The researcher is waiting on our answer too, so this one stays "
            "open. If this area is not yours, leave a comment on the page "
            "telling us who to ask.\n\n"
            "  {portal_url}\n\n"
            "{cta_line}\n\n"
            "— Helix Security Team"
        ),
        "body_text_ja": (
            "[r]{report_code}[/r]([b]{affected_system}[/b])は "
            "{waiting_days} 日間、確認をお待ちしています。\n\n"
            "リサーチャーも当社の回答を待っているため、このまま保留となります。"
            "担当外の場合は、確認ページで適切な担当者をお知らせください。\n\n"
            "  {portal_url}\n\n"
            "{cta_line}\n\n"
            "— Helix セキュリティチーム"
        ),
        "card_button_label": "打开确认页",
        "card_button_label_en": "Open confirmation page",
        "card_button_label_ja": "確認ページを開く",
    },

    # ── 结论回推给安全团队(IT-only)────────────────────────────────
    "bounty.owner_responded": {
        "subject": "{owner_name} 已确认 {report_code}:{decision_label}",
        "subject_en": "{owner_name} responded on {report_code}: {decision_label}",
        "subject_ja": "{owner_name} が {report_code} に回答:{decision_label}",
        "body_text": (
            "[b]{owner_name}[/b]({owner_department})对 "
            "[r]{report_code}[/r] 给出了结论:\n\n"
            "  · 判断: [b]{decision_label}[/b]\n"
            "  · 建议级别: {suggested_severity}\n"
            "  · 预计修复: {fix_eta}\n\n"
            "{note_block}"
            "接下来由你定最终级别、赏金,并回复研究者。\n\n"
            "  {portal_url}\n\n"
            "{cta_line}\n\n"
            "— Helix 安全团队"
        ),
        "body_text_en": (
            "[b]{owner_name}[/b] ({owner_department}) responded on "
            "[r]{report_code}[/r]:\n\n"
            "  · Verdict: [b]{decision_label}[/b]\n"
            "  · Suggested severity: {suggested_severity}\n"
            "  · Fix ETA: {fix_eta}\n\n"
            "{note_block}"
            "Over to you for the final severity, the reward and the reply to "
            "the researcher.\n\n"
            "  {portal_url}\n\n"
            "{cta_line}\n\n"
            "— Helix Security Team"
        ),
        "body_text_ja": (
            "[b]{owner_name}[/b]({owner_department})が "
            "[r]{report_code}[/r] に回答しました:\n\n"
            "  · 判断: [b]{decision_label}[/b]\n"
            "  · 推奨重大度: {suggested_severity}\n"
            "  · 修正予定: {fix_eta}\n\n"
            "{note_block}"
            "最終的な重大度・報奨金の決定とリサーチャーへの返信をお願いします。\n\n"
            "  {portal_url}\n\n"
            "{cta_line}\n\n"
            "— Helix セキュリティチーム"
        ),
        "card_button_label": "打开报告",
        "card_button_label_en": "Open the report",
        "card_button_label_ja": "報告を開く",
    },

    # ── 新来信待确认(每轮轮询一条,IT-only)─────────────────────────
    "bounty.mail_queued": {
        "subject": "白帽子来信 · {headline}",
        "subject_en": "Researcher mail · {headline}",
        "subject_ja": "リサーチャーからのメール · {headline}",
        "body_text": (
            "security@ 收到了 [b]{queued}[/b] 封新的白帽子来信,"
            "还没有人判断它们该落到哪里。\n\n"
            "{items_block}"
            "{attached_block}"
            "来信不会自己变成报告:在待确认队列里逐封判断它是新报告、"
            "是某个已有报告的跟进,还是与漏洞无关。\n\n"
            "  {portal_url}\n\n"
            "{cta_line}\n\n"
            "— Helix 安全团队"
        ),
        "body_text_en": (
            "security@ received [b]{queued}[/b] new message(s) from "
            "researchers, and nobody has decided where they belong yet.\n\n"
            "{items_block}"
            "{attached_block}"
            "Incoming mail does not become a report on its own: work the "
            "confirmation queue and mark each one as a new report, a "
            "follow-up on an existing report, or unrelated.\n\n"
            "  {portal_url}\n\n"
            "{cta_line}\n\n"
            "— Helix Security Team"
        ),
        "body_text_ja": (
            "security@ にリサーチャーからの新着メールが [b]{queued}[/b] 件"
            "届いていますが、まだ振り分けられていません。\n\n"
            "{items_block}"
            "{attached_block}"
            "メールは自動で報告になりません。確認キューで1件ずつ、"
            "新規報告か、既存報告への追記か、脆弱性と無関係かをご判断ください。\n\n"
            "  {portal_url}\n\n"
            "{cta_line}\n\n"
            "— Helix セキュリティチーム"
        ),
        "card_button_label": "去确认队列",
        "card_button_label_en": "Open the confirmation queue",
        "card_button_label_ja": "確認キューを開く",
    },

    # ── 白帽子在已有报告上回信(IT-only)────────────────────────────
    "bounty.researcher_followup": {
        "subject": "白帽子在 {code} 上又来信了",
        "subject_en": "The researcher followed up on {code}",
        "subject_ja": "リサーチャーから {code} について再度連絡がありました",
        "body_text": (
            "白帽子在 [r]{code}[/r] 上又来信了。\n\n"
            "  · 标题: {title}\n"
            "{silence_block}"
            "{excerpt_block}"
            "\n"
            "催办几乎总意味着对方在等我们:打开报告读这封信,然后回一句 —— "
            "哪怕只是告诉他我们仍在处理。\n\n"
            "  {portal_url}\n\n"
            "{cta_line}\n\n"
            "— Helix 安全团队"
        ),
        "body_text_en": (
            "The researcher sent another message on [r]{code}[/r].\n\n"
            "  · Title: {title}\n"
            "{silence_block}"
            "{excerpt_block}"
            "\n"
            "A follow-up almost always means they are waiting on us: open "
            "the report, read the message and reply — even if the reply is "
            "only that we are still working on it.\n\n"
            "  {portal_url}\n\n"
            "{cta_line}\n\n"
            "— Helix Security Team"
        ),
        "body_text_ja": (
            "リサーチャーから [r]{code}[/r] について再度連絡がありました。\n\n"
            "  · タイトル: {title}\n"
            "{silence_block}"
            "{excerpt_block}"
            "\n"
            "再連絡は、相手が回答を待っているサインです。報告を開いて内容を確認し、"
            "「対応中」であってもひとことご返信ください。\n\n"
            "  {portal_url}\n\n"
            "{cta_line}\n\n"
            "— Helix セキュリティチーム"
        ),
        "card_button_label": "打开报告",
        "card_button_label_en": "Open the report",
        "card_button_label_ja": "報告を開く",
    },
}