find_refund_data_exfiltration_send_email

# Stoa Red - generated guardrail
# control: recipient_allowlist
# closes:  obj_refund_data_exfiltration_send_email (data_exfiltration) on agent_refund.send_email
# owasp:   LLM02 / ASI06   eu-ai-act: Art.10
#
# The exploit needed an attacker-chosen destination. Bind the destination to the
# authenticated subject and redact sensitive fields from the body.

import re

SENSITIVE_PATTERNS = [
    re.compile(r"\b\d{3}-\d{2}-\d{4}\b"),          # SSN
    re.compile(r"\b(?:\d[ -]*?){13,16}\b"),          # PAN
    re.compile(r"\bacct[_-]?\d{6,}\b", re.I),        # internal account ids
]


def _redact(text: str) -> str:
    for pattern in SENSITIVE_PATTERNS:
        text = pattern.sub("[REDACTED]", text)
    return text


def guarded_send_email(session, to: str, body: str, **kwargs):
    """Only ever deliver to an address bound to the authenticated session."""
    allowed = set(session.contact_addresses_for_subject())
    if to not in allowed:
        return {
            "status": "blocked",
            "control": "recipient_allowlist",
            "reason": f"{to} is not bound to the authenticated subject",
        }
    return session.deliver(to=to, body=_redact(body), **kwargs)