[codex] Add NOC operations console and security hardening

README.md

@@ -148,6 +148,7 @@ flowchart LR
 - [Catálogo inicial de automações e agentes](docs/automacoes-sugeridas.md)
 - [Dados do GLPI para Analytics e ML](docs/glpi-dados-analytics-ml.md)
 - [Autonomia com LangGraph em ambiente monitorado](docs/langgraph-autonomia-ambiente-monitorado.md)
+- [Evolucao NOC, ITSM e operacao padronizada](docs/evolucao-noc-operacao.md)
 - [Portas e conectividade](docs/portas-e-conectividade.md)
 - [Roadmap de implantação](docs/roadmap.md)
 - [Guia do backend MVP](backend/README.md)

backend/.env.example

@@ -54,6 +54,8 @@ HELPDESK_EVOLUTION_BASE_URL=http://localhost:8080
 HELPDESK_EVOLUTION_API_KEY=
 HELPDESK_EVOLUTION_INSTANCE_NAME=helpdeskAutomacao
 HELPDESK_EVOLUTION_WEBHOOK_SECRET=
+# Nao habilite em producao: segredo em query string pode vazar em logs/proxies.
+HELPDESK_EVOLUTION_WEBHOOK_ALLOW_QUERY_SECRET=false
 # Algumas versões da Evolution entregam o remetente como @lid em vez de telefone.
 # Cadastre apenas mapeamentos confirmados: {"LID":"telefone cadastrado no GLPI"}
 HELPDESK_EVOLUTION_LID_PHONE_MAP=

backend/app/api/routes/helpdesk.py

@@ -37,6 +37,9 @@
     LLMGenerateResponse,
     IdentityLookupResponse,
     LLMStatusResponse,
+    NOCAlertReviewRequest,
+    NOCAlertReviewResponse,
+    NOCOperationalReportResponse,
     NormalizedWhatsAppMessage,
     RuntimeAuditOverviewResponse,
     RuntimeAutomationRunnerStatusResponse,
@@ -142,6 +145,30 @@ async def get_ticket_operations_summary(
     return await orchestrator.get_ticket_operations_summary()
 
 
+@router.get(
+    "/helpdesk/noc/report",
+    response_model=NOCOperationalReportResponse,
+    dependencies=[Depends(require_audit_access), Depends(require_automation_read_access)],
+)
+async def get_noc_operational_report(
+    period_label: str = Query(default="periodo atual", min_length=3, max_length=120),
+    orchestrator: HelpdeskOrchestrator = Depends(get_helpdesk_orchestrator),
+) -> NOCOperationalReportResponse:
+    return await orchestrator.get_noc_operational_report(period_label=period_label)
+
+
+@router.post(
+    "/helpdesk/noc/alerts/review",
+    response_model=NOCAlertReviewResponse,
+    dependencies=[Depends(require_audit_access)],
+)
+async def review_noc_alerts(
+    payload: NOCAlertReviewRequest,
+    orchestrator: HelpdeskOrchestrator = Depends(get_helpdesk_orchestrator),
+) -> NOCAlertReviewResponse:
+    return await orchestrator.review_noc_alerts(payload)
+
+
 @router.get(
     "/helpdesk/runtime/overview",
     response_model=RuntimeOverviewResponse,
@@ -520,7 +547,9 @@ async def receive_evolution_whatsapp_webhook(
         )
 
     raw_body = await request.body()
-    provided_secret = secret_header or secret_query
+    provided_secret = secret_header
+    if provided_secret is None and settings.evolution_webhook_allow_query_secret:
+        provided_secret = secret_query
     if not whatsapp_client.validate_evolution_webhook_secret(provided_secret):
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,