fix: strict RDG 302/303 IP pairing keeps break button visible (0.3.6)

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/services/rdg_session_flap.py

@@ -47,6 +47,15 @@ def _internal_ips_compatible(end_event: Event, success_event: Event) -> bool:
     return end_ip == success_ip
 
 
+def _internal_ips_match_strict(end_event: Event, success_event: Event) -> bool:
+    """Для «сессия завершена» — только при совпадении целевого ПК (оба IP заданы)."""
+    end_ip = _event_internal_ip(end_event)
+    success_ip = _event_internal_ip(success_event)
+    if not end_ip or not success_ip:
+        return False
+    return end_ip == success_ip
+
+
 def _as_utc(dt: datetime) -> datetime:
     if dt.tzinfo is None:
         return dt.replace(tzinfo=timezone.utc)
@@ -195,7 +204,7 @@ def find_normal_rdg_end_after_success(db: Session, success_event: Event) -> Even
     for end in candidates:
         if not _users_match(end, success_event):
             continue
-        if not _internal_ips_compatible(end, success_event):
+        if not _internal_ips_match_strict(end, success_event):
             continue
         return end
     return None

backend/app/version.py

@@ -1,5 +1,5 @@
 """Единый источник версии SAC (API, health, логи, OpenAPI)."""
 
 APP_NAME = "Security Alert Center"
-APP_VERSION = "0.3.5"
+APP_VERSION = "0.3.6"
 APP_VERSION_LABEL = f"{APP_NAME} v.{APP_VERSION}"

backend/tests/test_health.py

@@ -4,6 +4,6 @@ from app.version import APP_NAME, APP_VERSION, APP_VERSION_LABEL
 
 
 def test_version_constants():
-    assert APP_VERSION == "0.3.5"
+    assert APP_VERSION == "0.3.6"
     assert APP_NAME == "Security Alert Center"
-    assert APP_VERSION_LABEL == "Security Alert Center v.0.3.5"
+    assert APP_VERSION_LABEL == "Security Alert Center v.0.3.6"

backend/tests/test_rdg_session_flap.py

@@ -261,3 +261,34 @@ def test_rdg_qwinsta_enabled_while_session_open(db_session, rdg_settings):
 
     assert resolve_rdg_qwinsta_enabled(db_session, start) is True
     assert event_to_summary(start, db_session).rdg_qwinsta_enabled is True
+
+
+def test_rdg_qwinsta_stays_enabled_when_unrelated_303_without_internal_ip(db_session, rdg_settings):
+    t0 = datetime.now(timezone.utc)
+    user = "B26\\khodasevich"
+    details_302 = {"user": user, "internal_ip": "192.168.160.209"}
+    details_303_other = {"user": user}
+
+    start = _ingest(
+        db_session,
+        t0,
+        type="rdg.connection.success",
+        category="auth",
+        severity="warning",
+        title="302",
+        summary="302",
+        details=details_302,
+    )
+    _ingest(
+        db_session,
+        t0 + timedelta(minutes=5),
+        type="rdg.connection.disconnected",
+        category="auth",
+        severity="info",
+        title="303",
+        summary="303",
+        details=details_303_other,
+    )
+
+    assert resolve_rdg_qwinsta_enabled(db_session, start) is True
+    assert event_to_summary(start, db_session).rdg_qwinsta_enabled is True

frontend/src/version.ts

@@ -1,4 +1,4 @@
 /** Fallback до загрузки /health; при релизе держите в sync с backend/app/version.py */
 export const APP_NAME = "Security Alert Center";
-export const APP_VERSION = "0.3.5";
+export const APP_VERSION = "0.3.6";
 export const APP_VERSION_LABEL = `${APP_NAME} v.${APP_VERSION}`;