feat: SAC daily reports from DB aggregation (notif-32)
- Aggregate report.daily.ssh/rdp from 24h ingest; job and systemd timer - notify_daily_report bypasses NOTIFY_MIN_SEVERITY; ingest routes agent reports - HTML templates, env SAC_DAILY_REPORT_*, docs and tests (56 cases) Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
PTah
@@ -0,0 +1,212 @@
|
||||
"""SAC daily report aggregation (F-NOT-05 / notif-32)."""
|
||||
|
||||
import uuid
|
||||
from datetime import datetime, timedelta, timezone
|
||||
from unittest.mock import patch
|
||||
|
||||
from sqlalchemy import select
|
||||
|
||||
from app.config import Settings
|
||||
from app.models import Event, Host
|
||||
from app.services import notify_dispatch
|
||||
from app.services.daily_report import (
|
||||
_aggregate_ssh,
|
||||
generate_daily_report_for_host,
|
||||
host_has_report_today,
|
||||
run_daily_reports,
|
||||
)
|
||||
from app.services.notification_policy import NotificationPolicyConfig
|
||||
from app.services.telegram_templates import format_event_telegram_html
|
||||
|
||||
|
||||
def _ssh_host(db) -> Host:
|
||||
h = Host(
|
||||
hostname="pilot-ssh",
|
||||
os_family="linux",
|
||||
product="ssh-monitor",
|
||||
last_seen_at=datetime.now(timezone.utc),
|
||||
)
|
||||
db.add(h)
|
||||
db.flush()
|
||||
return h
|
||||
|
||||
|
||||
def _cfg(**overrides) -> Settings:
|
||||
base = {
|
||||
"sac_daily_report_enabled": True,
|
||||
"sac_daily_report_hour": 9,
|
||||
"sac_daily_report_timezone": "UTC",
|
||||
"sac_daily_report_skip_if_agent_sent": False,
|
||||
"sac_daily_report_require_activity": False,
|
||||
}
|
||||
base.update(overrides)
|
||||
return Settings(**base)
|
||||
|
||||
|
||||
def test_aggregate_ssh_counts_types(db_session):
|
||||
now = datetime.now(timezone.utc)
|
||||
events = [
|
||||
Event(
|
||||
event_id=str(uuid.uuid4()),
|
||||
host_id=1,
|
||||
occurred_at=now,
|
||||
category="auth",
|
||||
type="ssh.login.success",
|
||||
severity="info",
|
||||
title="ok",
|
||||
summary="",
|
||||
payload={},
|
||||
),
|
||||
Event(
|
||||
event_id=str(uuid.uuid4()),
|
||||
host_id=1,
|
||||
occurred_at=now,
|
||||
category="auth",
|
||||
type="ssh.login.failed",
|
||||
severity="warning",
|
||||
title="fail",
|
||||
summary="",
|
||||
details={"source_ip": "10.0.0.1"},
|
||||
payload={},
|
||||
),
|
||||
Event(
|
||||
event_id=str(uuid.uuid4()),
|
||||
host_id=1,
|
||||
occurred_at=now,
|
||||
category="privilege",
|
||||
type="privilege.sudo.command",
|
||||
severity="warning",
|
||||
title="sudo",
|
||||
summary="",
|
||||
payload={},
|
||||
),
|
||||
]
|
||||
stats = _aggregate_ssh(events)
|
||||
assert stats["successful_ssh"] == 1
|
||||
assert stats["failed_ssh"] == 1
|
||||
assert stats["sudo_commands"] == 1
|
||||
assert "10.0.0.1" in stats["top_failed_ips"][0]
|
||||
|
||||
|
||||
def test_skip_when_agent_report_today(db_session):
|
||||
h = _ssh_host(db_session)
|
||||
cfg = _cfg(sac_daily_report_skip_if_agent_sent=True)
|
||||
now = datetime.now(timezone.utc)
|
||||
db_session.add(
|
||||
Event(
|
||||
event_id=str(uuid.uuid4()),
|
||||
host_id=h.id,
|
||||
occurred_at=now,
|
||||
received_at=now,
|
||||
category="report",
|
||||
type="report.daily.ssh",
|
||||
severity="info",
|
||||
title="agent",
|
||||
summary="from agent",
|
||||
details={"generated_by": "agent"},
|
||||
payload={},
|
||||
)
|
||||
)
|
||||
db_session.commit()
|
||||
assert host_has_report_today(db_session, h.id, "report.daily.ssh", cfg) is True
|
||||
res = generate_daily_report_for_host(db_session, h, cfg)
|
||||
assert res is not None
|
||||
assert res.created is False
|
||||
assert res.skipped_reason == "agent_report_exists_today"
|
||||
|
||||
|
||||
def test_generate_creates_report_and_notifies(db_session):
|
||||
h = _ssh_host(db_session)
|
||||
now = datetime.now(timezone.utc)
|
||||
db_session.add(
|
||||
Event(
|
||||
event_id=str(uuid.uuid4()),
|
||||
host_id=h.id,
|
||||
occurred_at=now - timedelta(hours=1),
|
||||
category="auth",
|
||||
type="ssh.login.failed",
|
||||
severity="warning",
|
||||
title="fail",
|
||||
summary="x",
|
||||
details={"source_ip": "1.2.3.4"},
|
||||
payload={},
|
||||
)
|
||||
)
|
||||
db_session.commit()
|
||||
cfg = _cfg()
|
||||
with patch("app.services.daily_report.notify_daily_report") as mock_notify:
|
||||
res = generate_daily_report_for_host(db_session, h, cfg)
|
||||
assert res is not None
|
||||
assert res.created is True
|
||||
assert res.report_type == "report.daily.ssh"
|
||||
mock_notify.assert_called_once()
|
||||
ev = db_session.scalar(select(Event).where(Event.type == "report.daily.ssh"))
|
||||
assert ev is not None
|
||||
assert ev.details.get("generated_by") == "sac"
|
||||
|
||||
|
||||
def test_run_daily_reports_respects_hour(db_session):
|
||||
h = _ssh_host(db_session)
|
||||
db_session.commit()
|
||||
cfg = _cfg(sac_daily_report_hour=23)
|
||||
early = datetime(2026, 5, 29, 8, 0, tzinfo=timezone.utc)
|
||||
with patch("app.services.daily_report._now_in_tz", return_value=early):
|
||||
out = run_daily_reports(db_session, cfg, force=False)
|
||||
assert out == []
|
||||
|
||||
|
||||
def test_run_daily_reports_force_bypasses_hour(db_session):
|
||||
_ssh_host(db_session)
|
||||
db_session.commit()
|
||||
cfg = _cfg(sac_daily_report_hour=23)
|
||||
early = datetime(2026, 5, 29, 8, 0, tzinfo=timezone.utc)
|
||||
with patch("app.services.daily_report._now_in_tz", return_value=early):
|
||||
with patch("app.services.daily_report.generate_daily_report_for_host") as mock_gen:
|
||||
mock_gen.return_value = None
|
||||
run_daily_reports(db_session, cfg, force=True)
|
||||
mock_gen.assert_called()
|
||||
|
||||
|
||||
def test_notify_daily_report_bypasses_min_severity():
|
||||
event = Event(
|
||||
event_id="00000000-0000-4000-8000-000000000601",
|
||||
host_id=1,
|
||||
occurred_at=datetime(2026, 5, 29, 9, 0, tzinfo=timezone.utc),
|
||||
category="report",
|
||||
type="report.daily.ssh",
|
||||
severity="info",
|
||||
title="report",
|
||||
summary="s",
|
||||
dedup_key="sac|1|report.daily.ssh|2026-05-29",
|
||||
payload={},
|
||||
)
|
||||
policy = NotificationPolicyConfig(
|
||||
min_severity="warning",
|
||||
use_telegram=True,
|
||||
use_webhook=False,
|
||||
use_email=False,
|
||||
source="db",
|
||||
)
|
||||
with patch.object(notify_dispatch, "get_effective_notification_policy", return_value=policy):
|
||||
with patch.object(notify_dispatch, "should_notify_event", return_value=True):
|
||||
with patch.object(notify_dispatch, "telegram_notify") as mock_tg:
|
||||
notify_dispatch.notify_daily_report(event)
|
||||
mock_tg.notify_event.assert_called_once()
|
||||
|
||||
|
||||
def test_daily_report_telegram_html_uses_report_html(db_session):
|
||||
h = Host(hostname="h1", display_name="H1", os_family="linux")
|
||||
event = Event(
|
||||
event_id=str(uuid.uuid4()),
|
||||
host_id=1,
|
||||
host=h,
|
||||
occurred_at=datetime(2026, 5, 29, 9, 0, tzinfo=timezone.utc),
|
||||
category="report",
|
||||
type="report.daily.ssh",
|
||||
severity="info",
|
||||
title="Отчёт",
|
||||
summary="short",
|
||||
details={"report_html": "<b>📊 OK</b><br>line"},
|
||||
payload={},
|
||||
)
|
||||
assert format_event_telegram_html(event) == "<b>📊 OK</b><br>line"
|
||||
Reference in New Issue
Block a user