fix: event terminate-session 500 on rdp.login.success (0.3.7)

Use extract_event_actor_user instead of missing ORM field; map WinRM/SSH errors to HTTP 400.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/api/v1/events.py

@@ -26,7 +26,12 @@ from app.services.host_sessions import (
     terminate_session_for_event,
 )
 from app.services.linux_admin_settings import get_effective_linux_admin_config
+from app.services.ssh_connect import (
+    HostNotLinuxError as SshHostNotLinuxError,
+    HostTargetMissingError as SshHostTargetMissingError,
+)
 from app.services.win_admin_settings import get_effective_win_admin_config
+from app.services.winrm_connect import HostNotWindowsError, HostTargetMissingError
 from app.services.ingest import ingest_event
 from app.services.event_summary import event_to_summary
 from app.services.event_type_visibility import get_hidden_event_types, visibility_type_filter
@@ -263,6 +268,14 @@ def post_event_terminate_session(
         )
     except ValueError as exc:
         raise HTTPException(status_code=400, detail=str(exc)) from exc
+    except HostNotWindowsError as exc:
+        raise HTTPException(status_code=400, detail=str(exc)) from exc
+    except HostTargetMissingError as exc:
+        raise HTTPException(status_code=400, detail=str(exc)) from exc
+    except SshHostNotLinuxError as exc:
+        raise HTTPException(status_code=400, detail=str(exc)) from exc
+    except SshHostTargetMissingError as exc:
+        raise HTTPException(status_code=400, detail=str(exc)) from exc
 
     if hasattr(result, "exit_code"):
         return EventSessionTerminateResponse(

backend/app/services/host_sessions.py

@@ -7,6 +7,7 @@ import re
 from dataclasses import dataclass
 
 from app.models import Event, Host
+from app.services.event_actor_user import extract_event_actor_user
 from app.services.linux_admin_settings import LinuxAdminConfig
 from app.services.ssh_connect import (
     HostNotLinuxError as SshHostNotLinuxError,
@@ -69,6 +70,13 @@ def _details_dict(event: Event) -> dict:
     return raw if isinstance(raw, dict) else {}
 
 
+def _event_login_user(event: Event) -> str:
+    actor = extract_event_actor_user(event.type, event.details)
+    if actor:
+        return actor.strip()
+    return str(_details_dict(event).get("user") or "").strip()
+
+
 def event_session_id(event: Event) -> str | None:
     details = _details_dict(event)
     for key in ("session_id", "sid"):
@@ -422,7 +430,7 @@ def terminate_session_for_event(
     sid = (session_id or event_session_id(event) or "").strip()
     if is_linux_host(host):
         if not sid:
-            user = (event.actor_user or _details_dict(event).get("user") or "").strip()
+            user = _event_login_user(event)
             if user:
                 return _terminate_linux_user_sessions(host, linux_cfg, user)
             raise ValueError("session_id is required for this event")
@@ -430,7 +438,7 @@ def terminate_session_for_event(
 
     if is_windows_host(host):
         if not sid:
-            user = (event.actor_user or _details_dict(event).get("user") or "").strip()
+            user = _event_login_user(event)
             sessions, qwinsta = list_windows_sessions(host, win_cfg)
             if not qwinsta or not qwinsta.ok:
                 raise ValueError(qwinsta.message if qwinsta else "qwinsta failed")

backend/app/version.py

@@ -1,5 +1,5 @@
 """Единый источник версии SAC (API, health, логи, OpenAPI)."""
 
 APP_NAME = "Security Alert Center"
-APP_VERSION = "0.3.6"
+APP_VERSION = "0.3.7"
 APP_VERSION_LABEL = f"{APP_NAME} v.{APP_VERSION}"