fix: event terminate-session 500 on rdp.login.success (0.3.7)

Use extract_event_actor_user instead of missing ORM field; map WinRM/SSH errors to HTTP 400.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/tests/test_host_sessions.py

@@ -1,12 +1,20 @@
 """Tests for host session list/parse helpers."""
 
+from types import SimpleNamespace
+
 from app.services.host_sessions import (
+    HostSessionRow,
+    _event_login_user,
     event_supports_session_terminate,
     filter_logind_session_rows,
     parse_loginctl_sessions,
     parse_loginctl_sessions_json,
     parse_qwinsta_sessions,
+    terminate_session_for_event,
 )
+from app.services.linux_admin_settings import LinuxAdminConfig
+from app.services.win_admin_settings import WinAdminConfig
+from app.services.winrm_connect import WinRmCmdResult
 
 
 def test_parse_loginctl_sessions():
@@ -74,3 +82,51 @@ def test_event_supports_session_terminate_types():
             self.host = HostStub()
 
     assert event_supports_session_terminate(EventStub("ssh.login.success")) is True
+
+
+def test_event_login_user_without_orm_actor_user_attr():
+    event = SimpleNamespace(
+        type="rdp.login.success",
+        details={"user": "papatramp"},
+    )
+    assert _event_login_user(event) == "papatramp"
+
+
+def test_terminate_session_for_event_windows_no_actor_user_attr(monkeypatch):
+    host = SimpleNamespace(
+        os_family="windows",
+        product="rdp-login-monitor",
+        hostname="srv01",
+        ipv4="10.0.0.1",
+        display_name=None,
+        inventory={},
+    )
+    event = SimpleNamespace(
+        type="rdp.login.success",
+        details={"user": "papatramp"},
+        host=host,
+    )
+    rows = [HostSessionRow(session_id="2", user="B26\\papatramp", state="Active")]
+
+    def fake_list(_host, _cfg):
+        return rows, WinRmCmdResult(ok=True, message="ok", target="srv01")
+
+    def fake_term(_host, _cfg, sid):
+        assert sid == "2"
+        return WinRmCmdResult(ok=True, message="logged off", target="srv01")
+
+    monkeypatch.setattr(
+        "app.services.host_sessions.list_windows_sessions",
+        fake_list,
+    )
+    monkeypatch.setattr(
+        "app.services.host_sessions.terminate_windows_session",
+        fake_term,
+    )
+
+    result = terminate_session_for_event(
+        event,
+        linux_cfg=LinuxAdminConfig(user="", password="", source="test"),
+        win_cfg=WinAdminConfig(user="B26\\admin", password="x", source="test"),
+    )
+    assert result.ok is True