fix: show RDS break only on active or flap 302 events (0.3.4)

Hide Obryv RDS on 303 and on 302 after normal session end; keep for open sessions and RDG flap.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/tests/test_rdg_session_flap.py

@@ -15,6 +15,7 @@ from app.services.rdg_session_flap import (
     event_has_rdg_flap,
     find_rdg_success_before_end,
     resolve_rdg_flap_summary,
+    resolve_rdg_qwinsta_enabled,
 )
 from app.services.event_summary import event_to_summary
 from tests.test_ingest import VALID_EVENT
@@ -193,14 +194,70 @@ def test_resolve_rdg_flap_summary_for_302_and_303(db_session, rdg_settings):
 
     assert end_flap is True
     assert end_pair == start.id
-    assert end_qwinsta == end.id
+    assert end_qwinsta == start.id
 
     assert start_flap is True
     assert start_pair == end.id
-    assert start_qwinsta == end.id
+    assert start_qwinsta == start.id
 
     end_summary = event_to_summary(end, db_session)
     start_summary = event_to_summary(start, db_session)
     assert end_summary.rdg_flap is True
     assert start_summary.rdg_flap is True
-    assert start_summary.rdg_flap_qwinsta_event_id == end.id
+    assert start_summary.rdg_flap_qwinsta_event_id == start.id
+    assert start_summary.rdg_qwinsta_enabled is True
+    assert end_summary.rdg_qwinsta_enabled is False
+
+
+def test_rdg_qwinsta_disabled_after_normal_session_end(db_session, rdg_settings):
+    t0 = datetime.now(timezone.utc)
+    user = "B26\\normal.user"
+    details = {"user": user, "internal_ip": "192.168.163.49"}
+
+    start = _ingest(
+        db_session,
+        t0,
+        type="rdg.connection.success",
+        category="auth",
+        severity="info",
+        title="302",
+        summary="302",
+        details=details,
+    )
+    end = _ingest(
+        db_session,
+        t0 + timedelta(minutes=20),
+        type="rdg.connection.disconnected",
+        category="auth",
+        severity="info",
+        title="303",
+        summary="303",
+        details=details,
+    )
+
+    assert resolve_rdg_qwinsta_enabled(db_session, start) is False
+    assert resolve_rdg_qwinsta_enabled(db_session, end) is False
+
+    start_summary = event_to_summary(start, db_session)
+    end_summary = event_to_summary(end, db_session)
+    assert start_summary.rdg_qwinsta_enabled is False
+    assert end_summary.rdg_qwinsta_enabled is False
+
+
+def test_rdg_qwinsta_enabled_while_session_open(db_session, rdg_settings):
+    t0 = datetime.now(timezone.utc)
+    details = {"user": r"B26\active.user", "internal_ip": "192.168.163.50"}
+
+    start = _ingest(
+        db_session,
+        t0,
+        type="rdg.connection.success",
+        category="auth",
+        severity="info",
+        title="302",
+        summary="302",
+        details=details,
+    )
+
+    assert resolve_rdg_qwinsta_enabled(db_session, start) is True
+    assert event_to_summary(start, db_session).rdg_qwinsta_enabled is True