fix: skip alerts for hidden event types, show them on host card (0.4.7)

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/tests/test_event_type_visibility.py

@@ -55,6 +55,47 @@ def test_hidden_event_type_returns_404_on_detail(client, auth_headers, jwt_heade
     assert listed.json()["total"] == 0
 
 
+def test_hidden_event_type_visible_on_host_detail_list(client, auth_headers, jwt_headers, db_session):
+    from app.models import Host
+
+    host = Host(hostname="inv-pc", os_family="windows", product="rdp-login-monitor")
+    db_session.add(host)
+    db_session.add(EventTypeVisibility(event_type="agent.inventory", show_in_events=False))
+    db_session.commit()
+
+    payload = {
+        **VALID_EVENT,
+        "type": "agent.inventory",
+        "category": "agent",
+        "title": "Inventory",
+        "summary": "hw",
+        "host": {"hostname": "inv-pc", "os_family": "windows"},
+        "details": {"inventory": {"memory_gb": 16}},
+    }
+    _ingest(client, auth_headers, payload)
+
+    global_list = client.get("/api/v1/events", headers=jwt_headers, params={"type": "agent.inventory"})
+    assert global_list.json()["total"] == 0
+
+    host_list = client.get(
+        "/api/v1/events",
+        headers=jwt_headers,
+        params={"host_id": host.id, "include_hidden": "true"},
+    )
+    assert host_list.status_code == 200
+    assert host_list.json()["total"] == 1
+
+    event_db_id = host_list.json()["items"][0]["id"]
+    detail = client.get(f"/api/v1/events/{event_db_id}", headers=jwt_headers)
+    assert detail.status_code == 200
+    assert detail.json()["type"] == "agent.inventory"
+
+
+def test_include_hidden_requires_host_id(client, jwt_headers):
+    r = client.get("/api/v1/events", headers=jwt_headers, params={"include_hidden": "true"})
+    assert r.status_code == 400
+
+
 def test_visibility_settings_api(client, jwt_headers, db_session):
     put = client.put(
         "/api/v1/settings/notifications/severity-overrides",

backend/tests/test_notify_dispatch.py

@@ -124,6 +124,44 @@ def test_notify_event_skipped_by_cooldown():
     mock_tg.notify_event.assert_not_called()
 
 
+def test_notify_event_skips_hidden_event_type(db_session):
+    from app.models.event_type_visibility import EventTypeVisibility
+
+    db_session.add(EventTypeVisibility(event_type="agent.inventory", show_in_events=False))
+    db_session.commit()
+
+    event = Event(
+        event_id="00000000-0000-4000-8000-000000000701",
+        host_id=1,
+        occurred_at=datetime(2026, 6, 22, 12, 0, tzinfo=timezone.utc),
+        category="agent",
+        type="agent.inventory",
+        severity="warning",
+        title="Hardware changed",
+        summary="memory",
+        payload={},
+    )
+    policy = NotificationPolicyConfig(
+        min_severity="warning",
+        use_telegram=True,
+        use_webhook=True,
+        use_email=True,
+        use_mobile=True,
+        source="db",
+    )
+    with patch.object(notify_dispatch, "get_effective_notification_policy", return_value=policy):
+        with patch.object(notify_dispatch, "should_notify_event", return_value=True):
+            with patch.object(notify_dispatch, "telegram_notify") as mock_tg:
+                with patch.object(notify_dispatch, "webhook_notify") as mock_wh:
+                    with patch.object(notify_dispatch, "email_notify") as mock_em:
+                        with patch.object(notify_dispatch, "mobile_notify") as mock_mob:
+                            notify_dispatch.notify_event(event, db=db_session)
+    mock_tg.notify_event.assert_not_called()
+    mock_wh.notify_event.assert_not_called()
+    mock_em.notify_event.assert_not_called()
+    mock_mob.notify_event.assert_not_called()
+
+
 def test_notify_auth_login_bypasses_min_severity():
     event = Event(
         event_id="00000000-0000-4000-8000-000000000601",