feat: SAC Telegram settings view, notify_problem severity gate, exclusive docs

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/tests/test_settings_api.py

@@ -0,0 +1,21 @@
+"""GET /api/v1/settings/notifications"""
+
+from app.services.telegram_notify import get_settings
+
+
+def test_get_notification_settings_masks_secrets(jwt_headers, client, monkeypatch):
+    monkeypatch.setenv("TELEGRAM_ENABLED", "true")
+    monkeypatch.setenv("TELEGRAM_BOT_TOKEN", "1234567890:ABCDEFghij")
+    monkeypatch.setenv("TELEGRAM_CHAT_ID", "2843230")
+    monkeypatch.setenv("TELEGRAM_MIN_SEVERITY", "warning")
+    get_settings.cache_clear()
+
+    response = client.get("/api/v1/settings/notifications", headers=jwt_headers)
+    assert response.status_code == 200
+    body = response.json()
+    assert body["telegram"]["enabled"] is True
+    assert body["telegram"]["configured"] is True
+    assert body["telegram"]["min_severity"] == "warning"
+    assert body["telegram"]["source"] == "env"
+    assert body["telegram"]["bot_token_hint"].endswith("ghij")
+    assert "1234567890" not in body["telegram"]["bot_token_hint"]

backend/tests/test_telegram_notify.py

@@ -0,0 +1,73 @@
+"""Tests for SAC Telegram notification helpers."""
+
+from datetime import datetime, timezone
+from unittest.mock import patch
+
+import pytest
+
+from app.models import Event, Host, Problem
+from app.services import telegram_notify
+
+
+def test_notify_event_respects_min_severity(monkeypatch):
+    sent: list[str] = []
+
+    def fake_send(message: str) -> None:
+        sent.append(message)
+
+    monkeypatch.setenv("TELEGRAM_ENABLED", "true")
+    monkeypatch.setenv("TELEGRAM_BOT_TOKEN", "test-token")
+    monkeypatch.setenv("TELEGRAM_CHAT_ID", "123")
+    monkeypatch.setenv("TELEGRAM_MIN_SEVERITY", "warning")
+    telegram_notify.get_settings.cache_clear()
+
+    event = Event(
+        event_id="00000000-0000-4000-8000-000000000001",
+        host_id=1,
+        occurred_at=datetime(2026, 5, 28, 12, 0, tzinfo=timezone.utc),
+        category="auth",
+        type="rdp.login.success",
+        severity="info",
+        title="ok",
+        summary="info event",
+        payload={},
+    )
+
+    with patch.object(telegram_notify, "_send_text", side_effect=fake_send):
+        telegram_notify.notify_event(event)
+    assert sent == []
+
+    event.severity = "warning"
+    with patch.object(telegram_notify, "_send_text", side_effect=fake_send):
+        telegram_notify.notify_event(event)
+    assert len(sent) == 1
+
+
+def test_notify_problem_respects_min_severity(monkeypatch):
+    sent: list[str] = []
+
+    def fake_send(message: str) -> None:
+        sent.append(message)
+
+    monkeypatch.setenv("TELEGRAM_ENABLED", "true")
+    monkeypatch.setenv("TELEGRAM_BOT_TOKEN", "test-token")
+    monkeypatch.setenv("TELEGRAM_CHAT_ID", "123")
+    monkeypatch.setenv("TELEGRAM_MIN_SEVERITY", "high")
+    telegram_notify.get_settings.cache_clear()
+
+    problem = Problem(
+        title="brute",
+        summary="burst",
+        severity="warning",
+        status="open",
+        fingerprint="fp1",
+    )
+
+    with patch.object(telegram_notify, "_send_text", side_effect=fake_send):
+        telegram_notify.notify_problem(problem)
+    assert sent == []
+
+    problem.severity = "high"
+    with patch.object(telegram_notify, "_send_text", side_effect=fake_send):
+        telegram_notify.notify_problem(problem)
+    assert len(sent) == 1