feat: drill-down filters on overview and outdated agent version highlight

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/tests/test_agent_version.py

@@ -0,0 +1,68 @@
+"""Agent version parse/compare for outdated highlighting."""
+
+from app.services.agent_version import is_agent_version_outdated, latest_agent_versions_by_product, parse_agent_version
+from app.models import Host
+from datetime import datetime, timezone
+
+
+def test_parse_agent_version():
+    assert parse_agent_version("2.0.25-SAC") == parse_agent_version("2.0.25")
+    assert parse_agent_version("bad") is None
+    assert parse_agent_version(None) is None
+
+
+def test_outdated_same_minor_patch_lag():
+    latest = "2.0.25-SAC"
+    assert is_agent_version_outdated("2.0.25-SAC", latest) is False
+    assert is_agent_version_outdated("2.0.24-SAC", latest) is False
+    assert is_agent_version_outdated("2.0.23-SAC", latest) is False
+    assert is_agent_version_outdated("2.0.22-SAC", latest) is True
+    assert is_agent_version_outdated("2.0.18-SAC", latest) is True
+    assert is_agent_version_outdated("2.0.20-SAC", latest) is True
+
+
+def test_outdated_different_minor_or_major():
+    latest = "2.0.1-SAC"
+    assert is_agent_version_outdated("1.2.5-SAC", latest) is True
+    assert is_agent_version_outdated("2.1.0-SAC", latest) is False
+
+
+def test_latest_agent_versions_by_product(db_session):
+    now = datetime.now(timezone.utc)
+    db_session.add_all(
+        [
+            Host(
+                hostname="linux-a",
+                os_family="linux",
+                product="ssh-monitor",
+                product_version="1.2.5-SAC",
+                last_seen_at=now,
+            ),
+            Host(
+                hostname="linux-b",
+                os_family="linux",
+                product="ssh-monitor",
+                product_version="2.0.1-SAC",
+                last_seen_at=now,
+            ),
+            Host(
+                hostname="win-a",
+                os_family="windows",
+                product="rdp-login-monitor",
+                product_version="2.0.18-SAC",
+                last_seen_at=now,
+            ),
+            Host(
+                hostname="win-b",
+                os_family="windows",
+                product="rdp-login-monitor",
+                product_version="2.0.25-SAC",
+                last_seen_at=now,
+            ),
+        ]
+    )
+    db_session.commit()
+
+    latest = latest_agent_versions_by_product(db_session)
+    assert latest["ssh-monitor"] == "2.0.1-SAC"
+    assert latest["rdp-login-monitor"] == "2.0.25-SAC"

backend/tests/test_hosts.py

@@ -1,11 +1,86 @@
 """Hosts list API."""
 
 import uuid
-from datetime import datetime, timezone
+from datetime import datetime, timedelta, timezone
 
+import pytest
+
+from app.config import get_settings
 from app.models import Event, Host, Problem
 
 
+@pytest.fixture
+def host_stale_settings(monkeypatch):
+    monkeypatch.setenv("SAC_HEARTBEAT_STALE_MINUTES", "60")
+    get_settings.cache_clear()
+    yield
+    get_settings.cache_clear()
+
+
+def test_hosts_filter_agent_status_stale(client, db_session, jwt_headers, host_stale_settings):
+    now = datetime.now(timezone.utc)
+    stale_host = Host(
+        hostname="stale-pc",
+        os_family="windows",
+        product="rdp-login-monitor",
+        last_seen_at=now,
+    )
+    fresh_host = Host(
+        hostname="fresh-pc",
+        os_family="windows",
+        product="rdp-login-monitor",
+        last_seen_at=now,
+    )
+    unknown_host = Host(
+        hostname="unknown-pc",
+        os_family="linux",
+        product="ssh-monitor",
+        last_seen_at=now,
+    )
+    db_session.add_all([stale_host, fresh_host, unknown_host])
+    db_session.flush()
+
+    db_session.add(
+        Event(
+            event_id=str(uuid.uuid4()),
+            host_id=stale_host.id,
+            occurred_at=now - timedelta(hours=2),
+            received_at=now - timedelta(hours=2),
+            category="agent",
+            type="agent.heartbeat",
+            severity="info",
+            title="hb",
+            summary="s",
+            payload={},
+        )
+    )
+    db_session.add(
+        Event(
+            event_id=str(uuid.uuid4()),
+            host_id=fresh_host.id,
+            occurred_at=now - timedelta(minutes=5),
+            received_at=now - timedelta(minutes=5),
+            category="agent",
+            type="agent.heartbeat",
+            severity="info",
+            title="hb",
+            summary="s",
+            payload={},
+        )
+    )
+    db_session.commit()
+
+    r = client.get("/api/v1/hosts?agent_status=stale", headers=jwt_headers)
+    assert r.status_code == 200
+    body = r.json()
+    assert body["total"] == 1
+    assert body["items"][0]["hostname"] == "stale-pc"
+    assert body["items"][0]["agent_status"] == "stale"
+
+    r_all = client.get("/api/v1/hosts", headers=jwt_headers)
+    assert r_all.json()["total"] == 3
+
+
 def test_hosts_search_by_display_name(client, db_session, jwt_headers):
     h = Host(
         hostname="pc-01",

backend/tests/test_problems.py

@@ -1,9 +1,9 @@
 """Problems correlation and API smoke tests."""
 
 import uuid
-from datetime import datetime, timezone
+from datetime import datetime, timedelta, timezone
 
-from tests.test_ingest import VALID_EVENT
+from app.models import Host, Problem
 
 
 def _event_payload(**overrides):
@@ -67,3 +67,101 @@ def test_new_problem_after_resolve(client, auth_headers, jwt_headers):
     assert len(open_items) == 1
     assert open_items[0]["event_count"] == 1
     assert open_items[0]["id"] != pid
+
+
+def test_problems_created_within_hours(client, db_session, jwt_headers):
+    now = datetime.now(timezone.utc)
+    h = Host(
+        hostname="p-host",
+        os_family="linux",
+        product="ssh-monitor",
+        last_seen_at=now,
+    )
+    db_session.add(h)
+    db_session.flush()
+    db_session.add(
+        Problem(
+            host_id=h.id,
+            title="recent",
+            summary="s",
+            severity="warning",
+            status="open",
+            rule_id="rule:test",
+            fingerprint="fp-recent",
+            event_count=1,
+            last_seen_at=now,
+            created_at=now - timedelta(hours=2),
+            updated_at=now - timedelta(hours=2),
+        )
+    )
+    db_session.add(
+        Problem(
+            host_id=h.id,
+            title="old",
+            summary="s",
+            severity="warning",
+            status="resolved",
+            rule_id="rule:test",
+            fingerprint="fp-old",
+            event_count=1,
+            last_seen_at=now,
+            created_at=now - timedelta(days=3),
+            updated_at=now - timedelta(days=2),
+        )
+    )
+    db_session.commit()
+
+    r = client.get("/api/v1/problems?created_within_hours=24", headers=jwt_headers)
+    assert r.status_code == 200
+    body = r.json()
+    assert body["total"] == 1
+    assert body["items"][0]["title"] == "recent"
+
+
+def test_problems_resolved_within_hours(client, db_session, jwt_headers):
+    now = datetime.now(timezone.utc)
+    h = Host(
+        hostname="r-host",
+        os_family="linux",
+        product="ssh-monitor",
+        last_seen_at=now,
+    )
+    db_session.add(h)
+    db_session.flush()
+    db_session.add(
+        Problem(
+            host_id=h.id,
+            title="closed today",
+            summary="s",
+            severity="warning",
+            status="resolved",
+            rule_id="rule:test",
+            fingerprint="fp-closed-today",
+            event_count=1,
+            last_seen_at=now,
+            created_at=now - timedelta(days=2),
+            updated_at=now - timedelta(hours=1),
+        )
+    )
+    db_session.add(
+        Problem(
+            host_id=h.id,
+            title="closed long ago",
+            summary="s",
+            severity="warning",
+            status="resolved",
+            rule_id="rule:test",
+            fingerprint="fp-closed-old",
+            event_count=1,
+            last_seen_at=now,
+            created_at=now - timedelta(days=10),
+            updated_at=now - timedelta(days=5),
+        )
+    )
+    db_session.commit()
+
+    r = client.get("/api/v1/problems?resolved_within_hours=24", headers=jwt_headers)
+    assert r.status_code == 200
+    body = r.json()
+    assert body["total"] == 1
+    assert body["items"][0]["title"] == "closed today"