feat: always send RDP/SSH login success to Telegram via SAC

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/api/v1/events.py

@@ -18,15 +18,16 @@ from app.services.ingest import ingest_event
 from app.services.problems import maybe_create_problem
 from app.services.schema_validate import validate_event_payload
 from app.services.notify_dispatch import (
+    AUTH_LOGIN_SUCCESS_TYPES,
+    DAILY_REPORT_EVENT_TYPES,
     LIFECYCLE_EVENT_TYPE,
+    notify_auth_login,
     notify_daily_report,
     notify_event,
     notify_lifecycle,
     notify_problem,
 )
 
-DAILY_REPORT_EVENT_TYPES = frozenset({"report.daily.ssh", "report.daily.rdp"})
-
 router = APIRouter(prefix="/events", tags=["events"])
 logger = logging.getLogger("sac.ingest")
 
@@ -76,6 +77,8 @@ def post_event(
             notify_daily_report(event, db=db)
         elif event.type == LIFECYCLE_EVENT_TYPE:
             notify_lifecycle(event, db=db)
+        elif event.type in AUTH_LOGIN_SUCCESS_TYPES:
+            notify_auth_login(event, db=db)
         else:
             notify_event(event, db=db)
         if problem is not None and problem_created:

backend/app/services/notify_dispatch.py

@@ -13,6 +13,8 @@ from app.services.notification_severity import severity_meets_minimum
 logger = logging.getLogger(__name__)
 
 LIFECYCLE_EVENT_TYPE = "agent.lifecycle"
+DAILY_REPORT_EVENT_TYPES = frozenset({"report.daily.ssh", "report.daily.rdp"})
+AUTH_LOGIN_SUCCESS_TYPES = frozenset({"rdp.login.success", "ssh.login.success"})
 
 
 def _event_telegram_via_agent(event: Event) -> bool:
@@ -81,3 +83,14 @@ def notify_lifecycle(event: Event, *, db: Session | None = None) -> None:
     if not should_notify_event(event, db):
         return
     _dispatch_lifecycle_channels(event, db=db, policy=policy)
+
+
+def notify_auth_login(event: Event, *, db: Session | None = None) -> None:
+    """Успешный удалённый вход RDP/SSH — всегда в Telegram SAC (info вне min_severity).
+
+    При UseSAC=dual агент шлёт TG сам (telegram_via=agent) — SAC не дублирует.
+    """
+    policy = get_effective_notification_policy(db)
+    if not should_notify_event(event, db):
+        return
+    _dispatch_lifecycle_channels(event, db=db, policy=policy)