docs: refresh README; allow monitor JWT for RDG qwinsta/logoff (0.20.6)

Update platform docs for current features; Seaca and web operators with
monitor role can trigger WinRM actions via SAC API.

backend/app/api/v1/events.py

@@ -9,7 +9,7 @@ from sqlalchemy import func, select
 from sqlalchemy.orm import Session, joinedload
 
 from app.auth.api_key import get_api_key_auth
-from app.auth.jwt_auth import get_current_user, require_admin
+from app.auth.jwt_auth import get_current_user, CurrentUser
 from app.config import get_settings
 from app.database import get_db
 from app.models import Event, Host
@@ -212,12 +212,12 @@ class LogoffActionBody(BaseModel):
 def post_event_qwinsta(
     event_db_id: int,
     db: Session = Depends(get_db),
-    user=Depends(require_admin),
+    user: CurrentUser = Depends(get_current_user),
 ) -> AgentCommandResponse:
     event = db.get(Event, event_db_id)
     if event is None:
         raise HTTPException(status_code=404, detail="Event not found")
-    cmd = execute_qwinsta_via_winrm(db, event, requested_by=str(user))
+    cmd = execute_qwinsta_via_winrm(db, event, requested_by=user.username)
     db.commit()
     return _agent_command_response(cmd)
 
@@ -227,7 +227,7 @@ def post_event_logoff(
     event_db_id: int,
     body: LogoffActionBody,
     db: Session = Depends(get_db),
-    user=Depends(require_admin),
+    user: CurrentUser = Depends(get_current_user),
 ) -> AgentCommandResponse:
     event = db.get(Event, event_db_id)
     if event is None:
@@ -236,7 +236,7 @@ def post_event_logoff(
         db,
         event,
         session_id=body.session_id,
-        requested_by=str(user),
+        requested_by=user.username,
     )
     db.commit()
     return _agent_command_response(cmd)

backend/app/services/rdg_winrm_actions.py

@@ -10,7 +10,7 @@ from sqlalchemy.orm import Session
 
 from app.models import AgentCommand, Event, Host
 from app.services.rdg_client_host import ClientWorkstationNotFoundError, resolve_client_workstation
-from app.services.rdg_session_flap import event_has_rdg_flap, event_internal_ip
+from app.services.rdg_session_flap import event_has_rdg_flap, event_internal_ip, resolve_rdg_flap_summary
 from app.services.win_admin_settings import get_effective_win_admin_config
 from app.services.winrm_connect import (
     WinRmCmdResult,
@@ -30,9 +30,13 @@ def _require_win_admin(db: Session):
     return cfg
 
 
-def _require_rdg_flap(event: Event) -> None:
-    if not event_has_rdg_flap(event):
-        raise HTTPException(status_code=400, detail="Event is not flagged as RDG session flap")
+def _require_rdg_flap(db: Session, event: Event) -> None:
+    flap, _, qwinsta_id = resolve_rdg_flap_summary(db, event)
+    if flap and qwinsta_id == event.id:
+        return
+    if event_has_rdg_flap(event):
+        return
+    raise HTTPException(status_code=400, detail="Event is not flagged as RDG session flap")
 
 
 def _resolve_client(db: Session, event: Event) -> Host:
@@ -87,7 +91,7 @@ def _persist_command(
 
 
 def execute_qwinsta_via_winrm(db: Session, event: Event, *, requested_by: str) -> AgentCommand:
-    _require_rdg_flap(event)
+    _require_rdg_flap(db, event)
     cfg = _require_win_admin(db)
     client_host = _resolve_client(db, event)
 
@@ -130,7 +134,7 @@ def execute_logoff_via_winrm(
     session_id: int,
     requested_by: str,
 ) -> AgentCommand:
-    _require_rdg_flap(event)
+    _require_rdg_flap(db, event)
     cfg = _require_win_admin(db)
     client_host = _resolve_client(db, event)
 

backend/app/version.py

@@ -1,5 +1,5 @@
 """Единый источник версии SAC (API, health, логи, OpenAPI)."""
 
 APP_NAME = "Security Alert Center"
-APP_VERSION = "0.20.5"
+APP_VERSION = "0.20.6"
 APP_VERSION_LABEL = f"{APP_NAME} v.{APP_VERSION}"