feat: RDG 302/303 display path labels and RDS session break (0.3.1)

Show RDS access via RDG-Comp or Haproxy-RDG-Comp, enable qwinsta/logoff on any RDG event with internal_ip.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/config.py

@@ -106,6 +106,8 @@ class Settings(BaseSettings):
     sac_rdg_flap_window_min_sec: int = 1
     sac_rdg_flap_window_max_sec: int = 10
     sac_rdg_flap_dedup_sec: int = 30
+    # Внешние IP HAProxy/RDG-прокси: если external_ip в списке — путь Haproxy-RDG-Comp, иначе RDG-Comp
+    sac_rdg_haproxy_external_ips: str = ""
 
     # Windows admin for agent qwinsta/logoff (domain-wide)
     sac_win_admin_user: str = ""

backend/app/schemas/list_models.py

@@ -81,6 +81,8 @@ class EventSummary(BaseModel):
     rdg_flap: bool = False
     rdg_flap_pair_event_id: int | None = None
     rdg_flap_qwinsta_event_id: int | None = None
+    rdg_access_path: str | None = None
+    rdg_qwinsta_enabled: bool = False
 
     model_config = {"from_attributes": True}
 

backend/app/services/event_summary.py

@@ -3,6 +3,7 @@ from sqlalchemy.orm import Session
 from app.models.event import Event
 from app.schemas.list_models import EventSummary
 from app.services.event_actor_user import extract_event_actor_user
+from app.services.rdg_display import build_rdg_display
 from app.services.rdg_session_flap import resolve_rdg_flap_summary
 
 
@@ -16,6 +17,17 @@ def event_to_summary(event: Event, db: Session | None = None) -> EventSummary:
             db, event
         )
 
+    title = event.title
+    summary = event.summary
+    rdg_access_path: str | None = None
+    rdg_qwinsta_enabled = False
+    rdg_display = build_rdg_display(event, db)
+    if rdg_display is not None:
+        title = rdg_display.title
+        summary = rdg_display.summary
+        rdg_access_path = rdg_display.access_path
+        rdg_qwinsta_enabled = rdg_display.qwinsta_enabled
+
     return EventSummary(
         id=event.id,
         event_id=event.event_id,
@@ -28,10 +40,12 @@ def event_to_summary(event: Event, db: Session | None = None) -> EventSummary:
         category=event.category,
         type=event.type,
         severity=event.severity,
-        title=event.title,
-        summary=event.summary,
+        title=title,
+        summary=summary,
         actor_user=extract_event_actor_user(event.type, event.details),
         rdg_flap=rdg_flap,
         rdg_flap_pair_event_id=rdg_flap_pair_event_id,
         rdg_flap_qwinsta_event_id=rdg_flap_qwinsta_event_id,
+        rdg_access_path=rdg_access_path,
+        rdg_qwinsta_enabled=rdg_qwinsta_enabled,
     )

backend/app/services/rdg_display.py

@@ -0,0 +1,132 @@
+"""RD Gateway event labels (access path, UI title/summary)."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+from sqlalchemy.orm import Session
+
+from app.config import get_settings
+from app.models import Event
+from app.services.rdg_client_host import find_windows_host_by_ipv4
+from app.services.rdg_session_flap import event_internal_ip
+
+RDG_TYPES = frozenset(
+    {
+        "rdg.connection.success",
+        "rdg.connection.disconnected",
+        "rdg.connection.failed",
+    }
+)
+
+ACCESS_PATH_HAPROXY = "Haproxy-RDG-Comp"
+ACCESS_PATH_DIRECT = "RDG-Comp"
+
+
+@dataclass(frozen=True)
+class RdgDisplayInfo:
+    title: str
+    summary: str
+    access_path: str | None
+    internal_ip: str | None
+    qwinsta_enabled: bool
+
+
+def _details_dict(event: Event) -> dict:
+    raw = event.details
+    return raw if isinstance(raw, dict) else {}
+
+
+def _event_external_ip(event: Event) -> str:
+    details = _details_dict(event)
+    for key in ("external_ip", "source_ip", "ip_address"):
+        val = details.get(key)
+        if val is not None and str(val).strip():
+            return str(val).strip()
+    return ""
+
+
+def _parse_haproxy_ips() -> frozenset[str]:
+    raw = (get_settings().sac_rdg_haproxy_external_ips or "").strip()
+    if not raw:
+        return frozenset()
+    parts = [p.strip() for p in raw.replace(";", ",").split(",")]
+    return frozenset(p for p in parts if p)
+
+
+def classify_rdg_access_path(external_ip: str) -> str | None:
+    ip = (external_ip or "").strip()
+    if not ip or ip in ("-", "N/A"):
+        return None
+    if ip in _parse_haproxy_ips():
+        return ACCESS_PATH_HAPROXY
+    return ACCESS_PATH_DIRECT
+
+
+def _windows_event_label(event: Event) -> str:
+    details = _details_dict(event)
+    win_id = details.get("event_id_windows")
+    if win_id is None:
+        return ""
+    text = str(win_id).strip()
+    return f"Win{text}" if text else ""
+
+
+def _action_label(event: Event) -> str:
+    if event.type == "rdg.connection.success":
+        return "подключение"
+    if event.type == "rdg.connection.disconnected":
+        return "отключение"
+    return "ошибка"
+
+
+def build_rdg_display(event: Event, db: Session | None = None) -> RdgDisplayInfo | None:
+    if event.type not in RDG_TYPES:
+        return None
+
+    details = _details_dict(event)
+    internal_ip = event_internal_ip(event)
+    external_ip = _event_external_ip(event)
+    access_path = classify_rdg_access_path(external_ip)
+    user = str(details.get("user") or "").strip()
+    gateway = event.host.hostname if event.host else "—"
+
+    client_label = internal_ip or "—"
+    if db and internal_ip:
+        client_host = find_windows_host_by_ipv4(db, internal_ip)
+        if client_host is not None:
+            client_label = f"{client_host.hostname} ({internal_ip})"
+
+    path_note = f" ({access_path})" if access_path else ""
+    win_note = _windows_event_label(event)
+    action = _action_label(event)
+
+    title = f"RDS {action} → {client_label}{path_note}"
+    if win_note:
+        title = f"{title} · {win_note}"
+
+    summary_parts: list[str] = []
+    if user:
+        summary_parts.append(user)
+    if external_ip:
+        summary_parts.append(f"внешний {external_ip}")
+    summary_parts.append(f"шлюз {gateway}")
+    if win_note:
+        summary_parts.append(win_note)
+    summary = " · ".join(summary_parts)
+
+    qwinsta_enabled = bool(internal_ip)
+
+    return RdgDisplayInfo(
+        title=title,
+        summary=summary,
+        access_path=access_path,
+        internal_ip=internal_ip or None,
+        qwinsta_enabled=qwinsta_enabled,
+    )
+
+
+def event_supports_rdg_client_qwinsta(event: Event) -> bool:
+    if event.type not in RDG_TYPES:
+        return False
+    return bool(event_internal_ip(event))

backend/app/services/rdg_winrm_actions.py

@@ -10,7 +10,8 @@ from sqlalchemy.orm import Session
 
 from app.models import AgentCommand, Event, Host
 from app.services.rdg_client_host import ClientWorkstationNotFoundError, resolve_client_workstation
-from app.services.rdg_session_flap import event_has_rdg_flap, event_internal_ip, resolve_rdg_flap_summary
+from app.services.rdg_display import event_supports_rdg_client_qwinsta
+from app.services.rdg_session_flap import event_internal_ip
 from app.services.win_admin_settings import get_effective_win_admin_config
 from app.services.winrm_connect import (
     WinRmCmdResult,
@@ -30,13 +31,13 @@ def _require_win_admin(db: Session):
     return cfg
 
 
-def _require_rdg_flap(db: Session, event: Event) -> None:
-    flap, _, qwinsta_id = resolve_rdg_flap_summary(db, event)
-    if flap and qwinsta_id == event.id:
+def _require_rdg_client_qwinsta(event: Event) -> None:
+    if event_supports_rdg_client_qwinsta(event):
         return
-    if event_has_rdg_flap(event):
-        return
-    raise HTTPException(status_code=400, detail="Event is not flagged as RDG session flap")
+    raise HTTPException(
+        status_code=400,
+        detail="Event is not an RD Gateway connection with internal_ip (client workstation)",
+    )
 
 
 def _resolve_client(db: Session, event: Event) -> Host:
@@ -91,7 +92,7 @@ def _persist_command(
 
 
 def execute_qwinsta_via_winrm(db: Session, event: Event, *, requested_by: str) -> AgentCommand:
-    _require_rdg_flap(db, event)
+    _require_rdg_client_qwinsta(event)
     cfg = _require_win_admin(db)
     client_host = _resolve_client(db, event)
 
@@ -134,7 +135,7 @@ def execute_logoff_via_winrm(
     session_id: int,
     requested_by: str,
 ) -> AgentCommand:
-    _require_rdg_flap(db, event)
+    _require_rdg_client_qwinsta(event)
     cfg = _require_win_admin(db)
     client_host = _resolve_client(db, event)
 

backend/app/services/telegram_templates.py

@@ -544,18 +544,23 @@ def format_event_mobile_push(event: Event) -> tuple[str, str]:
 
 
 def _format_rdg_html(event: Event) -> str:
+    from app.services.rdg_display import build_rdg_display
+
     details = _details_dict(event)
+    display = build_rdg_display(event)
     if event.type.endswith(".success"):
-        header = "✅ RD Gateway: подключение"
+        header = "✅ RDS через RD Gateway"
     elif event.type.endswith(".disconnected"):
-        header = "ℹ️ RD Gateway: отключение"
+        header = "ℹ️ RDS отключение (RD Gateway)"
     else:
-        header = "❌ RD Gateway: ошибка"
+        header = "❌ RDS ошибка (RD Gateway)"
     msg = f"<b>{header}</b>\n"
+    if display is not None and display.access_path:
+        msg += _line("🔀", "Путь", html_escape(display.access_path))
     msg += _line("👤", "Пользователь", html_escape(_detail(details, "user", "username")))
-    msg += _line("🏢", "Хост", host_label(event.host))
+    msg += _line("🚪", "Шлюз RDG", host_label(event.host))
     msg += _line("🌐", "Внешний IP", html_escape(_detail(details, "external_ip", "ip_address")))
-    msg += _line("🏠", "Внутренний IP", html_escape(_detail(details, "internal_ip", default="-")))
+    msg += _line("🖥️", "Рабочий ПК", html_escape(_detail(details, "internal_ip", default="-")))
     err = _detail(details, "gateway_error_code", "error_code", default="")
     if err != "-":
         msg += _line("⚠️", "Код ошибки", html_escape(err))

backend/app/version.py

@@ -1,5 +1,5 @@
 """Единый источник версии SAC (API, health, логи, OpenAPI)."""
 
 APP_NAME = "Security Alert Center"
-APP_VERSION = "0.3.0"
+APP_VERSION = "0.3.1"
 APP_VERSION_LABEL = f"{APP_NAME} v.{APP_VERSION}"