feat: Problems correlation fingerprint, count, last_seen (d1-2)

- Migration 003; windowed host+type+rule correlation on ingest - GET /problems filters; GET /problems/{id} with event timeline; ack/resolve 409 guard - Tests and SAC_PROBLEM_CORRELATION_WINDOW_MINUTES config Co-authored-by: Cursor <cursoragent@cursor.com>
2026-05-28 09:46:12 +10:00
parent 8eb40cf75d
commit a4a224b284
10 changed files with 365 additions and 126 deletions
@@ -0,0 +1,49 @@
+"""problem correlation fields
+
+Revision ID: 003
+Revises: 002
+"""
+
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+
+revision: str = "003"
+down_revision: Union[str, None] = "002"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.add_column("problems", sa.Column("fingerprint", sa.String(length=128), nullable=True))
+    op.add_column(
+        "problems",
+        sa.Column("event_count", sa.Integer(), nullable=False, server_default="1"),
+    )
+    op.add_column("problems", sa.Column("last_seen_at", sa.DateTime(timezone=True), nullable=True))
+    op.create_index("ix_problems_fingerprint", "problems", ["fingerprint"])
+    op.create_index("ix_problems_last_seen_at", "problems", ["last_seen_at"])
+
+    op.execute(
+        """
+        UPDATE problems p SET
+            fingerprint = 'h' || COALESCE(p.host_id::text, '0') || ':r' || COALESCE(p.rule_id, 'unknown'),
+            event_count = COALESCE(
+                (SELECT COUNT(*)::int FROM problem_events pe WHERE pe.problem_id = p.id),
+                1
+            ),
+            last_seen_at = COALESCE(p.updated_at, p.created_at)
+        """
+    )
+
+    op.alter_column("problems", "fingerprint", nullable=False)
+    op.alter_column("problems", "last_seen_at", nullable=False)
+
+
+def downgrade() -> None:
+    op.drop_index("ix_problems_last_seen_at", table_name="problems")
+    op.drop_index("ix_problems_fingerprint", table_name="problems")
+    op.drop_column("problems", "last_seen_at")
+    op.drop_column("problems", "event_count")
+    op.drop_column("problems", "fingerprint")