fix: WinRM RDP bundle staging in %TEMP% (0.4.14)

Move zip download and extract to user TEMP to avoid ProgramData access denied on DCs. Improve WinRM ERROR line parsing and add optional SAC_AGENT_BUNDLE_BASE_URL for LAN clients.

Co-authored-by: Cursor <cursoragent@cursor.com>

.gitattributes

@@ -1,2 +0,0 @@
-# Shell scripts must use LF — CRLF in shebang breaks systemd (status=203/EXEC).
-*.sh text eol=lf

README.md

@@ -8,12 +8,12 @@
 
 | Репозиторий | Назначение |
 |-------------|------------|
-| [ssh-monitor](https://git.papatramp.ru/PapaTramp/ssh-monitor) | Linux-агент |
-| [RDP-login-monitor](https://git.papatramp.ru/PapaTramp/RDP-login-monitor) | Windows-агент |
+| [ssh-monitor](https://git.kalinamall.ru/PapaTramp/ssh-monitor) | Linux-агент |
+| [RDP-login-monitor](https://git.kalinamall.ru/PapaTramp/RDP-login-monitor) | Windows-агент |
 | **security-alert-center** | Сервер SAC (Ubuntu 24.04) |
-| [seaca](https://git.papatramp.ru/PapaTramp/seaca) | Android-клиент |
+| [seaca](https://git.kalinamall.ru/PapaTramp/seaca) | Android-клиент |
 
-**Версия:** `0.5.16` · **Деплой:** `sudo /opt/sac-deploy.sh`
+**Версия:** `0.4.11` · **Деплой:** `sudo /opt/sac-deploy.sh`
 
 ## Возможности
 
@@ -25,7 +25,6 @@
 - **Хосты** — статус агента, inventory, обновление ssh-monitor/RDP (SSH/WinRM), тест Git/SSH/WinRM; WinRM RDP: SAC тянет пакет с git, клиент скачивает zip с SAC, локальный `Deploy-LoginMonitor.ps1` (git на ПК не нужен)
 - **Мобильные** — enrollment, устройства, push; Seaca: ack/resolve, qwinsta/logoff через API SAC
 - **Роли** — `admin` / `monitor`; JWT, rate limit входа
-- **Безопасность (0.5.0)** — проверка host key SSH, SSE через httpOnly-cookie, защита rate limit от спуфинга `X-Forwarded-For`, `SAC_SECURITY_ENFORCE`, HMAC для API-ключей
 
 ## Документация
 
@@ -40,8 +39,8 @@
 ## Быстрый старт
 
 ```bash
-git clone https://git.papatramp.ru/PapaTramp/security-alert-center.git /opt/security-alert-center
-# deploy/env.native.example → config/sac-api.env (JWT_SECRET, CORS_ORIGINS, SAC_SECURITY_ENFORCE)
+git clone https://git.kalinamall.ru/PapaTramp/security-alert-center.git /opt/security-alert-center
+# deploy/env.native.example → config/sac-api.env
 cd /opt/security-alert-center/backend && python3 -m venv .venv
 .venv/bin/pip install -r requirements.txt && .venv/bin/alembic upgrade head
 ```

README_en.md

@@ -8,12 +8,12 @@ Self-hosted hub for security events from Linux and Windows agents: ingest, corre
 
 | Repository | Role |
 |------------|------|
-| [ssh-monitor](https://git.papatramp.ru/PapaTramp/ssh-monitor) | Linux agent |
-| [RDP-login-monitor](https://git.papatramp.ru/PapaTramp/RDP-login-monitor) | Windows agent |
+| [ssh-monitor](https://git.kalinamall.ru/PapaTramp/ssh-monitor) | Linux agent |
+| [RDP-login-monitor](https://git.kalinamall.ru/PapaTramp/RDP-login-monitor) | Windows agent |
 | **security-alert-center** | SAC server (Ubuntu 24.04) |
-| [seaca](https://git.papatramp.ru/PapaTramp/seaca) | Android client |
+| [seaca](https://git.kalinamall.ru/PapaTramp/seaca) | Android client |
 
-**Version:** `0.5.16` · **Deploy:** `sudo /opt/sac-deploy.sh`
+**Version:** `0.4.11` · **Deploy:** `sudo /opt/sac-deploy.sh`
 
 ## Features
 
@@ -25,7 +25,6 @@ Self-hosted hub for security events from Linux and Windows agents: ingest, corre
 - **Hosts** — agent status, inventory, agent updates (SSH/WinRM); WinRM RDP: SAC fetches from git, client downloads zip from SAC, runs local `Deploy-LoginMonitor.ps1` (no git on PC)
 - **Mobile** — enrollment, devices, push; Seaca: ack/resolve, qwinsta/logoff via SAC API
 - **Roles** — `admin` / `monitor`
-- **Security (0.5.0)** — SSH host-key verification, SSE via httpOnly cookie, anti-spoof login rate limit, `SAC_SECURITY_ENFORCE`, HMAC API keys
 
 ## Documentation
 
@@ -39,8 +38,8 @@ Self-hosted hub for security events from Linux and Windows agents: ingest, corre
 ## Quick start
 
 ```bash
-git clone https://git.papatramp.ru/PapaTramp/security-alert-center.git /opt/security-alert-center
-# deploy/env.native.example → config/sac-api.env
+git clone https://git.kalinamall.ru/PapaTramp/security-alert-center.git /opt/security-alert-center
+# deploy/env.native.example -> config/sac-api.env
 cd /opt/security-alert-center/backend && python3 -m venv .venv
 .venv/bin/pip install -r requirements.txt && .venv/bin/alembic upgrade head
 ```

backend/alembic/versions/027_host_mgmt_credentials.py

@@ -1,25 +0,0 @@
-"""per-host management credentials (SSH / WinRM override)
-
-Revision ID: 027_host_mgmt_credentials
-Revises: 026_host_silence_dedupe
-Create Date: 2026-07-14
-
-"""
-
-from alembic import op
-import sqlalchemy as sa
-
-revision = "027_host_mgmt_credentials"
-down_revision = "026_host_silence_dedupe"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.add_column("hosts", sa.Column("mgmt_user", sa.String(length=256), nullable=True))
-    op.add_column("hosts", sa.Column("mgmt_password", sa.Text(), nullable=True))
-
-
-def downgrade() -> None:
-    op.drop_column("hosts", "mgmt_password")
-    op.drop_column("hosts", "mgmt_user")

backend/app/api/v1/auth.py

@@ -1,90 +1,156 @@
-from fastapi import APIRouter, Depends, HTTPException, Request
-from fastapi.responses import JSONResponse, Response
-from pydantic import BaseModel
-from sqlalchemy import func, select
+from fastapi import APIRouter, Depends, HTTPException, Request
+
+from pydantic import BaseModel, Field
+
 from sqlalchemy.orm import Session
 
+
+
 from app.auth.jwt_auth import CurrentUser, create_access_token, get_current_user
-from app.auth.stream_cookie import clear_stream_auth_cookie, set_stream_auth_cookie
+
 from app.config import get_settings
+
 from app.database import get_db
+
 from app.services.login_rate_limit import (
+
     ensure_login_allowed,
+
     record_login_failure,
+
     record_login_success,
+
 )
+
 from app.services.user_auth import authenticate_user
 
+
+
 router = APIRouter(prefix="/auth", tags=["auth"])
 
 
+
+
+
 class LoginRequest(BaseModel):
+
     username: str
+
     password: str
 
 
+
+
+
 class TokenResponse(BaseModel):
+
     access_token: str
+
     token_type: str = "bearer"
+
     username: str
+
     role: str
 
 
+
+
+
 class MeResponse(BaseModel):
+
     username: str
+
     role: str
 
 
+
+
+
 @router.post("/login", response_model=TokenResponse)
-def login(body: LoginRequest, request: Request, db: Session = Depends(get_db)) -> JSONResponse:
+
+def login(body: LoginRequest, request: Request, db: Session = Depends(get_db)) -> TokenResponse:
+
     settings = get_settings()
+
     if not settings.sac_admin_password and not _has_any_user(db):
+
         raise HTTPException(
+
             status_code=503,
+
             detail="SAC UI users are not configured (run alembic upgrade and set SAC_ADMIN_PASSWORD for bootstrap)",
+
         )
 
+
+
     ip_address = ensure_login_allowed(db, request)
 
+
+
     user = authenticate_user(db, body.username, body.password)
+
     if user is None:
+
         record_login_failure(db, ip_address=ip_address, username=body.username)
+
         db.commit()
+
         raise HTTPException(status_code=401, detail="Invalid username or password")
 
+
+
     record_login_success(db, ip_address=ip_address, username=user.username)
+
     db.commit()
 
+
+
     token = create_access_token(user.username, user.role)
-    payload = TokenResponse(
+
+    return TokenResponse(
+
         access_token=token,
+
         username=user.username,
+
         role=user.role,
+
     )
-    response = JSONResponse(content=payload.model_dump())
-    set_stream_auth_cookie(response, token, settings)
-    return response
 
 
-@router.post("/logout", status_code=204)
-def logout() -> Response:
-    settings = get_settings()
-    response = Response(status_code=204)
-    clear_stream_auth_cookie(response, settings)
-    return response
+
 
 
 @router.get("/me", response_model=MeResponse)
+
 def me(current_user: CurrentUser = Depends(get_current_user)) -> MeResponse:
+
     return MeResponse(username=current_user.username, role=current_user.role)
 
 
+
+
+
 def _has_any_user(db: Session) -> bool:
+
+    from sqlalchemy import func, select
+
+
+
     from app.models.user import User
 
+
+
     try:
+
         count = db.scalar(select(func.count()).select_from(User)) or 0
+
         return count > 0
+
     except Exception:
+
         db.rollback()
+
         return False
+

backend/app/api/v1/events.py

@@ -14,7 +14,6 @@ from app.config import get_settings
 from app.database import get_db
 from app.models import Event, Host
 from app.schemas.list_models import EventDetail, EventListResponse, EventSummary
-from app.utils.sql_like import escape_ilike_pattern
 from app.services.agent_commands import (
     command_response_fields,
     command_to_dict,
@@ -28,12 +27,12 @@ from app.services.host_sessions import (
     mark_event_session_terminated,
     terminate_session_for_event,
 )
-from app.services.linux_admin_settings import get_effective_linux_admin_for_host
+from app.services.linux_admin_settings import get_effective_linux_admin_config
 from app.services.ssh_connect import (
     HostNotLinuxError as SshHostNotLinuxError,
     HostTargetMissingError as SshHostTargetMissingError,
 )
-from app.services.win_admin_settings import get_effective_win_admin_for_host
+from app.services.win_admin_settings import get_effective_win_admin_config
 from app.services.winrm_connect import HostNotWindowsError, HostTargetMissingError
 from app.services.ingest import ingest_event
 from app.services.event_summary import event_to_summary
@@ -52,9 +51,7 @@ from app.services.notify_dispatch import (
     notify_lifecycle,
     notify_problem,
     notify_rdg_connection,
-    schedule_notify_auth_login,
     schedule_notify_daily_report,
-    schedule_notify_lifecycle,
 )
 
 router = APIRouter(prefix="/events", tags=["events"])
@@ -102,17 +99,15 @@ def post_event(
     problem = None
     problem_created = False
     deferred_daily_report_id: int | None = None
-    deferred_lifecycle_id: int | None = None
-    deferred_auth_login_id: int | None = None
     if created:
         problem, problem_created = maybe_create_problem(db, event)
         maybe_auto_disconnect_stuck_rdp_session(db, event)
         if event.type in DAILY_REPORT_EVENT_TYPES:
             deferred_daily_report_id = event.id
         elif event.type == LIFECYCLE_EVENT_TYPE:
-            deferred_lifecycle_id = event.id
+            notify_lifecycle(event, db=db)
         elif event.type in AUTH_LOGIN_SUCCESS_TYPES:
-            deferred_auth_login_id = event.id
+            notify_auth_login(event, db=db)
         elif event.type in RDG_CONNECTION_TYPES:
             notify_rdg_connection(event, db=db)
         else:
@@ -126,10 +121,6 @@ def post_event(
 
     if deferred_daily_report_id is not None:
         background_tasks.add_task(schedule_notify_daily_report, deferred_daily_report_id)
-    if deferred_lifecycle_id is not None:
-        background_tasks.add_task(schedule_notify_lifecycle, deferred_lifecycle_id)
-    if deferred_auth_login_id is not None:
-        background_tasks.add_task(schedule_notify_auth_login, deferred_auth_login_id)
 
     body = _ingest_response(event, created=created)
     if problem is not None:
@@ -194,9 +185,9 @@ def list_events(
         stmt = stmt.where(Event.host_id == host_id)
         count_stmt = count_stmt.where(Event.host_id == host_id)
     if hostname:
-        like = f"%{escape_ilike_pattern(hostname)}%"
-        stmt = stmt.where(Host.hostname.ilike(like, escape="\\") | Host.display_name.ilike(like, escape="\\"))
-        count_stmt = count_stmt.where(Host.hostname.ilike(like, escape="\\") | Host.display_name.ilike(like, escape="\\"))
+        like = f"%{hostname}%"
+        stmt = stmt.where(Host.hostname.ilike(like) | Host.display_name.ilike(like))
+        count_stmt = count_stmt.where(Host.hostname.ilike(like) | Host.display_name.ilike(like))
     dt_from = _parse_optional_dt(from_time)
     dt_to = _parse_optional_dt(to_time, end_of_day=True)
     if dt_from:
@@ -206,9 +197,9 @@ def list_events(
         stmt = stmt.where(Event.occurred_at <= dt_to)
         count_stmt = count_stmt.where(Event.occurred_at <= dt_to)
     if q:
-        like = f"%{escape_ilike_pattern(q)}%"
-        stmt = stmt.where(Event.summary.ilike(like, escape="\\") | Event.title.ilike(like, escape="\\"))
-        count_stmt = count_stmt.where(Event.summary.ilike(like, escape="\\") | Event.title.ilike(like, escape="\\"))
+        like = f"%{q}%"
+        stmt = stmt.where(Event.summary.ilike(like) | Event.title.ilike(like))
+        count_stmt = count_stmt.where(Event.summary.ilike(like) | Event.title.ilike(like))
 
     total = db.scalar(count_stmt) or 0
     rows = db.scalars(
@@ -284,10 +275,8 @@ def post_event_terminate_session(
     if event_session_terminated(event, db=db):
         raise HTTPException(status_code=409, detail="Session already terminated for this event")
 
-    if event.host is None:
-        raise HTTPException(status_code=400, detail="Event has no host")
-    linux_cfg = get_effective_linux_admin_for_host(db, event.host)
-    win_cfg = get_effective_win_admin_for_host(db, event.host)
+    linux_cfg = get_effective_linux_admin_config(db)
+    win_cfg = get_effective_win_admin_config(db)
     sid = (body.session_id if body else None) or event_session_id(event)
 
     try:

backend/app/api/v1/hosts.py

@@ -12,7 +12,6 @@ from app.config import get_settings
 from app.database import get_db
 from app.models import Event, Host
 from app.schemas.list_models import HostDetail, HostListResponse, HostSummary
-from app.utils.sql_like import escape_ilike_pattern
 from app.services.agent_version import (
     latest_agent_versions_by_product,
     reference_agent_versions_by_product,
@@ -46,12 +45,8 @@ from app.services.host_sessions import (
     terminate_windows_session,
 )
 from app.services.host_delete import delete_host_and_related
-from app.services.host_mgmt_credentials import (
-    get_host_mgmt_access_view,
-    upsert_host_mgmt_credentials,
-)
-from app.services.linux_admin_settings import get_effective_linux_admin_for_host
-from app.services.win_admin_settings import get_effective_win_admin_for_host
+from app.services.linux_admin_settings import get_effective_linux_admin_config
+from app.services.win_admin_settings import get_effective_win_admin_config
 from app.services.winrm_connect import (
     HostNotWindowsError,
     HostTargetMissingError,
@@ -106,8 +101,8 @@ def list_hosts(
         stmt = stmt.where(Host.product == product)
         count_stmt = count_stmt.where(Host.product == product)
     if hostname:
-        like = f"%{escape_ilike_pattern(hostname)}%"
-        host_match = Host.hostname.ilike(like, escape="\\") | Host.display_name.ilike(like, escape="\\")
+        like = f"%{hostname}%"
+        host_match = Host.hostname.ilike(like) | Host.display_name.ilike(like)
         stmt = stmt.where(host_match)
         count_stmt = count_stmt.where(host_match)
 
@@ -303,23 +298,6 @@ class HostAgentConfigResponse(BaseModel):
     settings: dict[str, object]
 
 
-class HostMgmtAccessResponse(BaseModel):
-    host_id: int
-    has_override: bool
-    user: str | None = None
-    password_set: bool = False
-    password_hint: str | None = None
-    effective_source: str
-    effective_configured: bool
-    effective_user: str | None = None
-
-
-class HostMgmtAccessUpdate(BaseModel):
-    user: str | None = None
-    password: str | None = None
-    clear: bool = False
-
-
 class HostRemoteActionStartResponse(BaseModel):
     status: str
     host_id: int
@@ -490,12 +468,9 @@ def test_host_winrm(
     if host is None:
         raise HTTPException(status_code=404, detail="Host not found")
 
-    cfg = get_effective_win_admin_for_host(db, host)
+    cfg = get_effective_win_admin_config(db)
     if not cfg.configured:
-        raise HTTPException(
-            status_code=400,
-            detail="Windows admin is not configured (host override or Settings → Windows)",
-        )
+        raise HTTPException(status_code=400, detail="Windows domain admin is not configured")
 
     try:
         targets = iter_winrm_targets(host)
@@ -556,12 +531,9 @@ def test_host_ssh(
     if host is None:
         raise HTTPException(status_code=404, detail="Host not found")
 
-    cfg = get_effective_linux_admin_for_host(db, host)
+    cfg = get_effective_linux_admin_config(db)
     if not cfg.configured:
-        raise HTTPException(
-            status_code=400,
-            detail="Linux SSH admin is not configured (host override or Settings → Linux)",
-        )
+        raise HTTPException(status_code=400, detail="Linux SSH admin is not configured")
 
     response = _run_ssh_action_on_host(host, cfg, action=test_ssh_connection)
     _set_ssh_admin_status(host, response.ok)
@@ -583,12 +555,9 @@ def update_host_agent_via_ssh(
     if host is None:
         raise HTTPException(status_code=404, detail="Host not found")
 
-    cfg = get_effective_linux_admin_for_host(db, host)
+    cfg = get_effective_linux_admin_config(db)
     if not cfg.configured:
-        raise HTTPException(
-            status_code=400,
-            detail="Linux SSH admin is not configured (host override or Settings → Linux)",
-        )
+        raise HTTPException(status_code=400, detail="Linux SSH admin is not configured")
 
     title = "Обновление ssh-monitor (SSH)"
     try:
@@ -597,7 +566,6 @@ def update_host_agent_via_ssh(
             host,
             title=title,
             runner=run_ssh_monitor_update_action,
-            poll_remote_log=True,
         )
     except RemoteActionAlreadyRunningError as exc:
         raise HTTPException(status_code=409, detail=str(exc)) from exc
@@ -683,7 +651,6 @@ def get_host_remote_job(
     host = db.get(Host, host_id)
     if host is None:
         raise HTTPException(status_code=404, detail="Host not found")
-    db.refresh(host)
     return HostRemoteActionJobResponse(**get_remote_action_status(host))
 
 
@@ -716,12 +683,9 @@ def list_host_sessions(
     from app.services.winrm_connect import is_windows_host
 
     if is_linux_host(host):
-        cfg = get_effective_linux_admin_for_host(db, host)
+        cfg = get_effective_linux_admin_config(db)
         if not cfg.configured:
-            raise HTTPException(
-                status_code=400,
-                detail="Linux SSH admin is not configured (host override or Settings → Linux)",
-            )
+            raise HTTPException(status_code=400, detail="Linux SSH admin is not configured")
         try:
             sessions, result = list_linux_sessions(host, cfg)
         except SshHostNotLinuxError as exc:
@@ -736,12 +700,9 @@ def list_host_sessions(
         )
 
     if is_windows_host(host):
-        cfg = get_effective_win_admin_for_host(db, host)
+        cfg = get_effective_win_admin_config(db)
         if not cfg.configured:
-            raise HTTPException(
-                status_code=400,
-                detail="Windows admin is not configured (host override or Settings → Windows)",
-            )
+            raise HTTPException(status_code=400, detail="Windows domain admin is not configured")
         try:
             sessions, result = list_windows_sessions(host, cfg)
         except HostNotWindowsError as exc:
@@ -779,12 +740,9 @@ def terminate_host_session(
         raise HTTPException(status_code=422, detail="session_id is required")
 
     if is_linux_host(host):
-        cfg = get_effective_linux_admin_for_host(db, host)
+        cfg = get_effective_linux_admin_config(db)
         if not cfg.configured:
-            raise HTTPException(
-                status_code=400,
-                detail="Linux SSH admin is not configured (host override or Settings → Linux)",
-            )
+            raise HTTPException(status_code=400, detail="Linux SSH admin is not configured")
         try:
             result = terminate_linux_session(host, cfg, sid)
         except SshHostNotLinuxError as exc:
@@ -800,12 +758,9 @@ def terminate_host_session(
         )
 
     if is_windows_host(host):
-        cfg = get_effective_win_admin_for_host(db, host)
+        cfg = get_effective_win_admin_config(db)
         if not cfg.configured:
-            raise HTTPException(
-                status_code=400,
-                detail="Windows admin is not configured (host override or Settings → Windows)",
-            )
+            raise HTTPException(status_code=400, detail="Windows domain admin is not configured")
         try:
             result = terminate_windows_session(host, cfg, sid)
         except HostNotWindowsError as exc:
@@ -845,57 +800,6 @@ def patch_host_agent_config(
     )
 
 
-@router.get("/{host_id}/access", response_model=HostMgmtAccessResponse)
-def get_host_access(
-    host_id: int,
-    db: Session = Depends(get_db),
-    _user=Depends(require_admin),
-) -> HostMgmtAccessResponse:
-    host = db.get(Host, host_id)
-    if host is None:
-        raise HTTPException(status_code=404, detail="Host not found")
-    view = get_host_mgmt_access_view(db, host)
-    return HostMgmtAccessResponse(
-        host_id=view.host_id,
-        has_override=view.has_override,
-        user=view.user,
-        password_set=view.password_set,
-        password_hint=view.password_hint,
-        effective_source=view.effective_source,
-        effective_configured=view.effective_configured,
-        effective_user=view.effective_user,
-    )
-
-
-@router.put("/{host_id}/access", response_model=HostMgmtAccessResponse)
-def put_host_access(
-    host_id: int,
-    body: HostMgmtAccessUpdate,
-    db: Session = Depends(get_db),
-    _user=Depends(require_admin),
-) -> HostMgmtAccessResponse:
-    host = db.get(Host, host_id)
-    if host is None:
-        raise HTTPException(status_code=404, detail="Host not found")
-    view = upsert_host_mgmt_credentials(
-        db,
-        host,
-        user=body.user,
-        password=body.password,
-        clear=body.clear,
-    )
-    return HostMgmtAccessResponse(
-        host_id=view.host_id,
-        has_override=view.has_override,
-        user=view.user,
-        password_set=view.password_set,
-        password_hint=view.password_hint,
-        effective_source=view.effective_source,
-        effective_configured=view.effective_configured,
-        effective_user=view.effective_user,
-    )
-
-
 @router.get("/{host_id}/agent-config", response_model=HostAgentConfigResponse)
 def get_host_agent_config(
     host_id: int,

backend/app/api/v1/problems.py

@@ -18,7 +18,6 @@ from app.database import get_db
 
 from app.models import Event, Host, Problem, ProblemEvent
 from app.services.event_type_visibility import get_hidden_event_types
-from app.utils.sql_like import escape_ilike_pattern
 
 
 
@@ -194,11 +193,11 @@ def list_problems(
 
     if hostname:
 
-        like = f"%{escape_ilike_pattern(hostname)}%"
+        like = f"%{hostname}%"
 
-        stmt = stmt.where(Host.hostname.ilike(like, escape="\\") | Host.display_name.ilike(like, escape="\\"))
+        stmt = stmt.where(Host.hostname.ilike(like) | Host.display_name.ilike(like))
 
-        count_stmt = count_stmt.where(Host.hostname.ilike(like, escape="\\") | Host.display_name.ilike(like, escape="\\"))
+        count_stmt = count_stmt.where(Host.hostname.ilike(like) | Host.display_name.ilike(like))
 
     if created_within_hours is not None:
 

backend/app/api/v1/stream.py

@@ -1,14 +1,13 @@
-import asyncio
+import asyncio
 import json
 from datetime import datetime, timedelta, timezone
 
-from fastapi import APIRouter, Cookie, Depends, HTTPException
+from fastapi import APIRouter, Depends, Query
 from fastapi.responses import StreamingResponse
 from sqlalchemy import func, select
 from sqlalchemy.orm import Session
 
 from app.auth.jwt_auth import verify_access_token
-from app.auth.stream_cookie import STREAM_COOKIE_NAME
 from app.database import SessionLocal, get_db
 from app.models import Event, Problem
 from app.config import get_settings
@@ -68,12 +67,9 @@ async def _sse_generator():
 
 
 def _sse_auth(
-    sac_stream: str | None = Cookie(None, alias=STREAM_COOKIE_NAME),
+    token: str = Query(..., description="JWT access_token"),
     db: Session = Depends(get_db),
 ) -> str:
-    token = (sac_stream or "").strip()
-    if not token:
-        raise HTTPException(status_code=401, detail="SSE authentication required")
     return verify_access_token(token, db=db)
 
 

backend/app/auth/api_key.py

@@ -1,5 +1,4 @@
-import hashlib
-import hmac
+import hashlib
 import secrets
 
 from fastapi import Depends, HTTPException, Security
@@ -7,26 +6,14 @@ from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
 from sqlalchemy import select
 from sqlalchemy.orm import Session
 
-from app.config import get_settings
 from app.database import get_db
 from app.models import ApiKey
 
 security_scheme = HTTPBearer(auto_error=False)
 
 
-def _legacy_hash_api_key(raw_key: str) -> str:
-    return hashlib.sha256(raw_key.encode("utf-8")).hexdigest()
-
-
 def hash_api_key(raw_key: str) -> str:
-    secret = get_settings().jwt_secret.encode("utf-8")
-    return hmac.new(secret, raw_key.encode("utf-8"), hashlib.sha256).hexdigest()
-
-
-def verify_api_key_hash(raw_key: str, stored_hash: str) -> bool:
-    if hmac.compare_digest(hash_api_key(raw_key), stored_hash):
-        return True
-    return hmac.compare_digest(_legacy_hash_api_key(raw_key), stored_hash)
+    return hashlib.sha256(raw_key.encode("utf-8")).hexdigest()
 
 
 def generate_api_key() -> tuple[str, str, str]:
@@ -37,11 +24,9 @@ def generate_api_key() -> tuple[str, str, str]:
 
 
 def verify_api_key(db: Session, raw_key: str) -> bool:
-    rows = db.scalars(select(ApiKey).where(ApiKey.is_active.is_(True))).all()
-    for row in rows:
-        if verify_api_key_hash(raw_key, row.key_hash):
-            return True
-    return False
+    key_hash = hash_api_key(raw_key)
+    row = db.scalar(select(ApiKey).where(ApiKey.key_hash == key_hash, ApiKey.is_active.is_(True)))
+    return row is not None
 
 
 def get_api_key_auth(

backend/app/auth/stream_cookie.py

@@ -1,37 +0,0 @@
-"""httpOnly cookie auth for SSE (EventSource cannot send Authorization header)."""
-
-from __future__ import annotations
-
-from fastapi import Response
-
-from app.config import Settings
-
-STREAM_COOKIE_NAME = "sac_stream"
-STREAM_COOKIE_PATH = "/api/v1/stream"
-
-
-def stream_cookie_kwargs(settings: Settings) -> dict[str, object]:
-    secure = settings.sac_public_url.lower().startswith("https://")
-    return {
-        "key": STREAM_COOKIE_NAME,
-        "httponly": True,
-        "secure": secure,
-        "samesite": "strict",
-        "path": STREAM_COOKIE_PATH,
-        "max_age": max(60, int(settings.jwt_expire_minutes) * 60),
-    }
-
-
-def set_stream_auth_cookie(response: Response, token: str, settings: Settings) -> None:
-    response.set_cookie(value=token, **stream_cookie_kwargs(settings))
-
-
-def clear_stream_auth_cookie(response: Response, settings: Settings) -> None:
-    kwargs = stream_cookie_kwargs(settings)
-    response.delete_cookie(
-        key=kwargs["key"],
-        path=kwargs["path"],
-        secure=bool(kwargs["secure"]),
-        httponly=True,
-        samesite="strict",
-    )

backend/app/config.py

@@ -36,16 +36,12 @@ class Settings(BaseSettings):
     database_url: str = "postgresql+psycopg2://sac:sac@localhost:5432/sac"
     sac_db_pool_size: int = 15
     sac_db_max_overflow: int = 25
-    sac_uvicorn_workers: int = 4
     sac_public_url: str = "http://localhost:8000"
     # URL для скачивания RDP bundle с ПК (WinRM). По умолчанию = SAC_PUBLIC_URL.
     sac_agent_bundle_base_url: str = ""
     jwt_secret: str = "change-me-in-production"
     jwt_algorithm: str = "HS256"
     jwt_expire_minutes: int = 60 * 24
-    # Fail-fast on weak JWT/CORS defaults (disable only for local dev/tests).
-    sac_security_enforce: bool = True
-    sac_ingest_max_body_bytes: int = 2_097_152
 
     sac_bootstrap_api_key: str = ""
     sac_admin_username: str = "admin"
@@ -120,14 +116,10 @@ class Settings(BaseSettings):
     # Windows admin for agent qwinsta/logoff (domain-wide)
     sac_win_admin_user: str = ""
     sac_win_admin_password: str = ""
-    sac_winrm_use_https: bool = False
-    sac_winrm_server_cert_validation: str = "validate"
 
     # Linux SSH admin for remote agent update (fallback SSH, phase 5)
     sac_linux_admin_user: str = ""
     sac_linux_admin_password: str = ""
-    sac_ssh_known_hosts_file: str = "/opt/security-alert-center/config/ssh_known_hosts"
-    sac_ssh_auto_add_host_key: bool = False
 
     # Agent updates (mode gpo|sac, recommended versions, WinRM fallback script)
     sac_agent_update_mode: str = "gpo"
@@ -138,8 +130,8 @@ class Settings(BaseSettings):
     sac_agent_min_rdp_version: str = ""
     sac_agent_min_ssh_version: str = ""
     sac_win_agent_update_script: str = ""
-    sac_agent_rdp_git_repo_url: str = "https://git.papatramp.ru/PapaTramp/RDP-login-monitor.git"
-    sac_agent_ssh_git_repo_url: str = "https://git.papatramp.ru/PapaTramp/ssh-monitor.git"
+    sac_agent_rdp_git_repo_url: str = "https://git.kalinamall.ru/PapaTramp/RDP-login-monitor.git"
+    sac_agent_ssh_git_repo_url: str = "https://git.kalinamall.ru/PapaTramp/ssh-monitor.git"
     sac_agent_git_branch: str = "main"
     sac_agent_git_cache_dir: str = "/opt/security-alert-center/cache/agent-repos"
     sac_agent_git_cache_ttl_minutes: int = 30

backend/app/constants/event_types.py

@@ -23,7 +23,6 @@ DEFAULT_EVENT_SEVERITIES: dict[str, str] = {
     # RDP / Windows
     "rdp.login.success": "info",
     "rdp.login.failed": "warning",
-    "rdp.session.logoff": "info",
     "rdp.shadow.control.started": "warning",
     "rdp.shadow.control.stopped": "info",
     "rdp.shadow.control.permission": "warning",

backend/app/main.py

@@ -1,4 +1,4 @@
-import asyncio
+import asyncio
 import logging
 from contextlib import asynccontextmanager, suppress
 from pathlib import Path
@@ -13,9 +13,7 @@ from app.api.v1.router import api_router
 from app.auth.api_key import hash_api_key
 from app.config import get_settings
 from app.database import SessionLocal
-from app.middleware.ingest_body_limit import IngestBodySizeLimitMiddleware
 from app.models import ApiKey
-from app.security_bootstrap import validate_security_settings, warn_relaxed_security
 from app.services.user_auth import bootstrap_admin_user
 from app.version import APP_VERSION, APP_VERSION_LABEL
 
@@ -69,9 +67,6 @@ def bootstrap_stale_remote_actions() -> None:
 
 @asynccontextmanager
 async def lifespan(_app: FastAPI):
-    settings = get_settings()
-    validate_security_settings(settings)
-    warn_relaxed_security(settings)
     logger.info("%s — application startup (version %s)", APP_VERSION_LABEL, APP_VERSION)
     bootstrap_api_key()
     bootstrap_users()
@@ -79,6 +74,7 @@ async def lifespan(_app: FastAPI):
 
     stop_scan = asyncio.Event()
     scan_task: asyncio.Task | None = None
+    settings = get_settings()
     if settings.sac_host_silence_scan_enabled:
         from app.jobs.host_silence_background import host_silence_scan_loop
 
@@ -112,18 +108,13 @@ def create_app() -> FastAPI:
         lifespan=lifespan,
     )
     origins = [o.strip() for o in settings.cors_origins.split(",") if o.strip()]
-    wildcard = origins == ["*"]
     app.add_middleware(
         CORSMiddleware,
-        allow_origins=origins if not wildcard else ["*"],
-        allow_credentials=not wildcard,
+        allow_origins=origins if origins != ["*"] else ["*"],
+        allow_credentials=True,
         allow_methods=["*"],
         allow_headers=["*"],
     )
-    app.add_middleware(
-        IngestBodySizeLimitMiddleware,
-        max_bytes=settings.sac_ingest_max_body_bytes,
-    )
     from app.api.v1.health import router as health_router
 
     app.include_router(api_router, prefix="/api/v1")

backend/app/middleware/ingest_body_limit.py

@@ -1,28 +0,0 @@
-"""Limit POST /api/v1/events body size (matches nginx client_max_body_size)."""
-
-from __future__ import annotations
-
-from starlette.middleware.base import BaseHTTPMiddleware
-from starlette.requests import Request
-from starlette.responses import JSONResponse
-
-
-class IngestBodySizeLimitMiddleware(BaseHTTPMiddleware):
-    def __init__(self, app, *, max_bytes: int = 2_097_152) -> None:
-        super().__init__(app)
-        self._max_bytes = max_bytes
-
-    async def dispatch(self, request: Request, call_next):
-        if request.method == "POST" and request.url.path.rstrip("/") == "/api/v1/events":
-            content_length = request.headers.get("content-length")
-            if content_length:
-                try:
-                    size = int(content_length)
-                except ValueError:
-                    size = 0
-                if size > self._max_bytes:
-                    return JSONResponse(
-                        status_code=413,
-                        content={"detail": f"Request body too large (max {self._max_bytes} bytes)"},
-                    )
-        return await call_next(request)

backend/app/models/host.py

@@ -26,9 +26,6 @@ class Host(Base):
     use_sac_mode: Mapped[str | None] = mapped_column(String(32))
     ssh_admin_ok: Mapped[bool | None] = mapped_column(nullable=True)
     ssh_admin_checked_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
-    # Optional override for SSH/WinRM (home PCs, unique local admin). Empty → global Settings.
-    mgmt_user: Mapped[str | None] = mapped_column(String(256))
-    mgmt_password: Mapped[str | None] = mapped_column(Text)
     pending_agent_update: Mapped[bool] = mapped_column(default=False, server_default="false")
     pending_update_requested_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
     pending_update_target_version: Mapped[str | None] = mapped_column(String(64))

backend/app/schemas/list_models.py

@@ -78,7 +78,6 @@ class EventSummary(BaseModel):
     title: str
     summary: str
     actor_user: str | None = None
-    session_duration_sec: int | None = None
     rdg_flap: bool = False
     rdg_flap_pair_event_id: int | None = None
     rdg_flap_qwinsta_event_id: int | None = None

backend/app/security_bootstrap.py

@@ -1,52 +0,0 @@
-"""Fail-fast checks for insecure production defaults."""
-
-from __future__ import annotations
-
-import logging
-from urllib.parse import urlparse
-
-from app.config import Settings
-
-logger = logging.getLogger("sac")
-
-_WEAK_JWT_SECRETS = frozenset(
-    {
-        "",
-        "change-me-in-production",
-        "change-me-openssl-rand-hex-32",
-        "CHANGE_ME_openssl_rand_hex_32",
-    }
-)
-
-
-def _is_local_dev_url(public_url: str) -> bool:
-    parsed = urlparse(public_url.strip() or "http://localhost:8000")
-    host = (parsed.hostname or "").lower()
-    return host in {"localhost", "127.0.0.1", "::1", "testserver"}
-
-
-def validate_security_settings(settings: Settings) -> None:
-    """Raise on dangerous defaults when SAC_SECURITY_ENFORCE=true."""
-    if not settings.sac_security_enforce:
-        return
-
-    if settings.jwt_secret in _WEAK_JWT_SECRETS:
-        raise RuntimeError(
-            "JWT_SECRET is missing or uses an insecure default. "
-            "Set a random value in sac-api.env (openssl rand -hex 32)."
-        )
-
-    if settings.cors_origins.strip() == "*" and not _is_local_dev_url(settings.sac_public_url):
-        raise RuntimeError(
-            "CORS_ORIGINS=* is not allowed with SAC_SECURITY_ENFORCE=true on non-local SAC_PUBLIC_URL. "
-            "Set CORS_ORIGINS to your UI origin, e.g. https://sac.example.com"
-        )
-
-
-def warn_relaxed_security(settings: Settings) -> None:
-    if settings.sac_security_enforce:
-        return
-    if settings.jwt_secret in _WEAK_JWT_SECRETS:
-        logger.warning("JWT_SECRET uses insecure default — set a strong secret before production")
-    if settings.cors_origins.strip() == "*":
-        logger.warning("CORS_ORIGINS=* — restrict to explicit origins in production")

backend/app/services/agent_commands.py

@@ -7,22 +7,17 @@ from datetime import datetime, timezone
 from sqlalchemy import select
 from sqlalchemy.orm import Session
 
+from app.config import get_settings
 from app.models import AgentCommand, Host
-from app.services.win_admin_settings import (
-    get_effective_win_admin_config,
-    get_effective_win_admin_for_host,
-)
+from app.services.win_admin_settings import get_effective_win_admin_config
 
 
 def _win_admin_configured() -> bool:
     return get_effective_win_admin_config().configured
 
 
-def win_admin_run_as(db: Session | None = None, host: Host | None = None) -> dict[str, str] | None:
-    if host is not None and db is not None:
-        cfg = get_effective_win_admin_for_host(db, host)
-    else:
-        cfg = get_effective_win_admin_config(db)
+def win_admin_run_as() -> dict[str, str] | None:
+    cfg = get_effective_win_admin_config()
     if not cfg.configured:
         return None
     return {
@@ -31,13 +26,7 @@ def win_admin_run_as(db: Session | None = None, host: Host | None = None) -> dic
     }
 
 
-def command_to_dict(
-    cmd: AgentCommand,
-    *,
-    include_run_as: bool = False,
-    db: Session | None = None,
-    host: Host | None = None,
-) -> dict:
+def command_to_dict(cmd: AgentCommand, *, include_run_as: bool = False) -> dict:
     out = {
         "id": cmd.command_uuid,
         "type": cmd.command_type,
@@ -49,7 +38,7 @@ def command_to_dict(
         "completed_at": cmd.completed_at.isoformat() if cmd.completed_at else None,
     }
     if include_run_as and cmd.status == "pending":
-        run_as = win_admin_run_as(db, host)
+        run_as = win_admin_run_as()
         if run_as:
             out["run_as"] = run_as
     return out

backend/app/services/agent_poll.py

@@ -27,5 +27,5 @@ def build_agent_poll_payload(db: Session, host: Host) -> dict[str, Any]:
         "config_revision": int(host.agent_config_revision or 0),
         "config": config_payload,
         "update": update_block,
-        "commands": [command_to_dict(c, include_run_as=True, db=db, host=host) for c in pending],
+        "commands": [command_to_dict(c, include_run_as=True) for c in pending],
     }

backend/app/services/agent_update.py

@@ -20,7 +20,7 @@ from app.services.agent_version import (
     host_version_outdated,
     latest_agent_versions_by_product,
 )
-from app.services.linux_admin_settings import get_effective_linux_admin_for_host
+from app.services.linux_admin_settings import get_effective_linux_admin_config
 from app.services.ssh_connect import (
     HostNotLinuxError,
     HostTargetMissingError,
@@ -28,7 +28,7 @@ from app.services.ssh_connect import (
     iter_ssh_targets,
     run_ssh_monitor_update,
 )
-from app.services.win_admin_settings import get_effective_win_admin_for_host
+from app.services.win_admin_settings import get_effective_win_admin_config
 from app.services.winrm_connect import (
     HostNotWindowsError,
     HostTargetMissingError as WinRmHostTargetMissingError,
@@ -249,7 +249,7 @@ def execute_agent_update_fallback(db: Session, host: Host) -> AgentUpdateFallbac
     product = (host.product or "").strip()
 
     if product == PRODUCT_SSH or is_linux_host(host):
-        linux_cfg = get_effective_linux_admin_for_host(db, host)
+        linux_cfg = get_effective_linux_admin_config(db)
         agent_cfg = get_effective_agent_update_config(db)
         repo_url = (agent_cfg.ssh_git_repo_url or "").strip() or None
         branch = (agent_cfg.git_branch or "main").strip() or "main"
@@ -260,7 +260,7 @@ def execute_agent_update_fallback(db: Session, host: Host) -> AgentUpdateFallbac
             git_branch=branch,
         )
     elif product == PRODUCT_RDP or is_windows_host(host):
-        win_cfg = get_effective_win_admin_for_host(db, host)
+        win_cfg = get_effective_win_admin_config(db)
         result = run_windows_agent_update_fallback(
             host,
             win_cfg,

backend/app/services/client_ip.py

@@ -1,27 +0,0 @@
-"""Resolve client IP behind reverse proxy (nginx $proxy_add_x_forwarded_for)."""
-
-from __future__ import annotations
-
-from fastapi import Request
-
-
-def client_ip_from_request(request: Request) -> str:
-    """Client IP for rate limiting.
-
-    nginx with ``proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for``
-    appends the real peer address as the *last* hop. Spoofed values in the
-    incoming header therefore cannot replace the actual client IP.
-    """
-    if request.client and request.client.host:
-        direct = request.client.host.strip()
-    else:
-        direct = "unknown"
-
-    forwarded = (request.headers.get("x-forwarded-for") or "").strip()
-    if not forwarded:
-        return direct[:64]
-
-    parts = [part.strip() for part in forwarded.split(",") if part.strip()]
-    if not parts:
-        return direct[:64]
-    return parts[-1][:64]

backend/app/services/event_actor_user.py

@@ -15,7 +15,6 @@ ACTOR_USER_EVENT_TYPES: frozenset[str] = frozenset(
         "session.logind.failed",
         "rdp.login.success",
         "rdp.login.failed",
-        "rdp.session.logoff",
         "rdp.shadow.control.started",
         "rdp.shadow.control.stopped",
         "rdp.shadow.control.permission",

backend/app/services/event_summary.py

@@ -6,7 +6,6 @@ from app.services.event_actor_user import extract_event_actor_user
 from app.services.host_sessions import event_session_terminated
 from app.services.rdg_display import build_rdg_display
 from app.services.rdg_session_flap import resolve_rdg_flap_summary
-from app.services.session_duration import extract_session_duration_sec
 
 
 def event_to_summary(event: Event, db: Session | None = None) -> EventSummary:
@@ -45,9 +44,6 @@ def event_to_summary(event: Event, db: Session | None = None) -> EventSummary:
         title=title,
         summary=summary,
         actor_user=extract_event_actor_user(event.type, event.details),
-        session_duration_sec=extract_session_duration_sec(
-            event.details if isinstance(event.details, dict) else None
-        ),
         rdg_flap=rdg_flap,
         rdg_flap_pair_event_id=rdg_flap_pair_event_id,
         rdg_flap_qwinsta_event_id=rdg_flap_qwinsta_event_id,

backend/app/services/host_mgmt_credentials.py

@@ -1,116 +0,0 @@
-"""Per-host management credentials (override global Win/Linux admin)."""
-
-from __future__ import annotations
-
-from dataclasses import dataclass
-
-from sqlalchemy.orm import Session
-
-from app.models.host import Host
-from app.services.linux_admin_settings import (
-    LinuxAdminConfig,
-    get_effective_linux_admin_for_host,
-)
-from app.services.win_admin_settings import (
-    WinAdminConfig,
-    get_effective_win_admin_for_host,
-    normalize_win_admin_user,
-)
-
-
-def mask_secret(value: str | None) -> str | None:
-    if not value:
-        return None
-    text = value.strip()
-    if not text:
-        return None
-    if len(text) <= 4:
-        return "****"
-    return f"{text[:2]}…{text[-2:]}"
-
-
-@dataclass(frozen=True)
-class HostMgmtAccessView:
-    host_id: int
-    has_override: bool
-    user: str | None
-    password_set: bool
-    password_hint: str | None
-    effective_source: str
-    effective_configured: bool
-    effective_user: str | None
-
-
-def _effective_for_host(db: Session, host: Host) -> WinAdminConfig | LinuxAdminConfig:
-    os_family = (host.os_family or "").strip().lower()
-    if os_family == "windows" or (host.product or "").strip().lower() in {"rdp-login-monitor", "rdp"}:
-        return get_effective_win_admin_for_host(db, host)
-    if os_family == "linux" or (host.product or "").strip().lower() in {"ssh-monitor", "ssh"}:
-        return get_effective_linux_admin_for_host(db, host)
-    # Fallback: try host override first via win helper (same columns), then global win, then linux.
-    win_cfg = get_effective_win_admin_for_host(db, host)
-    if win_cfg.configured:
-        return win_cfg
-    return get_effective_linux_admin_for_host(db, host)
-
-
-def get_host_mgmt_access_view(db: Session, host: Host) -> HostMgmtAccessView:
-    host_user = (host.mgmt_user or "").strip() or None
-    host_password = (host.mgmt_password or "").strip() or None
-    has_override = bool(host_user or host_password)
-    effective = _effective_for_host(db, host)
-    return HostMgmtAccessView(
-        host_id=host.id,
-        has_override=has_override,
-        user=host_user,
-        password_set=bool(host_password),
-        password_hint=mask_secret(host_password),
-        effective_source=effective.source,
-        effective_configured=effective.configured,
-        effective_user=effective.user or None,
-    )
-
-
-def upsert_host_mgmt_credentials(
-    db: Session,
-    host: Host,
-    *,
-    user: str | None = None,
-    password: str | None = None,
-    clear: bool = False,
-) -> HostMgmtAccessView:
-    """Update per-host credentials.
-
-    - clear=True → wipe host override (use global Settings).
-    - user="" → clear username.
-    - password omitted (None) → keep existing password.
-    - password="" → clear password.
-    """
-    if clear:
-        host.mgmt_user = None
-        host.mgmt_password = None
-        db.commit()
-        db.refresh(host)
-        return get_host_mgmt_access_view(db, host)
-
-    if user is not None:
-        cleaned = user.strip()
-        if not cleaned:
-            host.mgmt_user = None
-        else:
-            # Preserve DOMAIN\\user form for Windows; for Linux leave as-is after strip.
-            os_family = (host.os_family or "").strip().lower()
-            if os_family == "windows" or "\\" in cleaned or "@" in cleaned:
-                host.mgmt_user = normalize_win_admin_user(cleaned)
-            else:
-                host.mgmt_user = cleaned
-
-    if password is not None:
-        if not password.strip():
-            host.mgmt_password = None
-        else:
-            host.mgmt_password = password
-
-    db.commit()
-    db.refresh(host)
-    return get_host_mgmt_access_view(db, host)

backend/app/services/host_remote_actions.py

@@ -14,14 +14,9 @@ from app.database import SessionLocal
 from app.models import Host
 from app.services.agent_update import execute_agent_update_fallback
 from app.services.agent_update_types import AgentUpdateFallbackResult
-from app.services.linux_admin_settings import get_effective_linux_admin_for_host
+from app.services.linux_admin_settings import get_effective_linux_admin_config
 from app.services.agent_update_settings import get_effective_agent_update_config
-from app.services.ssh_connect import (
-    iter_ssh_targets,
-    run_ssh_monitor_update,
-    SshCommandResult,
-    tail_ssh_monitor_update_log,
-)
+from app.services.ssh_connect import iter_ssh_targets, run_ssh_monitor_update, SshCommandResult
 
 logger = logging.getLogger(__name__)
 
@@ -81,61 +76,6 @@ def _result_payload(
     }
 
 
-def _completion_title(base_title: str, result: SshCommandResult) -> str:
-    if result.ok:
-        return f"{base_title} — готово"
-    return f"{base_title} — ошибка"
-
-
-def _completion_message(result: SshCommandResult) -> str:
-    if result.ok:
-        version = (result.agent_version or "").strip()
-        if version:
-            return f"Обновление завершено успешно. Версия агента: {version}"
-        return "Обновление завершено успешно"
-    return (result.message or "Обновление не удалось").strip()
-
-
-def _fetch_ssh_update_log_tail(db: Session, host: Host, *, lines: int = 200) -> str:
-    cfg = get_effective_linux_admin_for_host(db, host)
-    if not cfg.configured:
-        return ""
-    try:
-        targets = iter_ssh_targets(host)
-    except Exception:
-        return ""
-    for target in targets:
-        try:
-            tail = tail_ssh_monitor_update_log(
-                target=target,
-                user=cfg.user,
-                password=cfg.password,
-                lines=lines,
-            )
-            if tail:
-                return tail
-        except Exception:
-            logger.debug("final update log tail failed host_id=%s target=%s", host.id, target, exc_info=True)
-    return ""
-
-
-def _enrich_ssh_update_payload(
-    payload: dict[str, Any],
-    *,
-    base_title: str,
-    result: SshCommandResult,
-    previous_output: str,
-    log_tail: str,
-) -> dict[str, Any]:
-    payload["title"] = _completion_title(base_title, result)
-    payload["message"] = _completion_message(result)
-    if log_tail:
-        payload["output"] = log_tail
-    elif previous_output.strip():
-        payload["output"] = previous_output
-    return payload
-
-
 def _mark_running(db: Session, host: Host, *, title: str) -> str:
     started_at = _utcnow().isoformat()
     host.agent_update_state = "running"
@@ -173,70 +113,12 @@ def _apply_ssh_update_result(db: Session, host: Host, result: SshCommandResult)
         host.agent_update_last_error = (result.message or "SSH update failed")[:2000]
 
 
-_REMOTE_LOG_POLL_SEC = 2.0
-
-
-def _poll_ssh_update_log_loop(
-    host_id: int,
-    *,
-    stop: threading.Event,
-) -> None:
-    """Периодически подтягивает tail update_script.log в hosts.remote_action для UI."""
-    while not stop.wait(_REMOTE_LOG_POLL_SEC):
-        session = SessionLocal()
-        try:
-            row = session.get(Host, host_id)
-            if row is None or (row.agent_update_state or "").strip().lower() != "running":
-                continue
-            payload = dict(row.remote_action or {})
-            if (payload.get("status") or "").strip().lower() != "running":
-                continue
-            cfg = get_effective_linux_admin_for_host(session, row)
-            if not cfg.configured:
-                continue
-            try:
-                targets = iter_ssh_targets(row)
-            except Exception:
-                continue
-            tail = ""
-            for target in targets:
-                try:
-                    tail = tail_ssh_monitor_update_log(
-                        target=target,
-                        user=cfg.user,
-                        password=cfg.password,
-                        lines=200,
-                    )
-                except Exception:
-                    logger.debug("update log tail failed host_id=%s target=%s", host_id, target, exc_info=True)
-                    continue
-                if tail:
-                    break
-            session.refresh(row)
-            if (row.agent_update_state or "").strip().lower() != "running":
-                continue
-            payload = dict(row.remote_action or {})
-            if (payload.get("status") or "").strip().lower() != "running":
-                continue
-            if tail:
-                payload["output"] = tail
-                payload["message"] = "Выполняется обновление… (лог с хоста)"
-            row.remote_action = payload
-            session.commit()
-        except Exception:
-            logger.debug("remote log poll failed host_id=%s", host_id, exc_info=True)
-            session.rollback()
-        finally:
-            session.close()
-
-
 def start_host_remote_action(
     db: Session,
     host: Host,
     *,
     title: str,
     runner: ActionRunner,
-    poll_remote_log: bool = False,
 ) -> dict[str, Any]:
     host_id = int(host.id)
     with _lock:
@@ -251,35 +133,13 @@ def start_host_remote_action(
 
     def _worker() -> None:
         session = SessionLocal()
-        stop_poll = threading.Event()
-        poll_thread: threading.Thread | None = None
-        if poll_remote_log and runner is run_ssh_monitor_update_action:
-            poll_thread = threading.Thread(
-                target=_poll_ssh_update_log_loop,
-                args=(host_id,),
-                kwargs={"stop": stop_poll},
-                name=f"sac-remote-log-{host_id}",
-                daemon=True,
-            )
-            poll_thread.start()
         try:
             row = session.get(Host, host_id)
             if row is None:
                 return
-            previous_output = (row.remote_action or {}).get("output") or ""
             result = runner(session, row)
             started = (row.remote_action or {}).get("started_at") or started_at
-            payload = _result_payload(result, title=title, started_at=started)
-            if poll_remote_log and isinstance(result, SshCommandResult):
-                log_tail = _fetch_ssh_update_log_tail(session, row)
-                payload = _enrich_ssh_update_payload(
-                    payload,
-                    base_title=title,
-                    result=result,
-                    previous_output=previous_output,
-                    log_tail=log_tail,
-                )
-            row.remote_action = payload
+            row.remote_action = _result_payload(result, title=title, started_at=started)
             if isinstance(result, SshCommandResult):
                 _apply_ssh_update_result(session, row, result)
             session.commit()
@@ -307,9 +167,6 @@ def start_host_remote_action(
                 }
                 session.commit()
         finally:
-            stop_poll.set()
-            if poll_thread is not None:
-                poll_thread.join(timeout=5.0)
             session.close()
             with _lock:
                 _running.discard(host_id)
@@ -322,7 +179,7 @@ def start_host_remote_action(
 
 
 def run_ssh_monitor_update_action(db: Session, host: Host) -> SshCommandResult:
-    cfg = get_effective_linux_admin_for_host(db, host)
+    cfg = get_effective_linux_admin_config(db)
     if not cfg.configured:
         return SshCommandResult(
             ok=False,
@@ -419,16 +276,8 @@ def get_remote_action_status(host: Host) -> dict[str, Any]:
     payload = dict(host.remote_action or {})
     if not payload:
         return {"active": False, "host_id": host.id}
-    agent_state = (host.agent_update_state or "").strip().lower()
-    if agent_state == "running":
-        active = True
-        status = payload.get("status") or "running"
-    elif agent_state in ("success", "failed"):
-        active = False
-        status = payload.get("status") or agent_state
-    else:
-        status = payload.get("status") or host.agent_update_state or "unknown"
-        active = status == "running"
+    status = payload.get("status") or host.agent_update_state or "unknown"
+    active = status == "running" or host.agent_update_state == "running"
     return {
         "active": active,
         "host_id": host.id,

backend/app/services/host_sessions.py

@@ -84,10 +84,6 @@ def _event_login_user(event: Event) -> str:
 
 
 def event_session_terminated(event: Event, db: Session | None = None) -> bool:
-    from app.services.rdp_session_logoff import (
-        event_closed_by_logoff,
-        resolve_workstation_login_closed_by_logoff,
-    )
     from app.services.rdg_workstation_session import (
         event_closed_by_rdg,
         resolve_workstation_login_closed,
@@ -101,11 +97,7 @@ def event_session_terminated(event: Event, db: Session | None = None) -> bool:
         return True
     if event_closed_by_rdg(event):
         return True
-    if event_closed_by_logoff(event):
-        return True
     if db is not None and event.type == "rdp.login.success":
-        if resolve_workstation_login_closed_by_logoff(db, event):
-            return True
         return resolve_workstation_login_closed(db, event)
     return False
 
@@ -384,79 +376,28 @@ def terminate_linux_session(
     return last
 
 
-def _normalize_sam_account(user: str) -> str:
-    text = (user or "").strip()
-    if "\\" in text:
-        return text.split("\\")[-1].strip().casefold()
-    if "@" in text:
-        return text.split("@")[0].strip().casefold()
-    return text.casefold()
-
-
-def windows_user_matches_session(login_user: str, session_user: str) -> bool:
-    login = _normalize_sam_account(login_user)
-    session = _normalize_sam_account(session_user)
-    return bool(login and session and login == session)
-
-
-def filter_windows_sessions_for_user(
-    sessions: list[HostSessionRow],
-    login_user: str,
-) -> list[HostSessionRow]:
-    user = (login_user or "").strip()
-    if not user:
-        return sessions
-    return [s for s in sessions if windows_user_matches_session(user, s.user)]
-
-
-def _qwinsta_sam_account(value: str) -> str:
-    text = (value or "").strip()
-    if "\\" in text:
-        text = text.split("\\")[-1]
-    if "@" in text:
-        text = text.split("@")[0]
-    return text.casefold()
-
-
 def parse_qwinsta_sessions(stdout: str, *, filter_user: str | None = None) -> list[HostSessionRow]:
-    """Parse ``qwinsta`` output.
-
-    Disconnected sessions often have an empty SESSIONNAME column, so the line
-    becomes ``USERNAME  ID  STATE`` (3 tokens). Older parsing required 4 tokens
-    and skipped those rows — that broke RDG flap auto-logoff for Disc sessions.
-    """
     rows: list[HostSessionRow] = []
-    filter_sam = _qwinsta_sam_account(filter_user or "")
-    skip_users = frozenset({"services"})
+    norm_filter = (filter_user or "").strip().lower()
+
+    def norm_user(value: str) -> str:
+        return value.replace("B26\\", "").replace("b26\\", "").lower()
 
     for line in stdout.splitlines():
         text = line.strip()
         if not text or re.match(r"^SESSION", text, re.I) or text.startswith("---"):
             continue
         parts = text.split()
-        id_idx: int | None = None
-        sid = 0
-        for i, part in enumerate(parts):
-            token = part.lstrip(">")
-            if token.isdigit():
-                id_idx = i
-                sid = int(token)
-                break
-        if id_idx is None or id_idx < 1:
+        if len(parts) < 4:
             continue
-        state = " ".join(parts[id_idx + 1 :]) if id_idx + 1 < len(parts) else ""
-        if not state or state.casefold().startswith("listen"):
+        session_name = parts[0].lstrip(">")
+        user_name = parts[1]
+        try:
+            sid = int(parts[2])
+        except ValueError:
             continue
-        before = parts[:id_idx]
-        if len(before) == 1:
-            session_name = ""
-            user_name = before[0].lstrip(">")
-        else:
-            session_name = before[0].lstrip(">")
-            user_name = before[1]
-        if user_name.casefold() in skip_users:
-            continue
-        if filter_sam and filter_sam not in _qwinsta_sam_account(user_name):
+        state = " ".join(parts[3:])
+        if norm_filter and norm_filter not in norm_user(user_name):
             continue
         rows.append(
             HostSessionRow(
@@ -467,7 +408,7 @@ def parse_qwinsta_sessions(stdout: str, *, filter_user: str | None = None) -> li
             )
         )
 
-    if rows or not filter_sam:
+    if rows or not norm_filter:
         return rows
 
     return parse_qwinsta_sessions(stdout, filter_user=None)
@@ -534,17 +475,11 @@ def terminate_session_for_event(
             sessions, qwinsta = list_windows_sessions(host, win_cfg)
             if not qwinsta or not qwinsta.ok:
                 raise ValueError(qwinsta.message if qwinsta else "qwinsta failed")
-            matched = filter_windows_sessions_for_user(sessions, user) if user else sessions
+            matched = [s for s in sessions if user.lower() in s.user.lower()] if user else sessions
             if len(matched) == 1:
                 sid = matched[0].session_id
             elif not matched:
-                # Пользователь уже вышел из RDP — qwinsta пуст, событие входа в SAC ещё «открыто».
-                return WinRmCmdResult(
-                    ok=True,
-                    message="На хосте нет активной сессии пользователя (уже вышел из RDP)",
-                    target=qwinsta.target,
-                    stdout=qwinsta.stdout,
-                )
+                raise ValueError("No matching Windows session for user")
             else:
                 raise ValueError("Multiple sessions; specify session_id")
         result = terminate_windows_session(host, win_cfg, sid)

backend/app/services/ingest.py

@@ -9,7 +9,6 @@ from app.services.agent_update import process_agent_update_ingest
 from app.services.daily_report_format import normalize_daily_report_details
 from app.services.event_severity_overrides import apply_severity_override
 from app.services.host_inventory import INVENTORY_EVENT_TYPE, process_inventory_ingest
-from app.services.rdp_session_logoff import close_workstation_session_for_rdp_logoff
 from app.services.rdg_workstation_session import close_workstation_session_for_rdg_end
 
 DAILY_REPORT_TYPES = frozenset({"report.daily.ssh", "report.daily.rdp"})
@@ -128,15 +127,5 @@ def ingest_event(db: Session, payload: dict) -> tuple[Event, bool]:
         raise
 
     process_agent_update_ingest(db, host, payload.get("type", ""), details)
-    from app.services.rdg_workstation_session import (
-        enrich_empty_login_from_rdg_success,
-        enrich_workstation_login_user_from_rdg,
-    )
-
-    if event.host is None:
-        event.host = host
-    enrich_workstation_login_user_from_rdg(db, event)
-    enrich_empty_login_from_rdg_success(db, event)
     close_workstation_session_for_rdg_end(db, event)
-    close_workstation_session_for_rdp_logoff(db, event)
     return event, True

backend/app/services/linux_admin_settings.py

@@ -1,4 +1,4 @@
-"""Effective Linux SSH admin credentials (host → DB → env)."""
+"""Effective Linux SSH admin credentials (DB overrides env)."""
 
 from __future__ import annotations
 
@@ -7,7 +7,6 @@ from dataclasses import dataclass
 from sqlalchemy.orm import Session
 
 from app.config import get_settings
-from app.models.host import Host
 from app.models.ui_settings import UI_SETTINGS_ROW_ID, UiSettings
 
 
@@ -15,7 +14,7 @@ from app.models.ui_settings import UI_SETTINGS_ROW_ID, UiSettings
 class LinuxAdminConfig:
     user: str
     password: str
-    source: str  # host | env | db
+    source: str  # env | db
 
     @property
     def configured(self) -> bool:
@@ -81,16 +80,3 @@ def upsert_linux_admin_settings(
     db.commit()
     db.refresh(row)
     return get_effective_linux_admin_config(db)
-
-
-def get_effective_linux_admin_for_host(db: Session, host: Host) -> LinuxAdminConfig:
-    """Prefer per-host mgmt_* when both user and password are set; else global Settings/env."""
-    host_user = (host.mgmt_user or "").strip()
-    host_password = (host.mgmt_password or "").strip()
-    if host_user and host_password:
-        return LinuxAdminConfig(user=host_user, password=host_password, source="host")
-
-    global_cfg = get_effective_linux_admin_config(db)
-    if host_user and global_cfg.password.strip():
-        return LinuxAdminConfig(user=host_user, password=global_cfg.password, source="host")
-    return global_cfg

backend/app/services/login_rate_limit.py

@@ -1,4 +1,4 @@
-"""Rate limit failed SAC UI logins + optional Telegram alert."""
+"""Rate limit failed SAC UI logins + optional Telegram alert."""
 
 from __future__ import annotations
 
@@ -12,7 +12,6 @@ from sqlalchemy.orm import Session
 
 from app.config import get_settings
 from app.models.login_attempt import LoginAttempt
-from app.services.client_ip import client_ip_from_request
 from app.services.login_security_settings import (
     get_effective_login_security_config,
     is_ip_login_whitelisted,
@@ -38,6 +37,15 @@ def get_login_rate_limit_config() -> LoginRateLimitConfig:
     )
 
 
+def client_ip_from_request(request: Request) -> str:
+    forwarded = (request.headers.get("x-forwarded-for") or "").strip()
+    if forwarded:
+        return forwarded.split(",")[0].strip()[:64]
+    if request.client and request.client.host:
+        return request.client.host[:64]
+    return "unknown"
+
+
 def _failure_count(db: Session, ip_address: str, *, since: datetime) -> int:
     return int(
         db.scalar(

backend/app/services/notify_dispatch.py

@@ -4,7 +4,7 @@ import logging
 
 from sqlalchemy.orm import Session
 
-from app.models import Event, Host, Problem
+from app.models import Event, Problem
 from app.services import email_notify, mobile_notify, telegram_notify, webhook_notify
 from app.services.notification_cooldown import should_notify_event, should_notify_problem
 from app.services.notification_policy import get_effective_notification_policy
@@ -15,14 +15,6 @@ from app.services.notification_severity import severity_meets_minimum
 logger = logging.getLogger(__name__)
 
 LIFECYCLE_EVENT_TYPE = "agent.lifecycle"
-PRIVILEGE_SUDO_TYPE = "privilege.sudo.command"
-SUDO_MAINTENANCE_MARKERS = (
-    "update_ssh_monitor.sh",
-    "update_via_sac",
-    "update_script.log",
-    "/opt/scripts/update",
-    "agent-update-in-progress",
-)
 DAILY_REPORT_EVENT_TYPES = frozenset({"report.daily.ssh", "report.daily.rdp"})
 AUTH_LOGIN_SUCCESS_TYPES = frozenset({"rdp.login.success", "ssh.login.success"})
 RDG_CONNECTION_TYPES = frozenset({
@@ -75,8 +67,6 @@ def notify_event(event: Event, *, db: Session | None = None) -> None:
     # Heartbeat — только для UI/статуса хоста, не для Telegram/email/push.
     if event.type == HEARTBEAT_TYPE:
         return
-    if _should_suppress_sudo_notify(event, db=db):
-        return
     if _skip_notifications_for_hidden_event(event, db):
         return
     policy = get_effective_notification_policy(db)
@@ -121,68 +111,8 @@ def notify_daily_report(event: Event, *, db: Session | None = None) -> None:
     _dispatch_lifecycle_channels(event, db=db, policy=policy)
 
 
-def _host_sac_update_running(event: Event, db: Session | None) -> bool:
-    """Пока SAC выполняет agent-update на хосте — не слать шумные TG."""
-    if db is None or not event.host_id:
-        return False
-    host = db.get(Host, event.host_id)
-    if host is None:
-        return False
-    if (host.agent_update_state or "").strip().lower() == "running":
-        logger.info(
-            "notify skipped (host update running) type=%s host_id=%s event_id=%s",
-            event.type,
-            host.id,
-            event.event_id,
-        )
-        return True
-    return False
-
-
-def _sudo_event_is_agent_maintenance(event: Event) -> bool:
-    details = event.details if isinstance(event.details, dict) else {}
-    cmd = str(details.get("command") or "").strip()
-    if not cmd:
-        cmd = str(event.summary or "").strip()
-    text = cmd.casefold()
-    return any(marker in text for marker in SUDO_MAINTENANCE_MARKERS)
-
-
-def _should_suppress_sudo_notify(event: Event, *, db: Session | None) -> bool:
-    if event.type != PRIVILEGE_SUDO_TYPE:
-        return False
-    if _host_sac_update_running(event, db):
-        return True
-    if _sudo_event_is_agent_maintenance(event):
-        logger.info(
-            "notify sudo skipped maintenance command event_id=%s host_id=%s",
-            event.event_id,
-            event.host_id,
-        )
-        return True
-    return False
-
-
-def _lifecycle_suppress_notifications(event: Event, *, db: Session | None = None) -> bool:
-    """Не слать TG при штатном SAC/cron update (lifecycle с trigger deploy_recycle)."""
-    if _host_sac_update_running(event, db):
-        return True
-    details = event.details if isinstance(event.details, dict) else {}
-    trigger = str(details.get("trigger") or "").strip().lower()
-    if trigger in ("deploy_recycle", "sac_update", "agent_update"):
-        logger.info(
-            "notify lifecycle skipped trigger=%s event_id=%s",
-            trigger,
-            event.event_id,
-        )
-        return True
-    return False
-
-
 def notify_lifecycle(event: Event, *, db: Session | None = None) -> None:
     """Старт/стоп/reload агента — всегда в каналы SAC (кроме TG, если telegram_via=agent)."""
-    if _lifecycle_suppress_notifications(event, db=db):
-        return
     if _skip_notifications_for_hidden_event(event, db):
         return
     policy = get_effective_notification_policy(db)
@@ -216,30 +146,16 @@ def notify_rdg_connection(event: Event, *, db: Session | None = None) -> None:
 
 def schedule_notify_daily_report(event_db_id: int) -> None:
     """Отложенное оповещение по суточному отчёту (после commit ingest, вне горячего POST)."""
-    _schedule_deferred_event_notify(event_db_id, notify_daily_report, label="daily report")
-
-
-def schedule_notify_lifecycle(event_db_id: int) -> None:
-    """Отложенное lifecycle-оповещение (после commit ingest)."""
-    _schedule_deferred_event_notify(event_db_id, notify_lifecycle, label="lifecycle")
-
-
-def schedule_notify_auth_login(event_db_id: int) -> None:
-    """Отложенное оповещение об успешном RDP/SSH входе (после commit ingest)."""
-    _schedule_deferred_event_notify(event_db_id, notify_auth_login, label="auth login")
-
-
-def _schedule_deferred_event_notify(event_db_id: int, handler, *, label: str) -> None:
     from app.database import SessionLocal
 
     db = SessionLocal()
     try:
         event = db.get(Event, event_db_id)
         if event is None:
-            logger.warning("deferred %s notify: event id=%s not found", label, event_db_id)
+            logger.warning("deferred daily report notify: event id=%s not found", event_db_id)
             return
-        handler(event, db=db)
+        notify_daily_report(event, db=db)
     except Exception:
-        logger.exception("deferred %s notify failed event_db_id=%s", label, event_db_id)
+        logger.exception("deferred daily report notify failed event_db_id=%s", event_db_id)
     finally:
         db.close()

backend/app/services/rdg_winrm_actions.py

@@ -12,7 +12,7 @@ from app.models import AgentCommand, Event, Host
 from app.services.rdg_client_host import ClientWorkstationNotFoundError, resolve_client_workstation
 from app.services.rdg_display import event_supports_rdg_client_qwinsta
 from app.services.rdg_session_flap import event_internal_ip
-from app.services.win_admin_settings import get_effective_win_admin_for_host
+from app.services.win_admin_settings import get_effective_win_admin_config
 from app.services.winrm_connect import (
     WinRmCmdResult,
     run_winrm_logoff,
@@ -21,17 +21,12 @@ from app.services.winrm_connect import (
 )
 
 
-def _require_win_admin(db: Session, host: Host | None = None):
-    if host is not None:
-        cfg = get_effective_win_admin_for_host(db, host)
-    else:
-        from app.services.win_admin_settings import get_effective_win_admin_config
-
-        cfg = get_effective_win_admin_config(db)
+def _require_win_admin(db: Session):
+    cfg = get_effective_win_admin_config(db)
     if not cfg.configured:
         raise HTTPException(
             status_code=503,
-            detail="Windows admin is not configured (host override or Settings → Windows)",
+            detail="Windows domain admin is not configured (Settings or SAC_WIN_ADMIN_*)",
         )
     return cfg
 
@@ -98,8 +93,8 @@ def _persist_command(
 
 def execute_qwinsta_via_winrm(db: Session, event: Event, *, requested_by: str) -> AgentCommand:
     _require_rdg_client_qwinsta(db, event)
+    cfg = _require_win_admin(db)
     client_host = _resolve_client(db, event)
-    cfg = _require_win_admin(db, client_host)
 
     details = event.details if isinstance(event.details, dict) else {}
     user = details.get("user")
@@ -141,8 +136,8 @@ def execute_logoff_via_winrm(
     requested_by: str,
 ) -> AgentCommand:
     _require_rdg_client_qwinsta(db, event)
+    cfg = _require_win_admin(db)
     client_host = _resolve_client(db, event)
-    cfg = _require_win_admin(db, client_host)
 
     details = event.details if isinstance(event.details, dict) else {}
     user = details.get("user")

backend/app/services/rdg_workstation_session.py

@@ -2,8 +2,6 @@
 
 from __future__ import annotations
 
-from datetime import timedelta, timezone
-
 from sqlalchemy import select
 from sqlalchemy.orm import Session
 from sqlalchemy.orm.attributes import flag_modified
@@ -17,7 +15,6 @@ from app.services.host_sessions import (
 from app.services.rdg_client_host import find_windows_host_by_ipv4
 from app.services.rdg_session_flap import (
     RDG_END_TYPES,
-    RDG_SUCCESS_TYPE,
     _event_user,
     event_internal_ip,
     find_rdg_success_before_end,
@@ -25,22 +22,10 @@ from app.services.rdg_session_flap import (
 
 SESSION_CLOSED_BY_RDG_AT_KEY = "session_closed_by_rdg_at"
 SESSION_CLOSED_BY_RDG_EVENT_ID_KEY = "session_closed_by_rdg_event_id"
-USER_ENRICHED_FROM_RDG_EVENT_ID_KEY = "user_enriched_from_rdg_event_id"
-
-# RCM 1149 via RD Gateway often has empty Param1/Param2; RDG 302 has the account.
-RDG_LOGIN_USER_ENRICH_WINDOW = timedelta(minutes=5)
 
 WORKSTATION_LOGIN_TYPE = "rdp.login.success"
 
 
-def _as_utc(dt):
-    if dt is None:
-        return None
-    if dt.tzinfo is None:
-        return dt.replace(tzinfo=timezone.utc)
-    return dt.astimezone(timezone.utc)
-
-
 def normalize_sam_account(user: str) -> str:
     text = (user or "").strip()
     if "\\" in text:
@@ -56,115 +41,6 @@ def users_match_rdg(login_user: str, rdg_user: str) -> bool:
     return bool(left and right and left == right)
 
 
-def _login_user_missing(event: Event) -> bool:
-    details = _details_dict(event)
-    for key in ("user", "username"):
-        val = details.get(key)
-        if val is not None and str(val).strip() not in ("", "-"):
-            return False
-    return True
-
-
-def _apply_rdg_user_to_login(login_event: Event, *, rdg_event: Event, rdg_user: str) -> None:
-    details = dict(_details_dict(login_event))
-    details["user"] = rdg_user
-    details[USER_ENRICHED_FROM_RDG_EVENT_ID_KEY] = rdg_event.id
-    login_event.details = details
-    flag_modified(login_event, "details")
-    summary = (login_event.summary or "").strip()
-    if summary.startswith("RCM 1149") and rdg_user not in summary:
-        rest = summary[len("RCM 1149") :].strip()
-        login_event.summary = f"RCM 1149 {rdg_user} {rest}".strip()
-
-
-def find_rdg_success_for_workstation_login(db: Session, login_event: Event) -> Event | None:
-    """Nearest RDG 302 for this workstation IP within the enrich window."""
-    if login_event.type != WORKSTATION_LOGIN_TYPE:
-        return None
-    host = login_event.host
-    if host is None or not (host.ipv4 or "").strip():
-        return None
-    workstation_ip = host.ipv4.strip()
-    login_at = _as_utc(login_event.occurred_at)
-    window_start = login_at - RDG_LOGIN_USER_ENRICH_WINDOW
-    window_end = login_at + RDG_LOGIN_USER_ENRICH_WINDOW
-
-    candidates = db.scalars(
-        select(Event)
-        .where(
-            Event.type == RDG_SUCCESS_TYPE,
-            Event.occurred_at >= window_start,
-            Event.occurred_at <= window_end,
-            Event.id != login_event.id,
-        )
-        .order_by(Event.occurred_at.desc())
-    ).all()
-
-    best: Event | None = None
-    best_delta: timedelta | None = None
-    for rdg in candidates:
-        if event_internal_ip(rdg) != workstation_ip:
-            continue
-        if not _event_user(rdg):
-            continue
-        delta = abs(_as_utc(rdg.occurred_at) - login_at)
-        if best is None or best_delta is None or delta < best_delta:
-            best = rdg
-            best_delta = delta
-    return best
-
-
-def enrich_workstation_login_user_from_rdg(db: Session, login_event: Event) -> Event | None:
-    """Fill details.user when RCM 1149 EventLog left Param1/Param2 empty (seen on some Win10 Pro)."""
-    if login_event.type != WORKSTATION_LOGIN_TYPE:
-        return None
-    if not _login_user_missing(login_event):
-        return None
-    rdg = find_rdg_success_for_workstation_login(db, login_event)
-    if rdg is None:
-        return None
-    rdg_user = _event_user(rdg)
-    if not rdg_user:
-        return None
-    _apply_rdg_user_to_login(login_event, rdg_event=rdg, rdg_user=rdg_user)
-    return login_event
-
-
-def enrich_empty_login_from_rdg_success(db: Session, rdg_success_event: Event) -> Event | None:
-    """Backfill empty workstation 1149 when RDG 302 is ingested after it."""
-    if rdg_success_event.type != RDG_SUCCESS_TYPE:
-        return None
-    internal_ip = event_internal_ip(rdg_success_event)
-    rdg_user = _event_user(rdg_success_event)
-    if not internal_ip or not rdg_user:
-        return None
-    client_host = find_windows_host_by_ipv4(db, internal_ip)
-    if client_host is None:
-        return None
-
-    rdg_at = _as_utc(rdg_success_event.occurred_at)
-    window_start = rdg_at - RDG_LOGIN_USER_ENRICH_WINDOW
-    window_end = rdg_at + RDG_LOGIN_USER_ENRICH_WINDOW
-    candidates = db.scalars(
-        select(Event)
-        .where(
-            Event.host_id == client_host.id,
-            Event.type == WORKSTATION_LOGIN_TYPE,
-            Event.occurred_at >= window_start,
-            Event.occurred_at <= window_end,
-            Event.id != rdg_success_event.id,
-        )
-        .order_by(Event.occurred_at.desc())
-    ).all()
-
-    for login in candidates:
-        if not _login_user_missing(login):
-            continue
-        _apply_rdg_user_to_login(login, rdg_event=rdg_success_event, rdg_user=rdg_user)
-        return login
-    return None
-
-
 def event_closed_by_rdg(event: Event) -> bool:
     details = _details_dict(event)
     at = details.get(SESSION_CLOSED_BY_RDG_AT_KEY)
@@ -180,17 +56,13 @@ def mark_login_closed_by_rdg(login_event: Event, *, rdg_end_event: Event) -> Non
 
 
 def _login_already_closed(login_event: Event) -> bool:
-    from app.services.rdp_session_logoff import event_closed_by_logoff
-
     details = _details_dict(login_event)
     if details.get("session_terminated") is True:
         return True
     at = details.get(SESSION_TERMINATED_AT_KEY)
     if at is not None and str(at).strip() != "":
         return True
-    if event_closed_by_rdg(login_event):
-        return True
-    return event_closed_by_logoff(login_event)
+    return event_closed_by_rdg(login_event)
 
 
 def find_workstation_login_for_rdg_end(db: Session, rdg_end_event: Event) -> Event | None:
@@ -222,11 +94,8 @@ def find_workstation_login_for_rdg_end(db: Session, rdg_end_event: Event) -> Eve
     for login in candidates:
         if _login_already_closed(login):
             continue
-        login_user = (_event_login_user(login) or "").strip()
-        if login_user in ("", "-"):
-            login_user = ""
-        # RCM 1149 may lack user (empty Param1); still close by workstation IP + open session.
-        if login_user and not users_match_rdg(login_user, rdg_user):
+        login_user = _event_login_user(login)
+        if not users_match_rdg(login_user, rdg_user):
             continue
         return login
     return None

backend/app/services/rdp_flap_auto_disconnect.py

@@ -35,7 +35,7 @@ from app.services.rdg_workstation_session import (
     users_match_rdg,
 )
 from app.services.rdp_flap_settings import get_effective_rdp_flap_settings
-from app.services.win_admin_settings import get_effective_win_admin_for_host
+from app.services.win_admin_settings import get_effective_win_admin_config
 
 logger = logging.getLogger("sac.rdp_flap_auto_disconnect")
 
@@ -143,7 +143,7 @@ def _disconnect_on_workstation(
     user: str,
     login_event: Event | None,
 ) -> AutoDisconnectResult:
-    win_cfg = get_effective_win_admin_for_host(db, workstation)
+    win_cfg = get_effective_win_admin_config(db)
     sessions, qwinsta = list_windows_sessions(workstation, win_cfg)
     if qwinsta is None or not qwinsta.ok:
         message = qwinsta.message if qwinsta else "qwinsta failed"
@@ -155,23 +155,13 @@ def _disconnect_on_workstation(
             login_event_id=login_event.id if login_event else None,
         )
 
-    parsed = parse_qwinsta_sessions(qwinsta.stdout, filter_user=user)
-    matched = _sessions_for_user(parsed, user)
+    matched = _sessions_for_user(parse_qwinsta_sessions(qwinsta.stdout, filter_user=user), user)
     if not matched and qwinsta.stdout.strip():
-        parsed = parse_qwinsta_sessions(qwinsta.stdout)
-        matched = _sessions_for_user(parsed, user)
+        matched = _sessions_for_user(parse_qwinsta_sessions(qwinsta.stdout), user)
     if not matched:
-        snippet = " ".join(qwinsta.stdout.split())[:240]
-        parsed_note = f", parsed={len(parsed)} session(s)" if parsed else ""
-        message = (
-            f"No matching Windows session for user {user} on {workstation.hostname}"
-            f"{parsed_note}"
-        )
-        if snippet:
-            message = f"{message}; qwinsta: {snippet}"
         return AutoDisconnectResult(
             ok=False,
-            message=message,
+            message="No matching Windows session for user",
             trigger_event_id=trigger_event.id,
             workstation_host_id=workstation.id,
             login_event_id=login_event.id if login_event else None,
@@ -234,13 +224,11 @@ def _auto_disconnect_rdg_flap(db: Session, event: Event) -> AutoDisconnectResult
     try:
         workstation = resolve_client_workstation(db, rdg_success)
     except ClientWorkstationNotFoundError as exc:
-        result = AutoDisconnectResult(
+        return AutoDisconnectResult(
             ok=False,
             message=str(exc),
             trigger_event_id=event.id,
         )
-        _mark_auto_disconnect(event, result=result)
-        return result
 
     rdg_end = event if event.type in RDG_END_TYPES else db.get(Event, _stored_flap_pair_id(event) or -1)
     login_event = find_workstation_login_for_rdg_end(db, rdg_end) if rdg_end is not None else None
@@ -291,6 +279,14 @@ def maybe_auto_disconnect_stuck_rdp_session(db: Session, event: Event) -> AutoDi
     if not get_effective_rdp_flap_settings(db).auto_disconnect:
         return None
 
+    win_cfg = get_effective_win_admin_config(db)
+    if not win_cfg.configured:
+        logger.warning(
+            "auto rdp flap disconnect skipped: win admin not configured (event_id=%s)",
+            event.event_id,
+        )
+        return None
+
     result = _auto_disconnect_rdg_flap(db, event)
     if result is not None:
         if result.ok:

backend/app/services/rdp_session_logoff.py

@@ -1,148 +0,0 @@
-"""Correlate direct RDP logoff (Security 4634/4647) with workstation rdp.login.success."""
-
-from __future__ import annotations
-
-from sqlalchemy import select
-from sqlalchemy.orm import Session
-from sqlalchemy.orm.attributes import flag_modified
-
-from app.models import Event
-from app.services.host_sessions import (
-    SESSION_TERMINATED_AT_KEY,
-    _details_dict,
-    _event_login_user,
-)
-from app.services.rdg_workstation_session import (
-    WORKSTATION_LOGIN_TYPE,
-    event_closed_by_rdg,
-    users_match_rdg,
-)
-
-SESSION_CLOSED_BY_LOGOFF_AT_KEY = "session_closed_by_logoff_at"
-SESSION_CLOSED_BY_LOGOFF_EVENT_ID_KEY = "session_closed_by_logoff_event_id"
-
-LOGOFF_EVENT_TYPE = "rdp.session.logoff"
-LOGOFF_EVENT_TYPES = frozenset({LOGOFF_EVENT_TYPE})
-
-
-def event_closed_by_logoff(event: Event) -> bool:
-    details = _details_dict(event)
-    at = details.get(SESSION_CLOSED_BY_LOGOFF_AT_KEY)
-    return at is not None and str(at).strip() != ""
-
-
-def mark_login_closed_by_logoff(login_event: Event, *, logoff_event: Event) -> None:
-    details = dict(_details_dict(login_event))
-    details[SESSION_CLOSED_BY_LOGOFF_AT_KEY] = logoff_event.occurred_at.isoformat()
-    details[SESSION_CLOSED_BY_LOGOFF_EVENT_ID_KEY] = logoff_event.id
-    login_event.details = details
-    flag_modified(login_event, "details")
-
-
-def _login_already_closed(login_event: Event) -> bool:
-    details = _details_dict(login_event)
-    if details.get("session_terminated") is True:
-        return True
-    at = details.get(SESSION_TERMINATED_AT_KEY)
-    if at is not None and str(at).strip() != "":
-        return True
-    if event_closed_by_rdg(login_event):
-        return True
-    return event_closed_by_logoff(login_event)
-
-
-def find_workstation_login_for_logoff(db: Session, logoff_event: Event) -> Event | None:
-    if logoff_event.type not in LOGOFF_EVENT_TYPES:
-        return None
-
-    logoff_user = _event_login_user(logoff_event)
-    if not logoff_user:
-        return None
-    logoff_at = logoff_event.occurred_at
-    host_id = logoff_event.host_id
-    if host_id is None:
-        return None
-
-    candidates = db.scalars(
-        select(Event)
-        .where(
-            Event.host_id == host_id,
-            Event.type == WORKSTATION_LOGIN_TYPE,
-            Event.occurred_at <= logoff_at,
-            Event.id != logoff_event.id,
-        )
-        .order_by(Event.occurred_at.desc())
-    ).all()
-
-    logoff_details = _details_dict(logoff_event)
-    logoff_ip = str(logoff_details.get("ip_address") or "").strip()
-
-    for login in candidates:
-        if _login_already_closed(login):
-            continue
-        login_user = _event_login_user(login)
-        if not users_match_rdg(login_user, logoff_user):
-            continue
-        if logoff_ip and logoff_ip not in ("", "-"):
-            login_ip = str(_details_dict(login).get("ip_address") or "").strip()
-            if login_ip and login_ip not in ("", "-") and login_ip != logoff_ip:
-                continue
-        return login
-    return None
-
-
-def find_logoff_after_workstation_login(db: Session, login_event: Event) -> Event | None:
-    """Runtime lookup for historical logins without persisted close flag."""
-    if login_event.type != WORKSTATION_LOGIN_TYPE:
-        return None
-    if _login_already_closed(login_event):
-        return None
-
-    host_id = login_event.host_id
-    if host_id is None:
-        return None
-
-    login_user = _event_login_user(login_event)
-    if not login_user:
-        return None
-    login_at = login_event.occurred_at
-    login_ip = str(_details_dict(login_event).get("ip_address") or "").strip()
-
-    candidates = db.scalars(
-        select(Event)
-        .where(
-            Event.host_id == host_id,
-            Event.type == LOGOFF_EVENT_TYPE,
-            Event.occurred_at >= login_at,
-            Event.id != login_event.id,
-        )
-        .order_by(Event.occurred_at.asc())
-    ).all()
-
-    for logoff in candidates:
-        if not users_match_rdg(_event_login_user(logoff), login_user):
-            continue
-        logoff_ip = str(_details_dict(logoff).get("ip_address") or "").strip()
-        if login_ip and login_ip not in ("", "-") and logoff_ip and logoff_ip not in ("", "-"):
-            if login_ip != logoff_ip:
-                continue
-        return logoff
-    return None
-
-
-def resolve_workstation_login_closed_by_logoff(db: Session, login_event: Event) -> bool:
-    if event_closed_by_logoff(login_event):
-        return True
-    return find_logoff_after_workstation_login(db, login_event) is not None
-
-
-def close_workstation_session_for_rdp_logoff(db: Session, logoff_event: Event) -> Event | None:
-    """On direct RDP logoff, mark matching open workstation login as session-closed."""
-    if logoff_event.type not in LOGOFF_EVENT_TYPES:
-        return None
-
-    login = find_workstation_login_for_logoff(db, logoff_event)
-    if login is None:
-        return None
-    mark_login_closed_by_logoff(login, logoff_event=logoff_event)
-    return login

backend/app/services/session_duration.py

@@ -1,37 +0,0 @@
-"""Format and extract RDP/RDG session_duration_sec for UI."""
-
-from __future__ import annotations
-
-from typing import Any
-
-
-def extract_session_duration_sec(details: dict[str, Any] | None) -> int | None:
-    if not isinstance(details, dict):
-        return None
-    raw = details.get("session_duration_sec")
-    if raw is None or raw == "":
-        return None
-    try:
-        value = int(raw)
-    except (TypeError, ValueError):
-        return None
-    if value < 0:
-        return None
-    return value
-
-
-def format_session_duration(seconds: int) -> str:
-    """
-    Human-readable session length for lists:
-    - under 24h → HH:MM:SS (05:05:24)
-    - 24h+ → Nд HH:MM:SS (1д 00:01:25)
-    """
-    if seconds < 0:
-        return "—"
-    days, rem = divmod(int(seconds), 86_400)
-    hours, rem = divmod(rem, 3600)
-    minutes, secs = divmod(rem, 60)
-    clock = f"{hours:02d}:{minutes:02d}:{secs:02d}"
-    if days:
-        return f"{days}д {clock}"
-    return clock

backend/app/services/ssh_connect.py

@@ -6,15 +6,12 @@ import re
 import socket
 from dataclasses import dataclass
 
-from app.config import get_settings
 from app.models import Host
 
-SSH_MONITOR_UPDATE_STATE_FILE = "/var/lib/ssh-monitor/agent-update-in-progress"
-SSH_MONITOR_UPDATE_LOG_PATH = "/var/log/update_script.log"
 SSH_MONITOR_UPDATE_SCRIPT = "/opt/scripts/update_ssh_monitor.sh"
 SSH_MONITOR_UPDATE_DIR = "/opt/scripts/update"
 SSH_MONITOR_REPO_NAME = "ssh-monitor"
-SSH_MONITOR_UPDATE_REPO_URL = "https://git.papatramp.ru/PapaTramp/ssh-monitor.git"
+SSH_MONITOR_UPDATE_REPO_URL = "https://git.kalinamall.ru/PapaTramp/ssh-monitor.git"
 SSH_MONITOR_BINARY = "/usr/local/bin/ssh-monitor"
 SSH_MONITOR_VERSION_CMD = (
     f"grep -m1 '^SSH_MONITOR_VERSION=' {SSH_MONITOR_BINARY} 2>/dev/null "
@@ -190,55 +187,20 @@ def _shell_single_quote(value: str) -> str:
 def _remote_shell_command(
     user: str,
     remote_cmd: str,
+    password: str,
     *,
     need_root: bool = False,
     login_shell: bool = True,
-) -> tuple[str, bool]:
-    """Build remote shell command. Returns (command, needs_sudo_password_on_stdin)."""
+) -> str:
+    """Build remote shell command. Sudo only when need_root and user is not root."""
     safe_cmd = _shell_single_quote(remote_cmd)
     bash_flag = "lc" if login_shell else "c"
     if user == "root" or not need_root:
-        return f"bash -{bash_flag} {safe_cmd}", False
-    return f"sudo -S -p '' bash -{bash_flag} {safe_cmd}", True
+        return f"bash -{bash_flag} {safe_cmd}"
 
-
-def _configure_ssh_client(client, target: str) -> None:
-    import paramiko
-
-    settings = get_settings()
-    if settings.sac_ssh_auto_add_host_key:
-        client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
-        return
-
-    client.set_missing_host_key_policy(paramiko.RejectPolicy())
-    client.load_system_host_keys()
-    known_hosts = (settings.sac_ssh_known_hosts_file or "").strip()
-    if known_hosts:
-        try:
-            client.load_host_keys(known_hosts)
-        except OSError:
-            pass
-
-
-def _exec_remote_command(
-    client,
-    *,
-    shell_cmd: str,
-    password: str,
-    needs_sudo_password: bool,
-    command_timeout_sec: int,
-) -> tuple[int, str, str]:
-    if needs_sudo_password:
-        stdin, stdout, stderr = client.exec_command(shell_cmd, timeout=command_timeout_sec, get_pty=True)
-        stdin.write(f"{password}\n")
-        stdin.flush()
-        stdin.channel.shutdown_write()
-    else:
-        _stdin, stdout, stderr = client.exec_command(shell_cmd, timeout=command_timeout_sec)
-    exit_code = stdout.channel.recv_exit_status()
-    out_text = _truncate_output(stdout.read().decode("utf-8", errors="replace"))
-    err_text = _truncate_output(stderr.read().decode("utf-8", errors="replace"))
-    return exit_code, out_text, err_text
+    safe_pw = _shell_single_quote(password)
+    inner = f"printf '%s\\n' {safe_pw} | sudo -S -p '' bash -{bash_flag} {safe_cmd}"
+    return f"bash -{bash_flag} {_shell_single_quote(inner)}"
 
 
 def run_ssh_command(
@@ -262,9 +224,10 @@ def run_ssh_command(
     except ImportError as exc:
         raise RuntimeError("paramiko is not installed on SAC server") from exc
 
-    shell_cmd, needs_sudo_password = _remote_shell_command(
+    shell_cmd = _remote_shell_command(
         user,
         remote_cmd,
+        password,
         need_root=need_root,
         login_shell=login_shell,
     )
@@ -274,8 +237,8 @@ def run_ssh_command(
 
     for attempt in range(1, _SSH_CONNECT_ATTEMPTS + 1):
         client = paramiko.SSHClient()
+        client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
         try:
-            _configure_ssh_client(client, target)
             _connect_ssh_client(
                 client,
                 target=target,
@@ -283,13 +246,10 @@ def run_ssh_command(
                 password=password,
                 connect_timeout_sec=connect_timeout_sec,
             )
-            exit_code, out_text, err_text = _exec_remote_command(
-                client,
-                shell_cmd=shell_cmd,
-                password=password,
-                needs_sudo_password=needs_sudo_password,
-                command_timeout_sec=command_timeout_sec,
-            )
+            _stdin, stdout, stderr = client.exec_command(shell_cmd, timeout=command_timeout_sec)
+            exit_code = stdout.channel.recv_exit_status()
+            out_text = _truncate_output(stdout.read().decode("utf-8", errors="replace"))
+            err_text = _truncate_output(stderr.read().decode("utf-8", errors="replace"))
             break
         except paramiko.AuthenticationException:
             return SshCommandResult(
@@ -435,7 +395,7 @@ def _ssh_monitor_update_invoke_command(
     safe_repo = _shell_single_quote(repo_url.strip())
     safe_branch = _shell_single_quote((git_branch or "main").strip() or "main")
     preflight = _ssh_monitor_preflight_git_remote(repo_url)
-    return f"{preflight}; UPDATE_VIA_SAC=1 REPO_URL={safe_repo} GIT_BRANCH={safe_branch} {SSH_MONITOR_UPDATE_SCRIPT}"
+    return f"{preflight}; REPO_URL={safe_repo} GIT_BRANCH={safe_branch} {SSH_MONITOR_UPDATE_SCRIPT}"
 
 
 def _ssh_monitor_bootstrap_command(repo_url: str, *, git_branch: str = "main") -> str:
@@ -451,16 +411,7 @@ def _ssh_monitor_bootstrap_command(repo_url: str, *, git_branch: str = "main") -
         f'mkdir -p "$UPDATE_DIR" && cd "$UPDATE_DIR" && '
         f'([ -d "$SCRIPT_NAME" ] || git clone -b "$GIT_BRANCH" "$REPO_URL" "$SCRIPT_NAME") && '
         f'cp "$UPDATE_DIR/$SCRIPT_NAME/update_ssh_monitor.sh" "$INSTALL" && '
-        f'chmod 750 "$INSTALL" && UPDATE_VIA_SAC=1 REPO_URL="$REPO_URL" GIT_BRANCH="$GIT_BRANCH" "$INSTALL" --deploy'
-    )
-
-
-def _ssh_monitor_mark_update_begin_prefix() -> str:
-    """State-file до updater: lifecycle/sudo на агенте глушатся раньше bootstrap."""
-    return (
-        f"mkdir -p /var/lib/ssh-monitor && "
-        f"date +%s > {SSH_MONITOR_UPDATE_STATE_FILE} && "
-        f"chmod 600 {SSH_MONITOR_UPDATE_STATE_FILE} 2>/dev/null; "
+        f'chmod 750 "$INSTALL" && REPO_URL="$REPO_URL" GIT_BRANCH="$GIT_BRANCH" "$INSTALL"'
     )
 
 
@@ -508,7 +459,7 @@ def run_ssh_monitor_update(
             target=target,
             user=user,
             password=password,
-            remote_cmd=_ssh_monitor_mark_update_begin_prefix() + bootstrap_cmd,
+            remote_cmd=bootstrap_cmd,
             command_timeout_sec=900,
             need_root=True,
             login_shell=False,
@@ -519,7 +470,7 @@ def run_ssh_monitor_update(
             target=target,
             user=user,
             password=password,
-            remote_cmd=_ssh_monitor_mark_update_begin_prefix() + update_cmd,
+            remote_cmd=update_cmd,
             command_timeout_sec=900,
             need_root=True,
             login_shell=False,
@@ -560,29 +511,3 @@ def run_ssh_monitor_update(
             exit_code=updated.exit_code,
         )
     return updated
-
-
-def tail_ssh_monitor_update_log(
-    *,
-    target: str,
-    user: str,
-    password: str,
-    lines: int = 120,
-) -> str:
-    """Хвост /var/log/update_script.log на удалённом хосте (для live-лога в SAC UI)."""
-    safe_lines = max(20, min(int(lines), 400))
-    remote_cmd = (
-        f"test -r {SSH_MONITOR_UPDATE_LOG_PATH} && "
-        f"tail -n {safe_lines} {SSH_MONITOR_UPDATE_LOG_PATH} 2>/dev/null || true"
-    )
-    result = run_ssh_command(
-        target=target,
-        user=user,
-        password=password,
-        remote_cmd=remote_cmd,
-        command_timeout_sec=25,
-        need_root=True,
-        login_shell=False,
-    )
-    text = (result.stdout or "").strip()
-    return _truncate_output(text)

backend/app/services/telegram_templates.py

@@ -564,11 +564,9 @@ def _format_rdg_html(event: Event) -> str:
     err = _detail(details, "gateway_error_code", "error_code", default="")
     if err != "-":
         msg += _line("⚠️", "Код ошибки", html_escape(err))
-    from app.services.session_duration import extract_session_duration_sec, format_session_duration
-
-    dur_sec = extract_session_duration_sec(details if isinstance(details, dict) else None)
-    if dur_sec is not None and dur_sec > 0:
-        msg += _line("⏱️", "Длительность", html_escape(format_session_duration(dur_sec)))
+    dur = _detail(details, "session_duration_sec", default="")
+    if dur not in ("-", "0", ""):
+        msg += _line("⏱️", "Длительность", f"{html_escape(dur)} с")
     msg += _line("🕐", "Время", format_time(event.occurred_at))
     win_id = _detail(details, "event_id_windows", default="")
     if win_id != "-":

backend/app/services/win_admin_settings.py

@@ -1,4 +1,4 @@
-"""Effective Windows domain admin credentials (host → DB → env)."""
+"""Effective Windows domain admin credentials (DB overrides env)."""
 
 from __future__ import annotations
 
@@ -7,7 +7,6 @@ from dataclasses import dataclass
 from sqlalchemy.orm import Session
 
 from app.config import get_settings
-from app.models.host import Host
 from app.models.ui_settings import UI_SETTINGS_ROW_ID, UiSettings
 
 
@@ -15,7 +14,7 @@ from app.models.ui_settings import UI_SETTINGS_ROW_ID, UiSettings
 class WinAdminConfig:
     user: str
     password: str
-    source: str  # host | env | db
+    source: str  # env | db
 
     @property
     def configured(self) -> bool:
@@ -93,17 +92,3 @@ def upsert_win_admin_settings(
     db.commit()
     db.refresh(row)
     return get_effective_win_admin_config(db)
-
-
-def get_effective_win_admin_for_host(db: Session, host: Host) -> WinAdminConfig:
-    """Prefer per-host mgmt_* when both user and password are set; else global Settings/env."""
-    host_user = normalize_win_admin_user((host.mgmt_user or "").strip())
-    host_password = (host.mgmt_password or "").strip()
-    if host_user and host_password:
-        return WinAdminConfig(user=host_user, password=host_password, source="host")
-
-    global_cfg = get_effective_win_admin_config(db)
-    # Allow host to override only the username, still using global password (rare).
-    if host_user and global_cfg.password.strip():
-        return WinAdminConfig(user=host_user, password=global_cfg.password, source="host")
-    return global_cfg

backend/app/services/winrm_connect.py

@@ -92,20 +92,13 @@ def _winrm_session(
 
     operation_timeout_sec = max(5, timeout_sec)
     read_timeout_sec = operation_timeout_sec + 15
-    settings = get_settings()
-    scheme = "https" if settings.sac_winrm_use_https else "http"
-    port = 5986 if settings.sac_winrm_use_https else 5985
-    endpoint = f"{scheme}://{target}:{port}/wsman"
-    cert_validation = (settings.sac_winrm_server_cert_validation or "validate").strip().lower()
-    if cert_validation not in {"validate", "ignore"}:
-        cert_validation = "validate"
+    endpoint = f"http://{target}:5985/wsman"
     session = winrm.Session(
         endpoint,
         auth=(user, password),
         transport="ntlm",
         read_timeout_sec=read_timeout_sec,
         operation_timeout_sec=operation_timeout_sec,
-        server_cert_validation=cert_validation,
     )
     return session, winrm
 
@@ -487,7 +480,7 @@ def run_winrm_rdp_monitor_update(
         )
 
     effective_repo = (
-        repo_url or "https://git.papatramp.ru/PapaTramp/RDP-login-monitor.git"
+        repo_url or "https://git.kalinamall.ru/PapaTramp/RDP-login-monitor.git"
     ).strip()
     effective_branch = (git_branch or "main").strip() or "main"
     if not effective_repo:
@@ -547,7 +540,7 @@ def run_winrm_rdp_monitor_update(
             ok=False,
             message=(
                 f"Failed to download RDP bundle on client: {download.message} "
-                "(bundle URL omitted from logs)"
+                f"(URL: {bundle_url})"
             ),
             target=target,
             stdout="\n\n".join(part.strip() for part in [prep.stdout, download.stdout] if part.strip()),

backend/app/utils/sql_like.py

@@ -1,8 +0,0 @@
-"""Escape user input for SQL ILIKE patterns."""
-
-
-def escape_ilike_pattern(value: str) -> str:
-    text = (value or "").strip()
-    if not text:
-        return text
-    return text.replace("\\", "\\\\").replace("%", "\\%").replace("_", "\\_")

backend/app/version.py

@@ -1,5 +1,5 @@
-"""Единый источник версии SAC (API, health, логи, OpenAPI)."""
+"""Единый источник версии SAC (API, health, логи, OpenAPI)."""
 
 APP_NAME = "Security Alert Center"
-APP_VERSION = "0.5.17"
+APP_VERSION = "0.4.14"
 APP_VERSION_LABEL = f"{APP_NAME} v.{APP_VERSION}"

backend/tests/conftest.py

@@ -1,14 +1,10 @@
-"""SQLite in-memory fixtures for API tests."""
+"""SQLite in-memory fixtures for API tests."""
 
 import os
 
 # Must be set before app.database imports create_engine
 os.environ.setdefault("DATABASE_URL", "sqlite:///:memory:")
 os.environ.setdefault("SAC_BOOTSTRAP_API_KEY", "sac_test_key_for_pytest_only")
-os.environ.setdefault("SAC_SECURITY_ENFORCE", "false")
-os.environ.setdefault("JWT_SECRET", "pytest-jwt-secret-not-for-production-use")
-os.environ.setdefault("SAC_SSH_AUTO_ADD_HOST_KEY", "true")
-os.environ.setdefault("SAC_HOST_SILENCE_SCAN_ENABLED", "false")
 
 import pytest
 from fastapi.testclient import TestClient
@@ -124,7 +120,6 @@ def client(db_session, db_engine, monkeypatch):
     monkeypatch.setenv("SAC_REMOTE_ACTION_INLINE", "1")
     monkeypatch.setattr("app.main.bootstrap_api_key", lambda: None)
     monkeypatch.setattr("app.main.bootstrap_users", lambda: None)
-    monkeypatch.setattr("app.main.bootstrap_stale_remote_actions", lambda: None)
 
     test_session_local = sessionmaker(bind=db_engine, autocommit=False, autoflush=False)
     monkeypatch.setattr("app.services.host_remote_actions.SessionLocal", test_session_local)

backend/tests/test_agent_git_release.py

@@ -14,7 +14,7 @@ from app.services.agent_version import reference_agent_versions_by_product
 
 
 def test_normalize_git_repo_url():
-    assert normalize_git_repo_url("git.papatramp.ru/PapaTramp/ssh-monitor").endswith(
+    assert normalize_git_repo_url("git.kalinamall.ru/PapaTramp/ssh-monitor").endswith(
         "ssh-monitor.git"
     )
     assert normalize_git_repo_url("https://example.com/repo.git") == "https://example.com/repo.git"

backend/tests/test_agent_update.py

@@ -247,30 +247,6 @@ def test_clear_stale_running_remote_actions(db_session):
     assert host.remote_action["ok"] is False
 
 
-def test_get_remote_action_status_ignores_stale_running_payload(db_session):
-    from app.services.host_remote_actions import get_remote_action_status
-
-    host = Host(
-        hostname="done-linux",
-        os_family="linux",
-        product="ssh-monitor",
-        agent_update_state="success",
-        remote_action={
-            "status": "running",
-            "message": "Выполняется обновление… (лог с хоста)",
-            "output": "=== Script update completed successfully ===",
-            "ok": True,
-            "finished_at": "2026-07-08T02:21:11+00:00",
-        },
-    )
-    db_session.add(host)
-    db_session.commit()
-
-    status = get_remote_action_status(host)
-    assert status["active"] is False
-    assert status["agent_update_state"] == "success"
-
-
 def test_cancel_host_remote_job_api(jwt_headers, client, db_session):
     host = Host(
         hostname="cancel-me",

backend/tests/test_client_ip.py

@@ -1,26 +0,0 @@
-"""Tests for client IP resolution behind reverse proxy."""
-
-from types import SimpleNamespace
-
-from app.services.client_ip import client_ip_from_request
-
-
-def _request(*, client_host: str = "10.0.0.5", xff: str | None = None):
-    headers = {}
-    if xff is not None:
-        headers["x-forwarded-for"] = xff
-    return SimpleNamespace(client=SimpleNamespace(host=client_host), headers=headers)
-
-
-def test_client_ip_without_forwarded_header():
-    assert client_ip_from_request(_request(client_host="203.0.113.10")) == "203.0.113.10"
-
-
-def test_client_ip_uses_last_forwarded_hop():
-    req = _request(client_host="127.0.0.1", xff="203.0.113.99, 198.51.100.20")
-    assert client_ip_from_request(req) == "198.51.100.20"
-
-
-def test_client_ip_ignores_spoofed_first_hop():
-    req = _request(client_host="127.0.0.1", xff="1.2.3.4, 203.0.113.50")
-    assert client_ip_from_request(req) == "203.0.113.50"

backend/tests/test_health.py

@@ -1,9 +1,9 @@
-"""Version and health contract smoke tests (no DB required)."""
+"""Version and health contract smoke tests (no DB required)."""
 
 from app.version import APP_NAME, APP_VERSION, APP_VERSION_LABEL
 
 
 def test_version_constants():
-    assert APP_VERSION == "0.5.0"
+    assert APP_VERSION == "0.3.6"
     assert APP_NAME == "Security Alert Center"
-    assert APP_VERSION_LABEL == "Security Alert Center v.0.5.0"
+    assert APP_VERSION_LABEL == "Security Alert Center v.0.3.6"

backend/tests/test_host_mgmt_credentials.py

@@ -1,64 +0,0 @@
-"""Per-host management credential override."""
-
-from app.models.host import Host
-from app.services.linux_admin_settings import get_effective_linux_admin_for_host
-from app.services.win_admin_settings import get_effective_win_admin_for_host
-from app.services.host_mgmt_credentials import get_host_mgmt_access_view, upsert_host_mgmt_credentials
-
-
-def test_win_admin_for_host_prefers_override(db_session):
-    host = Host(
-        hostname="HOME-PC",
-        os_family="windows",
-        product="rdp-login-monitor",
-        mgmt_user=".\\Admin",
-        mgmt_password="local-secret",
-    )
-    db_session.add(host)
-    db_session.commit()
-    db_session.refresh(host)
-
-    cfg = get_effective_win_admin_for_host(db_session, host)
-    assert cfg.configured is True
-    assert cfg.source == "host"
-    assert cfg.user == ".\\Admin"
-    assert cfg.password == "local-secret"
-
-
-def test_linux_admin_for_host_prefers_override(db_session):
-    host = Host(
-        hostname="homeserver",
-        os_family="linux",
-        product="ssh-monitor",
-        mgmt_user="deploy",
-        mgmt_password="ssh-pass",
-    )
-    db_session.add(host)
-    db_session.commit()
-    db_session.refresh(host)
-
-    cfg = get_effective_linux_admin_for_host(db_session, host)
-    assert cfg.source == "host"
-    assert cfg.user == "deploy"
-
-
-def test_upsert_and_clear_host_access(db_session):
-    host = Host(hostname="box", os_family="windows", product="rdp-login-monitor")
-    db_session.add(host)
-    db_session.commit()
-    db_session.refresh(host)
-
-    view = upsert_host_mgmt_credentials(
-        db_session,
-        host,
-        user="HOME\\user",
-        password="secret123",
-    )
-    assert view.has_override is True
-    assert view.password_set is True
-    assert view.user == "HOME\\user"
-
-    cleared = upsert_host_mgmt_credentials(db_session, host, clear=True)
-    assert cleared.has_override is False
-    assert cleared.password_set is False
-    assert get_host_mgmt_access_view(db_session, host).user is None

backend/tests/test_host_sessions.py

@@ -8,7 +8,6 @@ from app.services.host_sessions import (
     event_session_terminated,
     event_supports_session_terminate,
     filter_logind_session_rows,
-    filter_windows_sessions_for_user,
     mark_event_session_terminated,
     parse_loginctl_sessions,
     parse_loginctl_sessions_json,
@@ -74,32 +73,6 @@ def test_parse_qwinsta_sessions_filters_user():
     assert filtered[0].session_id == "2"
 
 
-def test_parse_qwinsta_sessions_disconnected_without_sessionname():
-    """Disc rows often omit SESSIONNAME; auto flap logoff relies on these."""
-    stdout = """SESSIONNAME       USERNAME                 ID  STATE
- rdp-tcp#0         B26\\s.shelkovaya          2  Active
-                   B26\\s.shelkovaya          5  Disc
- rdp-tcp                                 65536  Listen
- services                                0  Disc
-"""
-    rows = parse_qwinsta_sessions(stdout)
-    assert {(r.session_id, r.state.split()[0], r.session_name) for r in rows} == {
-        ("2", "Active", "rdp-tcp#0"),
-        ("5", "Disc", ""),
-    }
-    filtered = parse_qwinsta_sessions(stdout, filter_user=r"B26\s.shelkovaya")
-    assert [r.session_id for r in filtered] == ["2", "5"]
-
-
-def test_parse_qwinsta_sessions_filters_domain_user():
-    stdout = """SESSIONNAME       USERNAME                 ID  STATE
- rdp-tcp#1         B26\\bob                   3  Active
-"""
-    rows = parse_qwinsta_sessions(stdout, filter_user=r"B26\bob")
-    assert len(rows) == 1
-    assert rows[0].session_id == "3"
-
-
 def test_event_supports_session_terminate_types():
     class HostStub:
         os_family = "linux"
@@ -121,48 +94,6 @@ def test_event_login_user_without_orm_actor_user_attr():
     assert _event_login_user(event) == "papatramp"
 
 
-def test_filter_windows_sessions_for_user_matches_domain():
-    rows = [
-        HostSessionRow(session_id="2", user="B26\\papatramp", state="Active"),
-        HostSessionRow(session_id="3", user="B26\\alice", state="Active"),
-    ]
-    matched = filter_windows_sessions_for_user(rows, "papatramp")
-    assert len(matched) == 1
-    assert matched[0].session_id == "2"
-
-
-def test_terminate_session_for_event_windows_already_logged_off(monkeypatch):
-    host = SimpleNamespace(
-        os_family="windows",
-        product="rdp-login-monitor",
-        hostname="BIV-PC",
-        ipv4="192.168.165.39",
-        display_name=None,
-        inventory={},
-    )
-    event = SimpleNamespace(
-        type="rdp.login.success",
-        details={"user": "papatramp"},
-        host=host,
-    )
-
-    def fake_list(_host, _cfg):
-        return [], WinRmCmdResult(ok=True, message="ok", target="BIV-PC", stdout="SESSIONNAME USERNAME ID STATE")
-
-    monkeypatch.setattr(
-        "app.services.host_sessions.list_windows_sessions",
-        fake_list,
-    )
-
-    result = terminate_session_for_event(
-        event,
-        linux_cfg=LinuxAdminConfig(user="", password="", source="test"),
-        win_cfg=WinAdminConfig(user="B26\\admin", password="x", source="test"),
-    )
-    assert result.ok is True
-    assert "уже вышел" in result.message
-
-
 def test_terminate_session_for_event_windows_no_actor_user_attr(monkeypatch):
     host = SimpleNamespace(
         os_family="windows",

backend/tests/test_ingest.py

@@ -133,48 +133,3 @@ def test_ingest_daily_report_calls_notify_daily_report(client, auth_headers):
     mock_daily.assert_called_once()
     mock_event.assert_not_called()
 
-
-def test_ingest_lifecycle_defers_notify(client, auth_headers):
-    from unittest.mock import patch
-
-    from app.api.v1 import events as events_api
-
-    event_id = str(uuid.uuid4())
-    payload = {
-        **VALID_EVENT,
-        "event_id": event_id,
-        "type": "agent.lifecycle",
-        "title": "started",
-        "summary": "agent started",
-        "details": {"lifecycle": "started"},
-    }
-    with patch.object(events_api, "schedule_notify_lifecycle") as mock_defer:
-        with patch.object(events_api, "notify_lifecycle") as mock_sync:
-            r = client.post("/api/v1/events", json=payload, headers=auth_headers)
-    assert r.status_code == 201
-    mock_defer.assert_called_once()
-    mock_sync.assert_not_called()
-
-
-def test_ingest_auth_login_defers_notify(client, auth_headers):
-    from unittest.mock import patch
-
-    from app.api.v1 import events as events_api
-
-    event_id = str(uuid.uuid4())
-    payload = {
-        **VALID_EVENT,
-        "event_id": event_id,
-        "category": "auth",
-        "type": "ssh.login.success",
-        "severity": "info",
-        "title": "SSH login",
-        "summary": "user@host",
-    }
-    with patch.object(events_api, "schedule_notify_auth_login") as mock_defer:
-        with patch.object(events_api, "notify_auth_login") as mock_sync:
-            r = client.post("/api/v1/events", json=payload, headers=auth_headers)
-    assert r.status_code == 201
-    mock_defer.assert_called_once()
-    mock_sync.assert_not_called()
-

backend/tests/test_ingest_body_limit.py

@@ -1,23 +0,0 @@
-"""Ingest body size limit middleware."""
-
-from fastapi import FastAPI
-from fastapi.testclient import TestClient
-
-from app.middleware.ingest_body_limit import IngestBodySizeLimitMiddleware
-
-
-def test_ingest_body_size_limit_rejects_large_content_length():
-    app = FastAPI()
-    app.add_middleware(IngestBodySizeLimitMiddleware, max_bytes=128)
-
-    @app.post("/api/v1/events")
-    def ingest():
-        return {"ok": True}
-
-    client = TestClient(app)
-    response = client.post(
-        "/api/v1/events",
-        content=b"x" * 10,
-        headers={"content-length": "256"},
-    )
-    assert response.status_code == 413

backend/tests/test_linux_admin_settings.py

@@ -174,51 +174,3 @@ def test_host_agent_update_success(jwt_headers, client, db_session, monkeypatch)
     assert job["target"] == "ubabuba"
     if "product_version" in job:
         assert job["product_version"] is None or isinstance(job["product_version"], str)
-
-
-def test_host_agent_update_job_shows_log_tail_and_completion_title(
-    jwt_headers, client, db_session, monkeypatch
-):
-    monkeypatch.setenv("SAC_LINUX_ADMIN_USER", "root")
-    monkeypatch.setenv("SAC_LINUX_ADMIN_PASSWORD", "pw")
-    from app.config import get_settings
-    from app.models import Host
-    from app.services.ssh_connect import SshCommandResult
-    from tests.test_agent_update import wait_remote_job
-
-    get_settings.cache_clear()
-
-    host = Host(hostname="router", os_family="linux", product="ssh-monitor", ipv4="10.0.0.1")
-    db_session.add(host)
-    db_session.commit()
-    db_session.refresh(host)
-
-    log_tail = (
-        "2026-07-08 14:18:15 INFO: === Script update completed successfully ===\n"
-        "2026-07-08 14:18:15 INFO: завершено успешно (код 0). Итог см. выше\n"
-    )
-    with (
-        patch("app.services.host_remote_actions.run_ssh_monitor_update") as mock_update,
-        patch("app.services.host_remote_actions.tail_ssh_monitor_update_log") as mock_tail,
-    ):
-        mock_update.return_value = SshCommandResult(
-            ok=True,
-            message="SSH OK (router), exit 0",
-            target="router",
-            stdout="",
-            exit_code=0,
-            agent_version="2.3.2-SAC",
-        )
-        mock_tail.return_value = log_tail
-        response = client.post(
-            f"/api/v1/hosts/{host.id}/actions/agent-update",
-            headers=jwt_headers,
-        )
-
-    assert response.status_code == 202
-    job = wait_remote_job(client, host.id, jwt_headers)
-    assert job["ok"] is True
-    assert "готово" in (job.get("title") or "")
-    assert "2.3.2-SAC" in (job.get("message") or "")
-    assert "Script update completed successfully" in (job.get("output") or "")
-    mock_tail.assert_called()

backend/tests/test_rdg_workstation_session.py

@@ -266,113 +266,3 @@ def test_ip_mismatch_does_not_close_login(db_session, rdg_settings, rdg_hosts):
 
     assert close_workstation_session_for_rdg_end(db_session, end) is None
     assert event_session_terminated(login, db=db_session) is False
-
-
-def test_empty_rcm1149_user_enriched_from_prior_rdg302(db_session, rdg_settings, rdg_hosts):
-    """COMM-PC class: EventLog 1149 has empty Param1; RDG 302 already has the account."""
-    ws, _gw = rdg_hosts
-    t0 = datetime.now(timezone.utc)
-    user = r"B26\s.shelkovaya"
-    internal_ip = ws.ipv4
-
-    _ingest(
-        db_session,
-        t0,
-        host={"hostname": "K6A-DC3", "os_family": "windows"},
-        source={"product": "rdp-login-monitor", "product_version": "2.1.13-SAC"},
-        type="rdg.connection.success",
-        category="auth",
-        severity="warning",
-        title="RDG 302",
-        summary="302",
-        details={"user": user, "internal_ip": internal_ip},
-    )
-    login = _ingest(
-        db_session,
-        t0 + timedelta(seconds=3),
-        host={"hostname": ws.hostname, "os_family": "windows", "ipv4": internal_ip},
-        source={"product": "rdp-login-monitor", "product_version": "2.1.13-SAC"},
-        type="rdp.login.success",
-        category="auth",
-        severity="warning",
-        title="RDP connection (RCM 1149)",
-        summary="RCM 1149 - 192.168.160.40",
-        details={"user": "-", "ip_address": "192.168.160.40", "event_id_windows": 1149},
-    )
-    db_session.refresh(login)
-
-    assert login.details["user"] == user
-    assert login.details.get("user_enriched_from_rdg_event_id")
-    summary = event_to_summary(login, db_session)
-    assert summary.actor_user == user
-
-
-def test_empty_rcm1149_backfilled_when_rdg302_arrives_later(db_session, rdg_settings, rdg_hosts):
-    ws, _gw = rdg_hosts
-    t0 = datetime.now(timezone.utc)
-    user = r"B26\s.shelkovaya"
-    internal_ip = ws.ipv4
-
-    login = _ingest(
-        db_session,
-        t0 + timedelta(seconds=1),
-        host={"hostname": ws.hostname, "os_family": "windows", "ipv4": internal_ip},
-        source={"product": "rdp-login-monitor", "product_version": "2.1.13-SAC"},
-        type="rdp.login.success",
-        category="auth",
-        severity="info",
-        title="RDP connection (RCM 1149)",
-        summary="RCM 1149 - 1.2.3.4",
-        details={"user": "-", "event_id_windows": 1149},
-    )
-    assert login.details["user"] == "-"
-
-    _ingest(
-        db_session,
-        t0,
-        host={"hostname": "K6A-DC3", "os_family": "windows"},
-        source={"product": "rdp-login-monitor", "product_version": "2.1.13-SAC"},
-        type="rdg.connection.success",
-        category="auth",
-        severity="info",
-        title="RDG 302",
-        summary="302",
-        details={"user": user, "internal_ip": internal_ip},
-    )
-    db_session.refresh(login)
-    assert login.details["user"] == user
-
-
-def test_empty_user_login_still_closed_by_rdg303(db_session, rdg_settings, rdg_hosts):
-    ws, _gw = rdg_hosts
-    t0 = datetime.now(timezone.utc)
-    user = r"B26\s.shelkovaya"
-    internal_ip = ws.ipv4
-
-    login = _ingest(
-        db_session,
-        t0,
-        host={"hostname": ws.hostname, "os_family": "windows", "ipv4": internal_ip},
-        source={"product": "rdp-login-monitor", "product_version": "2.1.13-SAC"},
-        type="rdp.login.success",
-        category="auth",
-        severity="info",
-        title="RDP connection (RCM 1149)",
-        summary="RCM 1149",
-        details={"user": "-", "event_id_windows": 1149},
-    )
-    end = _ingest(
-        db_session,
-        t0 + timedelta(minutes=5),
-        host={"hostname": "K6A-DC3", "os_family": "windows"},
-        source={"product": "rdp-login-monitor", "product_version": "2.1.13-SAC"},
-        type="rdg.connection.disconnected",
-        category="auth",
-        severity="info",
-        title="303",
-        summary="303",
-        details={"user": user, "internal_ip": internal_ip},
-    )
-    db_session.refresh(login)
-    assert login.details.get(SESSION_CLOSED_BY_RDG_AT_KEY) == end.occurred_at.isoformat()
-    assert event_session_terminated(login, db=db_session) is True

backend/tests/test_rdp_session_logoff.py

@@ -1,229 +0,0 @@
-"""Tests for direct RDP logoff → workstation rdp.login.success correlation."""
-
-import uuid
-from datetime import datetime, timedelta, timezone
-
-from app.services.event_summary import event_to_summary
-from app.services.host_sessions import event_session_terminated
-from app.services.ingest import ingest_event
-from app.services.rdp_session_logoff import (
-    SESSION_CLOSED_BY_LOGOFF_AT_KEY,
-    SESSION_CLOSED_BY_LOGOFF_EVENT_ID_KEY,
-    close_workstation_session_for_rdp_logoff,
-    find_logoff_after_workstation_login,
-    resolve_workstation_login_closed_by_logoff,
-)
-from tests.test_ingest import VALID_EVENT
-
-
-def _payload(**overrides):
-    base = {
-        **VALID_EVENT,
-        "event_id": str(uuid.uuid4()),
-        "occurred_at": datetime.now(timezone.utc).isoformat(),
-    }
-    base.update(overrides)
-    return base
-
-
-def _ingest(db, occurred_at: datetime, **overrides):
-    payload = _payload(**overrides)
-    payload["occurred_at"] = occurred_at.isoformat()
-    event, _ = ingest_event(db, payload)
-    db.flush()
-    return event
-
-
-def test_logoff_marks_workstation_login_closed_on_ingest(db_session):
-    t0 = datetime.now(timezone.utc)
-    user = r"B26\papatramp"
-    host = {"hostname": "BIV-PC", "os_family": "windows", "ipv4": "192.168.165.39"}
-    source = {"product": "rdp-login-monitor", "product_version": "2.1.11-SAC"}
-
-    login = _ingest(
-        db_session,
-        t0 + timedelta(seconds=1),
-        host=host,
-        source=source,
-        type="rdp.login.success",
-        category="auth",
-        severity="info",
-        title="RDP login",
-        summary="4624",
-        details={"user": user, "ip_address": "192.168.160.3", "logon_type": 10},
-    )
-    logoff = _ingest(
-        db_session,
-        t0 + timedelta(hours=1),
-        host=host,
-        source=source,
-        type="rdp.session.logoff",
-        category="auth",
-        severity="info",
-        title="RDP session logoff",
-        summary="4634",
-        details={
-            "user": user,
-            "ip_address": "192.168.160.3",
-            "logon_type": 10,
-            "event_id_windows": 4634,
-        },
-    )
-
-    assert login.details[SESSION_CLOSED_BY_LOGOFF_AT_KEY] == logoff.occurred_at.isoformat()
-    assert login.details[SESSION_CLOSED_BY_LOGOFF_EVENT_ID_KEY] == logoff.id
-    assert event_session_terminated(login, db=db_session) is True
-    assert event_to_summary(login, db_session).session_terminated is True
-
-
-def test_user_mismatch_does_not_close_login(db_session):
-    t0 = datetime.now(timezone.utc)
-    host = {"hostname": "BIV-PC", "os_family": "windows", "ipv4": "192.168.165.39"}
-    source = {"product": "rdp-login-monitor", "product_version": "2.1.11-SAC"}
-
-    login = _ingest(
-        db_session,
-        t0,
-        host=host,
-        source=source,
-        type="rdp.login.success",
-        category="auth",
-        severity="info",
-        title="RDP login",
-        summary="4624",
-        details={"user": r"B26\Alice"},
-    )
-    logoff = _ingest(
-        db_session,
-        t0 + timedelta(hours=1),
-        host=host,
-        source=source,
-        type="rdp.session.logoff",
-        category="auth",
-        severity="info",
-        title="RDP session logoff",
-        summary="4634",
-        details={"user": r"B26\Bob", "logon_type": 10, "event_id_windows": 4634},
-    )
-    db_session.refresh(login)
-
-    assert close_workstation_session_for_rdp_logoff(db_session, logoff) is None
-    assert event_session_terminated(login, db=db_session) is False
-
-
-def test_ip_mismatch_does_not_close_login_when_both_ips_present(db_session):
-    t0 = datetime.now(timezone.utc)
-    user = r"B26\papatramp"
-    host = {"hostname": "BIV-PC", "os_family": "windows", "ipv4": "192.168.165.39"}
-    source = {"product": "rdp-login-monitor", "product_version": "2.1.11-SAC"}
-
-    login = _ingest(
-        db_session,
-        t0,
-        host=host,
-        source=source,
-        type="rdp.login.success",
-        category="auth",
-        severity="info",
-        title="RDP login",
-        summary="4624",
-        details={"user": user, "ip_address": "192.168.160.3", "logon_type": 10},
-    )
-    logoff = _ingest(
-        db_session,
-        t0 + timedelta(hours=1),
-        host=host,
-        source=source,
-        type="rdp.session.logoff",
-        category="auth",
-        severity="info",
-        title="RDP session logoff",
-        summary="4634",
-        details={"user": user, "ip_address": "192.168.160.99", "logon_type": 10, "event_id_windows": 4634},
-    )
-    db_session.refresh(login)
-
-    assert close_workstation_session_for_rdp_logoff(db_session, logoff) is None
-    assert event_session_terminated(login, db=db_session) is False
-
-
-def test_runtime_resolve_for_historical_login_without_flag(db_session):
-    from app.models import Event, Host
-
-    t0 = datetime.now(timezone.utc)
-    user = r"B26\papatramp"
-    host = Host(
-        hostname="BIV-PC",
-        os_family="windows",
-        product="rdp-login-monitor",
-        ipv4="192.168.165.39",
-    )
-    db_session.add(host)
-    db_session.commit()
-
-    login = Event(
-        event_id=str(uuid.uuid4()),
-        host_id=host.id,
-        occurred_at=t0 + timedelta(seconds=1),
-        received_at=t0,
-        category="auth",
-        type="rdp.login.success",
-        severity="info",
-        title="RDP login",
-        summary="4624",
-        payload={},
-        details={"user": "papatramp", "ip_address": "192.168.160.3"},
-    )
-    logoff = Event(
-        event_id=str(uuid.uuid4()),
-        host_id=host.id,
-        occurred_at=t0 + timedelta(hours=2),
-        received_at=t0,
-        category="auth",
-        type="rdp.session.logoff",
-        severity="info",
-        title="4634",
-        summary="4634",
-        payload={},
-        details={"user": user, "ip_address": "192.168.160.3", "event_id_windows": 4634},
-    )
-    db_session.add_all([login, logoff])
-    db_session.commit()
-
-    assert resolve_workstation_login_closed_by_logoff(db_session, login) is True
-    assert find_logoff_after_workstation_login(db_session, login) is not None
-    assert event_to_summary(login, db_session).session_terminated is True
-
-
-def test_sam_domain_user_match_on_logoff(db_session):
-    t0 = datetime.now(timezone.utc)
-    host = {"hostname": "BIV-PC", "os_family": "windows", "ipv4": "192.168.165.39"}
-    source = {"product": "rdp-login-monitor", "product_version": "2.1.11-SAC"}
-
-    login = _ingest(
-        db_session,
-        t0,
-        host=host,
-        source=source,
-        type="rdp.login.success",
-        category="auth",
-        severity="info",
-        title="RDP login",
-        summary="4624",
-        details={"user": r"B26\papatramp", "logon_type": 10},
-    )
-    _ingest(
-        db_session,
-        t0 + timedelta(minutes=30),
-        host=host,
-        source=source,
-        type="rdp.session.logoff",
-        category="auth",
-        severity="info",
-        title="RDP session logoff",
-        summary="4647",
-        details={"user": "papatramp", "logon_type": 10, "event_id_windows": 4647},
-    )
-    db_session.refresh(login)
-
-    assert event_session_terminated(login, db=db_session) is True

backend/tests/test_security_hardening.py

@@ -1,52 +0,0 @@
-"""Security bootstrap and API key hashing."""
-
-import hashlib
-import pytest
-
-from app.auth.api_key import _legacy_hash_api_key, hash_api_key, verify_api_key_hash
-from app.security_bootstrap import validate_security_settings
-from app.config import Settings
-
-
-def test_hash_api_key_uses_hmac(monkeypatch):
-    monkeypatch.setenv("JWT_SECRET", "unit-test-secret")
-    from app.config import get_settings
-
-    get_settings.cache_clear()
-    raw = "sac_example_key"
-    assert hash_api_key(raw) != _legacy_hash_api_key(raw)
-    assert verify_api_key_hash(raw, hash_api_key(raw))
-    get_settings.cache_clear()
-
-
-def test_verify_api_key_hash_accepts_legacy_sha256(monkeypatch):
-    monkeypatch.setenv("JWT_SECRET", "unit-test-secret")
-    from app.config import get_settings
-
-    get_settings.cache_clear()
-    raw = "sac_legacy_key"
-    legacy = hashlib.sha256(raw.encode("utf-8")).hexdigest()
-    assert verify_api_key_hash(raw, legacy)
-    get_settings.cache_clear()
-
-
-def test_validate_security_settings_rejects_weak_jwt():
-    settings = Settings(
-        jwt_secret="change-me-in-production",
-        sac_public_url="https://sac.example.com",
-        cors_origins="https://sac.example.com",
-        sac_security_enforce=True,
-    )
-    with pytest.raises(RuntimeError, match="JWT_SECRET"):
-        validate_security_settings(settings)
-
-
-def test_validate_security_settings_rejects_wildcard_cors(monkeypatch):
-    settings = Settings(
-        jwt_secret="strong-secret-value",
-        sac_public_url="https://sac.example.com",
-        cors_origins="*",
-        sac_security_enforce=True,
-    )
-    with pytest.raises(RuntimeError, match="CORS_ORIGINS"):
-        validate_security_settings(settings)

backend/tests/test_session_duration.py

@@ -1,20 +0,0 @@
-"""Tests for session_duration_sec extract/format."""
-
-from app.services.session_duration import extract_session_duration_sec, format_session_duration
-
-
-def test_extract_session_duration_sec():
-    assert extract_session_duration_sec({"session_duration_sec": 18324}) == 18324
-    assert extract_session_duration_sec({"session_duration_sec": "42"}) == 42
-    assert extract_session_duration_sec({"session_duration_sec": ""}) is None
-    assert extract_session_duration_sec({}) is None
-    assert extract_session_duration_sec(None) is None
-    assert extract_session_duration_sec({"session_duration_sec": -1}) is None
-
-
-def test_format_session_duration():
-    assert format_session_duration(0) == "00:00:00"
-    assert format_session_duration(18324) == "05:05:24"
-    assert format_session_duration(2428) == "00:40:28"
-    assert format_session_duration(86400 + 85) == "1д 00:01:25"
-    assert format_session_duration(2 * 86400 + 3661) == "2д 01:01:01"

backend/tests/test_ssh_connect.py

@@ -31,7 +31,6 @@ def _install_fake_paramiko(monkeypatch, *, connect_side_effect=None, exec_setup=
     fake = MagicMock()
     fake.SSHClient = mock_client_cls
     fake.AutoAddPolicy = MagicMock()
-    fake.RejectPolicy = MagicMock()
     fake.AuthenticationException = _AuthError
     monkeypatch.setitem(sys.modules, "paramiko", fake)
     return client
@@ -43,30 +42,26 @@ def test_ssh_output_hostname_ignores_motd():
 
 
 def test_remote_shell_command_non_login_for_sessions():
-    cmd, needs_pw = _remote_shell_command("root", "loginctl list-sessions", login_shell=False)
+    cmd = _remote_shell_command("root", "loginctl list-sessions", "secret", login_shell=False)
     assert cmd == "bash -c 'loginctl list-sessions'"
-    assert needs_pw is False
 
 
 def test_remote_shell_command_non_root_probe_has_no_sudo():
-    cmd, needs_pw = _remote_shell_command("deploy", "hostname", need_root=False)
+    cmd = _remote_shell_command("deploy", "hostname", "secret", need_root=False)
     assert "sudo" not in cmd
     assert "hostname" in cmd
-    assert needs_pw is False
 
 
 def test_remote_shell_command_non_root_privileged_uses_sudo_s():
-    cmd, needs_pw = _remote_shell_command("deploy", "/opt/scripts/update_ssh_monitor.sh", need_root=True)
+    cmd = _remote_shell_command("deploy", "/opt/scripts/update_ssh_monitor.sh", "secret", need_root=True)
     assert "sudo -S" in cmd
+    assert "secret" in cmd
     assert "update_ssh_monitor.sh" in cmd
-    assert needs_pw is True
-    assert "secret" not in cmd
 
 
 def test_remote_shell_command_root_skips_sudo_even_when_need_root():
-    cmd, needs_pw = _remote_shell_command("root", "/opt/scripts/update_ssh_monitor.sh", need_root=True)
+    cmd = _remote_shell_command("root", "/opt/scripts/update_ssh_monitor.sh", "secret", need_root=True)
     assert "sudo" not in cmd
-    assert needs_pw is False
 
 
 def test_probe_ssh_connection_non_root_does_not_use_sudo(monkeypatch):
@@ -166,7 +161,6 @@ def test_run_ssh_command_retries_transient_no_existing_session(monkeypatch):
     fake = MagicMock()
     fake.SSHClient = MagicMock()
     fake.AutoAddPolicy = MagicMock()
-    fake.RejectPolicy = MagicMock()
     fake.AuthenticationException = _AuthError
 
     def make_client():
@@ -323,7 +317,7 @@ def test_run_ssh_monitor_update_runs_script(monkeypatch):
         target="ubabuba",
         user="root",
         password="pw",
-        repo_url="https://git.papatramp.ru/PapaTramp/ssh-monitor.git",
+        repo_url="https://git.kalinamall.ru/PapaTramp/ssh-monitor.git",
     )
     assert result.ok is True
     assert result.agent_version == "2.1.0-SAC"

deploy/env.native.example

@@ -1,4 +1,4 @@
-# Native: /opt/security-alert-center/config/sac-api.env
+# Native: /opt/security-alert-center/config/sac-api.env
 # sudo chown sac:sac ... && sudo chmod 600 ...
 # Пароль в URL — в двойных кавычках. Символ # в пароле допустим только внутри кавычек.
 # systemd НЕ парсит этот файл — читает приложение (SAC_CONFIG_FILE).
@@ -7,14 +7,11 @@ DATABASE_URL=postgresql+psycopg2://sac:CHANGE_ME_POSTGRES_PASSWORD@127.0.0.1:543
 # SQLAlchemy pool (uvicorn workers × concurrent ingest). Было по умолчанию 5+10 — мало для штурма 09:00.
 SAC_DB_POOL_SIZE=15
 SAC_DB_MAX_OVERFLOW=25
-# Uvicorn workers (ingest burst). Читает deploy/systemd/sac-api-start.sh; при >1 отключите in-process host_silence scan ниже.
-SAC_UVICORN_WORKERS=4
 
 SAC_PUBLIC_URL=https://sac.kalinamall.ru
 # Опционально: другой базовый URL для WinRM-скачивания RDP bundle с ПК (LAN / split-DNS).
 # SAC_AGENT_BUNDLE_BASE_URL=https://192.168.x.x
 JWT_SECRET=CHANGE_ME_openssl_rand_hex_32
-SAC_SECURITY_ENFORCE=true
 
 # API key для агентов: Authorization: Bearer <ключ>
 # python3.12 -c "import secrets; print('sac_'+secrets.token_urlsafe(32))"
@@ -127,13 +124,4 @@ SAC_FCM_PROJECT_ID=
 SAC_FCM_SERVICE_ACCOUNT_JSON=
 SAC_MOBILE_REFRESH_EXPIRE_DAYS=90
 
-CORS_ORIGINS=https://sac.kalinamall.ru
-
-# SSH: verify host keys (RejectPolicy). Add keys to file before remote actions.
-# Комментарий — только отдельной строкой с #. Нельзя: SAC_SSH_AUTO_ADD_HOST_KEY=false ← текст
-# SAC_SSH_KNOWN_HOSTS_FILE=/opt/security-alert-center/config/ssh_known_hosts
-# SAC_SSH_AUTO_ADD_HOST_KEY=false
-
-# WinRM: enable HTTPS listener on clients (5986) before turning on.
-# SAC_WINRM_USE_HTTPS=false
-# SAC_WINRM_SERVER_CERT_VALIDATION=validate
+CORS_ORIGINS=*

deploy/nginx/sac.conf.example

@@ -44,19 +44,6 @@ server {
         proxy_read_timeout 960s;
     }
 
-    # Ingest burst: lifecycle/auth deferred в API, но POST всё равно может ждать notify_event/problem.
-    location = /api/v1/events {
-        proxy_pass http://sac_api;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_connect_timeout 30s;
-        proxy_send_timeout 120s;
-        proxy_read_timeout 120s;
-    }
-
     location / {
         proxy_pass http://sac_api;
         proxy_http_version 1.1;

deploy/nginx/sac.conf.tls.example

@@ -69,19 +69,6 @@ server {
         proxy_read_timeout 960s;
     }
 
-    # Ingest burst: lifecycle/auth deferred в API, но POST всё равно может ждать notify_event/problem.
-    location = /api/v1/events {
-        proxy_pass http://sac_api;
-        proxy_http_version 1.1;
-        proxy_set_header Host $host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_connect_timeout 30s;
-        proxy_send_timeout 120s;
-        proxy_read_timeout 120s;
-    }
-
     location / {
         proxy_pass http://sac_api;
         proxy_http_version 1.1;

deploy/sac-deploy.sh

@@ -56,16 +56,12 @@ fi
 log "pip install -r requirements.txt"
 sudo -u "${APP_USER}" "${VENV}/bin/pip" install -q -r "${APP_ROOT}/backend/requirements.txt"
 
-log "Проверка ${CONFIG_FILE} (pydantic; без bash source — inline-комментарии в значениях ломают deploy)"
-sudo -u "${APP_USER}" bash -c "
-  export SAC_CONFIG_FILE='${CONFIG_FILE}'
-  cd '${APP_ROOT}/backend'
-  '${VENV}/bin/python' -c 'from app.config import get_settings; get_settings(); print(\"config: OK\")'
-" || die "Неверный ${CONFIG_FILE}: одна переменная = одна строка, комментарии только отдельной строкой с # (не «false ← …» после значения)"
-
 log "alembic upgrade head"
 sudo -u "${APP_USER}" bash -c "
-  export SAC_CONFIG_FILE='${CONFIG_FILE}'
+  set -a
+  # shellcheck source=/dev/null
+  source '${CONFIG_FILE}'
+  set +a
   cd '${APP_ROOT}/backend' && '${VENV}/bin/alembic' upgrade head
 "
 
@@ -93,16 +89,6 @@ if [ -f "${APP_ROOT}/deploy/systemd/${SERVICE_NAME}.service" ]; then
   systemctl daemon-reload
  fi
 fi
-START_SH="${APP_ROOT}/deploy/systemd/sac-api-start.sh"
-if [ -f "${START_SH}" ]; then
- sed -i 's/\r$//' "${START_SH}"
- chmod 755 "${START_SH}"
-fi
-for _sh in "${APP_ROOT}"/deploy/sac-deploy.sh "${APP_ROOT}"/deploy/systemd/*.sh; do
- [ -f "${_sh}" ] || continue
- sed -i 's/\r$//' "${_sh}"
- chmod 755 "${_sh}" 2>/dev/null || true
-done
 
 log "Проверка DATABASE_URL (как у uvicorn через SAC_CONFIG_FILE)"
 sudo -u "${APP_USER}" bash -c "
@@ -121,7 +107,10 @@ print('db: OK')
 log "systemctl restart ${SERVICE_NAME} (краткий 502 в UI возможен ~10 с)"
 log "Сброс зависших remote_action (running без worker после restart)"
 sudo -u "${APP_USER}" bash -c "
-  export SAC_CONFIG_FILE='${CONFIG_FILE}'
+  set -a
+  # shellcheck source=/dev/null
+  source '${CONFIG_FILE}'
+  set +a
   cd '${APP_ROOT}/backend'
   '${VENV}/bin/python' -c \"
 from app.database import SessionLocal
@@ -136,14 +125,7 @@ finally:
 \"
 "
 systemctl restart "${SERVICE_NAME}"
-sleep 2
-for _ in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15; do
- if systemctl is-active --quiet "${SERVICE_NAME}"; then
-  break
- fi
- sleep 1
-done
-systemctl is-active --quiet "${SERVICE_NAME}" || die "${SERVICE_NAME} не active — journalctl -u ${SERVICE_NAME} -n 40 --no-pager"
+systemctl is-active --quiet "${SERVICE_NAME}" || die "${SERVICE_NAME} не active"
 
 HEALTH_OK=0
 for _ in 1 2 3 4 5 6; do

deploy/systemd/sac-api-start.sh

@@ -1,42 +0,0 @@
-#!/usr/bin/env bash
-# Uvicorn launcher: SAC_UVICORN_WORKERS из sac-api.env (без systemd EnvironmentFile).
-set -euo pipefail
-
-APP_ROOT="${SAC_APP_ROOT:-/opt/security-alert-center}"
-CONFIG_FILE="${SAC_CONFIG_FILE:-${APP_ROOT}/config/sac-api.env}"
-VENV="${APP_ROOT}/backend/.venv"
-HOST="127.0.0.1"
-PORT="8000"
-WORKERS=4
-
-_read_env_int() {
-	local key="$1" default="$2" line val
-	[ -f "$CONFIG_FILE" ] || {
-		printf '%s\n' "$default"
-		return 0
-	}
-	line="$(grep -E "^[[:space:]]*${key}=" "$CONFIG_FILE" 2>/dev/null | tail -1)" || {
-		printf '%s\n' "$default"
-		return 0
-	}
-	val="${line#*=}"
-	val="${val#"${val%%[![:space:]]*}"}"
-	val="${val%"${val##*[![:space:]]}"}"
-	val="${val#\"}"
-	val="${val%\"}"
-	val="${val#\'}"
-	val="${val%\'}"
-	if [[ "$val" =~ ^[0-9]+$ ]] && [ "$val" -ge 1 ]; then
-		printf '%s\n' "$val"
-	else
-		printf '%s\n' "$default"
-	fi
-}
-
-WORKERS="$(_read_env_int SAC_UVICORN_WORKERS 4)"
-
-exec "${VENV}/bin/uvicorn" app.main:app \
-	--host "$HOST" \
-	--port "$PORT" \
-	--workers "$WORKERS" \
-	--timeout-graceful-shutdown 30

deploy/systemd/sac-api.service

@@ -1,6 +1,6 @@
 [Unit]
 Description=Security Alert Center API (FastAPI)
-Documentation=https://git.papatramp.ru/PapaTramp/security-alert-center
+Documentation=https://git.kalinamall.ru/PapaTramp/security-alert-center
 After=network-online.target postgresql.service
 Wants=network-online.target
 Requires=postgresql.service
@@ -13,7 +13,7 @@ WorkingDirectory=/opt/security-alert-center/backend
 # Конфиг читает само приложение (pydantic), не systemd — иначе ломаются пароли с #, $ и т.д.
 Environment=SAC_CONFIG_FILE=/opt/security-alert-center/config/sac-api.env
 Environment=PYTHONPATH=/opt/security-alert-center/backend
-ExecStart=/usr/bin/bash /opt/security-alert-center/deploy/systemd/sac-api-start.sh
+ExecStart=/opt/security-alert-center/backend/.venv/bin/uvicorn app.main:app --host 127.0.0.1 --port 8000 --workers 2 --timeout-graceful-shutdown 30
 Restart=on-failure
 RestartSec=5
 TimeoutStopSec=20

docs/agent-control-plane.md

@@ -183,13 +183,11 @@ sequenceDiagram
 
 ## 5. П.2C — Доступ SAC к хостам
 
-### 5.1. Windows — WinRM / учётки
+### 5.1. Windows — WinRM
 
-- **Глобальный доменный admin** в **Настройки → Windows**: `DOMAIN\user` + password (encrypted). Аналогично **Linux admin** для SSH.
-- **Override на карточке хоста** (**Хосты → WinRM/SSH / доступ к хосту**): `COMPUTER\user` / `.\Administrator` + password (encrypted в `hosts.mgmt_*`). Если пусто — берутся глобальные.
-- Effective creds: `get_effective_win_admin_for_host` / `get_effective_linux_admin_for_host` (source: `host` | `db` | `env`).
-- API: `GET` / `PUT /api/v1/hosts/{id}/access` (`user`, `password`, `clear`).
-- Используются для WinRM/SSH-test, fallback-update, qwinsta/logoff, remote ops; для run_as через агента — те же creds в command poll (TLS + API key, не пишутся на диск агента).
+- **Один доменный admin** в **Настройки → Управление хостами → Windows**: `DOMAIN\user` + password (encrypted).
+- Override на карточке хоста — опционально позже.
+- Используется для fallback-обновления и (при необходимости) remote ops; для qwinsta/logoff MVP — **через агента** с теми же creds, переданными в command poll (TLS + API key, не пишутся на диск агента).
 
 ### 5.2. Linux — bootstrap password → SSH key → удалить password
 
@@ -268,7 +266,7 @@ Authorization: Bearer sac_xxx
 | POST | `/api/v1/events/{id}/actions/logoff` | logoff `{ "session_id": 5 }` |
 | GET | `/api/v1/events/{id}/actions/{cmd_id}` | Статус / результат |
 | PATCH | `/api/v1/hosts/{id}/config` | Desired config |
-| GET/PUT | `/api/v1/hosts/{id}/access` | Per-host WinRM/SSH override (mgmt_user/password) |
+| PATCH | `/api/v1/hosts/{id}/access` | Bootstrap / WinRM creds |
 | GET/PATCH | `/api/v1/settings/agent-updates` | Режим A/B, версии, источники |
 | GET/PATCH | `/api/v1/settings/host-management` | Доменный admin Windows |
 

docs/agent-integration.md

@@ -185,7 +185,6 @@ Idempotency-Key: 550e8400-e29b-41d4-a716-446655440000
 | 4624 успех | `rdp.login.success` | info |
 | 4625 неудача | `rdp.login.failed` | warning |
 | RCM **20506** Shadow Control started | `rdp.shadow.control.started` | **warning** |
-| RCM **20506** Shadow Control started | `rdp.shadow.control.started` | **warning** |
 | RCM **20507** Shadow Control stopped | `rdp.shadow.control.stopped` | **warning** |
 | RCM **20510** Shadow Control permission | `rdp.shadow.control.permission` | **warning** |
 | WinRM **91** inbound shell (Enter-PSSession) | `winrm.session.started` | **warning** |

docs/deployment.md

@@ -115,7 +115,7 @@ sudo /opt/sac-deploy.sh
 
 Краткий **502 Bad Gateway** в UI (~10 с) возможен при перезапуске `sac-api` — список хостов автоматически повторяет запрос; после деплоя обновите страницу.
 
-**Важно в `sac-api.env`:** `SAC_PUBLIC_URL=https://sac.kalinamall.ru` — нужен для WinRM-обновления RDP (клиент скачивает zip с SAC). API: **4 worker** uvicorn по умолчанию (`SAC_UVICORN_WORKERS`, `deploy/systemd/sac-api-start.sh`).
+**Важно в `sac-api.env`:** `SAC_PUBLIC_URL=https://sac.kalinamall.ru` — нужен для WinRM-обновления RDP (клиент скачивает zip с SAC). API: **2 worker** uvicorn (`deploy/systemd/sac-api.service`).
 
 Установка скрипта (один раз): `sudo cp /opt/security-alert-center/deploy/sac-deploy.sh /opt/sac-deploy.sh && sudo chmod 755 /opt/sac-deploy.sh`
 

docs/event-schema-v1.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.papatramp.ru/PapaTramp/security-alert-center/schemas/event-v1.json",
+  "$id": "https://git.kalinamall.ru/PapaTramp/security-alert-center/schemas/event-v1.json",
   "title": "Security Alert Center Event v1",
   "description": "Каноническое событие от ssh-monitor или RDP-login-monitor",
   "type": "object",
@@ -94,7 +94,6 @@
         "session.logind.new",
         "rdp.login.success",
         "rdp.login.failed",
-        "rdp.session.logoff",
         "rdp.shadow.control.started",
         "rdp.shadow.control.stopped",
         "rdp.shadow.control.permission",

docs/ingest-mass-update-backlog.ru.md

@@ -1,50 +0,0 @@
-# Backlog: ingest и массовое обновление агентов
-
-**Статус:** ToDo (не в текущем релизе).  
-**Контекст:** массовый SSH-update через SAC (10+ хостов) + `sac-deploy` в одно окно → часть POST в ingest «теряется» с точки зрения агента (`SAC POST HTTP :`), flood в Telegram (fallback + watchdog).  
-**Связано:** [runbook-ops.md](runbook-ops.md), [agent-integration.md](agent-integration.md), ssh-monitor [security-roadmap.ru.md](https://git.papatramp.ru/PapaTramp/ssh-monitor/src/branch/main/docs/security-roadmap.ru.md).
-
-Увеличение `SAC_DB_POOL_SIZE` / defer daily в **0.5.0** лечит штурм суточных отчётов и пул БД; **не** снимает узкие места ниже при одновременном restart многих агентов.
-
----
-
-## Операционно (сразу, без кода)
-
-- [ ] **Не совмещать** `sudo /opt/sac-deploy.sh` и массовое «Обновить ssh-monitor (SSH)» по многим хостам — сначала deploy SAC, потом агенты (или наоборот).
-- [ ] Обновлять Linux-хосты **пачками по 2–3**, не все подряд.
-- [ ] На зрелых хостах перевести **`UseSAC=exclusive`** (нет дубля в Telegram с агента при fallback); watchdog по-прежнему шлёт в Telegram сам.
-- [ ] Перед первым SSH-update с SAC: **`ssh-keyscan`** в `config/ssh_known_hosts` (см. runbook).
-- [ ] В `sac-api.env`: только `KEY=value` на строку, комментарии отдельной строкой с `#`.
-
----
-
-## SAC (backend / deploy)
-
-- [x] **Defer** `notify_lifecycle` и `notify_auth_login` в background (как `report.daily.*` → `schedule_notify_daily_report`), чтобы ingest не ждал Telegram API — **0.5.5**
-- [x] **Uvicorn workers:** 4 по умолчанию или `SAC_UVICORN_WORKERS` в `sac-api.env` / `sac-api-start.sh` — **0.5.5**
-- [x] **nginx:** отдельный `location` для `POST /api/v1/events` с увеличенным `proxy_read_timeout` — **0.5.5**
-- [ ] Опционально: метрики/лог длительности ingest и очереди при burst.
-- [x] UI: предупреждение при массовом update («N хостов — рекомендуется пачками») — **0.5.5**
-
----
-
-## ssh-monitor (агент)
-
-- [x] При **shutdown** / `SIGTERM` не увеличивать `sac-fail.count` — **2.3.2-SAC**
-- [x] После успешного heartbeat сбрасывать fail counter (успешный POST ingest) — уже было
-- [x] Watchdog: не слать Telegram при штатном restart во время SAC-update (state file `/var/lib/ssh-monitor/agent-update-in-progress` от updater) — **2.2.1-SAC**
-- [x] Sudo bootstrap/update через SAC: не слать Telegram (`ssh_monitor_sudo_is_sac_maintenance`, state-file раньше) — **2.2.3-SAC**
-- [x] SAC: suppress `privilege.sudo.command` при `agent_update_state=running` / maintenance command — **0.5.3**
-- [x] Документировать рекомендуемый `SAC_TIMEOUT_SEC` при тяжёлом ingest — **2.3.2-SAC** (`docs/sac-ingest.ru.md`)
-
----
-
-## Принято / сделано
-
-- [x] Pool БД 15+25, defer daily push — SAC **0.5.0**
-- [x] `sac-deploy.sh` без `source` конфига, preflight pydantic — SAC `fa1bd41`
-- [x] Watchdog: строка `🖥️ Сервер:` в Telegram — ssh-monitor **2.1.9-SAC**
-
----
-
-*После реализации пунктов SAC — bump `APP_VERSION` и runbook.*

docs/install-ubuntu-24.04-docker.md

@@ -24,7 +24,7 @@ Docker удобен для локальной отладки или изолир
 
 ```bash
 sudo apt install -y git
-sudo git clone https://git.papatramp.ru/PapaTramp/security-alert-center.git /opt/security-alert-center
+sudo git clone https://git.kalinamall.ru/PapaTramp/security-alert-center.git /opt/security-alert-center
 sudo chown -R "$USER:$USER" /opt/security-alert-center
 ```
 

docs/install-ubuntu-24.04-native.md

@@ -71,7 +71,7 @@ nginx -v
 
 ```bash
 sudo mkdir -p /opt
-sudo git clone https://git.papatramp.ru/PapaTramp/security-alert-center.git /opt/security-alert-center
+sudo git clone https://git.kalinamall.ru/PapaTramp/security-alert-center.git /opt/security-alert-center
 ```
 
 ---

docs/install-ubuntu-24.04.md

@@ -14,7 +14,7 @@
 ```bash
 # см. полный чеклист в native-руководстве
 sudo apt update && sudo apt install -y git postgresql nginx python3.12 python3.12-venv
-sudo git clone https://git.papatramp.ru/PapaTramp/security-alert-center.git /opt/security-alert-center
+sudo git clone https://git.kalinamall.ru/PapaTramp/security-alert-center.git /opt/security-alert-center
 # … PostgreSQL, venv, config/sac-api.env, systemd, nginx
 ```
 

docs/operations-prod-status.md

@@ -39,7 +39,7 @@ sudo /opt/sac-deploy.sh
 | Параметр | Значение |
 |----------|----------|
 | Хост | `ubabuba` / `10.10.36.9` |
-| Репозиторий | `git.papatramp.ru/PapaTramp/ssh-monitor` (`main`, есть `sac-client.sh`) |
+| Репозиторий | `git.kalinamall.ru/PapaTramp/ssh-monitor` (`main`, есть `sac-client.sh`) |
 | `UseSAC` | пилот **exclusive** — см. [pilot-2.1-exclusive.md](pilot-2.1-exclusive.md) |
 | Сервис | `ssh-monitor.service` — **active** |
 | `--check-sac` | OK (health + ingest `agent.test` 202) |

docs/roadmap.md

@@ -66,7 +66,7 @@
 
 **Цель:** нативный Android-клиент и push по тем же правилам оповещений, что Telegram/email/webhook.
 
-Репозиторий клиента: [seaca](https://git.papatramp.ru/PapaTramp/seaca) (Kotlin, Jetpack Compose, FCM).
+Репозиторий клиента: [seaca](https://git.kalinamall.ru/PapaTramp/seaca) (Kotlin, Jetpack Compose, FCM).
 
 **Сервер SAC:**
 
@@ -77,7 +77,7 @@
 
 **Не в мобильном клиенте:** пользователи SAC, каналы Telegram/SMTP/webhook, админ-настройки.
 
-Подробный план клиента — [seaca/docs/ROADMAP.md](https://git.papatramp.ru/PapaTramp/seaca/src/branch/main/docs/ROADMAP.md).
+Подробный план клиента — [seaca/docs/ROADMAP.md](https://git.kalinamall.ru/PapaTramp/seaca/src/branch/main/docs/ROADMAP.md).
 
 ---
 
@@ -112,7 +112,7 @@
 | v0.1 | — (не требуется) | — |
 | v0.2 | TBD (тег с UseSAC) | TBD |
 | v0.3+ | совместимость schema 1.0 | совместимость schema 1.0 |
-| v0.6 | — | — (мобильный клиент [seaca](https://git.papatramp.ru/PapaTramp/seaca), не агент) |
+| v0.6 | — | — (мобильный клиент [seaca](https://git.kalinamall.ru/PapaTramp/seaca), не агент) |
 
 При breaking change схемы — `schema_version: 1.1` с поддержкой 1.0 на ingest.
 

docs/runbook-ops.md

@@ -18,32 +18,6 @@ curl -sS https://sac.kalinamall.ru/health | jq .
 
 Ожидается `status: ok`, `database: ok`. При устаревших heartbeat агентов — `status: degraded`, поле `hosts_stale` > 0.
 
-### `sac-api.env`: формат строк
-
-Файл читается **pydantic** (`SAC_CONFIG_FILE`), не как произвольный bash-скрипт.
-
-- Одна переменная — одна строка: `SAC_SSH_AUTO_ADD_HOST_KEY=false`
-- Комментарии — **отдельной** строкой с `#` в начале
-- **Нельзя** inline после значения: `false ← так и оставляем` — deploy упадёт на `alembic` с `bool_parsing`
-
-Проверка без деплоя:
-
-```bash
-sudo -u sac bash -c 'export SAC_CONFIG_FILE=/opt/security-alert-center/config/sac-api.env; cd /opt/security-alert-center/backend && .venv/bin/python -c "from app.config import get_settings; get_settings(); print(\"OK\")"'
-```
-
-### Linux SSH update: `known_hosts`
-
-Перед «Обновить ssh-monitor (SSH)» ключ хоста должен быть в файле (по умолчанию `config/ssh_known_hosts`):
-
-```bash
-ssh-keyscan -H 10.10.7.2 | sudo tee -a /opt/security-alert-center/config/ssh_known_hosts
-sudo chown sac:sac /opt/security-alert-center/config/ssh_known_hosts
-sudo chmod 600 /opt/security-alert-center/config/ssh_known_hosts
-```
-
-Иначе SAC: `Server '…' not found in known_hosts`. `SAC_SSH_AUTO_ADD_HOST_KEY=true` для prod не рекомендуется.
-
 ## Мобильные устройства (Seaca)
 
 См. [seaca-mobile.md](seaca-mobile.md) и [seaca-fcm.md](seaca-fcm.md).

docs/seaca-mobile.md

@@ -1,6 +1,6 @@
 # Seaca — мобильный клиент SAC
 
-Репозиторий приложения: [seaca](https://git.papatramp.ru/PapaTramp/seaca).  
+Репозиторий приложения: [seaca](https://git.kalinamall.ru/PapaTramp/seaca).  
 Требуется SAC **≥ 0.9.0** с применённой миграцией `014`.
 
 ---
@@ -84,7 +84,7 @@ SAC_FCM_SERVICE_ACCOUNT_JSON=/etc/security-alert-center/fcm-service-account.json
 | `sac.kalinamall.ru` | Web UI | yes (`git-sac-allowed`) |
 | `sac-api.kalinamall.ru` | Seaca, `/api/v1/mobile/*` | no (enroll + JWT) |
 
-Both resolve to the same SAC server (**192.168.160.145**). nginx must accept both names in `server_name`. See [reverse-proxy/docs/sac-access.md](https://git.papatramp.ru/PapaTramp/reverse-proxy/src/branch/main/docs/sac-access.md).
+Both resolve to the same SAC server (**192.168.160.145**). nginx must accept both names in `server_name`. See [reverse-proxy/docs/sac-access.md](https://git.kalinamall.ru/PapaTramp/reverse-proxy/src/branch/main/docs/sac-access.md).
 
 ---
 

docs/workspace-three-repos.md

@@ -8,9 +8,9 @@
 
 | Имя в workspace | Путь (пример Windows) | Remote |
 |-----------------|----------------------|--------|
-| `ssh-monitor` | `D:\Soft\Git\ssh-monitor` | git.papatramp.ru/PapaTramp/ssh-monitor |
-| `rdp-monitor` | `D:\Soft\Git\RDP-login-monitor` | git.papatramp.ru/PapaTramp/RDP-login-monitor |
-| `security-alert-center` | `D:\Soft\Git\security-alert-center` | git.papatramp.ru/PapaTramp/security-alert-center |
+| `ssh-monitor` | `D:\Soft\Git\ssh-monitor` | git.kalinamall.ru/PapaTramp/ssh-monitor |
+| `rdp-monitor` | `D:\Soft\Git\RDP-login-monitor` | git.kalinamall.ru/PapaTramp/RDP-login-monitor |
+| `security-alert-center` | `D:\Soft\Git\security-alert-center` | git.kalinamall.ru/PapaTramp/security-alert-center |
 
 Пути подставьте свои.
 
@@ -65,9 +65,9 @@ git push kalinamall main
 
 | Проект | URL |
 |--------|-----|
-| security-alert-center | `https://git.papatramp.ru/PapaTramp/security-alert-center.git` |
-| ssh-monitor | `https://git.papatramp.ru/PapaTramp/ssh-monitor.git` |
-| RDP-login-monitor | `https://git.papatramp.ru/PapaTramp/RDP-login-monitor.git` |
+| security-alert-center | `https://git.kalinamall.ru/PapaTramp/security-alert-center.git` |
+| ssh-monitor | `https://git.kalinamall.ru/PapaTramp/ssh-monitor.git` |
+| RDP-login-monitor | `https://git.kalinamall.ru/PapaTramp/RDP-login-monitor.git` |
 
 ---
 

frontend/src/api.ts

@@ -1,4 +1,4 @@
-const TOKEN_KEY = "sac_token";
+const TOKEN_KEY = "sac_token";
 const ROLE_KEY = "sac_role";
 
 export function getToken(): string | null {
@@ -31,14 +31,6 @@ export function clearToken(): void {
   localStorage.removeItem(ROLE_KEY);
 }
 
-export async function logoutApi(): Promise<void> {
-  try {
-    await fetch("/api/v1/auth/logout", { method: "POST", credentials: "same-origin" });
-  } catch {
-    /* ignore network errors on logout */
-  }
-}
-
 export class ApiError extends Error {
   status: number;
 
@@ -63,7 +55,7 @@ export async function apiFetch<T>(path: string, init: RequestInit = {}): Promise
   if (token) {
     headers.set("Authorization", `Bearer ${token}`);
   }
-  const res = await fetch(path, { ...init, headers, credentials: "same-origin" });
+  const res = await fetch(path, { ...init, headers });
   const text = await res.text();
   if (res.status === 401) {
     if (hadToken) {
@@ -192,7 +184,6 @@ export interface EventSummary {
   title: string;
   summary: string;
   actor_user?: string | null;
-  session_duration_sec?: number | null;
   rdg_flap?: boolean;
   rdg_flap_pair_event_id?: number | null;
   rdg_flap_qwinsta_event_id?: number | null;
@@ -532,31 +523,6 @@ export function updateLinuxAdminSettings(payload: {
   });
 }
 
-export interface HostMgmtAccess {
-  host_id: number;
-  has_override: boolean;
-  user: string | null;
-  password_set: boolean;
-  password_hint: string | null;
-  effective_source: string;
-  effective_configured: boolean;
-  effective_user: string | null;
-}
-
-export function fetchHostAccess(hostId: number): Promise<HostMgmtAccess> {
-  return apiFetch<HostMgmtAccess>(`/api/v1/hosts/${hostId}/access`);
-}
-
-export function updateHostAccess(
-  hostId: number,
-  payload: { user?: string | null; password?: string | null; clear?: boolean },
-): Promise<HostMgmtAccess> {
-  return apiFetch<HostMgmtAccess>(`/api/v1/hosts/${hostId}/access`, {
-    method: "PUT",
-    body: JSON.stringify(payload),
-  });
-}
-
 export interface HostSshActionResult {
   ok: boolean;
   message: string;
@@ -639,9 +605,7 @@ export function addHostManually(body: HostManualAddRequest): Promise<HostRemoteA
 }
 
 export function fetchHostRemoteJob(hostId: number): Promise<HostRemoteActionJobStatus> {
-  return apiFetch<HostRemoteActionJobStatus>(
-    `/api/v1/hosts/${hostId}/actions/remote-job?_ts=${Date.now()}`,
-  );
+  return apiFetch<HostRemoteActionJobStatus>(`/api/v1/hosts/${hostId}/actions/remote-job`);
 }
 
 export interface HostSessionItem {

frontend/src/components/AppSidebar.vue

@@ -1,4 +1,4 @@
-<template>
+<template>
   <aside class="sac-sidebar">
     <div class="sac-sidebar-brand">
       <img src="/sac-icon.png" alt="" class="sac-brand-logo" width="40" height="40" />
@@ -42,7 +42,7 @@
 <script setup lang="ts">
 import { computed } from "vue";
 import { useRoute, useRouter } from "vue-router";
-import { clearToken, isAdmin, logoutApi } from "../api";
+import { clearToken, isAdmin } from "../api";
 import SidebarSystemStats from "./SidebarSystemStats.vue";
 import { useSacVersion } from "../composables/useSacVersion";
 import {
@@ -82,10 +82,8 @@ function isActive(item: (typeof navItems.value)[number]) {
 }
 
 function logout() {
-  void logoutApi().finally(() => {
-    clearToken();
-    router.push("/login");
-  });
+  clearToken();
+  router.push("/login");
 }
 </script>
 

frontend/src/components/HostActionLogModal.vue

@@ -1,60 +1,31 @@
 <template>
   <div v-if="open" class="host-action-log-dock" aria-live="polite">
-    <div
-      class="host-action-log-panel"
-      :class="{ 'host-action-log-panel-done': !isLoading && ok === true, 'host-action-log-panel-fail': !isLoading && ok === false }"
-      role="dialog"
-      :aria-label="displayTitle"
-    >
+    <div class="host-action-log-panel" role="dialog" :aria-label="title">
       <div class="host-action-log-header">
-        <h3>
-          <span v-if="!isLoading && ok === true" class="host-action-log-mark host-action-log-mark-ok" aria-hidden="true">✓</span>
-          <span v-else-if="!isLoading && ok === false" class="host-action-log-mark host-action-log-mark-fail" aria-hidden="true">✗</span>
-          {{ displayTitle }}
-        </h3>
+        <h3>{{ title }}</h3>
         <button
           type="button"
           class="host-action-log-icon-btn"
-          :title="isLoading ? 'Свернуть — обновление продолжится на сервере' : 'Закрыть'"
-          :aria-label="isLoading ? 'Свернуть' : 'Закрыть'"
+          :title="loading ? 'Свернуть — обновление продолжится на сервере' : 'Закрыть'"
+          :aria-label="loading ? 'Свернуть' : 'Закрыть'"
           @click="emit('close')"
         >
           ×
         </button>
       </div>
-      <p v-if="isLoading" class="host-action-log-status">
+      <p v-if="loading" class="host-action-log-status">
         <span class="host-action-log-spinner" aria-hidden="true" />
         Выполняется на удалённом хосте… Можно запустить обновление других хостов.
       </p>
-      <p
-        v-else-if="ok === true"
-        class="host-action-log-message success host-action-log-result"
-      >
-        {{ displayMessage }}
-      </p>
-      <p
-        v-else-if="ok === false"
-        class="host-action-log-message error host-action-log-result"
-      >
-        {{ displayMessage }}
-      </p>
-      <p v-else-if="displayMessage && isLoading" class="muted host-action-log-sub host-action-log-message">
-        {{ displayMessage }}
-      </p>
-      <p v-if="!isLoading && ok === true && autoCloseSec > 0" class="muted host-action-log-sub">
-        Окно закроется автоматически через {{ autoCloseSec }} с
-      </p>
-      <pre
-        v-show="logVisible"
-        ref="logPreRef"
-        class="host-action-log-output"
-      >{{ displayOutput }}</pre>
+      <p v-if="message && !loading" class="host-action-log-message" :class="messageClass">{{ message }}</p>
+      <p v-else-if="message && loading" class="muted host-action-log-sub host-action-log-message">{{ message }}</p>
+      <pre v-if="output" class="host-action-log-output">{{ output }}</pre>
       <div class="host-action-log-actions">
-        <button type="button" class="secondary" @click="emit('toggle-log')">
-          {{ logVisible ? "Скрыть лог" : "Показать лог" }}
+        <button v-if="loading" type="button" class="secondary" @click="emit('close')">
+          Свернуть
         </button>
-        <button type="button" class="secondary" @click="emit('close')">
-          {{ isLoading ? "Свернуть" : "Закрыть" }}
+        <button v-else type="button" class="secondary" @click="emit('close')">
+          Закрыть
         </button>
       </div>
     </div>
@@ -62,210 +33,24 @@
 </template>
 
 <script setup lang="ts">
-import { computed, nextTick, onUnmounted, ref, watch } from "vue";
-import { fetchHostRemoteJob, type HostRemoteActionJobStatus } from "../api";
-
-const LOG_POLL_MS = 1500;
-const AUTO_CLOSE_MS = 30_000;
+import { computed } from "vue";
 
 const props = defineProps<{
-  hostId: number;
   open: boolean;
   title: string;
   loading: boolean;
   ok: boolean | null;
   message: string;
   output: string;
-  logPlaceholder: string;
-  logVisible: boolean;
-  sessionStartedAt: string;
 }>();
 
 const emit = defineEmits<{
   close: [];
-  "toggle-log": [];
-  finished: [job: HostRemoteActionJobStatus];
 }>();
 
-const logPreRef = ref<HTMLElement | null>(null);
-const polledOutput = ref("");
-const polledMessage = ref("");
-const isLoading = ref(true);
-const ok = ref<boolean | null>(null);
-const localTitle = ref("");
-const localMessage = ref("");
-const autoCloseSec = ref(0);
-let pollTimer: ReturnType<typeof setInterval> | null = null;
-let countdownTimer: ReturnType<typeof setInterval> | null = null;
-let finishedEmitted = false;
-let sawRunning = false;
-
-function isTerminalJob(job: HostRemoteActionJobStatus): boolean {
-  const st = (job.status || "").toLowerCase();
-  return st === "success" || st === "failed";
-}
-
-function jobStartedAfterSession(job: HostRemoteActionJobStatus): boolean {
-  const started = job.started_at;
-  if (!started) return false;
-  const jobMs = Date.parse(started);
-  const sessionMs = Date.parse(props.sessionStartedAt);
-  if (Number.isNaN(jobMs) || Number.isNaN(sessionMs)) return false;
-  return jobMs >= sessionMs - 3000;
-}
-
-function isJobRunning(job: HostRemoteActionJobStatus): boolean {
-  if (job.active) return true;
-  const st = (job.status || "").toLowerCase();
-  if (st === "running") return true;
-  return (job.agent_update_state || "").toLowerCase() === "running";
-}
-
-const displayTitle = computed(() => {
-  if (localTitle.value) return localTitle.value;
-  return props.title;
-});
-
-const displayMessage = computed(() => {
-  if (localMessage.value) return localMessage.value;
-  if (polledMessage.value) return polledMessage.value;
-  return props.message;
-});
-
-const displayOutput = computed(() => {
-  const text = (polledOutput.value || props.output).trim();
-  return text || props.logPlaceholder;
-});
-
-function stopPoll() {
-  if (pollTimer != null) {
-    clearInterval(pollTimer);
-    pollTimer = null;
-  }
-}
-
-function stopCountdown() {
-  if (countdownTimer != null) {
-    clearInterval(countdownTimer);
-    countdownTimer = null;
-  }
-  autoCloseSec.value = 0;
-}
-
-function startCountdown() {
-  stopCountdown();
-  autoCloseSec.value = Math.ceil(AUTO_CLOSE_MS / 1000);
-  countdownTimer = setInterval(() => {
-    if (autoCloseSec.value <= 1) {
-      stopCountdown();
-      return;
-    }
-    autoCloseSec.value -= 1;
-  }, 1000);
-}
-
-function applyFinishedJob(job: HostRemoteActionJobStatus) {
-  isLoading.value = false;
-  ok.value = job.ok ?? job.status === "success";
-  if (job.title) localTitle.value = job.title;
-  if (job.message) localMessage.value = job.message;
-  const out = (job.output || job.stdout || "").trim();
-  if (out) polledOutput.value = out;
-  if (ok.value) startCountdown();
-}
-
-async function pollJobOnce() {
-  try {
-    const job = await fetchHostRemoteJob(props.hostId);
-    const out = (job.output || job.stdout || "").trim();
-    if (out) polledOutput.value = out;
-    if (job.message && isLoading.value) polledMessage.value = job.message;
-
-    if (isJobRunning(job)) {
-      sawRunning = true;
-      return;
-    }
-
-    const canFinish =
-      isTerminalJob(job) && (sawRunning || jobStartedAfterSession(job));
-    if (canFinish) {
-      if (!finishedEmitted) {
-        finishedEmitted = true;
-        applyFinishedJob(job);
-        emit("finished", job);
-      }
-      stopPoll();
-    }
-  } catch {
-    /* следующий poll */
-  }
-}
-
-function startPoll() {
-  stopPoll();
-  void pollJobOnce();
-  pollTimer = setInterval(() => void pollJobOnce(), LOG_POLL_MS);
-}
-
-function resetLocalState() {
-  finishedEmitted = false;
-  sawRunning = false;
-  isLoading.value = true;
-  ok.value = null;
-  localTitle.value = "";
-  localMessage.value = "";
-  polledOutput.value = props.output.trim();
-  polledMessage.value = "";
-  stopCountdown();
-}
-
-watch(
-  () => props.open,
-  (open) => {
-    if (open && isLoading.value) {
-      startPoll();
-    } else {
-      stopPoll();
-    }
-  },
-  { immediate: true },
-);
-
-watch(
-  () => props.loading,
-  (loading) => {
-    if (loading) {
-      resetLocalState();
-      if (props.open) startPoll();
-      return;
-    }
-    if (!finishedEmitted && props.ok != null) {
-      finishedEmitted = true;
-      isLoading.value = false;
-      ok.value = props.ok;
-      localTitle.value = props.title;
-      localMessage.value = props.message;
-      if (props.output.trim()) polledOutput.value = props.output.trim();
-      if (props.ok) startCountdown();
-      stopPoll();
-    }
-  },
-  { immediate: true },
-);
-
-watch(
-  () => [displayOutput.value, props.logVisible] as const,
-  async () => {
-    if (!props.logVisible) return;
-    await nextTick();
-    const el = logPreRef.value;
-    if (el) el.scrollTop = el.scrollHeight;
-  },
-);
-
-onUnmounted(() => {
-  stopPoll();
-  stopCountdown();
+const messageClass = computed(() => {
+  if (props.loading || props.ok == null) return "muted";
+  return props.ok ? "success" : "error";
 });
 </script>
 
@@ -286,14 +71,6 @@ onUnmounted(() => {
   padding: 0.85rem 1rem 1rem;
 }
 
-.host-action-log-panel-done {
-  border-color: #3fb950;
-}
-
-.host-action-log-panel-fail {
-  border-color: #f85149;
-}
-
 .host-action-log-header {
   display: flex;
   align-items: flex-start;
@@ -305,22 +82,6 @@ onUnmounted(() => {
   margin: 0;
   font-size: 1rem;
   line-height: 1.3;
-  display: flex;
-  align-items: flex-start;
-  gap: 0.35rem;
-}
-
-.host-action-log-mark {
-  flex-shrink: 0;
-  font-weight: 700;
-}
-
-.host-action-log-mark-ok {
-  color: #3fb950;
-}
-
-.host-action-log-mark-fail {
-  color: #f85149;
 }
 
 .host-action-log-icon-btn {
@@ -361,20 +122,6 @@ onUnmounted(() => {
   word-break: break-word;
 }
 
-.host-action-log-result {
-  margin: 0.65rem 0 0;
-  font-size: 0.95rem;
-  font-weight: 500;
-}
-
-.host-action-log-message.success {
-  color: #3fb950;
-}
-
-.host-action-log-message.error {
-  color: #f85149;
-}
-
 .host-action-log-spinner {
   width: 1rem;
   height: 1rem;

frontend/src/components/HostActionLogStack.vue

@@ -1,23 +1,16 @@
 <template>
-  <div v-if="hasOpenLogs" class="host-action-log-stack" aria-live="polite">
-    <template v-for="entry in hostRemoteActionLogs" :key="entry.id">
-      <HostActionLogModal
-        v-if="entry.open"
-        :host-id="entry.hostId"
-        :open="true"
-        :title="entry.title"
-        :loading="entry.loading"
-        :ok="entry.ok"
-        :message="entry.message"
-        :output="entry.output"
-        :log-placeholder="entry.logPlaceholder"
-        :log-visible="entry.logVisible"
-        :session-started-at="entry.sessionStartedAt"
-        @close="closeHostRemoteActionLog(entry.id)"
-        @toggle-log="toggleHostRemoteActionLog(entry.id)"
-        @finished="syncHostRemoteActionJobFinished(entry.id, $event)"
-      />
-    </template>
+  <div v-if="openLogs.length" class="host-action-log-stack" aria-live="polite">
+    <HostActionLogModal
+      v-for="entry in openLogs"
+      :key="entry.id"
+      :open="true"
+      :title="entry.title"
+      :loading="entry.loading"
+      :ok="entry.ok"
+      :message="entry.message"
+      :output="entry.output"
+      @close="closeHostRemoteActionLog(entry.id)"
+    />
   </div>
 </template>
 
@@ -27,11 +20,9 @@ import HostActionLogModal from "./HostActionLogModal.vue";
 import {
   closeHostRemoteActionLog,
   hostRemoteActionLogs,
-  syncHostRemoteActionJobFinished,
-  toggleHostRemoteActionLog,
 } from "../composables/useHostRemoteAction";
 
-const hasOpenLogs = computed(() => hostRemoteActionLogs.some((e) => e.open));
+const openLogs = computed(() => hostRemoteActionLogs.filter((e) => e.open));
 </script>
 
 <style scoped>

frontend/src/composables/useHostRemoteAction.ts

@@ -16,16 +16,11 @@ export type HostRemoteActionLogEntry = {
   id: string;
   hostId: number;
   open: boolean;
-  logVisible: boolean;
   loading: boolean;
   ok: boolean | null;
   title: string;
   message: string;
   output: string;
-  /** Текст в окне лога, пока output с сервера ещё пустой */
-  logPlaceholder: string;
-  /** ISO-время открытия окна — отсекаем stale success от прошлого job */
-  sessionStartedAt: string;
 };
 
 export const hostRemoteActionLogs = reactive<HostRemoteActionLogEntry[]>([]);
@@ -86,22 +81,12 @@ function scheduleSuccessAutoClose(entryId: string) {
 }
 
 function applyJobToEntry(entry: HostRemoteActionLogEntry, job: HostRemoteActionJobStatus) {
-  if (job.title) {
-    entry.title = job.title;
-  }
-  if (job.message) {
-    entry.message = job.message;
-  }
-  const nextOutput = (job.output || job.stdout || "").trim();
-  if (nextOutput) {
-    entry.output = job.output || job.stdout || "";
-  }
+  entry.title = job.title || entry.title;
+  entry.message = job.message || entry.message;
+  entry.output = job.output || job.stdout || "";
 }
 
 function finishEntry(entry: HostRemoteActionLogEntry, job: HostRemoteActionJobStatus) {
-  if (!entry.loading && entry.ok != null) {
-    return;
-  }
   entry.loading = false;
   entry.ok = job.ok ?? job.status === "success";
   applyJobToEntry(entry, job);
@@ -111,16 +96,6 @@ function finishEntry(entry: HostRemoteActionLogEntry, job: HostRemoteActionJobSt
   }
 }
 
-export function syncHostRemoteActionJobFinished(
-  entryId: string,
-  job: HostRemoteActionJobStatus,
-): void {
-  const entry = findLogById(entryId);
-  if (!entry) return;
-  finishEntry(entry, job);
-  void patchHostFromJob(entry.hostId, job);
-}
-
 async function pollRemoteJob(hostId: number, entry: HostRemoteActionLogEntry): Promise<HostRemoteActionJobStatus> {
   for (;;) {
     const job = await fetchHostRemoteJob(hostId);
@@ -191,7 +166,6 @@ async function executeRemoteAction(
 export async function pollHostRemoteAction(
   hostId: number,
   title: string,
-  logPlaceholder?: string,
 ): Promise<HostRemoteActionJobStatus | null> {
   const existingPromise = hostRunningPromises.get(hostId);
   if (existingPromise) {
@@ -206,14 +180,11 @@ export async function pollHostRemoteAction(
     id: newLogId(),
     hostId,
     open: true,
-    logVisible: false,
     loading: true,
     ok: null,
     title,
     message: "Выполняется на удалённом хосте…",
     output: "",
-    logPlaceholder: logPlaceholder || "Ожидание лога с хоста…",
-    sessionStartedAt: new Date().toISOString(),
   };
   hostRemoteActionLogs.push(entry);
 
@@ -244,7 +215,6 @@ export async function runHostRemoteAction(
   hostId: number,
   title: string,
   kind: HostRemoteActionKind,
-  logPlaceholder?: string,
 ): Promise<HostRemoteActionJobStatus | null> {
   const existingPromise = hostRunningPromises.get(hostId);
   if (existingPromise) {
@@ -259,14 +229,11 @@ export async function runHostRemoteAction(
     id: newLogId(),
     hostId,
     open: true,
-    logVisible: false,
     loading: true,
     ok: null,
     title,
     message: "Запуск на сервере SAC…",
     output: "",
-    logPlaceholder: logPlaceholder || "Ожидание лога с хоста…",
-    sessionStartedAt: new Date().toISOString(),
   };
   hostRemoteActionLogs.push(entry);
 
@@ -279,13 +246,6 @@ export async function runHostRemoteAction(
   }
 }
 
-export function toggleHostRemoteActionLog(entryId: string) {
-  const entry = findLogById(entryId);
-  if (!entry) return;
-  entry.logVisible = !entry.logVisible;
-  entry.open = true;
-}
-
 export function closeHostRemoteActionLog(entryId: string) {
   clearAutoCloseTimer(entryId);
   const entry = findLogById(entryId);

frontend/src/composables/useSacLiveEventStream.ts

@@ -1,4 +1,4 @@
-import { onMounted, onUnmounted, ref } from "vue";
+import { onMounted, onUnmounted, ref } from "vue";
 import { getToken } from "../api";
 
 export interface SacDashboardStreamMessage {
@@ -41,7 +41,7 @@ export function useSacLiveEventStream(onNewEvent: () => void) {
     if (!token) return;
 
     eventSource?.close();
-    const url = `/api/v1/stream/events`;
+    const url = `/api/v1/stream/events?token=${encodeURIComponent(token)}`;
     eventSource = new EventSource(url);
 
     eventSource.onopen = () => {

frontend/src/utils/hostAgentUpgrade.ts

@@ -58,37 +58,3 @@ export function remoteActionTitleForHost(host: HostSummary): string {
   }
   return `Обновление ssh-monitor (SSH): ${label}`;
 }
-
-const LOG_PLACEHOLDER_SSH_UPDATE =
-  "Ожидание лога с хоста…\n(обновление /var/log/update_script.log)";
-
-const LOG_PLACEHOLDER_WINRM =
-  "Ожидание вывода с хоста…\n(WinRM: Deploy-LoginMonitor.ps1)";
-
-const LOG_PLACEHOLDER_GENERIC = "Ожидание лога с хоста…";
-
-export function remoteActionLogPlaceholder(
-  host: Pick<HostSummary, "os_family" | "product"> | null | undefined,
-  kind: HostRemoteActionKind | null,
-): string {
-  if (kind === "ssh-update") {
-    return LOG_PLACEHOLDER_SSH_UPDATE;
-  }
-  if (host && isWindowsAgentHost(host)) {
-    return LOG_PLACEHOLDER_WINRM;
-  }
-  if (kind === "fallback") {
-    return LOG_PLACEHOLDER_SSH_UPDATE;
-  }
-  return LOG_PLACEHOLDER_GENERIC;
-}
-
-export function remoteActionLogPlaceholderFromTitle(title: string): string {
-  if (/winrm/i.test(title)) {
-    return LOG_PLACEHOLDER_WINRM;
-  }
-  if (/ssh-monitor|\/var\/log\/update_script/i.test(title)) {
-    return LOG_PLACEHOLDER_SSH_UPDATE;
-  }
-  return LOG_PLACEHOLDER_GENERIC;
-}

frontend/src/utils/sessionDuration.ts

@@ -1,17 +0,0 @@
-/** Human-readable session_duration_sec for event tables. */
-
-export function formatSessionDuration(seconds: number | null | undefined): string {
-  if (seconds == null || !Number.isFinite(seconds) || seconds < 0) {
-    return "—";
-  }
-  const total = Math.floor(seconds);
-  const days = Math.floor(total / 86_400);
-  const hours = Math.floor((total % 86_400) / 3600);
-  const minutes = Math.floor((total % 3600) / 60);
-  const secs = total % 60;
-  const clock = `${String(hours).padStart(2, "0")}:${String(minutes).padStart(2, "0")}:${String(secs).padStart(2, "0")}`;
-  if (days > 0) {
-    return `${days}д ${clock}`;
-  }
-  return clock;
-}

frontend/src/version.ts

@@ -1,4 +1,4 @@
-/** Fallback до загрузки /health; при релизе держите в sync с backend/app/version.py */
+/** Fallback до загрузки /health; при релизе держите в sync с backend/app/version.py */
 export const APP_NAME = "Security Alert Center";
-export const APP_VERSION = "0.5.17";
+export const APP_VERSION = "0.4.11";
 export const APP_VERSION_LABEL = `${APP_NAME} v.${APP_VERSION}`;

frontend/src/views/DashboardView.vue

@@ -1,4 +1,4 @@
-<template>
+<template>
   <div class="overview-page">
       <h1>Обзор</h1>
 
@@ -238,8 +238,6 @@
 
           <th>Пользователь</th>
 
-          <th title="Длительность сессии (из session_duration_sec)">Длительность</th>
-
           <th>Версия агента</th>
 
           <th>Severity</th>
@@ -278,8 +276,6 @@
 
           <td>{{ e.actor_user || "—" }}</td>
 
-          <td>{{ formatSessionDuration(e.session_duration_sec) }}</td>
-
           <td>{{ e.product_version || "—" }}</td>
 
           <td :class="'sev-' + e.severity">{{ e.severity }}</td>
@@ -358,7 +354,6 @@ import RdgQwinstaModal from "../components/RdgQwinstaModal.vue";
 import { useRdgQwinsta } from "../composables/useRdgQwinsta";
 import { formatServerName } from "../utils/hostDisplay";
 import { hasRdgFlapUi, rdgQwinstaEventId } from "../utils/rdgFlap";
-import { formatSessionDuration } from "../utils/sessionDuration";
 import { markEventSessionTerminatedInList, showEventSessionTerminateButton } from "../utils/sessionActions";
 
 const { qwinstaLoadingId, qwinstaModal, closeQwinstaModal, runQwinsta, runLogoff } = useRdgQwinsta();
@@ -561,7 +556,7 @@ function connectLive() {
 
   eventSource?.close();
 
-  const url = `/api/v1/stream/events`;
+  const url = `/api/v1/stream/events?token=${encodeURIComponent(token)}`;
 
   eventSource = new EventSource(url);
 

frontend/src/views/EventsView.vue

@@ -34,7 +34,6 @@
           <th>Хост</th>
           <th>Имя сервера</th>
           <th>Пользователь</th>
-          <th title="Длительность сессии (из session_duration_sec)">Длительность</th>
           <th>Версия агента</th>
           <th>Severity</th>
           <th>Type</th>
@@ -51,7 +50,6 @@
           <td>{{ e.hostname }}</td>
           <td>{{ formatServerName(e.display_name) }}</td>
           <td>{{ e.actor_user || "—" }}</td>
-          <td>{{ formatSessionDuration(e.session_duration_sec) }}</td>
           <td>{{ e.product_version || "—" }}</td>
           <td :class="'sev-' + e.severity">{{ e.severity }}</td>
           <td><code>{{ e.type }}</code></td>
@@ -122,7 +120,6 @@ import {
   type EventsListState,
 } from "../utils/eventsListQuery";
 import { formatServerName } from "../utils/hostDisplay";
-import { formatSessionDuration } from "../utils/sessionDuration";
 import { markEventSessionTerminatedInList, showEventSessionTerminateButton } from "../utils/sessionActions";
 
 const route = useRoute();

frontend/src/views/HostDetailView.vue

@@ -69,52 +69,6 @@
           <dd>{{ host.event_count ?? 0 }}</dd>
         </div>
       </dl>
-
-      <section v-if="showAgentConfig" class="host-mgmt-access">
-        <h3>{{ isWindowsHost ? "WinRM / доступ к хосту" : "SSH / доступ к хосту" }}</h3>
-        <p class="muted">
-          Переопределение для этого ПК. Если пусто — используются глобальные учётные данные из
-          <RouterLink to="/settings">Настройки</RouterLink>
-          ({{ isWindowsHost ? "Windows admin" : "Linux admin" }}).
-          Сейчас effective:
-          <strong>{{ accessEffectiveLabel }}</strong>
-        </p>
-        <form class="agent-config-form" @submit.prevent="saveHostAccess">
-          <label class="config-field">
-            Логин
-            <input
-              v-model="accessForm.user"
-              type="text"
-              :placeholder="isWindowsHost ? 'COMPUTER\\user или .\\Administrator' : 'root'"
-              autocomplete="off"
-            />
-          </label>
-          <label class="config-field">
-            Пароль
-            <input
-              v-model="accessForm.password"
-              type="password"
-              :placeholder="accessForm.passwordSet ? '•••• (оставьте пустым, чтобы не менять)' : ''"
-              autocomplete="new-password"
-            />
-          </label>
-          <div class="host-actions-row">
-            <button type="submit" :disabled="savingAccess">
-              {{ savingAccess ? "Сохранение…" : "Сохранить доступ" }}
-            </button>
-            <button
-              type="button"
-              class="secondary"
-              :disabled="savingAccess || !accessForm.hasOverride"
-              @click="clearHostAccess"
-            >
-              Сбросить (глобальные)
-            </button>
-          </div>
-          <p v-if="accessMessage" :class="accessOk ? 'success' : 'error'">{{ accessMessage }}</p>
-        </form>
-      </section>
-
       <div v-if="isWindowsHost" class="host-actions">
         <button
           type="button"
@@ -342,8 +296,6 @@ import {
 import {
   apiFetch,
   fetchHost,
-  fetchHostAccess,
-  updateHostAccess,
   fetchRecentEvents,
   testHostWinRm,
   testHostSsh,
@@ -351,7 +303,6 @@ import {
   patchHostAgentConfig,
   type EventListResponse,
   type HostDetail,
-  type HostMgmtAccess,
 } from "../api";
 import { emitHostPatch } from "../utils/hostPatchBus";
 import HostSessionsPanel from "../components/HostSessionsPanel.vue";
@@ -364,7 +315,6 @@ import {
 import {
   isLinuxAgentHost,
   remoteActionKindForHost,
-  remoteActionLogPlaceholder,
   remoteActionTitleForHost,
   type AgentGitVersions,
 } from "../utils/hostAgentUpgrade";
@@ -403,32 +353,6 @@ const configForm = reactive({
   serverDisplayName: "",
   getInventory: true,
 });
-const savingAccess = ref(false);
-const accessMessage = ref("");
-const accessOk = ref(false);
-const accessForm = reactive({
-  user: "",
-  password: "",
-  passwordSet: false,
-  hasOverride: false,
-  effectiveSource: "",
-  effectiveUser: "",
-  effectiveConfigured: false,
-});
-const accessEffectiveLabel = computed(() => {
-  if (!accessForm.effectiveConfigured) {
-    return "не настроено";
-  }
-  const src =
-    accessForm.effectiveSource === "host"
-      ? "override хоста"
-      : accessForm.effectiveSource === "db"
-        ? "глобальные (Settings)"
-        : accessForm.effectiveSource === "env"
-          ? "env"
-          : accessForm.effectiveSource;
-  return `${accessForm.effectiveUser || "—"} · ${src}`;
-});
 let sshTestHideTimer: ReturnType<typeof setTimeout> | null = null;
 let winRmTestHideTimer: ReturnType<typeof setTimeout> | null = null;
 let sshProbeSeq = 0;
@@ -714,7 +638,7 @@ async function runRequestAgentUpdate() {
 async function runAgentFallback() {
   agentControlMessage.value = "";
   const title = isWindowsHost.value ? "Обновление через WinRM" : "Fallback SSH (ssh-monitor)";
-  const job = await runHostRemoteAction(hostId.value, title, "fallback", remoteActionLogPlaceholder(host.value, "fallback"));
+  const job = await runHostRemoteAction(hostId.value, title, "fallback");
   if (job) {
     agentControlOk.value = job.ok ?? false;
     if (job.ok) {
@@ -753,67 +677,6 @@ async function saveAgentConfig() {
   }
 }
 
-async function applyAccessView(view: HostMgmtAccess) {
-  accessForm.user = view.user || "";
-  accessForm.password = "";
-  accessForm.passwordSet = view.password_set;
-  accessForm.hasOverride = view.has_override;
-  accessForm.effectiveSource = view.effective_source;
-  accessForm.effectiveUser = view.effective_user || "";
-  accessForm.effectiveConfigured = view.effective_configured;
-}
-
-async function loadHostAccess() {
-  accessMessage.value = "";
-  try {
-    const view = await fetchHostAccess(hostId.value);
-    applyAccessView(view);
-  } catch (e) {
-    accessOk.value = false;
-    accessMessage.value = e instanceof Error ? e.message : "Не удалось загрузить доступ хоста";
-  }
-}
-
-async function saveHostAccess() {
-  savingAccess.value = true;
-  accessMessage.value = "";
-  try {
-    const payload: { user?: string | null; password?: string | null } = {
-      user: accessForm.user,
-    };
-    if (accessForm.password.trim()) {
-      payload.password = accessForm.password;
-    }
-    const view = await updateHostAccess(hostId.value, payload);
-    applyAccessView(view);
-    accessOk.value = true;
-    accessMessage.value = view.has_override
-      ? "Сохранено (override хоста)"
-      : "Сохранено (логин очищен — глобальные настройки)";
-  } catch (e) {
-    accessOk.value = false;
-    accessMessage.value = e instanceof Error ? e.message : "Ошибка сохранения доступа";
-  } finally {
-    savingAccess.value = false;
-  }
-}
-
-async function clearHostAccess() {
-  savingAccess.value = true;
-  accessMessage.value = "";
-  try {
-    const view = await updateHostAccess(hostId.value, { clear: true });
-    applyAccessView(view);
-    accessOk.value = true;
-    accessMessage.value = "Override сброшен — используются глобальные настройки";
-  } catch (e) {
-    accessOk.value = false;
-    accessMessage.value = e instanceof Error ? e.message : "Ошибка сброса доступа";
-  } finally {
-    savingAccess.value = false;
-  }
-}
-
 async function loadHost() {
   loading.value = true;
   error.value = "";
@@ -828,7 +691,6 @@ async function loadHost() {
   try {
     const detail = await fetchHost(hostId.value);
     applyHostDetail(detail);
-    void loadHostAccess();
     if (isLinuxHostDetail(detail)) {
       void probeSshOnOpen();
     }
@@ -844,7 +706,6 @@ async function runAgentUpdate() {
     hostId.value,
     "Обновление ssh-monitor (SSH)",
     "ssh-update",
-    remoteActionLogPlaceholder(host.value, "ssh-update"),
   );
   if (job?.ok) {
     const detail = await fetchHost(hostId.value);
@@ -867,7 +728,6 @@ async function runAgentUpgradeFromCell() {
     hostId.value,
     remoteActionTitleForHost(host.value),
     kind,
-    remoteActionLogPlaceholder(host.value, kind),
   );
   if (job?.ok) {
     const detail = await fetchHost(hostId.value);
@@ -985,49 +845,6 @@ watch(
   color: #9aa4b2;
 }
 
-.host-mgmt-access {
-  margin: 1rem 0 1.25rem;
-  padding: 0.85rem 1rem;
-  border: 1px solid #2a3340;
-  border-radius: 8px;
-  background: #141a22;
-}
-
-.host-mgmt-access h3 {
-  margin: 0 0 0.35rem;
-  font-size: 1rem;
-}
-
-.host-mgmt-form {
-  display: flex;
-  flex-direction: column;
-  gap: 0.65rem;
-  margin-top: 0.75rem;
-  max-width: 28rem;
-}
-
-.host-mgmt-field {
-  display: flex;
-  flex-direction: column;
-  gap: 0.25rem;
-  font-size: 0.9rem;
-}
-
-.host-mgmt-field input {
-  padding: 0.4rem 0.55rem;
-  border-radius: 6px;
-  border: 1px solid #3a4554;
-  background: #0f1419;
-  color: #e8eef5;
-}
-
-.host-mgmt-actions {
-  display: flex;
-  flex-wrap: wrap;
-  gap: 0.5rem;
-  align-items: center;
-}
-
 .host-actions {
   margin-top: 1rem;
   display: flex;

frontend/src/views/HostsView.vue

@@ -135,12 +135,9 @@ import { isAgentVersionOutdated } from "../utils/agentVersion";
 import {
   isGitAgentUpgradeAvailable,
   remoteActionKindForHost,
-  remoteActionLogPlaceholder,
-  remoteActionLogPlaceholderFromTitle,
   remoteActionTitleForHost,
 } from "../utils/hostAgentUpgrade";
 import {
-  hostRemoteActionLogs,
   isHostRemoteActionActive,
   pollHostRemoteAction,
   runHostRemoteAction,
@@ -247,37 +244,6 @@ function isVersionOutdated(h: HostSummary): boolean {
   return isAgentVersionOutdated(h.product_version, reference);
 }
 
-function countOutdatedUpgradeableHosts(): number {
-  return (data.value?.items ?? []).filter(
-    (h) => isGitAgentUpgradeAvailable(h, data.value) && isVersionOutdated(h),
-  ).length;
-}
-
-function countActiveRemoteUpgrades(): number {
-  return hostRemoteActionLogs.filter((e) => e.loading).length;
-}
-
-function confirmMassUpgradeIfNeeded(hostname: string): boolean {
-  const active = countActiveRemoteUpgrades();
-  const outdated = countOutdatedUpgradeableHosts();
-  if (active >= 2) {
-    return window.confirm(
-      `Сейчас обновляется ${active} хост(ов). Рекомендуется пачками по 2–3. Продолжить обновление «${hostname}»?`,
-    );
-  }
-  if (outdated > 3 && active >= 1) {
-    return window.confirm(
-      `Устарело агентов на странице: ${outdated}, уже идёт обновление. Продолжить «${hostname}»?`,
-    );
-  }
-  if (outdated > 3) {
-    return window.confirm(
-      `Устарело агентов на странице: ${outdated}. Рекомендуется обновлять пачками по 2–3, не все сразу. Продолжить «${hostname}»?`,
-    );
-  }
-  return true;
-}
-
 async function startAgentUpgrade(h: HostSummary) {
   if (!isGitAgentUpgradeAvailable(h, data.value)) {
     return;
@@ -286,17 +252,9 @@ async function startAgentUpgrade(h: HostSummary) {
     showHostRemoteActionLog(h.id);
     return;
   }
-  if (!confirmMassUpgradeIfNeeded(h.hostname)) {
-    return;
-  }
   const kind = remoteActionKindForHost(h);
   if (!kind) return;
-  void runHostRemoteAction(
-    h.id,
-    remoteActionTitleForHost(h),
-    kind,
-    remoteActionLogPlaceholder(h, kind),
-  );
+  void runHostRemoteAction(h.id, remoteActionTitleForHost(h), kind);
 }
 
 function openHost(id: number) {
@@ -457,11 +415,7 @@ interface HostDeleteResponse {
 
 async function onManualAddStarted(payload: { hostId: number; title: string }) {
   await loadHosts();
-  void pollHostRemoteAction(
-    payload.hostId,
-    payload.title,
-    remoteActionLogPlaceholderFromTitle(payload.title),
-  );
+  void pollHostRemoteAction(payload.hostId, payload.title);
 }
 
 async function confirmDelete(h: HostSummary) {

frontend/src/views/SettingsView.vue

@@ -1,4 +1,4 @@
-<template>
+<template>
   <div class="settings-page">
     <h1>Настройки</h1>
     <p class="settings-intro">
@@ -126,9 +126,8 @@
       <section class="card settings-card settings-policy">
         <h2>Windows (qwinsta / logoff)</h2>
         <p class="settings-hint settings-hint-top">
-          Глобальный (доменный) admin для удалённых команд на Windows-хостах (qwinsta, logoff, WinRM-update).
+          Доменный admin для удалённых команд на Windows-хостах (qwinsta, logoff через агент).
           Формат логина: <code>ДОМЕН\пользователь</code> (например <code>B26\papatramp</code>).
-          Для отдельного ПК (home/workgroup) задайте override в карточке <strong>Хосты → доступ к хосту</strong>.
           Пока запись не создана в UI — используются <code>SAC_WIN_ADMIN_*</code> из <code>sac-api.env</code>.
         </p>
         <form class="settings-form" @submit.prevent="saveWinAdminSettings">
@@ -187,9 +186,8 @@
       <section class="card settings-card settings-policy">
         <h2>Linux (SSH / обновление ssh-monitor)</h2>
         <p class="settings-hint settings-hint-top">
-          Глобальная SSH-учётка для удалённого запуска <code>/opt/scripts/update_ssh_monitor.sh</code> с карточки Linux-хоста.
+          SSH-учётка для удалённого запуска <code>/opt/scripts/update_ssh_monitor.sh</code> с карточки Linux-хоста.
           Рекомендуется <code>root</code> или пользователь с <code>sudo NOPASSWD</code>.
-          Для отдельного сервера задайте override в карточке <strong>Хосты → доступ к хосту</strong>.
           Пока запись не создана в UI — используются <code>SAC_LINUX_ADMIN_*</code> из <code>sac-api.env</code>.
         </p>
         <form class="settings-form" @submit.prevent="saveLinuxAdminSettings">
@@ -253,7 +251,7 @@
             <input
               v-model="agentUpdateForm.rdp_git_repo_url"
               type="text"
-              placeholder="https://git.papatramp.ru/PapaTramp/RDP-login-monitor.git"
+              placeholder="https://git.kalinamall.ru/PapaTramp/RDP-login-monitor.git"
             />
           </label>
           <label class="settings-field">
@@ -261,7 +259,7 @@
             <input
               v-model="agentUpdateForm.ssh_git_repo_url"
               type="text"
-              placeholder="https://git.papatramp.ru/PapaTramp/ssh-monitor.git"
+              placeholder="https://git.kalinamall.ru/PapaTramp/ssh-monitor.git"
             />
           </label>
           <label class="settings-field">

schemas/event-schema-v1.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://git.papatramp.ru/PapaTramp/security-alert-center/schemas/event-v1.json",
+  "$id": "https://git.kalinamall.ru/PapaTramp/security-alert-center/schemas/event-v1.json",
   "title": "Security Alert Center Event v1",
   "description": "Каноническое событие от ssh-monitor или RDP-login-monitor",
   "type": "object",
@@ -94,7 +94,6 @@
         "session.logind.new",
         "rdp.login.success",
         "rdp.login.failed",
-        "rdp.session.logoff",
         "rdp.shadow.control.started",
         "rdp.shadow.control.stopped",
         "rdp.shadow.control.permission",

tools/push-github-snapshot.sh

@@ -1,82 +0,0 @@
-#!/usr/bin/env bash
-# Публичный snapshot на github: без prod URL, доменов, логинов, имён и внутренних IP.
-set -Eeuo pipefail
-
-ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-WORK="$(mktemp -d "${TMPDIR:-/tmp}/sac-github-snapshot.XXXX")"
-trap 'rm -rf "$WORK"' EXIT
-
-REF="${1:-HEAD}"
-MSG="${2:-chore: public release snapshot $(date +%F) (SAC $(git -C "$ROOT" show -s --format=%s "$REF" | sed -n 's/.*(\([0-9.]*\)).*/\1/p' | head -1))}"
-
-echo "[snapshot] export $REF -> $WORK"
-git -C "$ROOT" archive --format=tar "$REF" \
-  | tar -x -C "$WORK" \
-  --exclude='.cursor' \
-  --exclude='.venv' \
-  --exclude='frontend/node_modules' \
-  --exclude='frontend/dist' \
-  --exclude='.env' \
-  --exclude='deploy/.env'
-
-apply_sed() {
-  local expr=$1
-  if [[ "$(uname -s)" == Darwin ]]; then
-    find "$WORK" -type f \( -name '*.py' -o -name '*.md' -o -name '*.ts' -o -name '*.vue' -o -name '*.sh' -o -name '*.ps1' -o -name '*.example' -o -name '*.yml' -o -name '*.json' -o -name '*.conf' \) \
-      ! -path '*/tools/push-github-snapshot.sh' \
-      -print0 | xargs -0 sed -i '' -E "$expr"
-  else
-    find "$WORK" -type f \( -name '*.py' -o -name '*.md' -o -name '*.ts' -o -name '*.vue' -o -name '*.sh' -o -name '*.ps1' -o -name '*.example' -o -name '*.yml' -o -name '*.json' -o -name '*.conf' \) \
-      ! -path '*/tools/push-github-snapshot.sh' \
-      -print0 | xargs -0 sed -i -E "$expr"
-  fi
-}
-
-echo "[snapshot] rewrite hosts, domains, logins, IPs"
-apply_sed 's#https://git\.kalinamall\.ru/PapaTramp#https://github.com/PTah#g'
-apply_sed 's#git\.kalinamall\.ru/PapaTramp#github.com/PTah#g'
-apply_sed 's#git\.kalinamall\.ru/papatramp#github.com/PTah#g'
-apply_sed 's#git\.papatramp\.ru/PapaTramp#github.com/PTah#g'
-apply_sed 's#git\.papatramp\.lan:[0-9]+/PapaTramp#github.com/PTah#g'
-apply_sed 's#sac\.kalinamall\.ru#sac.example.com#g'
-apply_sed 's#git\.kalinamall\.lan#github.com#g'
-apply_sed 's#kalinamall-sac\.conf#origin-sac.conf#g'
-apply_sed 's#remote add kalinamall#remote add origin#g'
-apply_sed 's#remote set-url kalinamall#remote set-url origin#g'
-apply_sed 's#B26\\\\#CONTOSO\\\\#g'
-apply_sed 's#B26\\#CONTOSO\\#g'
-apply_sed 's#papatramp#example.user#g'
-apply_sed 's#PapaTramp#PTah#g'
-apply_sed 's#192\.168\.160\.#192.0.2.#g'
-apply_sed 's#192\.168\.128\.#192.0.2.#g'
-apply_sed 's#192\.168\.163\.#192.0.2.#g'
-apply_sed 's#password="[^"]*"#password=_TEST_PASSWORD#g'
-apply_sed "s#password='[^']*'#password=_TEST_PASSWORD#g"
-apply_sed 's#postgresql\+psycopg2://sac:sac@#postgresql+psycopg2://sac:CHANGE_ME@#g'
-
-if ! grep -q '_TEST_PASSWORD' "$WORK/backend/tests/conftest.py" 2>/dev/null; then
-  sed -i.bak '1a\
-_TEST_PASSWORD = "test-only"
-' "$WORK/backend/tests/conftest.py" && rm -f "$WORK/backend/tests/conftest.py.bak"
-fi
-
-echo "[snapshot] git commit in temp repo"
-cd "$WORK"
-git init -q
-git checkout -q -b main
-git add -A
-git -c user.name="PTah" -c user.email="papatramp@gmail.com" commit -q -m "$MSG"
-
-echo "[snapshot] secret scan (private keys only)"
-while IFS= read -r -d '' f; do
-  if grep -q 'BEGIN OPENSSH PRIVATE KEY' "$f" 2>/dev/null || grep -q 'BEGIN RSA PRIVATE KEY' "$f" 2>/dev/null; then
-    echo "  BLOCKED: $f (private key)"
-    exit 1
-  fi
-done < <(find . -type f -print0)
-
-echo "[snapshot] push github main (force snapshot)"
-git remote add github "$(git -C "$ROOT" remote get-url github)"
-git push github main --force
-
-echo "[snapshot] OK -> github/main @ $(git rev-parse --short HEAD)"

tools/test_sac_agent_git.py

@@ -7,8 +7,8 @@ REMOTE_CMD = (
     "set -e\n"
     "TMP=$(mktemp -d)\n"
     'trap "rm -rf \\"$TMP\\"" EXIT\n'
-    "git clone --depth 1 -q https://git.papatramp.ru/PapaTramp/RDP-login-monitor.git \"$TMP/rdp\"\n"
-    "git clone --depth 1 -q https://git.papatramp.ru/PapaTramp/ssh-monitor.git \"$TMP/ssh\"\n"
+    "git clone --depth 1 -q https://git.kalinamall.ru/PapaTramp/RDP-login-monitor.git \"$TMP/rdp\"\n"
+    "git clone --depth 1 -q https://git.kalinamall.ru/PapaTramp/ssh-monitor.git \"$TMP/ssh\"\n"
     "echo RDP_version_txt:\n"
     "cat \"$TMP/rdp/version.txt\" 2>/dev/null || echo missing\n"
     "echo RDP_script:\n"

tools/test_sac_agent_git.sh

@@ -2,8 +2,8 @@
 set -e
 TMP=$(mktemp -d)
 trap 'rm -rf "$TMP"' EXIT
-git clone --depth 1 -q https://git.papatramp.ru/PapaTramp/RDP-login-monitor.git "$TMP/rdp"
-git clone --depth 1 -q https://git.papatramp.ru/PapaTramp/ssh-monitor.git "$TMP/ssh"
+git clone --depth 1 -q https://git.kalinamall.ru/PapaTramp/RDP-login-monitor.git "$TMP/rdp"
+git clone --depth 1 -q https://git.kalinamall.ru/PapaTramp/ssh-monitor.git "$TMP/ssh"
 echo RDP_version_txt:
 cat "$TMP/rdp/version.txt" 2>/dev/null || echo missing
 echo RDP_script: