feat: CrowdSec journald-Acquisition + Alarm-Quittieren/Löschen — v1.3.5

- fix(crowdsec/packaging): postinst setzt die HAProxy-Acquisition deterministisch auf die journald-Unit (haproxy.service) statt der cscli-setup-Datei-Default (/var/log/haproxy.log existiert nicht → CrowdSec las nichts → HTTP/CVE-Szenarien liefen leer). Self-healing auf jedem configure; admin-Custom bleibt unangetastet. - feat(alerts): Alarme (alert_events) bulk quittieren + löschen. Migration 0045 (acknowledged_at + Teil-Index). Dashboard-Karte zählt nur noch OFFENE (open=true) → Quittieren lässt die "Aktuelle Alerts"-Meldung verschwinden, History bleibt. Events-Tab: Row-Selection, Quittieren/Löschen (Auswahl) + "Alle quittieren", Status-Spalte (offen/quittiert). Audit-geloggt. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-31 10:58:27 +02:00
parent 0ac91a7c59
commit dca40761a4
10 changed files with 279 additions and 42 deletions
--- a/internal/database/migrations/0045_alert_events_acknowledge.sql
+++ b/internal/database/migrations/0045_alert_events_acknowledge.sql
@@ -0,0 +1,22 @@
+-- +goose Up
+-- +goose StatementBegin
+
+-- Quittieren von Alarmen. acknowledged_at = NULL → offen (zählt im Dashboard).
+-- Gesetzt → quittiert (bleibt als History sichtbar, zählt aber nicht mehr auf
+-- der Startseiten-Karte "Aktuelle Alerts"). alert_events ist node-lokal
+-- (localOnlyTables) → kein Replikations-Effekt.
+ALTER TABLE alert_events
+    ADD COLUMN IF NOT EXISTS acknowledged_at TIMESTAMPTZ;
+
+-- Teil-Index für den Dashboard-Query (nur offene, newest-first).
+CREATE INDEX IF NOT EXISTS idx_alert_events_open
+    ON alert_events (fired_at DESC)
+    WHERE acknowledged_at IS NULL;
+
+-- +goose StatementEnd
+
+-- +goose Down
+-- +goose StatementBegin
+DROP INDEX IF EXISTS idx_alert_events_open;
+ALTER TABLE alert_events DROP COLUMN IF EXISTS acknowledged_at;
+-- +goose StatementEnd
--- a/internal/handlers/alerts.go
+++ b/internal/handlers/alerts.go
@@ -18,7 +18,10 @@ import (
 //	PUT    /api/v1/alerts/channels/:id
 //	DELETE /api/v1/alerts/channels/:id
 //	POST   /api/v1/alerts/test           — Test-Event in alle aktiven Channels
-//	GET    /api/v1/alerts/events?limit=N — History
+//	GET    /api/v1/alerts/events?limit=N&open=true — History (open=nur offene)
+//	POST   /api/v1/alerts/events/acknowledge      — Bulk-Quittieren {ids:[…]}
+//	POST   /api/v1/alerts/events/acknowledge-all  — alle offenen quittieren
+//	POST   /api/v1/alerts/events/delete           — Bulk-Löschen {ids:[…]}
 type AlertsHandler struct {
 	Service *alerts.Service
 	Audit   *audit.Repo
@@ -37,6 +40,9 @@ func (h *AlertsHandler) Register(rg *gin.RouterGroup) {
 	g.DELETE("/channels/:id", h.DeleteChannel)
 	g.POST("/test", h.TestFire)
 	g.GET("/events", h.ListEvents)
+	g.POST("/events/acknowledge", h.AcknowledgeEvents)
+	g.POST("/events/acknowledge-all", h.AcknowledgeAllEvents)
+	g.POST("/events/delete", h.DeleteEvents)
 }

 func (h *AlertsHandler) ListChannels(c *gin.Context) {
@@ -125,10 +131,64 @@ func (h *AlertsHandler) ListEvents(c *gin.Context) {
 			limit = n
 		}
 	}
-	out, err := h.Service.ListEvents(c.Request.Context(), limit)
+	// ?open=true → nur offene (nicht quittierte) Events. Nutzt die
+	// Dashboard-Karte, damit Quittieren die Meldung verschwinden lässt.
+	openOnly := c.Query("open") == "true"
+	out, err := h.Service.ListEvents(c.Request.Context(), limit, openOnly)
 	if err != nil {
 		response.Internal(c, err)
 		return
 	}
 	response.OK(c, gin.H{"events": out})
 }
+
+// eventIDsRequest ist der Body für Bulk-Quittieren/-Löschen.
+type eventIDsRequest struct {
+	IDs []int64 `json:"ids"`
+}
+
+// AcknowledgeEvents quittiert die übergebenen Event-IDs.
+func (h *AlertsHandler) AcknowledgeEvents(c *gin.Context) {
+	var req eventIDsRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	n, err := h.Service.Acknowledge(c.Request.Context(), req.IDs)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "alert.events.acknowledge",
+		strconv.Itoa(len(req.IDs)), gin.H{"ids": req.IDs, "acknowledged": n}, h.NodeID)
+	response.OK(c, gin.H{"acknowledged": n})
+}
+
+// AcknowledgeAllEvents quittiert alle offenen Events.
+func (h *AlertsHandler) AcknowledgeAllEvents(c *gin.Context) {
+	n, err := h.Service.AcknowledgeAll(c.Request.Context())
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "alert.events.acknowledge_all",
+		"all", gin.H{"acknowledged": n}, h.NodeID)
+	response.OK(c, gin.H{"acknowledged": n})
+}
+
+// DeleteEvents löscht die übergebenen Event-IDs endgültig.
+func (h *AlertsHandler) DeleteEvents(c *gin.Context) {
+	var req eventIDsRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, err)
+		return
+	}
+	n, err := h.Service.DeleteEvents(c.Request.Context(), req.IDs)
+	if err != nil {
+		response.Internal(c, err)
+		return
+	}
+	_ = h.Audit.Log(c.Request.Context(), actorOf(c), "alert.events.delete",
+		strconv.Itoa(len(req.IDs)), gin.H{"ids": req.IDs, "deleted": n}, h.NodeID)
+	response.OK(c, gin.H{"deleted": n})
+}
--- a/internal/services/alerts/alerts.go
+++ b/internal/services/alerts/alerts.go
@@ -62,13 +62,14 @@ type EmailSettings struct {

 // Event ist eine Row in alert_events.
 type Event struct {
-	ID        int64           `json:"id"`
-	Kind      string          `json:"kind"`
-	Severity  Severity        `json:"severity"`
-	Subject   string          `json:"subject"`
-	Message   string          `json:"message"`
-	SentTo    json.RawMessage `json:"sent_to"`
-	FiredAt   time.Time       `json:"fired_at"`
+	ID             int64           `json:"id"`
+	Kind           string          `json:"kind"`
+	Severity       Severity        `json:"severity"`
+	Subject        string          `json:"subject"`
+	Message        string          `json:"message"`
+	SentTo         json.RawMessage `json:"sent_to"`
+	FiredAt        time.Time       `json:"fired_at"`
+	AcknowledgedAt *time.Time      `json:"acknowledged_at,omitempty"`
 }

 // SendResult pro Channel — landet als JSON-Array in sent_to.
@@ -170,14 +171,19 @@ func (s *Service) DeleteChannel(ctx context.Context, id int64) error {
 	return nil
 }

-// ListEvents liefert die letzten N Events newest-first.
-func (s *Service) ListEvents(ctx context.Context, limit int) ([]Event, error) {
+// ListEvents liefert die letzten N Events newest-first. Wenn openOnly
+// gesetzt ist, werden nur noch offene (nicht quittierte) Events geliefert —
+// das nutzt die Dashboard-Karte, damit Quittieren die Meldung verschwinden
+// lässt.
+func (s *Service) ListEvents(ctx context.Context, limit int, openOnly bool) ([]Event, error) {
 	if limit <= 0 || limit > 500 {
 		limit = 100
 	}
 	rows, err := s.Pool.Query(ctx, `
-SELECT id, kind, severity, subject, message, sent_to, fired_at
-FROM alert_events ORDER BY fired_at DESC, id DESC LIMIT $1`, limit)
+SELECT id, kind, severity, subject, message, sent_to, fired_at, acknowledged_at
+FROM alert_events
+WHERE ($2::bool = false OR acknowledged_at IS NULL)
+ORDER BY fired_at DESC, id DESC LIMIT $1`, limit, openOnly)
 	if err != nil {
 		return nil, err
 	}
@@ -186,7 +192,7 @@ FROM alert_events ORDER BY fired_at DESC, id DESC LIMIT $1`, limit)
 	for rows.Next() {
 		var e Event
 		if err := rows.Scan(&e.ID, &e.Kind, &e.Severity, &e.Subject,
-			&e.Message, &e.SentTo, &e.FiredAt); err != nil {
+			&e.Message, &e.SentTo, &e.FiredAt, &e.AcknowledgedAt); err != nil {
 			return nil, err
 		}
 		out = append(out, e)
@@ -194,6 +200,46 @@ FROM alert_events ORDER BY fired_at DESC, id DESC LIMIT $1`, limit)
 	return out, rows.Err()
 }

+// Acknowledge quittiert die angegebenen Events (setzt acknowledged_at=NOW()
+// bei noch offenen). Liefert die Anzahl geänderter Rows.
+func (s *Service) Acknowledge(ctx context.Context, ids []int64) (int64, error) {
+	if len(ids) == 0 {
+		return 0, nil
+	}
+	tag, err := s.Pool.Exec(ctx,
+		`UPDATE alert_events SET acknowledged_at = NOW()
+		 WHERE id = ANY($1) AND acknowledged_at IS NULL`, ids)
+	if err != nil {
+		return 0, err
+	}
+	return tag.RowsAffected(), nil
+}
+
+// AcknowledgeAll quittiert alle offenen Events — Backing für den
+// "Alle quittieren"-Button.
+func (s *Service) AcknowledgeAll(ctx context.Context) (int64, error) {
+	tag, err := s.Pool.Exec(ctx,
+		`UPDATE alert_events SET acknowledged_at = NOW() WHERE acknowledged_at IS NULL`)
+	if err != nil {
+		return 0, err
+	}
+	return tag.RowsAffected(), nil
+}
+
+// DeleteEvents löscht die angegebenen Events endgültig. Liefert die Anzahl
+// gelöschter Rows.
+func (s *Service) DeleteEvents(ctx context.Context, ids []int64) (int64, error) {
+	if len(ids) == 0 {
+		return 0, nil
+	}
+	tag, err := s.Pool.Exec(ctx,
+		`DELETE FROM alert_events WHERE id = ANY($1)`, ids)
+	if err != nil {
+		return 0, err
+	}
+	return tag.RowsAffected(), nil
+}
+
 // Cleanup löscht alert_events älter als keepDays und liefert die Anzahl
 // gelöschter Rows. make_interval(days => $1) nimmt $1 sauber als int —
 // der frühere ($1 || ' days')::interval-Ansatz erzwang text und scheiterte