Cheng Zhou
d5279b124f
Storage Persistence Guard / storage-persistence-audit (push) Has been cancelled
Client Quality Gates / Shared client and Web (push) Has been cancelled
Client Quality Gates / macOS Desktop (push) Has been cancelled
Client Quality Gates / Shared client and Web (pull_request) Has been cancelled
Client Quality Gates / macOS Desktop (pull_request) Has been cancelled
Storage Persistence Guard / storage-persistence-audit (pull_request) Has been cancelled
94 lines
4.5 KiB
Python
94 lines
4.5 KiB
Python
"""add source location hourly snapshots
|
|
|
|
Revision ID: 20260710_02
|
|
Revises: 20260710_01
|
|
Create Date: 2026-07-10 15:30:00.000000
|
|
"""
|
|
|
|
from typing import Sequence, Union
|
|
|
|
import sqlalchemy as sa
|
|
from alembic import op
|
|
|
|
|
|
revision: str = "20260710_02"
|
|
down_revision: Union[str, None] = "20260710_01"
|
|
branch_labels: Union[str, Sequence[str], None] = None
|
|
depends_on: Union[str, Sequence[str], None] = None
|
|
|
|
|
|
def upgrade() -> None:
|
|
op.create_table(
|
|
"source_location_snapshots",
|
|
sa.Column("id", sa.Uuid(), nullable=False),
|
|
sa.Column("bucket_time", sa.DateTime(timezone=True), nullable=False),
|
|
sa.Column("ip_hash", sa.String(length=64), nullable=False),
|
|
sa.Column("user_hash", sa.String(length=64), nullable=False, server_default=""),
|
|
sa.Column("country", sa.String(length=100), nullable=False, server_default=""),
|
|
sa.Column("country_code", sa.String(length=16), nullable=False, server_default=""),
|
|
sa.Column("province", sa.String(length=100), nullable=False, server_default=""),
|
|
sa.Column("region_code", sa.String(length=24), nullable=False, server_default=""),
|
|
sa.Column("city", sa.String(length=100), nullable=False, server_default=""),
|
|
sa.Column("isp", sa.String(length=160), nullable=False, server_default=""),
|
|
sa.Column("location", sa.String(length=320), nullable=False, server_default=""),
|
|
sa.Column("longitude", sa.Float(), nullable=True),
|
|
sa.Column("latitude", sa.Float(), nullable=True),
|
|
sa.Column("accuracy_level", sa.String(length=16), nullable=False, server_default="unknown"),
|
|
sa.Column("allowed_count", sa.Integer(), nullable=False, server_default="0"),
|
|
sa.Column("denied_count", sa.Integer(), nullable=False, server_default="0"),
|
|
sa.Column("security_event_count", sa.Integer(), nullable=False, server_default="0"),
|
|
sa.Column("high_risk_count", sa.Integer(), nullable=False, server_default="0"),
|
|
sa.Column("auth_failure_count", sa.Integer(), nullable=False, server_default="0"),
|
|
sa.Column("first_seen_at", sa.DateTime(timezone=True), nullable=False),
|
|
sa.Column("last_seen_at", sa.DateTime(timezone=True), nullable=False),
|
|
sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
|
|
sa.PrimaryKeyConstraint("id"),
|
|
sa.UniqueConstraint("bucket_time", "ip_hash", "user_hash", name="uq_source_location_bucket_identity"),
|
|
)
|
|
op.create_index("ix_source_location_bucket", "source_location_snapshots", ["bucket_time"])
|
|
op.create_index(
|
|
"ix_source_location_country_bucket",
|
|
"source_location_snapshots",
|
|
["country_code", "bucket_time"],
|
|
)
|
|
op.create_index(
|
|
"ix_source_location_risk_bucket",
|
|
"source_location_snapshots",
|
|
["high_risk_count", "bucket_time"],
|
|
)
|
|
|
|
op.execute(
|
|
"""
|
|
UPDATE security_access_logs
|
|
SET category = CASE
|
|
WHEN lower(path) LIKE '%/.env%' OR lower(path) LIKE '%.git%'
|
|
OR lower(path) LIKE '%backup%' OR lower(path) LIKE '%config.php%'
|
|
OR lower(path) LIKE '%wp-config%' OR lower(path) LIKE '%database.yml%'
|
|
THEN 'PROBE'
|
|
WHEN status_code >= 500 THEN 'SERVER_ERROR'
|
|
WHEN auth_status = 'INVALID_TOKEN' THEN 'INVALID_TOKEN'
|
|
WHEN auth_status = 'ANONYMOUS' AND status_code IN (401, 403) THEN 'ANONYMOUS_API'
|
|
WHEN status_code = 404 THEN 'NOT_FOUND_NOISE'
|
|
ELSE 'OTHER'
|
|
END,
|
|
severity = CASE
|
|
WHEN lower(path) LIKE '%/.env%' OR lower(path) LIKE '%.git%'
|
|
OR lower(path) LIKE '%backup%' OR lower(path) LIKE '%config.php%'
|
|
OR lower(path) LIKE '%wp-config%' OR lower(path) LIKE '%database.yml%'
|
|
THEN 'CRITICAL'
|
|
WHEN status_code >= 500 THEN 'HIGH'
|
|
WHEN auth_status = 'INVALID_TOKEN' THEN 'MEDIUM'
|
|
WHEN auth_status = 'ANONYMOUS' AND status_code IN (401, 403) THEN 'MEDIUM'
|
|
ELSE 'LOW'
|
|
END
|
|
WHERE category = 'ABNORMAL_IP'
|
|
"""
|
|
)
|
|
|
|
|
|
def downgrade() -> None:
|
|
op.drop_index("ix_source_location_risk_bucket", table_name="source_location_snapshots")
|
|
op.drop_index("ix_source_location_country_bucket", table_name="source_location_snapshots")
|
|
op.drop_index("ix_source_location_bucket", table_name="source_location_snapshots")
|
|
op.drop_table("source_location_snapshots")
|