feat: login anomaly detection & suspicious activity alerts (#124)

[Entr0zy]

Login anomaly detection & suspicious activity alerts

Production-ready login fingerprinting and anomaly detection for issue #124.

What's added

Models (app/models.py)

• LoginEvent — every login attempt stored with SHA-256-hashed IP & user-agent (PII-safe), masked display IP (e.g. 192.168.1.xxx), success flag, failure reason
• SecurityAlert — stored alert with type, severity (low/medium/high), message, acknowledged flag, link to triggering event
• AlertType enum: new_ip | new_device | failed_burst | unusual_hour
• AlertSeverity enum: low | medium | high

Service (app/services/anomaly.py)

• record_login_event() — hashes & masks PII before storing
• check_and_create_alerts() — runs all four detection rules atomically with the event

Detection rules:

Rule	Trigger	Severity
new_ip	IP hash not seen in last 20 successful logins	medium
new_device	UA hash not seen in last 20 successful logins	medium
failed_burst	≥5 failures in 15-minute window (deduped — one alert per window)	high
unusual_hour	Login between 00:00–04:59 UTC	low

Routes (app/routes/security.py, at /security)

Method	Path	Description
GET	/security/events	Login history (most recent first, ?limit=N)
GET	/security/alerts	All alerts (?unread_only=true supported)
GET	/security/alerts/unread-count	Badge count for UI
PATCH	/security/alerts//acknowledge	Mark alert as read

Auth integration (app/routes/auth.py)

• /auth/login now records every attempt (success or failure)
• On success: anomaly detection runs; security_alerts list included in response when anomalies found (key absent for clean logins)
• Failures still recorded for burst detection; anomaly errors are caught and logged without breaking login flow

Tests (tests/test_anomaly.py) — 28 tests, all green

• Auth gates (401 without JWT)
• Event recording on success & failure; IP masking verification
• new_ip alert: first login → no alert; known IP → no alert; new IP → alert
• new_device alert: same UA → no alert; new UA → alert
• failed_burst: below threshold → no alert; threshold → alert; 10 failures → only 1 alert (dedup verified)
• unusual_hour: injected 02:30 UTC → alert; 10:00 UTC → no alert
• Alert endpoints: list, unread filter, unread count, acknowledge
• Cross-user isolation (404 for other user's alert)
• Login response security_alerts present when anomalies found; absent on clean login

/claim #124

---

🤖 Generated with Claude Code