Kwaku Danso
b873012191
Per-event fraud tuning. Hosts can now dial the medium / high / block
boundaries, allowlist trusted networks, and feed verdicts back on
flagged accesses — the seed corpus for a future ML model.
Schema (migration 0011)
- events.fraud_{medium,high,block}_threshold default 30/60/85 so
existing events behave identically until a host changes them
- access_logs.geo_{country,city,lat,lon} for future enrichment
- fraud_feedback table — verdict ('legitimate' | 'suspicious') + note,
PK on access_log_id so re-mark is an upsert
- event_allowlists table — (event_id, ip_cidr) primary key, inet column
so containment checks use the native >>= operator (indexed lookup)
Domain
- FraudThresholds with Valid() + Band() helpers; Default trio echoed
through GET responses so the frontend doesn't duplicate constants
- ParseAllowlistCIDR accepts bare IPs (auto-widens to /32 or /128) and
canonicalises the output (203.0.113.42 → 203.0.113.42/32)
- Event.Thresholds() falls back to defaults if columns weren't
populated yet, so the API never wedges every score into "low"
Storage
- AllowlistRepo: List / Add / Remove + Matches() — the latter pushes
CIDR containment into Postgres rather than streaming rows back
- FeedbackRepo: Record (upserts) + ListForEvent (joined through guests)
- EventRepo.GetThresholds + UpdateThresholds, plus the threshold
columns baked into scanEvent so every event load carries them
- AccessLogRepo.BelongsToEvent — stops a hostile editor on event A
from marking event B's access logs
API
- GET/PUT /events/{id}/security/thresholds (viewer/editor)
- GET/POST/DELETE /events/{id}/security/allowlist
- POST /events/{id}/access-logs/{log_id}/feedback (editor)
- GET /events/{id}/security/feedback
- RSVP scoring path: allowlist short-circuit fires before the fraud
engine; the engine's score is then re-banded against the event's
thresholds (engine.Risk becomes advisory — API is the source of
truth for "what counts as block here")
- CORS Allow-Methods already includes PUT (Block D fix)
Fraud engine
- Single-signal cap: it now takes ≥2 sub-scores of ≥70 to push the
final into HIGH. Fixes the well-known "second visit with a slightly
shifted fingerprint scores 60+" false positive
- Engine band remains advisory; API re-bands using per-event
thresholds before deciding to block
Frontend
- SecurityCard.vue: visual band ribbon (proportional to thresholds),
three sliders with mutual clamping so dragging medium past high
pushes high (not an invalid ordering), reset-to-defaults button,
CIDR allowlist with inline add + per-row remove, verdict-history
inbox. Toast feedback on save/add/remove
- "Security" tab added to the event-detail tab nav (5th tab,
right of Analytics)
- Viewer role hides write affordances; server enforces too
Tests
- Domain: ThresholdsBand, ThresholdsValid, ParseAllowlistCIDR (bare
IP widening + traversal/typo rejection), FraudFeedbackValid
- Integration: thresholds round-trip + invalid ordering rejection,
allowlist CRUD + duplicate 409 + invalid CIDR 400 + IP auto-widen,
feedback record + upsert + cross-tenant 404 + invalid verdict 400,
viewer can read / editor can write / outsider gets 404
- Full integration suite green (315.8s, all 36 top-level tests pass)
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
45 lines
1.9 KiB
SQL
45 lines
1.9 KiB
SQL
-- Tier 2 Block G — smarter fraud detection.
|
|
--
|
|
-- Four schema additions:
|
|
-- 1. Per-event tunable thresholds. Defaults match the previous hardcoded
|
|
-- 30/60/85 band boundaries so existing events behave identically until
|
|
-- a host tweaks them.
|
|
-- 2. Geolocation columns on access_logs. The fraud engine fills these
|
|
-- asynchronously; nullable so logs from before this migration aren't
|
|
-- retroactively required to have geo data.
|
|
-- 3. fraud_feedback for the "this was legitimate / actually suspicious"
|
|
-- hostback. Seeds the future ML model and lets hosts silence specific
|
|
-- false positives.
|
|
-- 4. event_allowlists for CIDR-based bypass — the corporate-Wi-Fi and
|
|
-- family-router escape valve.
|
|
|
|
ALTER TABLE events
|
|
ADD COLUMN IF NOT EXISTS fraud_medium_threshold SMALLINT NOT NULL DEFAULT 30,
|
|
ADD COLUMN IF NOT EXISTS fraud_high_threshold SMALLINT NOT NULL DEFAULT 60,
|
|
ADD COLUMN IF NOT EXISTS fraud_block_threshold SMALLINT NOT NULL DEFAULT 85;
|
|
|
|
ALTER TABLE access_logs
|
|
ADD COLUMN IF NOT EXISTS geo_country TEXT,
|
|
ADD COLUMN IF NOT EXISTS geo_city TEXT,
|
|
ADD COLUMN IF NOT EXISTS geo_lat DOUBLE PRECISION,
|
|
ADD COLUMN IF NOT EXISTS geo_lon DOUBLE PRECISION;
|
|
|
|
CREATE TABLE IF NOT EXISTS fraud_feedback (
|
|
access_log_id UUID PRIMARY KEY REFERENCES access_logs(id) ON DELETE CASCADE,
|
|
verdict TEXT NOT NULL CHECK (verdict IN ('legitimate', 'suspicious')),
|
|
marked_by UUID REFERENCES users(id) ON DELETE SET NULL,
|
|
note TEXT,
|
|
created_at TIMESTAMPTZ NOT NULL DEFAULT now()
|
|
);
|
|
|
|
CREATE TABLE IF NOT EXISTS event_allowlists (
|
|
event_id UUID NOT NULL REFERENCES events(id) ON DELETE CASCADE,
|
|
ip_cidr INET NOT NULL,
|
|
label TEXT,
|
|
created_by UUID REFERENCES users(id) ON DELETE SET NULL,
|
|
created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
|
|
PRIMARY KEY (event_id, ip_cidr)
|
|
);
|
|
|
|
CREATE INDEX IF NOT EXISTS idx_allowlists_event ON event_allowlists(event_id);
|