Reject reclassifying closed alerts and constrain enums

api_classify() now returns 409 when an alert is no longer 'open' so a
resolved alert can't be silently overwritten. Added CHECK constraints
on alerts.severity and alerts.status matching the documented enums.

Tests: 409-on-closed case plus pure compute_sla() unit tests for the
MEDIUM SLA path and unknown-severity skip (no fixture row, so the
existing 2/4=50% SLA assertions stay intact).

Built with Claude Code and the Claude API (LLM).

Author: Romil2112

app.py

@@ -209,6 +209,8 @@ def api_classify(alert_id):
         alert = cur.fetchone()
         if alert is None:
             abort(404, description="alert not found")
+        if alert["status"] != "open":
+            abort(409, description="alert is already closed")
 
         # Update the alert's status and assignee.
         cur.execute(

schema.sql

@@ -12,12 +12,14 @@ CREATE TABLE alerts (
     id          SERIAL PRIMARY KEY,
     title       TEXT        NOT NULL,
     category    TEXT        NOT NULL,
-    severity    TEXT        NOT NULL,
+    severity    TEXT        NOT NULL
+                CHECK (severity IN ('CRITICAL', 'HIGH', 'MEDIUM', 'LOW')),
     source      TEXT,
     source_ip   TEXT,
     description TEXT,
     created_at  TIMESTAMPTZ NOT NULL DEFAULT now(),
-    status      TEXT        NOT NULL DEFAULT 'open',
+    status      TEXT        NOT NULL DEFAULT 'open'
+                CHECK (status IN ('open', 'true_positive', 'false_positive', 'escalated')),
     assigned_to TEXT
 );
 

tests/test_app.py

@@ -1,5 +1,8 @@
 """Integration tests for the SOC dashboard API (Flask test client + Postgres)."""
 import json
+from datetime import datetime, timedelta, timezone
+
+from app import compute_sla
 
 
 def test_pages_render(client):
@@ -101,6 +104,34 @@ def test_classify_rejects_unknown_action(client):
     assert resp.status_code == 400
 
 
+def test_classify_already_closed_returns_409(client):
+    # alert 1 is already true_positive in the fixtures; reclassifying is rejected.
+    resp = client.post(
+        "/api/alerts/1/classify",
+        data=json.dumps({"analyst": "carol", "action": "classify_tp"}),
+        content_type="application/json",
+    )
+    assert resp.status_code == 409
+
+
+def test_compute_sla_counts_medium_severity_breach():
+    # MEDIUM target is 4h; a still-open alert aged 5h breaches SLA.
+    old = datetime.now(timezone.utc) - timedelta(hours=5)
+    sla = compute_sla([{"severity": "MEDIUM", "resp": None, "created_at": old}])
+    assert sla["considered"] == 1
+    assert sla["breaches"] == 1
+    assert sla["by_severity"]["MEDIUM"] == 1
+
+
+def test_compute_sla_skips_unknown_severity():
+    # An unrecognized severity is silently excluded from SLA accounting.
+    now = datetime.now(timezone.utc)
+    sla = compute_sla([{"severity": "BOGUS", "resp": 10, "created_at": now}])
+    assert sla["considered"] == 0
+    assert sla["breaches"] == 0
+    assert sla["breach_rate"] == 0.0
+
+
 def test_classify_unknown_alert_404(client):
     resp = client.post(
         "/api/alerts/9999/classify",