Added new_country alert filter logic

CHANGELOG.md

@@ -1,3 +1,8 @@
+## 1.3.x
+## 1.3.0
+#### Changes
+* Changed the *new_country* alert logic: previously, if the new country has already been reported, the alert wasn't triggered again; now, after *CERTEGO_BUFFALOGS_NEW_COUNTRY_ALERT_FILTER* days from the first alert, it can be triggered again
+
 ## 1.2.x
 ### 1.2.9
 #### Bugfix

buffalogs/buffalogs/settings/settings.py

@@ -222,6 +222,7 @@
 CERTEGO_BUFFALOGS_LOGIN_MAX_DAYS = 10
 CERTEGO_BUFFALOGS_ALERT_MAX_DAYS = 10
 CERTEGO_BUFFALOGS_IP_MAX_DAYS = 7
+CERTEGO_BUFFALOGS_NEW_COUNTRY_ALERT_FILTER = 30
 
 # Celery config
 CELERY_BROKER_URL = CERTEGO_BUFFALOGS_RABBITMQ_URI

buffalogs/impossible_travel/modules/login_from_new_country.py

@@ -1,5 +1,7 @@
 import logging
 
+from django.conf import settings
+from django.utils import timezone
 from impossible_travel.models import Alert
 from impossible_travel.modules import impossible_travel
 
@@ -16,8 +18,19 @@ def check_country(self, db_user, login_field):
         Check Login from new Country and send alert
         """
         alert_info = {}
+        send_alert = False
         new_country = login_field["country"]
         if db_user.login_set.filter(country=new_country).count() == 0:
+            # alert if there are no logins from that country before
+            send_alert = True
+        elif db_user.alert_set.filter(name="Login from new country", login_raw_data__country=new_country).exists():
+            if (
+                abs((timezone.now() - db_user.alert_set.filter(name="Login from new country", login_raw_data__country=new_country).last().created)).days
+            ) >= settings.CERTEGO_BUFFALOGS_NEW_COUNTRY_ALERT_FILTER:
+                # or... alert if last "new country" alert for that country is older than NEW_COUNTRY_FILTER days
+                send_alert = True
+
+        if send_alert is True:
             time = login_field["timestamp"]
             alert_info["alert_name"] = Alert.ruleNameEnum.NEW_COUNTRY
             alert_info["alert_desc"] = f"{alert_info['alert_name']} for User: {db_user.username}, at: {time}, from: {new_country}"

buffalogs/impossible_travel/tests/test_login_from_new_country.py

@@ -1,5 +1,6 @@
 from django.test import TestCase
-from impossible_travel.models import Login, User
+from django.utils import timezone
+from impossible_travel.models import Alert, Login, User
 from impossible_travel.modules import login_from_new_country
 
 
@@ -25,6 +26,7 @@ def setUpTestData(self):
         login.save()
 
     def test_check_country(self):
+        """Test to check that no new_country alert is sent if a login from that country already exists in the Login model"""
         db_user = User.objects.get(username="Lorena Goldoni")
         last_login_user_fields = {
             "timestamp": "2023-03-08T17:10:33.358Z",
@@ -36,6 +38,7 @@ def test_check_country(self):
         self.assertIsNone(self.new_country.check_country(db_user, last_login_user_fields))
 
     def test_check_country_alert(self):
+        """Test new_country alert to be sent"""
         db_user = User.objects.get(username="Lorena Goldoni")
         last_login_user_fields = {
             "timestamp": "2023-03-08T17:10:33.358Z",
@@ -46,3 +49,46 @@ def test_check_country_alert(self):
         }
         alert_result = self.new_country.check_country(db_user, last_login_user_fields)
         self.assertEqual("Login from new country", alert_result["alert_name"].value)
+
+    def test_check_country_days_filter(self):
+        """Test that checks that if the last new_country alert was triggered before than 30 days, it will be sent again"""
+        # insert previous new_country alert with created time > 30 days before
+        db_user = User.objects.get(username="Lorena Goldoni")
+        new_login = {
+            "timestamp": "2023-07-25T12:00:00+00:00",
+            "lat": "44.4937",
+            "lon": "11.3430",
+            "country": "Italy",
+            "user_agent": "Mozilla/5.0 (X11; U; Linux i686; es-AR; rv:1.9.1.8) Gecko/20100214 Ubuntu/9.10 (karmic) Firefox/3.5.8",
+        }
+        creation_mock_time = timezone.datetime(2023, 7, 25, 12, 0, tzinfo=timezone.utc)
+        login = Login.objects.create(
+            user=db_user,
+            timestamp=new_login["timestamp"],
+            latitude=new_login["lat"],
+            longitude=new_login["lon"],
+            country=new_login["country"],
+            user_agent=new_login["user_agent"],
+        )
+        login.created = creation_mock_time
+        login.save()
+        alert = Alert.objects.create(
+            user_id=db_user.id,
+            login_raw_data=new_login,
+            name="Login from new country",
+            description=f"Login from new country for User: {db_user.username}, at: {new_login['timestamp']}, from: {new_login['country']}",
+        )
+        # Set a created time before 30 days
+        alert.created = creation_mock_time
+        alert.save()
+        # add new login from Italy that should triggered a new_country alert
+        last_login_user_fields = {
+            "timestamp": timezone.now(),
+            "lat": "44.4937",
+            "lon": "11.3430",
+            "country": "Italy",
+            "user_agent": "Mozilla/5.0 (X11; U; Linux i686; es-AR; rv:1.9.1.8) Gecko/20100214 Ubuntu/9.10 (karmic) Firefox/3.5.8",
+        }
+        alert_result = self.new_country.check_country(db_user, last_login_user_fields)
+        # it returns the alert because the last new_country alert from Italy is before 30 days
+        self.assertEqual("Login from new country", alert_result["alert_name"].value)