feat: Login anomaly detection & suspicious activity alerts (#124)

[DrGalio]

Fixes #124 — Login anomaly detection & suspicious activity alerts

Bounty: $50

What's Implemented

Backend (Python/Flask)

• LoginAttempt model — tracks every login with IP, user agent, success/failure, timestamp
• LoginAlert model — stores generated security alerts with severity and metadata
• Anomaly detection service with 4 detection algorithms:
  • Brute force — alerts when 5+ failed attempts in 15 min window (Redis-backed for speed)
  • New IP — alerts on login from previously unseen IP address (30-day lookback)
  • New device — alerts on login from new device/user agent fingerprint (90-day lookback)
  • Credential stuffing — alerts on successful login after multiple failures
• Modified /auth/login to record attempts, run anomaly checks, and return security alerts in response
• New /alerts/ API: list (with unread filter), mark read, unread count
• Schema migrations with proper indexes for production use

Frontend (React/TypeScript)

• SecurityAlerts component with severity badges, filter tabs, mark-read actions
• alerts.ts API module following existing patterns

Tests — 17 passing

• Login attempt recording (3 tests)
• Brute force detection (2 tests)
• New IP detection (3 tests)
• New device detection (1 test)
• Credential stuffing detection (1 test)
• Combined detection (1 test)
• Alert management (2 tests)
• Auth endpoint integration (4 tests)

Files Changed

• packages/backend/app/models.py — Added LoginAttempt + LoginAlert models
• packages/backend/app/services/login_anomaly.py — Anomaly detection service (new)
• packages/backend/app/routes/auth.py — Integrated login tracking into auth flow
• packages/backend/app/routes/alerts.py — Alert management endpoints (new)
• packages/backend/app/routes/__init__.py — Registered alerts blueprint
• packages/backend/app/db/schema.sql — Added tables + indexes
• packages/backend/app/__init__.py — Schema compatibility patches
• packages/backend/tests/test_login_anomaly.py — 17 comprehensive tests (new)
• app/src/api/alerts.ts — Frontend API module (new)
• app/src/components/SecurityAlerts.tsx — Security alerts UI component (new)

How It Works

1. Every login attempt is recorded with IP, user agent, success/failure
2. On successful login, anomaly checks run automatically
3. If anomalies detected, alerts are created AND returned in the login response
4. Users can view alerts via the /alerts/ API or the SecurityAlerts component
5. Brute force detection uses Redis counters for sub-millisecond lookups