Add fleet alert notifications for shop floor PCs

Fleet alerts push server notifications to endpoint PCs via the command pipe.
Operators acknowledge alerts via toast UI in the tray. Backend tracks
acknowledgements per asset to prevent re-showing dismissed alerts.

Backend: alertfleet/alertscope/alerttimeout columns, GET/POST /api/endpoints/alerts,
NotificationAcknowledgement model with unique constraint, hostname validation.

Frontend: Alert Fleet checkbox in notification form.

Agent: FleetAlertClient polls alerts, FleetAlertStore tracks acknowledged IDs,
FleetAlertForm displays toast (no auto-dismiss), FleetAlertWorker 60s polling.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

plugins/endpoints/api/routes.py

@@ -3077,3 +3077,148 @@ def serve_operator_report_image(operatorreportid: int):
     return send_upload(_operator_report_dir(), report.imagefilename)
 
 
+# =============================================================================
+# Fleet alerts (agent-facing, collector-token auth)
+# =============================================================================
+
+_DEFAULT_ALERT_TYPE_COLOR = '#17a2b8'
+
+@endpoints_bp.route('/alerts', methods=['GET'])
+def get_fleet_alerts():
+    """Fleet alerts for one endpoint by hostname (collector-token auth).
+
+    Called by the endpoint agent to fetch active, unacknowledged fleet alerts
+    for its hostname. Returns alerts with notification type info (typename and
+    typecolor from database) formatted for display in the agent tray.
+    """
+    error = _collector_auth_or_error()
+    if error is not None:
+        return error
+
+    hostname = (request.args.get('hostname') or '').strip()
+    if not hostname:
+        return error_response(ErrorCodes.VALIDATION_ERROR,
+                              'hostname is required')
+
+    asset_id = _resolve_asset_for_hostname(hostname)
+    if asset_id is None:
+        return error_response(ErrorCodes.NOT_FOUND,
+                              f'Unknown hostname: {hostname!r}', http_code=404)
+
+    from plugins.notifications.models import Notification, NotificationType, NotificationAcknowledgement
+
+    now = _naive_utcnow()
+
+    # Query for active fleet alerts not acknowledged by this asset
+    query = (db.session.query(Notification, NotificationType)
+             .join(NotificationType,
+                   NotificationType.notificationtypeid == Notification.notificationtypeid)
+             .outerjoin(NotificationAcknowledgement,
+                       db.and_(
+                           NotificationAcknowledgement.notificationid == Notification.notificationid,
+                           NotificationAcknowledgement.assetid == asset_id))
+             .filter(Notification.alertfleet.is_(True),
+                     Notification.isactive.is_(True),
+                     db.or_(
+                         Notification.endtime.is_(None),
+                         Notification.endtime > now),
+                     NotificationAcknowledgement.notificationacknowledgementid.is_(None)))
+
+    results = query.all()
+
+    alerts = []
+    for notification, ntype in results:
+        title = notification.notification[:100] if notification.notification else ''
+        if '\n' in title:
+            title = title.split('\n')[0][:100] or '(no title)'
+
+        alerts.append({
+            'notificationId': notification.notificationid,
+            'type': ntype.typename,
+            'typeColor': ntype.typecolor or _DEFAULT_ALERT_TYPE_COLOR,
+            'title': title,
+            'message': notification.notification or '',
+            'timeout': notification.alerttimeout,
+        })
+
+    return success_response(alerts)
+
+
+@endpoints_bp.route('/alerts/<int:notification_id>/acknowledge', methods=['POST'])
+def acknowledge_fleet_alert(notification_id: int):
+    """Agent acknowledges a fleet alert (collector-token auth).
+
+    The agent posts the hostname plus assetid when dismissing a fleet alert from
+    the tray. Records acknowledgement so this alert will not reappear in future polls.
+    Idempotent - repeated acknowledgements succeed.
+    """
+    error = _collector_auth_or_error()
+    if error is not None:
+        return error
+
+    payload = request.get_json(silent=True) or {}
+    hostname = (payload.get('hostname') or '').strip()
+    assetid = payload.get('assetid')
+
+    if not hostname:
+        return error_response(ErrorCodes.VALIDATION_ERROR,
+                              'hostname is required')
+
+    if assetid is None:
+        return error_response(ErrorCodes.VALIDATION_ERROR,
+                              'assetid is required')
+
+    try:
+        assetid = int(assetid)
+    except (TypeError, ValueError):
+        return error_response(ErrorCodes.VALIDATION_ERROR,
+                              'assetid must be an integer')
+
+    from plugins.notifications.models import Notification, NotificationAcknowledgement
+
+    notification = db.session.get(Notification, notification_id)
+    if notification is None:
+        return error_response(ErrorCodes.NOT_FOUND,
+                              f'Notification {notification_id} not found',
+                              http_code=404)
+
+    asset = db.session.get(Asset, assetid)
+    if asset is None:
+        return error_response(ErrorCodes.NOT_FOUND,
+                              f'Asset {assetid} not found',
+                              http_code=404)
+
+    # Validate hostname matches assetid to prevent cross-machine acknowledgements
+    resolved_asset = _resolve_asset_for_hostname(hostname)
+    if resolved_asset is None or resolved_asset.assetid != assetid:
+        return error_response(ErrorCodes.VALIDATION_ERROR,
+                              'hostname does not match provided assetid')
+
+    # Check if already acknowledged (idempotent)
+    existing = (NotificationAcknowledgement.query
+                .filter_by(notificationid=notification_id, assetid=assetid)
+                .first())
+    if existing:
+        return success_response({'acknowledged': True},
+                                message='Alert already acknowledged')
+
+    # Record acknowledgement
+    ack = NotificationAcknowledgement(
+        notificationid=notification_id,
+        assetid=assetid
+    )
+    db.session.add(ack)
+
+    try:
+        db.session.commit()
+    except Exception as exc:
+        db.session.rollback()
+        logger.warning(f'Failed to commit acknowledgement for notification {notification_id}: {exc}')
+        return error_response(ErrorCodes.INTERNAL_ERROR,
+                              'Failed to record acknowledgement',
+                              http_code=500)
+
+    return success_response({'acknowledged': True},
+                            message='Alert acknowledged', http_code=201)
+
+