fix(api): resolve ticket and implement unit tests

keep/api/core/alerts.py

@@ -17,7 +17,7 @@
 from keep.api.core.cel_to_sql.sql_providers.get_cel_to_sql_provider_for_dialect import (
     get_cel_to_sql_provider,
 )
-from keep.api.core.db import engine
+from keep.api.core.db import cleanup_expired_dismissals, engine
 
 # This import is required to create the tables
 from keep.api.core.facets import get_facet_options, get_facets
@@ -371,6 +371,16 @@
         ]
 
     with Session(engine) as session:
+        # Clean up expired dismissals if CEL query involves dismissed field
+        if query_with_defaults.cel and "dismissed" in query_with_defaults.cel:
+            try:
+                cleanup_expired_dismissals(tenant_id, session)
+            except Exception as e:
+                logger.warning(
+                    f"Failed to cleanup expired dismissals: {e}",
+                    extra={"tenant_id": tenant_id}
+                )
+
         try:
             total_count_query = build_total_alerts_query(
                 tenant_id=tenant_id, query=query_with_defaults

keep/api/core/db.py

@@ -5911,3 +5911,170 @@
         except Exception:
             logger.exception("Failed to create single tenant")
             pass
+
+
+def cleanup_expired_dismissals(tenant_id: str, session: Session = None):
+    """
+    Clean up expired alert dismissals by setting dismissed=false for alerts
+    where dismissedUntil time has passed.
+
+    This ensures that SQL-based CEL filtering works correctly for expired dismissals.
+    """
+    logger = logging.getLogger(__name__)
+
+    logger.info(
+        "Starting cleanup of expired dismissals",
+        extra={"tenant_id": tenant_id}
+    )
+
+    with existed_or_new_session(session) as session:
+        try:
+            # Get current time in UTC
+            current_time = datetime.now(timezone.utc)
+
+            logger.debug(
+                "Checking for expired dismissals",
+                extra={
+                    "tenant_id": tenant_id,
+                    "current_time": current_time.isoformat()
+                }
+            )
+
+            # Get JSON extract function for the database dialect
+            dismissed_field = get_json_extract_field(session, AlertEnrichment.enrichments, "dismissed")
+            dismissed_until_field = get_json_extract_field(session, AlertEnrichment.enrichments, "dismissedUntil")
+
+            # Find enrichments where:
+            # 1. dismissed is true/True/"true"
+            # 2. dismissedUntil is not null/forever and is in the past
+            query = session.query(AlertEnrichment).filter(
+                and_(
+                    AlertEnrichment.tenant_id == tenant_id,
+                    dismissed_field.in_(['true', 'True', True, '1']),
+                    dismissed_until_field.is_not(null()),
+                    dismissed_until_field != 'forever'
+                )
+            )
+
+            expired_enrichments = query.all()
+
+            logger.debug(
+                f"Found {len(expired_enrichments)} potentially expired dismissals to check",
+                extra={
+                    "tenant_id": tenant_id,
+                    "total_dismissed_alerts": len(expired_enrichments)
+                }
+            )
+
+            updated_count = 0
+
+            for enrichment in expired_enrichments:
+                try:
+                    dismissed_until_str = enrichment.enrichments.get("dismissedUntil")
+                    if not dismissed_until_str or dismissed_until_str == "forever":
+                        continue
+
+                    logger.debug(
+                        "Checking dismissal expiration for alert",
+                        extra={
+                            "tenant_id": tenant_id,
+                            "fingerprint": enrichment.alert_fingerprint,
+                            "dismissed_until": dismissed_until_str,
+                            "current_time": current_time.isoformat()
+                        }
+                    )
+
+                    # Parse the dismissedUntil datetime
+                    dismissed_until_datetime = datetime.strptime(
+                        dismissed_until_str, "%Y-%m-%dT%H:%M:%S.%fZ"
+                    ).replace(tzinfo=timezone.utc)
+
+                    # Check if dismissal has expired
+                    if current_time >= dismissed_until_datetime:
+                        # Log before making the change
+                        logger.info(
+                            "Updating expired dismissal for alert",
+                            extra={
+                                "tenant_id": tenant_id,
+                                "fingerprint": enrichment.alert_fingerprint,
+                                "dismissed_until": dismissed_until_str,
+                                "expired_by_seconds": (current_time - dismissed_until_datetime).total_seconds(),
+                                "current_time": current_time.isoformat()
+                            }
+                        )
+
+                        # Update the enrichment to set dismissed=false
+                        new_enrichments = enrichment.enrichments.copy()
+                        old_dismissed = new_enrichments.get("dismissed")
+                        new_enrichments["dismissed"] = False
+
+                        # Update in database
+                        stmt = (
+                            update(AlertEnrichment)
+                            .where(AlertEnrichment.id == enrichment.id)
+                            .values(enrichments=new_enrichments)
+                        )
+                        session.execute(stmt)
+                        updated_count += 1
+
+                        logger.info(
+                            "Successfully updated expired dismissal",
+                            extra={
+                                "tenant_id": tenant_id,
+                                "fingerprint": enrichment.alert_fingerprint,
+                                "old_dismissed": old_dismissed,
+                                "new_dismissed": False,
+                                "dismissed_until": dismissed_until_str
+                            }
+                        )
+                    else:
+                        # Log that dismissal is still active
+                        time_remaining = (dismissed_until_datetime - current_time).total_seconds()
+                        logger.debug(
+                            "Dismissal still active for alert",
+                            extra={
+                                "tenant_id": tenant_id,
+                                "fingerprint": enrichment.alert_fingerprint,
+                                "dismissed_until": dismissed_until_str,
+                                "time_remaining_seconds": time_remaining
+                            }
+                        )
+
+                except (ValueError, KeyError) as e:
+                    logger.warning(
+                        f"Failed to parse dismissedUntil for alert {enrichment.alert_fingerprint}: {e}",
+                        extra={
+                            "tenant_id": tenant_id,
+                            "fingerprint": enrichment.alert_fingerprint,
+                            "dismissed_until": enrichment.enrichments.get("dismissedUntil"),
+                            "error": str(e)
+                        }
+                    )
+                    continue
+
+            if updated_count > 0:
+                session.commit()
+                logger.info(
+                    "Cleanup completed successfully",
+                    extra={
+                        "tenant_id": tenant_id, 
+                        "updated_count": updated_count,
+                        "total_checked": len(expired_enrichments)
+                    }
+                )
+            else:
+                logger.debug(
+                    "No expired dismissals found to clean up",
+                    extra={
+                        "tenant_id": tenant_id,
+                        "total_checked": len(expired_enrichments)
+                    }
+                )
+
+        except Exception as e:
+            logger.exception(
+                f"Failed to cleanup expired dismissals for tenant {tenant_id}: {e}",
+                extra={"tenant_id": tenant_id, "error": str(e)}
+            )
+            session.rollback()
+            raise

keep/searchengine/searchengine.py

@@ -98,6 +98,7 @@ def search_alerts_by_cel(
             list[AlertDto]: The list of alerts that match the query
         """
         self.logger.info("Searching alerts by CEL")
+
         db_alerts, _ = query_last_alerts(
             tenant_id=self.tenant_id,
             query=QueryDto(