mihari 5.7.0 → 5.7.2

data/lib/mihari/web/endpoints/alerts.rb

@@ -7,6 +7,72 @@ module Mihari
       # Alert API endpoint
       #
       class Alerts < Grape::API
+        class AlertSearcher < Mihari::Service
+          class ResultValue
+            # @return [Array<Mihari::Models::Alert>]
+            attr_reader :alerts
+
+            # @return [Integer]
+            attr_reader :total
+
+            # @return [Mihari::Structs::Filters::Alert::SearchFilterWithPagination]
+            attr_reader :filter
+
+            #
+            # @param [Array<Mihari::Models::Alert>] alerts
+            # @param [Integer] total
+            # @param [Mihari::Structs::Filters::Alert::SearchFilterWithPagination] filter
+            #
+            def initialize(alerts:, total:, filter:)
+              @alerts = alerts
+              @total = total
+              @filter = filter
+            end
+          end
+
+          #
+          # @param [Hash] params
+          #
+          # @return [ResultValue]
+          #
+          def call(params)
+            filter = params.to_h.to_snake_keys
+
+            # normalize keys
+            filter["artifact_data"] = filter["artifact"]
+            filter["tag_name"] = filter["tag"]
+            # symbolize hash keys
+            filter = filter.to_h.symbolize_keys
+
+            search_filter_with_pagination = Structs::Filters::Alert::SearchFilterWithPagination.new(**filter)
+            alerts = Mihari::Models::Alert.search(search_filter_with_pagination)
+            total = Mihari::Models::Alert.count(search_filter_with_pagination.without_pagination)
+
+            ResultValue.new(alerts: alerts, total: total, filter: filter)
+          end
+        end
+
+        class AlertCreator < Service
+          #
+          # @param [Hash] params
+          #
+          # @return [Mihari::Models::Alert]
+          #
+          def call(params)
+            proxy = Services::AlertProxy.new(**params.to_snake_keys)
+            Services::AlertRunner.call proxy
+          end
+        end
+
+        class AlertDestroyer < Service
+          #
+          # @param [String] id
+          #
+          def call(id)
+            Mihari::Models::Alert.find(id).destroy
+          end
+        end
+
         namespace :alerts do
           desc "Search alerts", {
             is_array: true,
@@ -17,33 +83,20 @@ module Mihari
           params do
             optional :page, type: Integer, default: 1
             optional :limit, type: Integer, default: 10
-
             optional :artifact, type: String
             optional :rule_id, type: String
             optional :tag, type: String
-
             optional :fromAt, type: DateTime
             optional :toAt, type: DateTime
           end
           get "/" do
-            filter = params.to_h.to_snake_keys
-
-            # normalize keys
-            filter["artifact_data"] = filter["artifact"]
-            filter["tag_name"] = filter["tag"]
-            # symbolize hash keys
-            filter = filter.to_h.symbolize_keys
-
-            search_filter_with_pagination = Structs::Filters::Alert::SearchFilterWithPagination.new(**filter)
-            alerts = Mihari::Models::Alert.search(search_filter_with_pagination)
-            total = Mihari::Models::Alert.count(search_filter_with_pagination.without_pagination)
-
+            value = AlertSearcher.call(params.to_h)
             present(
               {
-                alerts: alerts,
-                total: total,
-                current_page: filter[:page].to_i,
-                page_size: filter[:limit].to_i
+                alerts: value.alerts,
+                total: value.total,
+                current_page: value.filter[:page].to_i,
+                page_size: value.filter[:limit].to_i
               },
               with: Entities::AlertsWithPagination
             )
@@ -58,15 +111,8 @@ module Mihari
             requires :id, type: Integer
           end
           delete "/:id" do
-            extend Dry::Monads[:result, :try]
-
             id = params["id"].to_i
-
-            result = Try do
-              alert = Mihari::Models::Alert.find(id)
-              alert.destroy
-            end.to_result
-
+            result = AlertDestroyer.result(id)
             if result.success?
               status 204
               return present({ message: "" }, with: Entities::Message)
@@ -76,9 +122,8 @@ module Mihari
             case failure
             when ActiveRecord::RecordNotFound
               error!({ message: "ID:#{id} is not found" }, 404)
-            else
-              raise failure
             end
+            raise failure
           end
 
           desc "Create an alert", {
@@ -90,14 +135,7 @@ module Mihari
             requires :artifacts, type: Array, documentation: { type: String, is_array: true, param_type: "body" }
           end
           post "/" do
-            extend Dry::Monads[:result, :try]
-
-            result = Try do
-              proxy = Services::AlertProxy.new(**params.to_snake_keys)
-              runner = Services::AlertRunner.new(proxy)
-              runner.call
-            end.to_result
-
+            result = AlertCreator.result(params)
             if result.success?
               status 201
               return present(result.value!, with: Entities::Alert)
@@ -107,9 +145,8 @@ module Mihari
             case failure
             when ActiveRecord::RecordNotFound
               error!({ message: "Rule:#{params["ruleId"]} is not found" }, 404)
-            else
-              raise failure
             end
+            raise failure
           end
         end
       end

data/lib/mihari/web/endpoints/artifacts.rb

@@ -7,6 +7,60 @@ module Mihari
       # Artifact API endpoint
       #
       class Artifacts < Grape::API
+        class ArtifactGetter < Service
+          #
+          # @param [Integer] id
+          #
+          # @return [Mihari::Models::Artifact]
+          #
+          def call(id)
+            artifact = Mihari::Models::Artifact.includes(
+              :autonomous_system,
+              :geolocation,
+              :whois_record,
+              :dns_records,
+              :reverse_dns_names
+            ).find(id)
+            # TODO: improve queries
+            alert_ids = Mihari::Models::Artifact.where(data: artifact.data).pluck(:alert_id)
+            tag_ids = Mihari::Models::Tagging.where(alert_id: alert_ids).pluck(:tag_id)
+            tags = Mihari::Models::Tag.where(id: tag_ids)
+
+            artifact.tags = tags
+
+            artifact
+          end
+        end
+
+        class ArtifactEnricher < Service
+          #
+          # @param [String] id
+          #
+          def call(id)
+            artifact = Mihari::Models::Artifact.includes(
+              :autonomous_system,
+              :geolocation,
+              :whois_record,
+              :dns_records,
+              :reverse_dns_names,
+              :cpes,
+              :ports
+            ).find(id)
+
+            artifact.enrich_all
+            artifact.save
+          end
+        end
+
+        class ArtifactDestroyer < Service
+          #
+          # @param [Integer] id
+          #
+          def call(id)
+            Mihari::Models::Artifact.find(id).destroy
+          end
+        end
+
         namespace :artifacts do
           desc "Get an artifact", {
             success: Entities::Artifact,
@@ -17,37 +71,16 @@ module Mihari
             requires :id, type: Integer
           end
           get "/:id" do
-            extend Dry::Monads[:result, :try]
-
             id = params[:id].to_i
-
-            result = Try do
-              artifact = Mihari::Models::Artifact.includes(
-                :autonomous_system,
-                :geolocation,
-                :whois_record,
-                :dns_records,
-                :reverse_dns_names
-              ).find(id)
-              # TODO: improve queries
-              alert_ids = Mihari::Models::Artifact.where(data: artifact.data).pluck(:alert_id)
-              tag_ids = Mihari::Models::Tagging.where(alert_id: alert_ids).pluck(:tag_id)
-              tag_names = Mihari::Models::Tag.where(id: tag_ids).distinct.pluck(:name)
-
-              artifact.tags = tag_names
-
-              artifact
-            end.to_result
-
+            result = ArtifactGetter.result(id)
             return present(result.value!, with: Entities::Artifact) if result.success?
 
             failure = result.failure
             case failure
             when ActiveRecord::RecordNotFound
               error!({ message: "ID:#{id} is not found" }, 404)
-            else
-              raise failure
             end
+            raise failure
           end
 
           desc "Enrich an artifact", {
@@ -59,25 +92,8 @@ module Mihari
             requires :id, type: Integer
           end
           get "/:id/enrich" do
-            extend Dry::Monads[:result, :try]
-
             id = params["id"].to_i
-
-            result = Try do
-              artifact = Mihari::Models::Artifact.includes(
-                :autonomous_system,
-                :geolocation,
-                :whois_record,
-                :dns_records,
-                :reverse_dns_names,
-                :cpes,
-                :ports
-              ).find(id)
-
-              artifact.enrich_all
-              artifact.save
-            end.to_result
-
+            result = ArtifactEnricher.result(id)
             if result.success?
               status 201
               return present({ message: "" }, with: Entities::Message)
@@ -87,9 +103,8 @@ module Mihari
             case failure
             when ActiveRecord::RecordNotFound
               error!({ message: "ID:#{id} is not found" }, 404)
-            else
-              raise failure
             end
+            raise failure
           end
 
           desc "Delete an artifact", {
@@ -101,15 +116,8 @@ module Mihari
             requires :id, type: Integer
           end
           delete "/:id" do
-            extend Dry::Monads[:result, :try]
-
             id = params["id"].to_i
-
-            result = Try do
-              alert = Mihari::Models::Artifact.find(id)
-              alert.destroy
-            end.to_result
-
+            result = ArtifactDestroyer.result(id)
             if result.success?
               status 204
               return present({ message: "" }, with: Entities::Message)
@@ -119,9 +127,8 @@ module Mihari
             case failure
             when ActiveRecord::RecordNotFound
               error!({ message: "ID:#{id} is not found" }, 404)
-            else
-              raise failure
             end
+            raise failure
           end
         end
       end

data/lib/mihari/web/endpoints/ip_addresses.rb

@@ -7,6 +7,17 @@ module Mihari
       # IP address API endpoint
       #
       class IPAddresses < Grape::API
+        class IPGetter < Service
+          #
+          # @param [String] ip
+          #
+          # @return [Mihari::Structs::IPInfo::Response]
+          #
+          def call(ip)
+            Mihari::Enrichers::IPInfo.new.call ip
+          end
+        end
+
         namespace :ip_addresses do
           desc "Get an IP address", {
             success: Entities::IPAddress,
@@ -18,11 +29,15 @@ module Mihari
           end
           get "/:ip", requirements: { ip: %r{[^/]+} } do
             ip = params[:ip].to_s
+            result = IPGetter.result(ip)
+            return present(result.value!, with: Entities::IPAddress) if result.success?
 
-            data = Enrichers::IPInfo.new.call(ip)
-            error!({ message: "IP:#{ip} is not found" }, 404) if data.nil?
-
-            present data, with: Entities::IPAddress
+            failure = result.failure
+            case failure
+            when Mihari::StatusCodeError
+              error!({ message: "ID:#{id} is not found" }, 404) if failure.status_code == 404
+            end
+            raise failure
           end
         end
       end

data/lib/mihari/web/endpoints/rules.rb

@@ -7,6 +7,113 @@ module Mihari
       # Rule API endpoint
       #
       class Rules < Grape::API
+        class RuleSearcher < Mihari::Service
+          class ResultValue
+            # @return [Array<Mihari::Models::Rule>]
+            attr_reader :rules
+
+            # @return [Integer]
+            attr_reader :total
+
+            # @return [Mihari::Structs::Filters::Rule::SearchFilterWithPagination]
+            attr_reader :filter
+
+            #
+            # @param [Array<Mihari::Models::Rule>] rules
+            # @param [Integer] total
+            # @param [Mihari::Structs::Filters::Rule::SearchFilterWithPagination] filter
+            #
+            def initialize(rules:, total:, filter:)
+              @rules = rules
+              @total = total
+              @filter = filter
+            end
+          end
+
+          #
+          # @params [Hash]
+          #
+          # @return [ResultValue]
+          #
+          def call(params)
+            filter = params.to_h.to_snake_keys
+
+            # normalize keys
+            filter["tag_name"] = filter["tag"]
+            # symbolize hash keys
+            filter = filter.to_h.symbolize_keys
+
+            search_filter_with_pagination = Mihari::Structs::Filters::Rule::SearchFilterWithPagination.new(**filter)
+            rules = Mihari::Models::Rule.search(search_filter_with_pagination)
+            total = Mihari::Models::Rule.count(search_filter_with_pagination.without_pagination)
+
+            ResultValue.new(rules: rules, total: total, filter: filter)
+          end
+        end
+
+        class RuleGetter < Service
+          #
+          # @params [String] id
+          #
+          # @return [Mihari::Models::Rule]
+          #
+          def call(id)
+            Mihari::Models::Rule.find id
+          end
+        end
+
+        class RuleRunner < Service
+          #
+          # @param [String] id
+          #
+          def call(id)
+            rule = Mihari::Rule.from_model(Mihari::Models::Rule.find(id))
+            rule.call
+          end
+        end
+
+        class RuleCreator < Service
+          #
+          # @params [String]
+          #
+          # @return [Mihari::Models::Rule]
+          #
+          def call(yaml)
+            rule = Rule.from_yaml(yaml)
+
+            found = Mihari::Models::Rule.find_by_id(rule.id)
+            error!({ message: "ID:#{rule.id} is already registered" }, 400) unless found.nil?
+
+            rule.model.save
+            rule
+          end
+        end
+
+        class RuleUpdater < Service
+          #
+          # @params [String] id
+          # @params [String] yaml
+          #
+          # @return [Mihari::Models::Rule]
+          #
+          def call(id:, yaml:)
+            Mihari::Models::Rule.find(id)
+
+            rule = Rule.from_yaml(yaml)
+            rule.model.save
+            rule
+          end
+        end
+
+        class RuleDestroyer < Service
+          #
+          # @param [String] id
+          #
+          def call(id)
+            Mihari::Models::Rule.find(id).destroy
+          end
+        end
+
         namespace :rules do
           desc "Get Rule IDs", {
             is_array: true,
@@ -27,33 +134,21 @@ module Mihari
           params do
             optional :page, type: Integer, default: 1
             optional :limit, type: Integer, default: 10
-
             optional :title, type: String
             optional :description, type: String
             optional :tag, type: String
-
             optional :fromAt, type: DateTime
             optional :toAt, type: DateTime
           end
           get "/" do
-            filter = params.to_h.to_snake_keys
-
-            # normalize keys
-            filter["tag_name"] = filter["tag"]
-            # symbolize hash keys
-            filter = filter.to_h.symbolize_keys
-
-            search_filter_with_pagenation = Structs::Filters::Rule::SearchFilterWithPagination.new(**filter)
-            rules = Mihari::Models::Rule.search(search_filter_with_pagenation)
-            total = Mihari::Models::Rule.count(search_filter_with_pagenation.without_pagination)
-
-            present(
-              { rules: rules,
-                total: total,
-                current_page: filter[:page].to_i,
-                page_size: filter[:limit].to_i },
-              with: Entities::RulesWithPagination
-            )
+            value = RuleSearcher.call(params.to_h)
+            present({
+              rules: value.rules,
+              total: value.total,
+              current_page: value.filter[:page].to_i,
+              page_size: value.filter[:limit].to_i
+            },
+              with: Entities::RulesWithPagination)
           end
 
           desc "Get a rule", {
@@ -65,23 +160,16 @@ module Mihari
             requires :id, type: String
           end
           get "/:id" do
-            extend Dry::Monads[:result, :try]
-
-            id = params["id"].to_s
-
-            result = Try do
-              Mihari::Models::Rule.find(id)
-            end.to_result
-
+            id = params[:id].to_s
+            result = RuleGetter.result(params[:id].to_s)
             return present(result.value!, with: Entities::Rule) if result.success?
 
             failure = result.failure
             case failure
             when ActiveRecord::RecordNotFound
               error!({ message: "ID:#{id} is not found" }, 404)
-            else
-              raise failure
             end
+            raise failure
           end
 
           desc "Run a rule", {
@@ -92,24 +180,19 @@ module Mihari
             requires :id, type: String
           end
           get "/:id/run" do
-            extend Dry::Monads[:result, :try]
-
-            id = params["id"].to_s
-
-            result = Try { Rule.from_model(Mihari::Models::Rule.find(id)) }.to_result
+            id = params[:id].to_s
+            result = RuleRunner.result(id)
             if result.success?
-              result.value!.analyzer.run
               status 201
-              return present({ message: "ID:#{id} is ran successfully" }, with: Entities::Message)
+              return present({ message: "ID:#{id}} ran successfully" }, with: Entities::Message)
             end
 
             failure = result.failure
             case failure
             when ActiveRecord::RecordNotFound
               error!({ message: "ID:#{id} is not found" }, 404)
-            else
-              raise failure
             end
+            raise failure
           end
 
           desc "Create a rule", {
@@ -120,22 +203,7 @@ module Mihari
             requires :yaml, type: String, documentation: { param_type: "body" }
           end
           post "/" do
-            extend Dry::Monads[:result, :try]
-
-            yaml = params[:yaml]
-            result = Try { Rule.from_yaml(yaml) }.to_result.bind do |rule|
-              Try do
-                found = Mihari::Models::Rule.find_by_id(rule.id)
-                error!({ message: "ID:#{rule.id} is already registered" }, 400) unless found.nil?
-                rule
-              end.to_result
-            end.bind do |rule|
-              Try do
-                rule.model.save
-                rule
-              end.to_result
-            end
-
+            result = RuleCreator.result(params[:yaml])
             if result.success?
               status 201
               return present(result.value!.model, with: Entities::Rule)
@@ -146,10 +214,9 @@ module Mihari
             when Psych::SyntaxError
               error!({ message: failure.message }, 400)
             when ValidationError
-              error!({ message: "Data format is invalid", details: failure.errors.to_h }, 400)
-            else
-              raise failure
+              error!({ message: "Rule format is invalid", details: failure.errors.to_h }, 400)
             end
+            raise failure
           end
 
           desc "Update a rule", {
@@ -161,22 +228,8 @@ module Mihari
             requires :yaml, type: String, documentation: { param_type: "body" }
           end
           put "/" do
-            extend Dry::Monads[:result, :try]
-
-            id = params[:id]
-            yaml = params[:yaml]
-
-            result = Try do
-              Mihari::Models::Rule.find(id)
-            end.to_result.bind do |_|
-              Try { Rule.from_yaml(yaml) }.to_result
-            end.bind do |rule|
-              Try do
-                rule.model.save
-                rule
-              end.to_result
-            end
-
+            id = params[:id].to_s
+            result = RuleUpdater.result(id: id, yaml: params[:yaml].to_s)
             if result.success?
               status 201
               return present(result.value!.model, with: Entities::Rule)
@@ -189,10 +242,9 @@ module Mihari
             when Psych::SyntaxError
               error!({ message: failure.message }, 400)
             when ValidationError
-              error!({ message: "Data format is invalid", details: failure.errors.to_h }, 400)
-            else
-              raise failure
+              error!({ message: "Rule format is invalid", details: failure.errors.to_h }, 400)
             end
+            raise failure
           end
 
           desc "Delete a rule", {
@@ -204,15 +256,8 @@ module Mihari
             requires :id, type: String
           end
           delete "/:id" do
-            extend Dry::Monads[:result, :try]
-
-            id = params["id"].to_s
-
-            result = Try do
-              rule = Mihari::Models::Rule.find(id)
-              rule.destroy
-            end.to_result
-
+            id = params[:id].to_s
+            result = RuleDestroyer.result(id)
             if result.success?
               status 204
               return present({ message: "ID:#{id} is deleted" }, with: Entities::Message)
@@ -222,9 +267,8 @@ module Mihari
             case failure
             when ActiveRecord::RecordNotFound
               error!({ message: "ID:#{id} is not found" }, 404)
-            else
-              raise failure
             end
+            raise failure
           end
         end
       end