runline 0.2.1 → 0.2.2

package/dist/plugins/thehive/src/index.js

@@ -1,6 +1,9 @@
 function getConn(ctx) {
     const c = ctx.connection.config;
-    return { url: c.url.replace(/\/$/, ""), apiKey: c.apiKey };
+    return {
+        url: c.url.replace(/\/$/, ""),
+        apiKey: c.apiKey,
+    };
 }
 async function api(conn, method, endpoint, body, qs) {
     const url = new URL(`${conn.url}/api${endpoint}`);
@@ -10,7 +13,13 @@ async function api(conn, method, endpoint, body, qs) {
                 url.searchParams.set(k, String(v));
         }
     }
-    const init = { method, headers: { Authorization: `Bearer ${conn.apiKey}`, "Content-Type": "application/json" } };
+    const init = {
+        method,
+        headers: {
+            Authorization: `Bearer ${conn.apiKey}`,
+            "Content-Type": "application/json",
+        },
+    };
     if (body && Object.keys(body).length > 0)
         init.body = JSON.stringify(body);
     const res = await fetch(url.toString(), init);
@@ -22,121 +31,317 @@ export default function thehive(rl) {
     rl.setName("thehive");
     rl.setVersion("0.1.0");
     rl.setConnectionSchema({
-        url: { type: "string", required: true, description: "TheHive instance URL", env: "THEHIVE_URL" },
-        apiKey: { type: "string", required: true, description: "TheHive API key", env: "THEHIVE_API_KEY" },
+        url: {
+            type: "string",
+            required: true,
+            description: "TheHive instance URL",
+            env: "THEHIVE_URL",
+        },
+        apiKey: {
+            type: "string",
+            required: true,
+            description: "TheHive API key",
+            env: "THEHIVE_API_KEY",
+        },
     });
     // ── Alert ───────────────────────────────────────────
-    rl.registerAction("alert.create", { description: "Create an alert",
-        inputSchema: { title: { type: "string", required: true }, description: { type: "string", required: true }, severity: { type: "number", required: true, description: "1-4" }, type: { type: "string", required: true }, source: { type: "string", required: true }, sourceRef: { type: "string", required: true }, tlp: { type: "number", required: false }, tags: { type: "string", required: false, description: "Comma-separated" } },
+    rl.registerAction("alert.create", {
+        description: "Create an alert",
+        inputSchema: {
+            title: { type: "string", required: true },
+            description: { type: "string", required: true },
+            severity: { type: "number", required: true, description: "1-4" },
+            type: { type: "string", required: true },
+            source: { type: "string", required: true },
+            sourceRef: { type: "string", required: true },
+            tlp: { type: "number", required: false },
+            tags: { type: "string", required: false, description: "Comma-separated" },
+        },
         async execute(input, ctx) {
             const p = input;
             const body = { ...p, date: Date.now() };
             if (p.tags)
-                body.tags = p.tags.split(",").map(t => t.trim());
+                body.tags = p.tags.split(",").map((t) => t.trim());
             return api(getConn(ctx), "POST", "/alert", body);
-        } });
-    rl.registerAction("alert.get", { description: "Get an alert by ID", inputSchema: { id: { type: "string", required: true } },
-        async execute(input, ctx) { return api(getConn(ctx), "GET", `/alert/${input.id}`); } });
-    rl.registerAction("alert.list", { description: "List alerts", inputSchema: { limit: { type: "number", required: false } },
+        },
+    });
+    rl.registerAction("alert.get", {
+        description: "Get an alert by ID",
+        inputSchema: { id: { type: "string", required: true } },
+        async execute(input, ctx) {
+            return api(getConn(ctx), "GET", `/alert/${input.id}`);
+        },
+    });
+    rl.registerAction("alert.list", {
+        description: "List alerts",
+        inputSchema: { limit: { type: "number", required: false } },
         async execute(input, ctx) {
             const p = (input ?? {});
             const body = { query: [{ _name: "listAlert" }] };
             if (p.limit)
                 body.query.push({ _name: "page", from: 0, to: p.limit });
             return api(getConn(ctx), "POST", "/v1/query", body, { name: "alerts" });
-        } });
-    rl.registerAction("alert.update", { description: "Update an alert", inputSchema: { id: { type: "string", required: true }, data: { type: "object", required: true } },
-        async execute(input, ctx) { const p = input; return api(getConn(ctx), "PATCH", `/alert/${p.id}`, p.data); } });
-    rl.registerAction("alert.markAsRead", { description: "Mark an alert as read", inputSchema: { id: { type: "string", required: true } },
-        async execute(input, ctx) { return api(getConn(ctx), "POST", `/alert/${input.id}/markAsRead`); } });
-    rl.registerAction("alert.markAsUnread", { description: "Mark an alert as unread", inputSchema: { id: { type: "string", required: true } },
-        async execute(input, ctx) { return api(getConn(ctx), "POST", `/alert/${input.id}/markAsUnread`); } });
-    rl.registerAction("alert.promote", { description: "Promote an alert to a case", inputSchema: { id: { type: "string", required: true } },
-        async execute(input, ctx) { return api(getConn(ctx), "POST", `/alert/${input.id}/createCase`); } });
-    rl.registerAction("alert.merge", { description: "Merge an alert into an existing case", inputSchema: { alertId: { type: "string", required: true }, caseId: { type: "string", required: true } },
-        async execute(input, ctx) { const p = input; return api(getConn(ctx), "POST", `/alert/${p.alertId}/merge/${p.caseId}`); } });
+        },
+    });
+    rl.registerAction("alert.update", {
+        description: "Update an alert",
+        inputSchema: {
+            id: { type: "string", required: true },
+            data: { type: "object", required: true },
+        },
+        async execute(input, ctx) {
+            const p = input;
+            return api(getConn(ctx), "PATCH", `/alert/${p.id}`, p.data);
+        },
+    });
+    rl.registerAction("alert.markAsRead", {
+        description: "Mark an alert as read",
+        inputSchema: { id: { type: "string", required: true } },
+        async execute(input, ctx) {
+            return api(getConn(ctx), "POST", `/alert/${input.id}/markAsRead`);
+        },
+    });
+    rl.registerAction("alert.markAsUnread", {
+        description: "Mark an alert as unread",
+        inputSchema: { id: { type: "string", required: true } },
+        async execute(input, ctx) {
+            return api(getConn(ctx), "POST", `/alert/${input.id}/markAsUnread`);
+        },
+    });
+    rl.registerAction("alert.promote", {
+        description: "Promote an alert to a case",
+        inputSchema: { id: { type: "string", required: true } },
+        async execute(input, ctx) {
+            return api(getConn(ctx), "POST", `/alert/${input.id}/createCase`);
+        },
+    });
+    rl.registerAction("alert.merge", {
+        description: "Merge an alert into an existing case",
+        inputSchema: {
+            alertId: { type: "string", required: true },
+            caseId: { type: "string", required: true },
+        },
+        async execute(input, ctx) {
+            const p = input;
+            return api(getConn(ctx), "POST", `/alert/${p.alertId}/merge/${p.caseId}`);
+        },
+    });
     // ── Case ────────────────────────────────────────────
-    rl.registerAction("case.create", { description: "Create a case",
-        inputSchema: { title: { type: "string", required: true }, description: { type: "string", required: true }, severity: { type: "number", required: true }, tlp: { type: "number", required: false }, tags: { type: "string", required: false, description: "Comma-separated" }, owner: { type: "string", required: false } },
+    rl.registerAction("case.create", {
+        description: "Create a case",
+        inputSchema: {
+            title: { type: "string", required: true },
+            description: { type: "string", required: true },
+            severity: { type: "number", required: true },
+            tlp: { type: "number", required: false },
+            tags: { type: "string", required: false, description: "Comma-separated" },
+            owner: { type: "string", required: false },
+        },
         async execute(input, ctx) {
             const p = input;
             const body = { ...p, startDate: Date.now() };
             if (p.tags)
-                body.tags = p.tags.split(",").map(t => t.trim());
+                body.tags = p.tags.split(",").map((t) => t.trim());
             return api(getConn(ctx), "POST", "/case", body);
-        } });
-    rl.registerAction("case.get", { description: "Get a case", inputSchema: { id: { type: "string", required: true } },
-        async execute(input, ctx) { return api(getConn(ctx), "GET", `/case/${input.id}`); } });
-    rl.registerAction("case.list", { description: "List cases", inputSchema: { limit: { type: "number", required: false } },
+        },
+    });
+    rl.registerAction("case.get", {
+        description: "Get a case",
+        inputSchema: { id: { type: "string", required: true } },
+        async execute(input, ctx) {
+            return api(getConn(ctx), "GET", `/case/${input.id}`);
+        },
+    });
+    rl.registerAction("case.list", {
+        description: "List cases",
+        inputSchema: { limit: { type: "number", required: false } },
         async execute(input, ctx) {
             const p = (input ?? {});
             const body = { query: [{ _name: "listCase" }] };
             if (p.limit)
                 body.query.push({ _name: "page", from: 0, to: p.limit });
             return api(getConn(ctx), "POST", "/v1/query", body, { name: "cases" });
-        } });
-    rl.registerAction("case.update", { description: "Update a case", inputSchema: { id: { type: "string", required: true }, data: { type: "object", required: true } },
-        async execute(input, ctx) { const p = input; return api(getConn(ctx), "PATCH", `/case/${p.id}`, p.data); } });
+        },
+    });
+    rl.registerAction("case.update", {
+        description: "Update a case",
+        inputSchema: {
+            id: { type: "string", required: true },
+            data: { type: "object", required: true },
+        },
+        async execute(input, ctx) {
+            const p = input;
+            return api(getConn(ctx), "PATCH", `/case/${p.id}`, p.data);
+        },
+    });
     // ── Observable ──────────────────────────────────────
-    rl.registerAction("observable.create", { description: "Create an observable on a case",
-        inputSchema: { caseId: { type: "string", required: true }, dataType: { type: "string", required: true }, data: { type: "string", required: true }, message: { type: "string", required: false }, tlp: { type: "number", required: false }, ioc: { type: "boolean", required: false }, sighted: { type: "boolean", required: false } },
+    rl.registerAction("observable.create", {
+        description: "Create an observable on a case",
+        inputSchema: {
+            caseId: { type: "string", required: true },
+            dataType: { type: "string", required: true },
+            data: { type: "string", required: true },
+            message: { type: "string", required: false },
+            tlp: { type: "number", required: false },
+            ioc: { type: "boolean", required: false },
+            sighted: { type: "boolean", required: false },
+        },
         async execute(input, ctx) {
             const { caseId, ...body } = input;
             return api(getConn(ctx), "POST", `/case/${caseId}/artifact`, body);
-        } });
-    rl.registerAction("observable.get", { description: "Get an observable", inputSchema: { id: { type: "string", required: true } },
+        },
+    });
+    rl.registerAction("observable.get", {
+        description: "Get an observable",
+        inputSchema: { id: { type: "string", required: true } },
         async execute(input, ctx) {
-            return api(getConn(ctx), "POST", "/v1/query", { query: [{ _name: "getObservable", idOrName: input.id }] }, { name: "get-observable" });
-        } });
-    rl.registerAction("observable.list", { description: "List observables for a case", inputSchema: { caseId: { type: "string", required: true }, limit: { type: "number", required: false } },
+            return api(getConn(ctx), "POST", "/v1/query", {
+                query: [
+                    {
+                        _name: "getObservable",
+                        idOrName: input.id,
+                    },
+                ],
+            }, { name: "get-observable" });
+        },
+    });
+    rl.registerAction("observable.list", {
+        description: "List observables for a case",
+        inputSchema: {
+            caseId: { type: "string", required: true },
+            limit: { type: "number", required: false },
+        },
         async execute(input, ctx) {
             const p = input;
-            const body = { query: [{ _name: "getCase", idOrName: p.caseId }, { _name: "observables" }] };
+            const body = {
+                query: [
+                    { _name: "getCase", idOrName: p.caseId },
+                    { _name: "observables" },
+                ],
+            };
             if (p.limit)
                 body.query.push({ _name: "page", from: 0, to: p.limit });
-            return api(getConn(ctx), "POST", "/v1/query", body, { name: "observables" });
-        } });
-    rl.registerAction("observable.update", { description: "Update an observable", inputSchema: { id: { type: "string", required: true }, data: { type: "object", required: true } },
-        async execute(input, ctx) { const p = input; return api(getConn(ctx), "PATCH", `/case/artifact/${p.id}`, p.data); } });
+            return api(getConn(ctx), "POST", "/v1/query", body, {
+                name: "observables",
+            });
+        },
+    });
+    rl.registerAction("observable.update", {
+        description: "Update an observable",
+        inputSchema: {
+            id: { type: "string", required: true },
+            data: { type: "object", required: true },
+        },
+        async execute(input, ctx) {
+            const p = input;
+            return api(getConn(ctx), "PATCH", `/case/artifact/${p.id}`, p.data);
+        },
+    });
     // ── Task ────────────────────────────────────────────
-    rl.registerAction("task.create", { description: "Create a task on a case",
-        inputSchema: { caseId: { type: "string", required: true }, title: { type: "string", required: true }, status: { type: "string", required: false, description: "Waiting, InProgress, Completed, Cancel" }, flag: { type: "boolean", required: false } },
+    rl.registerAction("task.create", {
+        description: "Create a task on a case",
+        inputSchema: {
+            caseId: { type: "string", required: true },
+            title: { type: "string", required: true },
+            status: {
+                type: "string",
+                required: false,
+                description: "Waiting, InProgress, Completed, Cancel",
+            },
+            flag: { type: "boolean", required: false },
+        },
         async execute(input, ctx) {
             const { caseId, ...body } = input;
             return api(getConn(ctx), "POST", `/case/${caseId}/task`, body);
-        } });
-    rl.registerAction("task.get", { description: "Get a task", inputSchema: { id: { type: "string", required: true } },
+        },
+    });
+    rl.registerAction("task.get", {
+        description: "Get a task",
+        inputSchema: { id: { type: "string", required: true } },
         async execute(input, ctx) {
-            return api(getConn(ctx), "POST", "/v1/query", { query: [{ _name: "getTask", idOrName: input.id }] }, { name: "get-task" });
-        } });
-    rl.registerAction("task.list", { description: "List tasks for a case", inputSchema: { caseId: { type: "string", required: true }, limit: { type: "number", required: false } },
+            return api(getConn(ctx), "POST", "/v1/query", {
+                query: [
+                    {
+                        _name: "getTask",
+                        idOrName: input.id,
+                    },
+                ],
+            }, { name: "get-task" });
+        },
+    });
+    rl.registerAction("task.list", {
+        description: "List tasks for a case",
+        inputSchema: {
+            caseId: { type: "string", required: true },
+            limit: { type: "number", required: false },
+        },
         async execute(input, ctx) {
             const p = input;
-            const body = { query: [{ _name: "getCase", idOrName: p.caseId }, { _name: "tasks" }] };
+            const body = {
+                query: [{ _name: "getCase", idOrName: p.caseId }, { _name: "tasks" }],
+            };
             if (p.limit)
                 body.query.push({ _name: "page", from: 0, to: p.limit });
-            return api(getConn(ctx), "POST", "/v1/query", body, { name: "case-tasks" });
-        } });
-    rl.registerAction("task.update", { description: "Update a task", inputSchema: { id: { type: "string", required: true }, data: { type: "object", required: true } },
-        async execute(input, ctx) { const p = input; return api(getConn(ctx), "PATCH", `/case/task/${p.id}`, p.data); } });
+            return api(getConn(ctx), "POST", "/v1/query", body, {
+                name: "case-tasks",
+            });
+        },
+    });
+    rl.registerAction("task.update", {
+        description: "Update a task",
+        inputSchema: {
+            id: { type: "string", required: true },
+            data: { type: "object", required: true },
+        },
+        async execute(input, ctx) {
+            const p = input;
+            return api(getConn(ctx), "PATCH", `/case/task/${p.id}`, p.data);
+        },
+    });
     // ── Log ─────────────────────────────────────────────
-    rl.registerAction("log.create", { description: "Create a log entry on a task",
-        inputSchema: { taskId: { type: "string", required: true }, message: { type: "string", required: true }, status: { type: "string", required: false, description: "Ok, Deleted" } },
+    rl.registerAction("log.create", {
+        description: "Create a log entry on a task",
+        inputSchema: {
+            taskId: { type: "string", required: true },
+            message: { type: "string", required: true },
+            status: { type: "string", required: false, description: "Ok, Deleted" },
+        },
         async execute(input, ctx) {
             const { taskId, ...body } = input;
             body.startDate = Date.now();
             return api(getConn(ctx), "POST", `/case/task/${taskId}/log`, body);
-        } });
-    rl.registerAction("log.get", { description: "Get a log entry", inputSchema: { id: { type: "string", required: true } },
+        },
+    });
+    rl.registerAction("log.get", {
+        description: "Get a log entry",
+        inputSchema: { id: { type: "string", required: true } },
         async execute(input, ctx) {
-            return api(getConn(ctx), "POST", "/v1/query", { query: [{ _name: "getLog", idOrName: input.id }] }, { name: "get-log" });
-        } });
-    rl.registerAction("log.list", { description: "List logs for a task", inputSchema: { taskId: { type: "string", required: true }, limit: { type: "number", required: false } },
+            return api(getConn(ctx), "POST", "/v1/query", {
+                query: [
+                    {
+                        _name: "getLog",
+                        idOrName: input.id,
+                    },
+                ],
+            }, { name: "get-log" });
+        },
+    });
+    rl.registerAction("log.list", {
+        description: "List logs for a task",
+        inputSchema: {
+            taskId: { type: "string", required: true },
+            limit: { type: "number", required: false },
+        },
         async execute(input, ctx) {
             const p = input;
-            const body = { query: [{ _name: "getTask", idOrName: p.taskId }, { _name: "logs" }] };
+            const body = {
+                query: [{ _name: "getTask", idOrName: p.taskId }, { _name: "logs" }],
+            };
             if (p.limit)
                 body.query.push({ _name: "page", from: 0, to: p.limit });
-            return api(getConn(ctx), "POST", "/v1/query", body, { name: "case-task-logs" });
-        } });
+            return api(getConn(ctx), "POST", "/v1/query", body, {
+                name: "case-task-logs",
+            });
+        },
+    });
 }