clue-api 1.3.0.dev20__tar.gz → 1.3.0.dev32__tar.gz

{clue_api-1.3.0.dev20 → clue_api-1.3.0.dev32}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: clue-api
-Version: 1.3.0.dev20
+Version: 1.3.0.dev32
 Summary: Clue distributed enrichment service
 License: MIT
 License-File: LICENSE

{clue_api-1.3.0.dev20 → clue_api-1.3.0.dev32}/clue/api/v1/lookup.py

@@ -205,13 +205,16 @@ def enrich(type_name: str, value: str, **kwargs) -> dict[str, QueryResult]:
     user = kwargs["user"]
 
     # For backwards compatability, if eml is used it is replaced with email
-    type_name = type_name.replace("eml", "email")
+    type_name = type_name.lower().replace("eml", "email")
 
     if type_name == "telemetry":
         try:
             json.loads(urllib.parse.unquote(value))
         except json.JSONDecodeError:
             return bad_request(err="If type is telemetry, value must be a valid JSON object.")
+    else:
+        # Normalize to lowercase all non-telemetry inputs
+        value = value.lower()
 
     # re-encode the type after being decoded going through flask/wsgi route
     value = urllib.parse.quote(value, safe="")

{clue_api-1.3.0.dev20 → clue_api-1.3.0.dev32}/clue/constants/supported_types.py

@@ -37,4 +37,4 @@ SUPPORTED_TYPES = {
     "tenant-id": UUID4_REGEX,
 }
 
-CASE_INSENSITIVE_TYPES = ["ip", "domain", "port", "tenant-id"]
+CASE_INSENSITIVE_TYPES = ["ip", "domain", "port", "tenant-id", "hbs_oid", "hbs_agent_id"]

{clue_api-1.3.0.dev20 → clue_api-1.3.0.dev32}/clue/models/selector.py

@@ -1,9 +1,10 @@
 # ruff: noqa: D101
 import ipaddress
 import json
+from typing import Annotated
 
 from flask import request
-from pydantic import BaseModel, Field, model_validator
+from pydantic import BaseModel, Field, StringConstraints, model_validator
 from typing_extensions import Self
 
 from clue.common.logging import get_logger
@@ -14,7 +15,7 @@ logger = get_logger(__file__)
 
 
 class Selector(BaseModel):
-    type: str
+    type: Annotated[str, StringConstraints(to_lower=True, strip_whitespace=True)]
     value: str
     classification: str | None = Field(default=None)
     sources: list[str] | None = Field(default=None)
@@ -41,8 +42,7 @@ class Selector(BaseModel):
                 json.loads(self.value)
             except json.JSONDecodeError as e:
                 raise AssertionError("If type is telemetry, value must be a valid JSON object.") from e
-
-        if self.type in CASE_INSENSITIVE_TYPES:
+        elif self.type in CASE_INSENSITIVE_TYPES:
             self.value = self.value.lower()
 
         if not self.classification:

{clue_api-1.3.0.dev20 → clue_api-1.3.0.dev32}/clue/security/obo.py

@@ -27,7 +27,12 @@ def _get_token_raw(service: str, user: str) -> Optional[str]:
     token_store = _get_obo_token_store(service, user)
 
     if token_store.length() > 0:
-        return token_store.random(1)[0]
+        result = token_store.random(1)
+
+        if len(result) > 0:
+            return result[0]
+
+        logger.warning("Token store reported at least one entry, but was empty on fetch.")
 
     return None
 

{clue_api-1.3.0.dev20 → clue_api-1.3.0.dev32}/clue/services/type_service.py

@@ -1,7 +1,7 @@
 from typing import Any
 
-import elasticapm
 import requests
+from elasticapm.traces import capture_span
 from flask import request
 from requests import exceptions
 
@@ -62,12 +62,12 @@ def get_supported_types(source_url: str, access_token: str | None = None, obo_ac
         return result
 
     logger.debug("Cache miss, polling plugin")
-    with elasticapm.capture_span(f"GET {url}", span_type="http"):
+    with capture_span(f"GET {url}", span_type="http"):
         headers = generate_headers(obo_access_token or access_token, access_token if obo_access_token else None)
 
         try:
             rsp = requests.get(url, headers=headers, timeout=3.0)
-        except exceptions.ConnectionError:
+        except (exceptions.ConnectionError, exceptions.ReadTimeout):
             # any errors are logged and no result is saved to local cache to enable retry on next query
             logger.exception(f"Unable to connect: {url}")
             return None
@@ -81,7 +81,7 @@ def get_supported_types(source_url: str, access_token: str | None = None, obo_ac
             except requests.exceptions.JSONDecodeError:
                 logger.exception(
                     f"Parsing error in error ({rsp.status_code}) response - unknown format\n"
-                    f"Raw response: {rsp.content}"
+                    f"Raw response: {rsp.text}"
                 )
                 return None
             except KeyError:
@@ -103,7 +103,7 @@ def get_supported_types(source_url: str, access_token: str | None = None, obo_ac
             CACHE.set(url, types_result)
             return types_result
         except requests.exceptions.JSONDecodeError:
-            logger.exception("Parsing error in OK response - unknown format\n" f"Raw response: {rsp.content}")
+            logger.exception("Parsing error in OK response - unknown format\n" f"Raw response: {rsp.text}")
             return None
         except Exception:
             logger.exception("External API did not return expected format:")

{clue_api-1.3.0.dev20 → clue_api-1.3.0.dev32}/pyproject.toml

@@ -146,7 +146,7 @@ log_cli_level = "WARN"
 [tool.poetry]
 package-mode = true
 name = "clue-api"
-version = "1.3.0.dev20"
+version = "1.3.0.dev32"
 description = "Clue distributed enrichment service"
 authors = ["Canadian Centre for Cyber Security <contact@cyber.gc.ca>"]
 license = "MIT"