clue-api 1.6.0.dev320__tar.gz → 1.6.0.dev335__tar.gz

{clue_api-1.6.0.dev320 → clue_api-1.6.0.dev335}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: clue-api
-Version: 1.6.0.dev320
+Version: 1.6.0.dev335
 Summary: Clue distributed enrichment service
 License: MIT
 License-File: LICENSE

{clue_api-1.6.0.dev320 → clue_api-1.6.0.dev335}/clue/models/network.py

@@ -76,11 +76,6 @@ class ClueResponse(BaseModel):
 Timestamp = Annotated[
     datetime,
     BeforeValidator(parse_datetime),
-    Field(
-        description="A timestamp describing when the knowledge was generated.",
-        default_factory=lambda: datetime.now(timezone.utc),
-        examples=[datetime.now(timezone.utc), datetime.now(timezone.utc) - timedelta(weeks=2)],
-    ),
 ]
 
 
@@ -121,7 +116,11 @@ class Annotation(BaseModel):
             examples=["v0.0.1", "1.0.0", None],
         ),
     ] = None
-    timestamp: Timestamp
+    timestamp: Timestamp = Field(
+        description="A timestamp describing when the knowledge was generated.",
+        default_factory=lambda: datetime.now(timezone.utc),
+        examples=[datetime.now(timezone.utc), datetime.now(timezone.utc) - timedelta(weeks=2)],
+    )
     type: Annotated[
         Literal["opinion", "frequency", "assessment", "mitigation", "context"],
         Field(

{clue_api-1.6.0.dev320 → clue_api-1.6.0.dev335}/clue/services/fetcher_service.py

@@ -3,7 +3,7 @@ from urllib.parse import urljoin
 
 import elasticapm
 import requests
-from flask import request
+from flask import has_request_context, request
 from pydantic import TypeAdapter, ValidationError
 from requests import JSONDecodeError, exceptions
 
@@ -11,6 +11,7 @@ from clue.common.exceptions import (
     AuthenticationException,
     ClueException,
     ClueValueError,
+    InvalidDataException,
     NotFoundException,
 )
 from clue.common.logging import get_logger
@@ -26,6 +27,26 @@ logger = get_logger(__file__)
 CACHE_TIMEOUT: int = 1 if DEBUG else 5 * 60
 
 
+def get_obo_access_token(
+    source: ExternalSource, user: dict[str, Any], access_token: Optional[str] = None
+) -> tuple[Optional[str], Optional[str]]:
+    """Get the caller access token and an OBO token for an external source when needed."""
+    if access_token is None and has_request_context():
+        auth_header = request.headers.get("Authorization", type=str)
+        if auth_header:
+            parts = auth_header.split(" ", 1)
+            access_token = parts[1] if len(parts) == 2 and parts[0].lower() == "bearer" else auth_header
+    if not access_token:
+        return None, None
+
+    obo_access_token, error = auth_service.check_obo(source, access_token, user["uname"])
+    if error:
+        logger.error("%s: %s", source.name, error)
+        raise AuthenticationException("Invalid token provided for this enrichment.")
+
+    return access_token, obo_access_token
+
+
 @cache.memoize(timeout=1 if DEBUG else 5 * 60, args_to_ignore=["access_token"])  # Cached for 5 minutes
 def get_supported_fetchers(
     source: ExternalSource, user: dict[str, Any], access_token: Optional[str] = None
@@ -43,13 +64,10 @@ def get_supported_fetchers(
 
     url = urljoin(source.url, "fetchers/")
 
-    obo_access_token = None
-    if access_token:
-        obo_access_token, error = auth_service.check_obo(source, access_token, user["uname"])
-
-        if error:
-            logger.error("%s: %s", source.name, error)
-            return {}
+    try:
+        access_token, obo_access_token = get_obo_access_token(source, user, access_token)
+    except AuthenticationException:
+        return {}
 
     headers = {"Accept": "application/json"}
     if obo_access_token or access_token:
@@ -130,6 +148,15 @@ def get_plugins_supported_fetchers(user: dict[str, Any]) -> dict[str, FetcherDef
     return available_fetchers
 
 
+def _validate_fetcher_classification(fetcher: FetcherDefinition | None, selector: Selector, fetcher_id: str) -> None:
+    if fetcher and not CLASSIFICATION.is_accessible(fetcher.classification, selector.classification):
+        raise InvalidDataException(
+            f"Cannot send data classified as {selector.classification} to fetcher {fetcher_id} "
+            f"at classification {fetcher.classification}.",
+            status_code=400,
+        )
+
+
 def run_fetcher(plugin_id: str, fetcher_id: str, user: dict[str, Any]) -> FetcherResult:
     """Executes a specified fetcher.
 
@@ -150,30 +177,34 @@ def run_fetcher(plugin_id: str, fetcher_id: str, user: dict[str, Any]) -> Fetche
     if not plugin:
         raise NotFoundException(f"Plugin {plugin_id} does not exist.")
 
-    access_token = request.headers.get("Authorization", type=str)
-    if access_token:
-        access_token = access_token.split(" ")[1]
-
-    obo_access_token = None
-    if access_token:
-        obo_access_token, error = auth_service.check_obo(plugin, access_token, user["uname"])
-
-        if error:
-            logger.error("%s: %s", plugin.name, error)
-            raise AuthenticationException("Invalid token provided for this enrichment.")
+    access_token, obo_access_token = get_obo_access_token(plugin, user)
 
     headers = {"Accept": "application/json"}
     if obo_access_token or access_token:
         headers["Authorization"] = f"Bearer {obo_access_token or access_token}"
 
-    if request.content_type == "application/json":
+    if request.is_json:
         parameters = request.json
     else:
-        # TODO: Pass parameters via urlencode?
-        parameters = {}
+        logger.error(
+            "Invalid content-type detected: %s",
+        )
+        raise ClueValueError(
+            "The request body must be of type application/json.",
+            status_code=400,
+        )
 
     try:
-        Selector.model_validate(parameters)
+        selector = Selector.model_validate(parameters)
+        supported_fetchers = get_supported_fetchers(plugin, user, access_token=access_token)
+
+        if len(supported_fetchers) < 1:
+            raise NotFoundException(f"{plugin_id} does not support any fetchers.")
+
+        fetcher = supported_fetchers.get(fetcher_id)
+        if fetcher is None:
+            raise NotFoundException(f"Fetcher {fetcher_id} does not exist", status_code=404)
+        _validate_fetcher_classification(fetcher, selector, fetcher_id)
 
         response = requests.post(
             urljoin(plugin.url, f"fetchers/{fetcher_id}"),
@@ -192,7 +223,7 @@ def run_fetcher(plugin_id: str, fetcher_id: str, user: dict[str, Any]) -> Fetche
         return FetcherResult.model_validate(result["api_response"], context={"is_response": True})
     except ValidationError as err:
         logger.exception("Invalid Request Body:")
-        raise ClueValueError(
+        raise InvalidDataException(
             "Validation error encountered on request body. Ensure your request body is properly formatted.",
             status_code=400,
         ) from err
@@ -224,17 +255,7 @@ def get_fetcher_status(plugin_id: str, fetcher_id: str, task_id: str, user: dict
     if not plugin:
         raise NotFoundException(f"Plugin {plugin_id} does not exist.")
 
-    access_token = request.headers.get("Authorization", type=str)
-    if access_token:
-        access_token = access_token.split(" ")[1]
-
-    obo_access_token = None
-    if access_token:
-        obo_access_token, error = auth_service.check_obo(plugin, access_token, user["uname"])
-
-        if error:
-            logger.error("%s: %s", plugin.name, error)
-            raise AuthenticationException("Invalid token provided for this enrichment.")
+    access_token, obo_access_token = get_obo_access_token(plugin, user)
 
     headers = {"Accept": "application/json"}
     if obo_access_token or access_token:

{clue_api-1.6.0.dev320 → clue_api-1.6.0.dev335}/pyproject.toml

@@ -141,7 +141,7 @@ log_cli_level = "WARN"
 [tool.poetry]
 package-mode = true
 name = "clue-api"
-version = "1.6.0.dev320"
+version = "1.6.0.dev335"
 description = "Clue distributed enrichment service"
 authors = ["Canadian Centre for Cyber Security <contact@cyber.gc.ca>"]
 license = "MIT"