howler-api 3.3.0.dev604__tar.gz → 3.3.0.dev644__tar.gz

{howler_api-3.3.0.dev604 → howler_api-3.3.0.dev644}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: howler-api
-Version: 3.3.0.dev604
+Version: 3.3.0.dev644
 Summary: Howler - API server
 License: MIT
 Keywords: howler,alerting,gc,canada,cse-cst,cse,cst,cyber,cccs

{howler_api-3.3.0.dev604 → howler_api-3.3.0.dev644}/howler/api/v1/dossier.py

@@ -139,7 +139,7 @@ def get_dossier_for_hit(id: str, user: User, **kwargs):
 
         hit = response["items"][0]
 
-        return ok(dossier_service.get_matching_dossiers(hit))
+        return ok(dossier_service.get_matching_dossiers(hit, username=user.uname))
     except ValueError as e:
         return bad_request(err=str(e))
 

{howler_api-3.3.0.dev604 → howler_api-3.3.0.dev644}/howler/api/v1/search.py

@@ -16,6 +16,7 @@ from howler.common.logging import get_logger
 from howler.common.swagger import generate_swagger_docs
 from howler.datastore.exceptions import SearchException
 from howler.helper.search import get_collection, get_default_sort, has_access_control, list_all_fields
+from howler.odm.models.user import User
 from howler.security import api_login
 from howler.services import hit_service, lucene_service
 
@@ -100,7 +101,7 @@ def search(index, **kwargs):
      "next_deep_paging_id": "asX3f...342",  # ID to pass back for the next page during deep paging
      "items": []}                           # List of results
     """
-    user = kwargs["user"]
+    user: User = kwargs["user"]
     collection = get_collection(index, user)
     default_sort = get_default_sort(index, user)
 

{howler_api-3.3.0.dev604 → howler_api-3.3.0.dev644}/howler/services/dossier_service.py

@@ -235,7 +235,9 @@ def update_dossier(dossier_id: str, dossier_data: dict[str, Any], user: User) ->
         raise InvalidDataException("We were unable to update the dossier.", cause=e) from e
 
 
-def get_matching_dossiers(hit: dict[str, Any], dossiers: list[dict[str, Any]] | None = None):
+def get_matching_dossiers(
+    hit: dict[str, Any], dossiers: list[dict[str, Any]] | None = None, username: str | None = None
+):
     """Get a list of dossiers that match a specific security alert/hit.
 
     This function evaluates each dossier's query against the provided hit data
@@ -256,7 +258,7 @@ def get_matching_dossiers(hit: dict[str, Any], dossiers: list[dict[str, Any]] |
     # Retrieve all dossiers if none provided
     if dossiers is None:
         dossiers = datastore().dossier.search(
-            "dossier_id:*",
+            f"type:global OR owner:{username}" if username else "type:global",
             as_obj=False,
             # TODO: Eventually implement caching here
             rows=1000,

{howler_api-3.3.0.dev604 → howler_api-3.3.0.dev644}/howler/services/hit_service.py

@@ -880,7 +880,7 @@ def __match_metadata(candidates: list[dict[str, Any]], hit: dict[str, Any]) -> O
     return sorted(matching_candidates, key=functools.cmp_to_key(__compare_metadata))[0]
 
 
-def augment_metadata(data: list[dict[str, Any]] | dict[str, Any] | None, metadata: list[str], user: dict[str, Any]):  # noqa: C901
+def augment_metadata(data: list[dict[str, Any]] | dict[str, Any] | None, metadata: list[str], user: User):  # noqa: C901
     """Augment hit search results with additional metadata.
 
     This function enriches hit data by adding related information such as templates,
@@ -909,7 +909,7 @@ def augment_metadata(data: list[dict[str, Any]] | dict[str, Any] | None, metadat
     logger.debug("Augmenting %s hits with %s", len(hits), ",".join(metadata))
 
     if "template" in metadata:
-        template_candidates = template_service.get_matching_templates(hits, as_odm=False, uname=user["uname"])
+        template_candidates = template_service.get_matching_templates(hits, as_odm=False, uname=user.uname)
 
         logger.debug("\tRetrieved %s matching templates", len(template_candidates))
 
@@ -942,11 +942,11 @@ def augment_metadata(data: list[dict[str, Any]] | dict[str, Any] | None, metadat
 
     if "dossiers" in metadata:
         dossiers: list[dict[str, Any]] = datastore().dossier.search(
-            "dossier_id:*",
+            f"type:global OR owner:{user.uname}",
             as_obj=False,
             # TODO: Eventually implement caching here
             rows=1000,
         )["items"]
 
         for hit in hits:
-            hit["__dossiers"] = dossier_service.get_matching_dossiers(hit, dossiers)
+            hit["__dossiers"] = dossier_service.get_matching_dossiers(hit, dossiers, username=user.uname)

{howler_api-3.3.0.dev604 → howler_api-3.3.0.dev644}/howler/services/lucene_service.py

@@ -60,12 +60,14 @@ class LuceneProcessor(TreeVisitor):
         for child in node.children:
             child_context = self.child_context(node, child, context)
             for result in self.visit_iter(child, context=child_context):
-                # If we run across a MUST or MUST NOT (plus, probhit) object and the value doesn't match, we immediately
-                # shortcircuit and return false.
+                # If we run across a MUST or MUST NOT (plus, prohibit) object and the value doesn't match, we
+                # immediately shortcircuit and return false.
+                # NOTE: visit_prohibit already negates the inner result, so a violated MUST NOT arrives here as
+                # False (not True). We therefore short-circuit on `not result` rather than `result`.
                 if isinstance(child, Plus) and not result:
                     yield False
                     return
-                elif isinstance(child, Prohibit) and result:
+                elif isinstance(child, Prohibit) and not result:
                     yield False
                     return
 

{howler_api-3.3.0.dev604 → howler_api-3.3.0.dev644}/pyproject.toml

@@ -152,7 +152,7 @@ suppress-none-returning = true
 [tool.poetry]
 package-mode = true
 name = "howler-api"
-version = "3.3.0.dev604"
+version = "3.3.0.dev644"
 description = "Howler - API server"
 authors = [
     "Canadian Centre for Cyber Security <howler@cyber.gc.ca>",