howler-api 3.3.0.dev767__tar.gz → 3.3.0.dev773__tar.gz

{howler_api-3.3.0.dev767 → howler_api-3.3.0.dev773}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: howler-api
-Version: 3.3.0.dev767
+Version: 3.3.0.dev773
 Summary: Howler - API server
 License: MIT
 Keywords: howler,alerting,gc,canada,cse-cst,cse,cst,cyber,cccs
@@ -38,7 +38,7 @@ Requires-Dist: opentelemetry-instrumentation-flask (==0.61b0)
 Requires-Dist: opentelemetry-sdk (==1.40.0)
 Requires-Dist: packaging (<25.0)
 Requires-Dist: passlib (==1.7.4)
-Requires-Dist: prometheus-client (==0.24.1)
+Requires-Dist: prometheus-client (==0.25.0)
 Requires-Dist: pydantic (>=2.11.4,<3.0.0)
 Requires-Dist: pydantic-settings[yaml] (>=2.9.1,<3.0.0)
 Requires-Dist: pydash (>=8.0.5,<9.0.0)
@@ -51,10 +51,10 @@ Requires-Dist: python-dotenv (>=1.1.0,<2.0.0)
 Requires-Dist: pytz (>=2025.2,<2026.0)
 Requires-Dist: pyyaml (==6.0.3)
 Requires-Dist: redis (==4.6.0)
-Requires-Dist: requests (==2.33.0)
+Requires-Dist: requests (==2.33.1)
 Requires-Dist: tzdata (>=2026.1,<2027.0)
 Requires-Dist: validators (>=0.34,<0.36)
-Requires-Dist: wsproto (==1.2.0)
+Requires-Dist: wsproto (==1.3.2)
 Project-URL: Documentation, https://cybercentrecanada.github.io/howler/developer/backend/
 Project-URL: Homepage, https://cybercentrecanada.github.io/howler/
 Project-URL: Repository, https://github.com/CybercentreCanada/howler-api

{howler_api-3.3.0.dev767 → howler_api-3.3.0.dev773}/howler/api/v1/user.py

@@ -128,9 +128,7 @@ def add_user_account(username, **_):
         data["name"] = data["uname"]
 
     # Add dynamic classification group
-    data["classification"] = user_service.get_dynamic_classification(
-        cast(str | None, data.get("classification", None)), data["email"]
-    )
+    data["classification"] = user_service.get_dynamic_classification(data)
 
     # Clear non user account data
     avatar = data.pop("avatar", None)
@@ -290,7 +288,7 @@ def set_user_account(username: str, **kwargs):  # noqa: C901
             data.pop("new_pass_confirm", None)
 
         # Apply dynamic classification
-        data["classification"] = user_service.get_dynamic_classification(data["classification"], data["email"])
+        data["classification"] = user_service.get_dynamic_classification(data)
 
         ret_val = user_service.save_user_account(username, data, kwargs["user"])
         return ok({"success": ret_val})

{howler_api-3.3.0.dev767 → howler_api-3.3.0.dev773}/howler/common/classification.py

@@ -38,7 +38,7 @@ class Classification(object):
             "description",
         ]
         self.original_definition = classification_definition
-        self.levels_map: dict[str, str] = {}
+        self.levels_map: dict[str, int] = {}
         self.levels_map_stl = {}
         self.levels_map_lts = {}
         self.levels_styles_map = {}
@@ -64,6 +64,9 @@ class Classification(object):
 
         self.enforce = False
         self.dynamic_groups = False
+        # dynamic group type is one of: email | group | all
+        # defaults to email for original behavior
+        self.dynamic_groups_type = "email"
 
         # Add Invalid classification
         self.levels_map["INV"] = self.INVALID_LVL
@@ -84,12 +87,10 @@ class Classification(object):
                 raise HowlerKeyError("Enforce not set!")
 
             self.dynamic_groups = classification_definition.get("dynamic_groups", None)
-            if self.enforce is None:
+            if self.dynamic_groups is None:
                 raise HowlerKeyError("Dynamic groups not set!")
 
-            if self.enforce:
-                self._classification_cache = self.list_all_classification_combinations()
-                self._classification_cache_short = self.list_all_classification_combinations(long_format=False)
+            self.dynamic_groups_type = classification_definition.get("dynamic_groups_type", self.dynamic_groups_type)
 
             if classification_definition.get("levels", None) is None:
                 raise HowlerKeyError("No classification levels provided!")
@@ -186,6 +187,16 @@ class Classification(object):
                 self.description[short_name] = x.get("description", "N/A")
                 self.description[name] = self.description[short_name]
 
+            # Build the classification cache AFTER all maps are populated so
+            # that normalize_classification can fully validate each combination.
+            # Using normalized=True filters out invalid combos (e.g. subgroups
+            # that violate limited_to_group constraints).
+            if self.enforce:
+                self._classification_cache = self.list_all_classification_combinations(normalized=True)
+                self._classification_cache_short = self.list_all_classification_combinations(
+                    long_format=False, normalized=True
+                )
+
             if not self.is_valid(classification_definition["unrestricted"]):
                 raise InvalidDefinition("Classification definition's unrestricted classification is invalid.")
 
@@ -238,40 +249,46 @@ class Classification(object):
 
         return items
 
-    def _get_c12n_level_index(self, c12n: str) -> str:
+    def _get_c12n_level_index(self, c12n: str) -> tuple[int, str]:
         # Parse classifications in uppercase mode only
         c12n = c12n.upper()
 
-        lvl = c12n.split("//")[0]
+        lvl, _, remain = c12n.partition("//")
         if lvl in self.levels_map:
-            return self.levels_map[lvl]
+            return self.levels_map[lvl], remain
         elif lvl in self.levels_map_lts:
-            return self.levels_map[self.levels_map_lts[lvl]]
+            return self.levels_map[self.levels_map_lts[lvl]], remain
         elif lvl in self.levels_aliases:
-            return self.levels_map[self.levels_aliases[lvl]]
+            return self.levels_map[self.levels_aliases[lvl]], remain
         else:
             raise InvalidClassification(
                 "Classification level '%s' was not found in your classification definition." % lvl
             )
 
     def _get_c12n_level_text(self, lvl_idx: int, long_format: bool = True) -> str:
-        text = self.levels_map.get(str(lvl_idx), None)
+        text: Any = self.levels_map.get(str(lvl_idx), None)
+
         if not text:
             raise InvalidClassification(
                 "Classification level number '%s' was not found in your classification definition." % lvl_idx
             )
+
         if long_format:
             return self.levels_map_stl[text]
+
         return text
 
-    def _get_c12n_required(self, c12n: str, long_format: bool = True) -> List:
+    def _get_c12n_required(self, c12n: str, long_format: bool = True) -> tuple[List, list[str]]:
         # Parse classifications in uppercase mode only
         c12n = c12n.upper()
 
         return_set = set()
         part_set = set(c12n.split("/"))
+        unused = []
 
         for p in part_set:
+            if not p:
+                continue
             if p in self.access_req_map_lts:
                 return_set.add(self.access_req_map_lts[p])
             elif p in self.access_req_map_stl:
@@ -279,27 +296,37 @@ class Classification(object):
             elif p in self.access_req_aliases:
                 for a in self.access_req_aliases[p]:
                     return_set.add(a)
+            else:
+                unused.append(p)
 
         if long_format:
-            return sorted([self.access_req_map_stl[r] for r in return_set])
-        return sorted(list(return_set))
+            return sorted([self.access_req_map_stl[r] for r in return_set]), unused
+        return sorted(list(return_set)), unused
 
-    def _get_c12n_groups(self, c12n: str, long_format: bool = True) -> Tuple[List, List]:
+    def _get_c12n_groups(
+        self, c12n: list[str], long_format: bool = True, get_dynamic_groups: bool = True, auto_select: bool = False
+    ) -> Tuple[List, List, list[str]]:
         # Parse classifications in uppercase mode only
-        c12n = c12n.upper()
 
         g1_set = set()
         g2_set = set()
         others = set()
 
-        grp_part = c12n.split("//")
         groups = []
-        for gp in grp_part:
-            gp = gp.replace("REL TO ", "")
-            gp = gp.replace("REL ", "")
-            temp_group = set([x.strip() for x in gp.split(",")])
-            for t in temp_group:
-                groups.extend(t.split("/"))
+        subgroups = []
+
+        for gp in c12n:
+            # If there is a rel marking we know we have groups
+            if gp.startswith("REL "):
+                gp = gp.replace("REL TO ", "")
+                gp = gp.replace("REL ", "")
+                temp_group = set([x.strip() for x in gp.split(",")])
+                for t in temp_group:
+                    groups.extend(t.split("/"))
+            else:
+                # if there is not a rel marking we either have a subgroup or a solitary_display_name
+                # alias for a group, which we will filter out later
+                subgroups.append(gp)
 
         for g in groups:
             if g in self.groups_map_lts:
@@ -309,33 +336,63 @@ class Classification(object):
             elif g in self.groups_aliases:
                 for a in self.groups_aliases[g]:
                     g1_set.add(a)
-            elif g in self.subgroups_map_lts:
+            else:
+                others.add(g)
+
+        for g in subgroups:
+            if g in self.subgroups_map_lts:
                 g2_set.add(self.subgroups_map_lts[g])
             elif g in self.subgroups_map_stl:
                 g2_set.add(g)
             elif g in self.subgroups_aliases:
                 for a in self.subgroups_aliases[g]:
                     g2_set.add(a)
+            # Here is where we catch any solitary_display_name aliases for groups within the subgroup sections
+            elif g in self.groups_aliases:
+                # Check that this alias is actually a solitary name, don't
+                # let other aliases leak outside the REL marking
+                groups = self.groups_aliases[g]
+                if len(groups) > 1:
+                    raise InvalidClassification(f"Unclear use of alias: {g}")
+                g1_set.add(groups[0])
             else:
-                others.add(g)
+                raise InvalidClassification(f"Unknown Subgroup: {g}")
+
+        # If dynamic groups are active all remaining parts should be groups found under a
+        # REL TO marking that we can merge in with the other groups
+        if self.dynamic_groups and get_dynamic_groups:
+            g1_set.update(others)
+            others = set()
+
+        # Check if there are any required group assignments
+        for subgroup in g2_set:
+            required = self.params_map.get(subgroup, {}).get("require_group", None)
+            if required:
+                g1_set.add(required)
+
+        # Check if there are any forbidden group assignments
+        for subgroup in g2_set:
+            limited_to_group = self.params_map.get(subgroup, {}).get("limited_to_group", None)
+            if limited_to_group is not None:
+                if len(g1_set) > 1 or (len(g1_set) == 1 and g1_set != set([limited_to_group])):
+                    raise InvalidClassification(
+                        f"Subgroup {subgroup} is limited to group {limited_to_group} (found: {', '.join(g1_set)})"
+                    )
 
-        if self.dynamic_groups:
-            for o in others:
-                if (
-                    o not in self.access_req_map_lts
-                    and o not in self.access_req_map_stl
-                    and o not in self.access_req_aliases
-                    and o not in self.levels_map
-                    and o not in self.levels_map_lts
-                    and o not in self.levels_aliases
-                ):
-                    g1_set.add(o)
+        # Do auto select
+        if auto_select and g1_set:
+            g1_set.update(self.groups_auto_select_short)
+        if auto_select and g2_set:
+            g2_set.update(self.subgroups_auto_select_short)
 
+        # Swap to long format if required
         if long_format:
-            return sorted([self.groups_map_stl.get(r, r) for r in g1_set]), sorted(
-                [self.subgroups_map_stl[r] for r in g2_set]
+            return (
+                sorted([self.groups_map_stl.get(r, r) for r in g1_set]),
+                sorted([self.subgroups_map_stl[r] for r in g2_set]),
+                list(others),
             )
-        return sorted(list(g1_set)), sorted(list(g2_set))
+        return sorted(list(g1_set)), sorted(list(g2_set)), list(others)
 
     @staticmethod
     def _can_see_required(user_req: List, req: List) -> bool:
@@ -446,11 +503,22 @@ class Classification(object):
         return out
 
     def _get_classification_parts(
-        self, c12n: str, long_format: bool = True
-    ) -> Tuple[Union[Union[int, str], Any], List, List, List]:
-        lvl_idx = self._get_c12n_level_index(c12n)
-        req = self._get_c12n_required(c12n, long_format=long_format)
-        groups, subgroups = self._get_c12n_groups(c12n, long_format=long_format)
+        self,
+        c12n: str,
+        long_format: bool = True,
+        get_dynamic_groups: bool = True,
+        auto_select: bool = False,
+        ignore_unused: bool = False,
+    ) -> Tuple[int, list[str], list[str], list[str]]:
+        lvl_idx, unused = self._get_c12n_level_index(c12n)
+        req, unused_parts = self._get_c12n_required(unused, long_format=long_format)
+
+        groups, subgroups, unused_parts = self._get_c12n_groups(
+            unused_parts, long_format=long_format, get_dynamic_groups=get_dynamic_groups, auto_select=auto_select
+        )
+
+        if unused_parts and not ignore_unused:
+            raise InvalidClassification(f"Unparsable classification parts: {', '.join(unused_parts)}")
 
         return lvl_idx, req, groups, subgroups
 
@@ -473,7 +541,7 @@ class Classification(object):
     # Public functions
     # ++++++++++++++++++++++++
     # noinspection PyUnusedLocal
-    def list_all_classification_combinations(self, long_format: bool = True) -> Set:
+    def list_all_classification_combinations(self, long_format: bool = True, normalized: bool = False) -> Set:
         combinations = set()
 
         levels = self._list_items_and_aliases(self.original_definition["levels"], long_format=long_format)
@@ -529,7 +597,10 @@ class Classification(object):
 
         temp_combinations = copy(combinations)
         for p in itertools.product(temp_combinations, sgrp_cbs):
-            if "//REL TO " in p[0]:
+            # A combo already has a group part when it contains "//REL TO " (explicit)
+            # or ends with a solitary display name like "//ANY" (after replacement).
+            has_group = "//REL TO " in p[0] or any(p[0].endswith(f"//{sol_name}") for sol_name in solitary_names)
+            if has_group:
                 cl = "/".join(p)
 
                 if cl.endswith("/"):
@@ -537,13 +608,25 @@ class Classification(object):
                 else:
                     combinations.add(cl)
             else:
-                cl = "//REL TO ".join(p)
+                # No group present — subgroups are joined with "//" (not "//REL TO ")
+                # to match the format produced by _get_normalized_classification_text.
+                # "REL TO" is reserved for groups in _get_c12n_groups.
+                cl = "//".join(p)
 
-                if cl.endswith("//REL TO "):
-                    combinations.add(cl[:-9])
+                if cl.endswith("//"):
+                    combinations.add(cl[:-2])
                 else:
                     combinations.add(cl)
 
+        if normalized:
+            good = []
+            for x in combinations:
+                try:
+                    good.append(self.normalize_classification(x, long_format=long_format))
+                except InvalidClassification:
+                    pass
+            return set(good)
+
         return combinations
 
     # noinspection PyUnusedLocal
@@ -581,7 +664,8 @@ class Classification(object):
         return out
 
     def get_access_control_parts(self, c12n: str, user_classification: bool = False) -> Dict:
-        """Returns a dictionary containing the different access parameters Lucene needs to build it's queries
+        """
+        Returns a dictionary containing the different access parameters Lucene needs to build it's queries
 
         Args:
             c12n: The classification to get the parts from
@@ -591,12 +675,8 @@ class Classification(object):
             c12n = self.UNRESTRICTED
 
         try:
-            # Normalize the classification before gathering the parts
-            c12n = self.normalize_classification(c12n, skip_auto_select=user_classification)
-
-            access_lvl = self._get_c12n_level_index(c12n)
-            access_req = self._get_c12n_required(c12n, long_format=False)
-            access_grp1, access_grp2 = self._get_c12n_groups(c12n, long_format=False)
+            parts = self._get_classification_parts(c12n, long_format=False, auto_select=not user_classification)
+            access_lvl, access_req, access_grp1, access_grp2 = parts
 
             return {
                 "__access_lvl__": access_lvl,
@@ -679,7 +759,8 @@ class Classification(object):
         )
 
     def is_accessible(self, user_c12n: str, c12n: str, ignore_invalid: bool = False) -> bool:
-        """Given a user classification, check if a user is allow to see a certain classification
+        """
+        Given a user classification, check if a user is allow to see a certain classification
 
         Args:
             user_c12n: Maximum classification for the user
@@ -698,16 +779,10 @@ class Classification(object):
             return True
 
         try:
-            # Normalize classifications before comparing them
-            user_c12n = self.normalize_classification(user_c12n, skip_auto_select=True)
-            c12n = self.normalize_classification(c12n, skip_auto_select=True)
+            user_lvl, user_req, user_groups, user_subgroups = self._get_classification_parts(user_c12n)
+            lvl, req, groups, subgroups = self._get_classification_parts(c12n)
 
-            user_req = self._get_c12n_required(user_c12n)
-            user_groups, user_subgroups = self._get_c12n_groups(user_c12n)
-            req = self._get_c12n_required(c12n)
-            groups, subgroups = self._get_c12n_groups(c12n)
-
-            if self._get_c12n_level_index(user_c12n) >= self._get_c12n_level_index(c12n):
+            if int(user_lvl) >= int(lvl):
                 if not self._can_see_required(user_req, req):
                     return False
                 if not self._can_see_groups(user_groups, groups):
@@ -812,7 +887,7 @@ class Classification(object):
 
         return True
 
-    def max_classification(self, c12n_1: str, c12n_2: str, long_format: bool = True) -> str:
+    def max_classification(self, c12n_1: str | None, c12n_2: str | None, long_format: bool = True) -> str:
         """Mixes to classification and returns to most restrictive form for them
 
         Args:
@@ -833,9 +908,10 @@ class Classification(object):
             c12n_2 = self.normalize_classification(c12n_2)
 
         if c12n_1 is None:
-            return c12n_2
+            return c12n_2 if c12n_2 else self.UNRESTRICTED
+
         if c12n_2 is None:
-            return c12n_1
+            return c12n_1 if c12n_1 else self.UNRESTRICTED
 
         lvl_idx_1, req_1, groups_1, subgroups_1 = self._get_classification_parts(c12n_1, long_format=long_format)
         lvl_idx_2, req_2, groups_2, subgroups_2 = self._get_classification_parts(c12n_2, long_format=long_format)
@@ -899,8 +975,16 @@ class Classification(object):
             long_format=long_format,  # type: ignore
         )
 
-    def normalize_classification(self, c12n: str, long_format: bool = True, skip_auto_select: bool = False) -> str:
-        """Normalize a given classification by applying the rules defined in the classification definition.
+    def normalize_classification(
+        self,
+        c12n: str,
+        long_format: bool = True,
+        skip_auto_select: bool = False,
+        get_dynamic_groups: bool = True,
+        ignore_unused: bool = False,
+    ) -> str:
+        """
+        Normalize a given classification by applying the rules defined in the classification definition.
         This function will remove any invalid parts and add missing parts to the classification.
         It will also ensure that the display of the classification is always done the same way
 
@@ -916,19 +1000,16 @@ class Classification(object):
             return self.UNRESTRICTED
 
         # Has the classification has already been normalized before?
-        if long_format and c12n in self._classification_cache:
+        if long_format and c12n in self._classification_cache and get_dynamic_groups:
             return c12n
-        if not long_format and c12n in self._classification_cache_short:
+        if not long_format and c12n in self._classification_cache_short and get_dynamic_groups:
             return c12n
 
-        lvl_idx, req, groups, subgroups = self._get_classification_parts(c12n, long_format=long_format)
+        lvl_idx, req, groups, subgroups = self._get_classification_parts(
+            c12n, long_format=long_format, get_dynamic_groups=get_dynamic_groups, ignore_unused=ignore_unused
+        )
         new_c12n = self._get_normalized_classification_text(
-            lvl_idx,  # type: ignore
-            req,
-            groups,
-            subgroups,
-            long_format=long_format,
-            skip_auto_select=skip_auto_select,
+            lvl_idx, req, groups, subgroups, long_format=long_format, skip_auto_select=skip_auto_select
         )
         if long_format:
             self._classification_cache.add(new_c12n)
@@ -937,7 +1018,7 @@ class Classification(object):
 
         return new_c12n
 
-    def build_user_classification(self, c12n_1: str | None, c12n_2: str | None, long_format: bool = True) -> str | None:
+    def build_user_classification(self, c12n_1: str, c12n_2: str, long_format: bool = True) -> str:
         """Mixes to classification and return the classification marking that would give access to the most data
 
         Args:
@@ -959,7 +1040,6 @@ class Classification(object):
 
         if c12n_1 is None:
             return c12n_2
-
         if c12n_2 is None:
             return c12n_1
 

{howler_api-3.3.0.dev767 → howler_api-3.3.0.dev773}/howler/config.py

@@ -10,7 +10,7 @@ from howler.remote.datatypes.user_quota_tracker import UserQuotaTracker
 #################################################################
 # Configuration
 
-CLASSIFICATION = loader.get_classification()
+CLASSIFICATION = loader.get_classification(os.getenv("HWL_CLASSIFICATION_PATH", None))
 
 AUDIT = config.ui.audit
 

{howler_api-3.3.0.dev767 → howler_api-3.3.0.dev773}/howler/helper/azure.py

@@ -1,6 +1,6 @@
 import requests
 
-from howler.common.exceptions import HowlerException
+from howler.common.exceptions import HowlerAttributeError, HowlerException
 from howler.common.logging import get_logger
 from howler.config import config
 from howler.utils.str_utils import default_string_value
@@ -20,7 +20,12 @@ def azure_obo(token: str) -> str:
     Returns:
         str: The new access token with updated privileges
     """
-    azure_provider_config = config.auth.oauth.providers["azure"]
+    if "azure" in config.auth.oauth.providers:
+        azure_provider_config = config.auth.oauth.providers["azure"]
+    elif "entraid" in config.auth.oauth.providers:
+        azure_provider_config = config.auth.oauth.providers["entraid"]
+    else:
+        raise HowlerAttributeError("No azure/entraid-based provider configured!")
 
     logger.debug("OBOing to MS Graph")
     # Azure is a special case here, as we need to OBO to MS Graph

{howler_api-3.3.0.dev767 → howler_api-3.3.0.dev773}/howler/helper/oauth.py

@@ -60,7 +60,7 @@ def parse_profile(profile: dict[str, Any], provider_config: OAuthProvider) -> di
         uname = profile.get("uname", profile.get("preferred_username", email_adr))
 
         # Did we default to email?
-        if email_adr is not None and uname is not None and uname.lower() == email_adr.lower():
+        if uname is not None and email_adr is not None and uname.lower() == email_adr.lower():
             # 1. Use provided regex matcher
             if provider_config.uid_regex:
                 match = re.match(provider_config.uid_regex, uname)
@@ -93,6 +93,8 @@ def parse_profile(profile: dict[str, Any], provider_config: OAuthProvider) -> di
     # Compute access, roles and classification using auto_properties
     access = True
     roles = ["user"]
+    groups: list[str] = profile.get("groups", [])
+    assignments = []
     classification = CLASSIFICATION_ENGINE.UNRESTRICTED
     if provider_config.auto_properties:
         for auto_prop in provider_config.auto_properties:
@@ -129,18 +131,33 @@ def parse_profile(profile: dict[str, Any], provider_config: OAuthProvider) -> di
                         classification = CLASSIFICATION_ENGINE.build_user_classification(
                             classification, auto_prop.value
                         )
+                        logger.debug("Classification: %s", classification)
                         break
 
-    # Infer roles from groups
-    if profile.get("groups") and provider_config.role_map:
+                # Append groups from matching patterns
+                elif auto_prop.type == "group":
+                    if re.match(auto_prop.pattern, value):
+                        groups.append(auto_prop.value)
+                        break
+
+                # Append assignments from matching patterns
+                elif auto_prop.type == "assignment":
+                    if re.match(auto_prop.pattern, value):
+                        assignments.append(auto_prop.value)
+                        break
+
+    # Infer roles from groups (legacy)
+    if groups and provider_config.role_map:
         for user_type in USER_TYPES:
             if (
                 user_type in provider_config.role_map
-                and provider_config.role_map[user_type] in profile.get("groups", [])
+                and provider_config.role_map[user_type] in groups
                 and user_type not in roles
             ):
                 roles.append(user_type)
 
+    # TODO: re-export assignments once they're actually used.
+    # This may need a refactor once the tags stuff is figured out
     return dict(
         access=access,
         type=roles,
@@ -150,7 +167,7 @@ def parse_profile(profile: dict[str, Any], provider_config: OAuthProvider) -> di
         email=email_adr,
         password="__NO_PASSWORD__",  # noqa: S106
         avatar=profile.get("picture", provider_config.picture_url or alternate),
-        groups=profile.get("groups", []),
+        groups=groups,
     )
 
 
@@ -166,9 +183,9 @@ def fetch_avatar(  # noqa: C901
         # Generic picture url endpoint, i.e. MS Graph
         if url == provider_config.picture_url:
             headers = {}
-
             token: str | None = None
-            if oauth_provider == "azure":
+
+            if oauth_provider in ["entraid", "azure"]:
                 if not access_token:
                     raise HowlerValueError("An azure access token is necessary to retrieve the profile picture")  # noqa: TRY301
 
@@ -206,13 +223,13 @@ def fetch_avatar(  # noqa: C901
         return None
 
 
-def fetch_groups(token: str):
-    """Fetch a user's groups form an external endpoint"""
+def fetch_groups(token: str):  # noqa: C901
+    """Fetch a user's groups from an external endpoint"""
     oauth_provider = jwt_service.get_provider(token)
     oauth_provider_config = config.auth.oauth.providers[oauth_provider]
 
     if oauth_provider_config.groups_url:
-        if oauth_provider == "azure":
+        if oauth_provider in ["entraid", "azure"]:
             try:
                 token = azure_obo(token)
             except HowlerException:
@@ -232,13 +249,20 @@ def fetch_groups(token: str):
                     result = result[part]
 
             detailed_group_data = []
+
             for group in result:
-                detailed_group_data.append(
-                    {
-                        "id": group.get("id", None),
-                        "name": group.get("name", group.get("displayName", group.get("id", None))),
-                    }
-                )
+                # Only process groups that are groups (not directory roles)
+                if group.get("@odata.type") == "#microsoft.graph.group":
+                    group_id = group.get("id")
+                    display_name = group.get("displayName")
+                    if display_name:  # Only add if display name exists
+                        detailed_group_data.append(
+                            {
+                                "id": group_id,
+                                "name": display_name,
+                            }
+                        )
+                        logger.debug("Added group: %s (%s)", display_name, group_id)
 
             return sorted(detailed_group_data, key=lambda g: g.get("name", "").lower())
 

{howler_api-3.3.0.dev767 → howler_api-3.3.0.dev773}/howler/helper/search.py

@@ -5,7 +5,7 @@ from howler.datastore.collection import ESCollection
 from howler.odm.models.user import User
 
 # List of indices where queries are protected with classification access control
-ACCESS_CONTROLLED_INDICES: dict[str, ESCollection] = {}
+ACCESS_CONTROLLED_INDICES: set[str] = {"hit"}
 
 ADMIN_INDEX_MAP: dict[str, Callable[[], ESCollection]] = {}
 

{howler_api-3.3.0.dev767 → howler_api-3.3.0.dev773}/howler/odm/models/config.py

@@ -176,7 +176,7 @@ class OAuthAutoProperty(BaseModel):
 
     field: str = Field(description="Field to apply `pattern` to")
     pattern: str = Field(description="Regex pattern for auto-prop assignment")
-    type: Literal["access", "classification", "role"] = Field(
+    type: Literal["access", "classification", "role", "group", "assignment"] = Field(
         description="Type of property assignment on pattern match",
     )
     value: str = Field(description="Assigned property value")