howler-api 3.4.0.dev830__tar.gz → 3.4.0.dev834__tar.gz

{howler_api-3.4.0.dev830 → howler_api-3.4.0.dev834}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: howler-api
-Version: 3.4.0.dev830
+Version: 3.4.0.dev834
 Summary: Howler - API server
 License: MIT
 Keywords: howler,alerting,gc,canada,cse-cst,cse,cst,cyber,cccs

{howler_api-3.4.0.dev830 → howler_api-3.4.0.dev834}/howler/actions/__init__.py

@@ -2,8 +2,10 @@ import importlib
 import os
 import re
 from pathlib import Path
+from types import ModuleType
 from typing import Any, Optional
 
+from howler.common.loader import datastore
 from howler.common.logging import get_logger
 from howler.odm.models.user import User
 from howler.plugins import get_plugins
@@ -12,6 +14,9 @@ logger = get_logger(__file__)
 
 PLUGIN_PATH = Path(os.environ.get("HWL_PLUGIN_DIRECTORY", "/etc/howler/plugins"))
 
+# Roles that grant advanced hit limits
+ADVANCED_ROLES = {"automation_advanced", "actionrunner_advanced", "admin"}
+
 
 def __sanitize_specification(spec: dict[str, Any]) -> dict[str, Any]:
     """Adapt the specification for use in the UI
@@ -71,6 +76,68 @@ def __sanitize_report(report: list[dict[str, Any]]) -> list[dict[str, Any]]:
     return sanitized
 
 
+def _get_operation(operation_id: str) -> ModuleType | None:
+    """Find and return an operation module by ID."""
+    operation = None
+    try:
+        operation = importlib.import_module(f"howler.actions.{operation_id}")
+    except ImportError:
+        pass
+
+    if not operation:
+        for plugin in get_plugins():
+            if not plugin.modules.operations:
+                continue
+
+            operation = next(
+                (operation for operation in plugin.modules.operations if operation.OPERATION_ID == operation_id), None
+            )
+
+            if operation:
+                break
+
+    return operation
+
+
+def check_hit_limit(
+    query: str, user: User, max_hits_basic: int | None, max_hits_advanced: int | None
+) -> dict[str, Any] | None:
+    """Check if the user exceeds hit count limits. Returns error dict if exceeded, None otherwise.
+
+    Args:
+        query: The query to check hit count for (should be the effective query the operation will execute).
+        user: The user executing the action.
+        max_hits_basic: Maximum hits allowed for basic users (None for no limit).
+        max_hits_advanced: Maximum hits allowed for advanced users (None for no limit).
+
+    Returns:
+        Error dict if limit exceeded, None otherwise.
+    """
+    is_advanced = bool(ADVANCED_ROLES & set(user["type"]))
+    limit = max_hits_advanced if is_advanced else max_hits_basic
+
+    if limit is not None:
+        hit_count = datastore().hit.search(query, rows=0)["total"]
+        if hit_count > limit:
+            return {
+                "query": query,
+                "outcome": "error",
+                "title": "Hit limit exceeded",
+                "message": (
+                    f"This action affects {hit_count} hits, but you can only process {limit} at a time. "
+                    "Contact an administrator for bulk operations."
+                ),
+            }
+    return None
+
+
+def _check_hit_limit(operation: ModuleType, query: str, user: User) -> dict[str, Any] | None:
+    """Central hit limit check using raw query. Skipped if operation sets SKIP_CENTRAL_LIMIT."""
+    max_hits_basic = getattr(operation, "MAX_HITS_BASIC", None)
+    max_hits_advanced = getattr(operation, "MAX_HITS_ADVANCED", None)
+    return check_hit_limit(query, user, max_hits_basic, max_hits_advanced)
+
+
 def execute(
     operation_id: str,
     query: str,
@@ -89,23 +156,7 @@ def execute(
     Returns:
         list[dict[str, Any]]: A report on the execution
     """
-    operation = None
-    try:
-        operation = importlib.import_module(f"howler.actions.{operation_id}")
-    except ImportError:
-        pass
-
-    if not operation:
-        for plugin in get_plugins():
-            if not plugin.modules.operations:
-                continue
-
-            operation = next(
-                (operation for operation in plugin.modules.operations if operation.OPERATION_ID == operation_id), None
-            )
-
-            if operation:
-                break
+    operation = _get_operation(operation_id)
 
     if not operation:
         return [
@@ -117,9 +168,21 @@ def execute(
             }
         ]
 
-    user_roles: set[str] = set(user["type"] if user else [])
-    missing_roles = set(operation.specification()["roles"]) - user_roles
-    if missing_roles:
+    if not user:
+        return [
+            {
+                "query": query,
+                "outcome": "error",
+                "title": "Authentication required",
+                "message": "You must be logged in to execute actions.",
+            }
+        ]
+
+    user_roles = set(user["type"])
+    is_admin = "admin" in user_roles
+    required_roles = set(operation.specification()["roles"])
+    has_roles = required_roles & user_roles
+    if not is_admin and not has_roles:
         return [
             {
                 "query": query,
@@ -127,11 +190,18 @@ def execute(
                 "title": "Insufficient permissions",
                 "message": (
                     f"The operation ID provided ({operation_id}) requires permissions you do not have "
-                    f"({', '.join(missing_roles)}). Contact HOWLER Support for more information."
+                    f"(missing one of: {', '.join(sorted(required_roles))}). "
+                    "Contact HOWLER Support for more information."
                 ),
             }
         ]
 
+    # Skip central limit check if operation handles it locally with transformed query
+    if not getattr(operation, "SKIP_CENTRAL_LIMIT", False):
+        limit_error = _check_hit_limit(operation, query, user)
+        if limit_error:
+            return [limit_error]
+
     report = operation.execute(query=query, request_id=request_id, user=user, **kwargs)
 
     return __sanitize_report(report)

{howler_api-3.4.0.dev830 → howler_api-3.4.0.dev834}/howler/actions/add_label.py

@@ -10,6 +10,8 @@ from howler.utils.str_utils import sanitize_lucene_query
 hit_helper = OdmHelper(Hit)
 
 OPERATION_ID = "add_label"
+MAX_HITS_BASIC = 20
+MAX_HITS_ADVANCED = 1000
 
 CATEGORIES = list(Label.fields().keys())
 
@@ -99,7 +101,7 @@ def specification():
             "short": "Add a label to a hit",
             "long": execute.__doc__,
         },
-        "roles": ["automation_basic"],
+        "roles": ["automation_basic", "actionrunner_basic"],
         "steps": [
             {
                 "args": {"category": [], "label": []},

{howler_api-3.4.0.dev830 → howler_api-3.4.0.dev834}/howler/actions/add_to_bundle.py

@@ -1,18 +1,23 @@
 from typing import Optional
 
+from howler.actions import check_hit_limit
 from howler.common.loader import datastore
 from howler.datastore.operations import OdmHelper
 from howler.odm.models.action import VALID_TRIGGERS
 from howler.odm.models.hit import Hit
+from howler.odm.models.user import User
 from howler.services import hit_service
 from howler.utils.str_utils import sanitize_lucene_query
 
 hit_helper = OdmHelper(Hit)
 
 OPERATION_ID = "add_to_bundle"
+MAX_HITS_BASIC = 10
+MAX_HITS_ADVANCED = 1000
+SKIP_CENTRAL_LIMIT = True  # This operation transforms the query, handles limit check locally
 
 
-def execute(query: str, bundle_id: Optional[str] = None, **kwargs):
+def execute(query: str, bundle_id: Optional[str] = None, user: Optional[User] = None, **kwargs):
     """Add a set of hits matching the query to the specified bundle.
 
     Args:
@@ -77,7 +82,14 @@ def execute(query: str, bundle_id: Optional[str] = None, **kwargs):
             )
 
         safe_query = f"({query}) AND (-howler.bundles:({sanitize_lucene_query(bundle_id)}) AND howler.is_bundle:false)"
-        matching_hits = ds.hit.search(safe_query)["items"]
+
+        # Check hit limit against the effective query (not raw query)
+        if user:
+            limit_error = check_hit_limit(safe_query, user, MAX_HITS_BASIC, MAX_HITS_ADVANCED)
+            if limit_error:
+                return [limit_error]
+
+        matching_hits = ds.hit.search(safe_query, rows=MAX_HITS_ADVANCED, fl="howler.id")["items"]
         if len(matching_hits) < 1:
             report.append(
                 {
@@ -141,7 +153,7 @@ def specification():
             "short": "Add a set of hits to a bundle",
             "long": execute.__doc__,
         },
-        "roles": ["automation_basic"],
+        "roles": ["automation_basic", "actionrunner_basic"],
         "steps": [
             {
                 "args": {"bundle_id": []},

{howler_api-3.4.0.dev830 → howler_api-3.4.0.dev834}/howler/actions/change_field.py

@@ -65,7 +65,7 @@ def specification():
             "short": "Change one of the fields of a hit",
             "long": execute.__doc__,
         },
-        "roles": ["automation_advanced", "admin"],
+        "roles": ["automation_advanced", "actionrunner_advanced", "admin"],
         "steps": [
             {
                 "args": {"field": [], "value": []},

{howler_api-3.4.0.dev830 → howler_api-3.4.0.dev834}/howler/actions/demote.py

@@ -15,6 +15,8 @@ from howler.odm.models.user import User
 from howler.utils.str_utils import sanitize_lucene_query
 
 OPERATION_ID = "demote"
+MAX_HITS_BASIC = 10
+MAX_HITS_ADVANCED = 1000
 
 ESCALATIONS = [esc for esc in Escalation.list() if esc != Escalation.EVIDENCE]
 
@@ -131,7 +133,7 @@ def specification():
             "short": "Demote a hit",
             "long": execute.__doc__,
         },
-        "roles": ["automation_basic"],
+        "roles": ["automation_basic", "actionrunner_basic"],
         "steps": [
             {
                 "args": {"escalation": []},

{howler_api-3.4.0.dev830 → howler_api-3.4.0.dev834}/howler/actions/example_plugin.py

@@ -67,7 +67,7 @@ def specification():
         },
         # What roles should be necessary to run this action? In general, automation_basic should always be required,
         # while automation_advanced should be set when this action could be dangerous or costly in terms of resources.
-        "roles": ["automation_basic"],
+        "roles": ["automation_basic", "actionrunner_basic"],
         # What data should the user be required to provide? This is split intop steps, so arguments can depend on each
         # other, giving basic control flow for specifying arguments.
         "steps": [

{howler_api-3.4.0.dev830 → howler_api-3.4.0.dev834}/howler/actions/prioritization.py

@@ -6,6 +6,8 @@ from howler.odm.models.hit import Hit
 hit_helper = OdmHelper(Hit)
 
 OPERATION_ID = "prioritization"
+MAX_HITS_BASIC = 10
+MAX_HITS_ADVANCED = 1000
 
 VALID_FIELDS = ["reliability", "severity", "volume", "confidence", "score"]
 
@@ -82,7 +84,7 @@ def specification():
             "short": "Change one of the prioritization fields of a hit",
             "long": execute.__doc__,
         },
-        "roles": ["automation_basic"],
+        "roles": ["automation_basic", "actionrunner_basic"],
         "steps": [
             {
                 "args": {"field": [], "value": []},

{howler_api-3.4.0.dev830 → howler_api-3.4.0.dev834}/howler/actions/promote.py

@@ -13,6 +13,8 @@ from howler.odm.models.howler_data import (
 from howler.utils.str_utils import sanitize_lucene_query
 
 OPERATION_ID = "promote"
+MAX_HITS_BASIC = 10
+MAX_HITS_ADVANCED = 1000
 
 ESCALATIONS = [esc for esc in Escalation.list() if esc != Escalation.MISS]
 
@@ -118,7 +120,7 @@ def specification():
             "short": "Promote a hit",
             "long": execute.__doc__,
         },
-        "roles": ["automation_basic"],
+        "roles": ["automation_basic", "actionrunner_basic"],
         "steps": [
             {
                 "args": {"escalation": []},

{howler_api-3.4.0.dev830 → howler_api-3.4.0.dev834}/howler/actions/remove_from_bundle.py

@@ -1,19 +1,24 @@
 from typing import Optional
 
+from howler.actions import check_hit_limit
 from howler.common.exceptions import HowlerException
 from howler.common.loader import datastore
 from howler.datastore.operations import OdmHelper
 from howler.odm.models.action import VALID_TRIGGERS
 from howler.odm.models.hit import Hit
+from howler.odm.models.user import User
 from howler.services import hit_service
 from howler.utils.str_utils import sanitize_lucene_query
 
 hit_helper = OdmHelper(Hit)
 
 OPERATION_ID = "remove_from_bundle"
+MAX_HITS_BASIC = 10
+MAX_HITS_ADVANCED = 1000
+SKIP_CENTRAL_LIMIT = True  # This operation transforms the query, handles limit check locally
 
 
-def execute(query: str, bundle_id: Optional[str] = None, **kwargs):
+def execute(query: str, bundle_id: Optional[str] = None, user: Optional[User] = None, **kwargs):
     """Remove a set of hits matching the query from the specified bundle.
 
     Args:
@@ -62,9 +67,15 @@ def execute(query: str, bundle_id: Optional[str] = None, **kwargs):
                 }
             )
 
-        safe_query = f"{query} AND (howler.bundles:{bundle_id})"
+        safe_query = f"{query} AND (howler.bundles:{sanitize_lucene_query(bundle_id)})"
 
-        matching_hits = ds.hit.search(safe_query)["items"]
+        # Check hit limit against the effective query (not raw query)
+        if user:
+            limit_error = check_hit_limit(safe_query, user, MAX_HITS_BASIC, MAX_HITS_ADVANCED)
+            if limit_error:
+                return [limit_error]
+
+        matching_hits = ds.hit.search(safe_query, rows=MAX_HITS_ADVANCED, fl="howler.id")["items"]
         if len(matching_hits) < 1:
             report.append(
                 {
@@ -83,7 +94,7 @@ def execute(query: str, bundle_id: Optional[str] = None, **kwargs):
 
         hit_service.update_hit(
             bundle_id,
-            [hit_helper.list_remove("howler.hits", h["howler"]["id"]) for h in ds.hit.search(safe_query)["items"]],
+            [hit_helper.list_remove("howler.hits", h["howler"]["id"]) for h in matching_hits],
         )
 
         if len(ds.hit.get(bundle_id).howler.hits) < 1:
@@ -121,7 +132,7 @@ def specification():
             "short": "Remove a set of hits from a bundle",
             "long": execute.__doc__,
         },
-        "roles": ["automation_basic"],
+        "roles": ["automation_basic", "actionrunner_basic"],
         "steps": [
             {
                 "args": {"bundle_id": []},

{howler_api-3.4.0.dev830 → howler_api-3.4.0.dev834}/howler/actions/remove_label.py

@@ -10,6 +10,8 @@ from howler.utils.str_utils import sanitize_lucene_query
 hit_helper = OdmHelper(Hit)
 
 OPERATION_ID = "remove_label"
+MAX_HITS_BASIC = 20
+MAX_HITS_ADVANCED = 1000
 
 CATEGORIES = list(Label.fields().keys())
 
@@ -99,7 +101,7 @@ def specification():
             "short": "Remove a label from a hit",
             "long": execute.__doc__,
         },
-        "roles": ["automation_basic"],
+        "roles": ["automation_basic", "actionrunner_basic"],
         "steps": [
             {
                 "args": {"category": [], "label": []},

{howler_api-3.4.0.dev830 → howler_api-3.4.0.dev834}/howler/actions/transition.py

@@ -1,6 +1,7 @@
 import inspect
 from typing import Optional, cast
 
+from howler.actions import check_hit_limit
 from howler.common.exceptions import InvalidDataException, NotFoundException
 from howler.common.loader import datastore
 from howler.common.logging import get_logger
@@ -17,6 +18,9 @@ from howler.services import event_service, hit_service
 from howler.utils.list_utils import flatten_list
 
 OPERATION_ID = "transition"
+MAX_HITS_BASIC = 10
+MAX_HITS_ADVANCED = 1000
+SKIP_CENTRAL_LIMIT = True  # This operation transforms the query, handles limit check locally
 
 log = get_logger(__file__)
 
@@ -70,8 +74,17 @@ def execute(
         status (str): The status from which to transition.
         transition (str): The transition to attempt to execute.
     """
-    rows = 1000 if "automation_advanced" in user.type else 10
-    hits = datastore().hit.search(f"({query}) AND howler.status:{status}", rows=rows, fl="howler.id")
+    # Build effective query with status filter
+    effective_query = f"({query}) AND howler.status:{status}"
+
+    # Check hit limit against the effective query (not raw query)
+    limit_error = check_hit_limit(effective_query, user, MAX_HITS_BASIC, MAX_HITS_ADVANCED)
+    if limit_error:
+        return [limit_error]
+
+    is_advanced = "automation_advanced" in user.type or "actionrunner_advanced" in user.type or "admin" in user.type
+    rows = MAX_HITS_ADVANCED if is_advanced else MAX_HITS_BASIC
+    hits = datastore().hit.search(effective_query, rows=rows, fl="howler.id")
 
     ids = [hit.howler.id for hit in hits["items"]]
 
@@ -176,7 +189,7 @@ def specification():
             "short": "Transition a hit",
             "long": execute.__doc__,
         },
-        "roles": ["automation_basic"],
+        "roles": ["automation_basic", "actionrunner_basic"],
         "steps": [
             {
                 "args": {"status": []},

{howler_api-3.4.0.dev830 → howler_api-3.4.0.dev834}/howler/api/v1/action.py

@@ -23,7 +23,11 @@ action_api._doc = "Endpoints relating to bulk actions and automation"  # type: i
 
 @generate_swagger_docs()
 @action_api.route("/")
-@api_login(audit=False, check_xsrf_token=False, required_type=["automation_basic"])
+@api_login(
+    audit=False,
+    check_xsrf_token=False,
+    required_type=["admin", "automation_basic", "automation_advanced", "actionrunner_basic", "actionrunner_advanced"],
+)
 def get_actions(**_) -> Response:
     """Get a list of existing actions
 
@@ -43,7 +47,7 @@ def get_actions(**_) -> Response:
 
 @generate_swagger_docs()
 @action_api.route("/", methods=["POST"])
-@api_login(audit=False, check_xsrf_token=False, required_type=["automation_basic"])
+@api_login(audit=False, check_xsrf_token=False, required_type=["admin", "automation_basic", "automation_advanced"])
 def add_action(user: User, **_) -> Response:
     """Create a new action
 
@@ -97,7 +101,7 @@ def add_action(user: User, **_) -> Response:
 @api_login(
     audit=False,
     check_xsrf_token=False,
-    required_type=["automation_basic"],
+    required_type=["admin", "automation_basic", "automation_advanced"],
 )
 def update_action(id: str, user: User, **_) -> Response:
     """Update an existing action
@@ -164,7 +168,7 @@ def update_action(id: str, user: User, **_) -> Response:
 
 @generate_swagger_docs()
 @action_api.route("/<id>", methods=["DELETE"])
-@api_login(audit=True, check_xsrf_token=False, required_type=["automation_basic"])
+@api_login(audit=True, check_xsrf_token=False, required_type=["admin", "automation_basic", "automation_advanced"])
 def delete_action(id: str, user: User, **kwargs) -> Response:
     """Delete an existing action
 
@@ -200,7 +204,11 @@ def delete_action(id: str, user: User, **kwargs) -> Response:
 
 @generate_swagger_docs()
 @action_api.route("/<id>/execute", methods=["POST"])
-@api_login(audit=True, check_xsrf_token=False, required_type=["automation_basic"])
+@api_login(
+    audit=True,
+    check_xsrf_token=False,
+    required_type=["admin", "automation_basic", "automation_advanced", "actionrunner_basic", "actionrunner_advanced"],
+)
 def execute_action(id: str, **kwargs) -> Response:
     """Execute one or more actions on a given query
 
@@ -275,7 +283,11 @@ def execute_action(id: str, **kwargs) -> Response:
 
 @generate_swagger_docs()
 @action_api.route("/operations")
-@api_login(audit=False, check_xsrf_token=False, required_type=["automation_basic"])
+@api_login(
+    audit=False,
+    check_xsrf_token=False,
+    required_type=["admin", "automation_basic", "automation_advanced", "actionrunner_basic", "actionrunner_advanced"],
+)
 def get_operations(**_) -> Response:
     """Get a list of operations the user can run on a query
 
@@ -295,7 +307,11 @@ def get_operations(**_) -> Response:
 
 @generate_swagger_docs()
 @action_api.route("/execute", methods=["POST"])
-@api_login(audit=True, check_xsrf_token=False, required_type=["automation_basic"])
+@api_login(
+    audit=True,
+    check_xsrf_token=False,
+    required_type=["admin", "automation_basic", "automation_advanced", "actionrunner_basic", "actionrunner_advanced"],
+)
 def execute_operations(**kwargs) -> Response:
     """Execute one or more operations on a given query
 

{howler_api-3.4.0.dev830 → howler_api-3.4.0.dev834}/howler/common/loader.py

@@ -13,7 +13,7 @@ if TYPE_CHECKING:
 
 APP_NAME = os.environ.get("APP_NAME", "howler")
 APP_PREFIX = os.environ.get("APP_PREFIX", "hwl")
-USER_TYPES = {"admin", "user", "automation_basic", "automation_advanced"}
+USER_TYPES = {"admin", "user", "automation_basic", "automation_advanced", "actionrunner_basic", "actionrunner_advanced"}
 
 
 def env_substitute(buffer):

{howler_api-3.4.0.dev830 → howler_api-3.4.0.dev834}/howler/odm/models/user.py

@@ -63,7 +63,7 @@ class User(odm.Model):
     access_control: str = odm.Keyword(index=False, store=False, optional=True, description="Access control filter")
     type: list[str] = odm.List(
         odm.Enum(values=loader.USER_TYPES),
-        default=["user", "automation_basic"],
+        default=["user", "actionrunner_basic"],
         description="Type of user",
     )
     uname: str = odm.Keyword(copyto="__text__", description="Username")

{howler_api-3.4.0.dev830 → howler_api-3.4.0.dev834}/howler/odm/random_data.py

@@ -119,7 +119,14 @@ def create_users(ds):
             "email": "admin@howler.cyber.gc.ca",
             "password": admin_hash,
             "uname": "admin",
-            "type": ["admin", "user", "automation_basic", "automation_advanced"],
+            "type": [
+                "admin",
+                "user",
+                "automation_basic",
+                "automation_advanced",
+                "actionrunner_basic",
+                "actionrunner_advanced",
+            ],
             "groups": [
                 "group1",
                 "group2",
@@ -169,6 +176,11 @@ def create_users(ds):
                     "password": user_hash,
                 },
             },
+            "type": [
+                "user",
+                "automation_basic",
+                "actionrunner_basic",
+            ],
             "password": user_hash,
             "uname": "user",
             "favourite_views": [user_view.view_id],

{howler_api-3.4.0.dev830 → howler_api-3.4.0.dev834}/pyproject.toml

@@ -152,7 +152,7 @@ suppress-none-returning = true
 [tool.poetry]
 package-mode = true
 name = "howler-api"
-version = "3.4.0.dev830"
+version = "3.4.0.dev834"
 description = "Howler - API server"
 authors = [
     "Canadian Centre for Cyber Security <howler@cyber.gc.ca>",