howler-api 4.0.0.dev1020__tar.gz → 4.0.0.dev1044__tar.gz

{howler_api-4.0.0.dev1020 → howler_api-4.0.0.dev1044}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: howler-api
-Version: 4.0.0.dev1020
+Version: 4.0.0.dev1044
 Summary: Howler - API server
 License: MIT
 Keywords: howler,alerting,gc,canada,cse-cst,cse,cst,cyber,cccs
@@ -29,7 +29,7 @@ Requires-Dist: elasticsearch (==8.19.3)
 Requires-Dist: flasgger (>=0.9.7.1,<0.10.0.0)
 Requires-Dist: flask (==3.1.3)
 Requires-Dist: flask-caching (==2.4.0)
-Requires-Dist: gevent (==23.9.1)
+Requires-Dist: gevent (>=25.9.1,<26.0.0)
 Requires-Dist: gunicorn (==23.0.0)
 Requires-Dist: luqum (>=1.0.0,<2.0.0)
 Requires-Dist: mergedeep (>=1.3.4,<2.0.0)

howler_api-4.0.0.dev1044/howler/actions/add_to_bundle.py

@@ -0,0 +1,148 @@
+"""Deprecated add_to_bundle action — delegates to add_to_case via bundle_compat_service."""
+
+from typing import Optional
+
+from howler.actions import check_hit_limit
+from howler.common.exceptions import NotFoundException
+from howler.common.loader import datastore
+from howler.odm.models.action import VALID_TRIGGERS
+from howler.odm.models.user import User
+from howler.services import bundle_compat_service, case_service
+from howler.utils.str_utils import sanitize_lucene_query
+
+OPERATION_ID = "add_to_bundle"
+MAX_HITS_BASIC = 10
+MAX_HITS_ADVANCED = 1000
+SKIP_CENTRAL_LIMIT = True  # This operation transforms the query, handles limit check locally
+
+
+def execute(query: str, bundle_id: Optional[str] = None, user: Optional[User] = None, **kwargs):  # noqa: C901
+    """Add a set of hits matching the query to the specified bundle (deprecated — uses cases).
+
+    Args:
+        query (str): The query containing the matching hits
+        bundle_id (str): The ``howler.id`` of the bundle to add the hits to.
+    """
+    report = []
+
+    if not bundle_id:
+        return [
+            {
+                "query": query,
+                "outcome": "error",
+                "title": "Invalid Bundle ID",
+                "message": "Bundle ID cannot be empty.",
+            }
+        ]
+
+    try:
+        case_id = bundle_compat_service.find_case_for_bundle(bundle_id)
+        if case_id is None:
+            report.append(
+                {
+                    "query": query,
+                    "outcome": "error",
+                    "title": "Invalid Bundle",
+                    "message": f"Either a hit with ID {bundle_id} does not exist, or it has no associated case.",
+                }
+            )
+            return report
+
+        ds = datastore()
+
+        # Check hit limit against the query before searching
+        if user:
+            limit_error = check_hit_limit(query, user, MAX_HITS_BASIC, MAX_HITS_ADVANCED)
+            if limit_error:
+                return [limit_error]
+
+        matching_hits = ds.hit.search(query, rows=MAX_HITS_ADVANCED)["items"]
+
+        if not matching_hits:
+            report.append(
+                {
+                    "query": query,
+                    "outcome": "skipped",
+                    "title": "No Matching Hits",
+                    "message": "There were no hits matching this query.",
+                }
+            )
+            return report
+
+        added = []
+        skipped = []
+        for hit in matching_hits:
+            child_label = f"hits/{hit.howler.analytic} ({hit.howler.id})"
+            try:
+                case_service.append_case_item(
+                    case_id,
+                    item_type="hit",
+                    item_value=hit.howler.id,
+                    item_path=child_label,
+                )
+                added.append(hit.howler.id)
+            except Exception:
+                skipped.append(hit.howler.id)
+
+        if skipped:
+            report.append(
+                {
+                    "query": f"howler.id:({' OR '.join(sanitize_lucene_query(h) for h in skipped)})",
+                    "outcome": "skipped",
+                    "title": "Skipped Hits",
+                    "message": "These hits could not be added (already present or invalid).",
+                }
+            )
+
+        if added:
+            report.append(
+                {
+                    "query": f"howler.id:({' OR '.join(sanitize_lucene_query(h) for h in added)})",
+                    "outcome": "success",
+                    "title": "Executed Successfully",
+                    "message": "The specified bundle has had all matching hits added.",
+                }
+            )
+
+    except NotFoundException as e:
+        report.append(
+            {
+                "query": query,
+                "outcome": "error",
+                "title": "Failed to Execute",
+                "message": str(e),
+            }
+        )
+    except Exception as e:
+        report.append(
+            {
+                "query": query,
+                "outcome": "error",
+                "title": "Failed to Execute",
+                "message": f"Unknown exception occurred: {str(e)}",
+            }
+        )
+
+    return report
+
+
+def specification():
+    """Specify various properties of the action, such as title, descriptions, permissions and input steps."""
+    return {
+        "id": OPERATION_ID,
+        "title": "Add to Bundle (Deprecated)",
+        "priority": 6,
+        "i18nKey": f"operations.{OPERATION_ID}",
+        "description": {
+            "short": "Add a set of hits to a bundle (deprecated — uses cases)",
+            "long": execute.__doc__,
+        },
+        "roles": ["automation_basic", "actionrunner_basic"],
+        "steps": [
+            {
+                "args": {"bundle_id": []},
+                "options": {},
+            }
+        ],
+        "triggers": VALID_TRIGGERS,
+    }

howler_api-4.0.0.dev1044/howler/actions/add_to_case.py

@@ -0,0 +1,136 @@
+from typing import Optional
+
+import chevron
+
+from howler.common.exceptions import InvalidDataException, NotFoundException
+from howler.common.loader import datastore
+from howler.odm.models.action import VALID_TRIGGERS
+from howler.services import case_service
+
+OPERATION_ID = "add_to_case"
+
+
+def execute(
+    query: str,
+    case_id: Optional[str] = None,
+    path: str = "related",
+    title_template: str = "{{howler.analytic}} ({{howler.id}})",
+    **kwargs,
+):
+    """Add matching alerts to a given case.
+
+    Args:
+        query (str): The query on which to apply this automation.
+        case_id (str): The ID of the case to add the alerts to.
+        path (str): The path within the case at which to place the alerts. Defaults to "related".
+        title_template (str): A Mustache-compatible template string used to generate each item's
+            path suffix (title). The hit's fields are available as template variables.
+            Defaults to "{{howler.analytic}} ({{howler.id}})".
+    """
+    if not case_id:
+        return [
+            {
+                "query": query,
+                "outcome": "error",
+                "title": "Missing Case ID",
+                "message": "A case_id must be provided.",
+            }
+        ]
+
+    ds = datastore()
+
+    if ds.case.get(case_id) is None:
+        return [
+            {
+                "query": query,
+                "outcome": "error",
+                "title": "Case Not Found",
+                "message": f"No case with ID '{case_id}' exists.",
+            }
+        ]
+
+    hits = ds.hit.search(query, rows=1000)["items"]
+
+    if not hits:
+        return [
+            {
+                "query": query,
+                "outcome": "skipped",
+                "title": "No Matching Hits",
+                "message": "No hits matched the query, so the action was skipped.",
+            }
+        ]
+
+    report = []
+    skipped = []
+    added = []
+
+    normalized_path = path.rstrip("/")
+
+    for hit in hits:
+        hit_data = hit.as_primitives()
+        title = chevron.render(title_template, hit_data)
+        item_path = f"{normalized_path}/{title}" if normalized_path else title
+
+        try:
+            case_service.append_case_item(
+                case_id,
+                item_type="hit",
+                item_value=hit.howler.id,
+                item_path=item_path,
+            )
+            added.append(hit.howler.id)
+        except InvalidDataException as e:
+            skipped.append(f"{hit.howler.id}: {e}")
+        except NotFoundException as e:
+            skipped.append(f"{hit.howler.id}: {e}")
+        except Exception as e:
+            skipped.append(f"{hit.howler.id}: {e}")
+
+    if added:
+        report.append(
+            {
+                "query": f"howler.id:({' OR '.join(added)})",
+                "outcome": "success",
+                "title": "Added to Case",
+                "message": f"{len(added)} alert(s) successfully added to case '{case_id}'.",
+            }
+        )
+
+    if skipped:
+        report.append(
+            {
+                "query": query,
+                "outcome": "skipped",
+                "title": "Skipped Alerts",
+                "message": f"{len(skipped)} alert(s) could not be added: {'; '.join(skipped)}",
+            }
+        )
+
+    return report
+
+
+def specification():
+    """Specify various properties of the action, such as title, descriptions, permissions and input steps."""
+    return {
+        "id": OPERATION_ID,
+        "title": "Add to Case",
+        "priority": 9,
+        "i18nKey": f"operations.{OPERATION_ID}",
+        "description": {
+            "short": "Add matching alerts to a case",
+            "long": execute.__doc__,
+        },
+        "roles": ["automation_basic"],
+        "steps": [
+            {
+                "args": {
+                    "case_id": [],
+                    "path": [],
+                    "title_template": [],
+                },
+                "options": {},
+            }
+        ],
+        "triggers": VALID_TRIGGERS,
+    }

{howler_api-4.0.0.dev1020 → howler_api-4.0.0.dev1044}/howler/actions/demote.py

@@ -9,7 +9,7 @@ from howler.odm.models.howler_data import (
     Assessment,
     AssessmentEscalationMap,
     Escalation,
-    HitStatus,
+    Status,
 )
 from howler.odm.models.user import User
 from howler.utils.str_utils import sanitize_lucene_query
@@ -99,7 +99,7 @@ def execute(
                         "howler.assignment",
                         user.get("uname", "automation") if user else "automation",
                     ),
-                    odm_helper.update("howler.status", HitStatus.RESOLVED),
+                    odm_helper.update("howler.status", Status.RESOLVED),
                 ],
             )
 

{howler_api-4.0.0.dev1020 → howler_api-4.0.0.dev1044}/howler/actions/remove_from_bundle.py

@@ -1,29 +1,27 @@
+"""Deprecated remove_from_bundle action — delegates to case_service for item removal."""
+
 from typing import Optional
 
 from howler.actions import check_hit_limit
-from howler.common.exceptions import HowlerException
+from howler.common.exceptions import NotFoundException
 from howler.common.loader import datastore
-from howler.datastore.operations import OdmHelper
 from howler.odm.models.action import VALID_TRIGGERS
-from howler.odm.models.hit import Hit
 from howler.odm.models.user import User
-from howler.services import hit_service
+from howler.services import bundle_compat_service, case_service
 from howler.utils.str_utils import sanitize_lucene_query
 
-hit_helper = OdmHelper(Hit)
-
 OPERATION_ID = "remove_from_bundle"
 MAX_HITS_BASIC = 10
 MAX_HITS_ADVANCED = 1000
 SKIP_CENTRAL_LIMIT = True  # This operation transforms the query, handles limit check locally
 
 
-def execute(query: str, bundle_id: Optional[str] = None, user: Optional[User] = None, **kwargs):
-    """Remove a set of hits matching the query from the specified bundle.
+def execute(query: str, bundle_id: Optional[str] = None, user: Optional[User] = None, **kwargs):  # noqa: C901
+    """Remove a set of hits matching the query from the specified bundle (deprecated — uses cases).
 
     Args:
         query (str): The query containing the matching hits
-        bundle_id (str): The `howler.id` of the bundle to remove the hits from.
+        bundle_id (str): The ``howler.id`` of the bundle to remove the hits from.
     """
     report = []
 
@@ -38,67 +36,78 @@ def execute(query: str, bundle_id: Optional[str] = None, user: Optional[User] =
         ]
 
     try:
-        bundle_hit = hit_service.get_hit(bundle_id, as_odm=True)
-        if not bundle_hit or not bundle_hit.howler.is_bundle:
+        case_id = bundle_compat_service.find_case_for_bundle(bundle_id)
+        if case_id is None:
             report.append(
                 {
                     "query": query,
                     "outcome": "error",
                     "title": "Invalid Bundle",
-                    "message": f"Either a hit with ID {bundle_id} does not exist, or it is not a bundle.",
+                    "message": f"Either a hit with ID {bundle_id} does not exist, or it has no associated case.",
                 }
             )
             return report
 
         ds = datastore()
 
-        skipped_hits = ds.hit.search(
-            f"({query}) AND -howler.bundles:{sanitize_lucene_query(bundle_id)}",
-            fl="howler.id",
-        )["items"]
+        # Check hit limit against the query before searching
+        if user:
+            limit_error = check_hit_limit(query, user, MAX_HITS_BASIC, MAX_HITS_ADVANCED)
+            if limit_error:
+                return [limit_error]
+
+        matching_hits = ds.hit.search(query, rows=MAX_HITS_ADVANCED)["items"]
 
-        if len(skipped_hits) > 0:
+        if not matching_hits:
             report.append(
                 {
-                    "query": f"howler.id:({' OR '.join(h.howler.id for h in skipped_hits)})",
+                    "query": query,
                     "outcome": "skipped",
-                    "title": "Skipped Hit not in Bundle",
-                    "message": "These hits already are not in the bundle.",
+                    "title": "No Matching Hits",
+                    "message": "There were no hits matching this query.",
                 }
             )
+            return report
 
-        safe_query = f"{query} AND (howler.bundles:{sanitize_lucene_query(bundle_id)})"
+        # Get the case to check which hits are actually in it
+        case = ds.case.get(case_id)
+        if case is None:
+            report.append(
+                {
+                    "query": query,
+                    "outcome": "error",
+                    "title": "Case Not Found",
+                    "message": f"Associated case {case_id} no longer exists.",
+                }
+            )
+            return report
 
-        # Check hit limit against the effective query (not raw query)
-        if user:
-            limit_error = check_hit_limit(safe_query, user, MAX_HITS_BASIC, MAX_HITS_ADVANCED)
-            if limit_error:
-                return [limit_error]
+        case_item_values = {item.value for item in case.items}
+        values_to_remove = [h.howler.id for h in matching_hits if h.howler.id in case_item_values]
+        skipped_ids = [h.howler.id for h in matching_hits if h.howler.id not in case_item_values]
 
-        matching_hits = ds.hit.search(safe_query, rows=MAX_HITS_ADVANCED, fl="howler.id")["items"]
-        if len(matching_hits) < 1:
+        if skipped_ids:
             report.append(
                 {
-                    "query": safe_query,
+                    "query": f"howler.id:({' OR '.join(sanitize_lucene_query(h) for h in skipped_ids)})",
+                    "outcome": "skipped",
+                    "title": "Skipped Hits Not in Bundle",
+                    "message": "These hits are not in the bundle.",
+                }
+            )
+
+        if not values_to_remove:
+            report.append(
+                {
+                    "query": query,
                     "outcome": "skipped",
                     "title": "No Matching Hits",
-                    "message": "There were no hits matching this query.",
+                    "message": "None of the matching hits were found in the bundle.",
                 }
             )
             return report
 
-        ds.hit.update_by_query(
-            safe_query,
-            [hit_helper.list_remove("howler.bundles", bundle_id)],
-        )
-
-        hit_service.update_hit(
-            bundle_id,
-            [hit_helper.list_remove("howler.hits", h["howler"]["id"]) for h in matching_hits],
-        )
-
-        if len(ds.hit.get(bundle_id).howler.hits) < 1:
-            hit_service.update_hit(bundle_id, [hit_helper.update("howler.is_bundle", False)])
+        case_service.remove_case_items(case_id, values_to_remove)
 
         report.append(
             {
@@ -108,7 +117,17 @@ def execute(query: str, bundle_id: Optional[str] = None, user: Optional[User] =
                 "message": f"Matching hits removed from bundle with id {bundle_id}",
             }
         )
-    except HowlerException as e:
+
+    except NotFoundException as e:
+        report.append(
+            {
+                "query": query,
+                "outcome": "error",
+                "title": "Failed to Execute",
+                "message": str(e),
+            }
+        )
+    except Exception as e:
         report.append(
             {
                 "query": query,
@@ -125,11 +144,11 @@ def specification():
     """Specify various properties of the action, such as title, descriptions, permissions and input steps."""
     return {
         "id": OPERATION_ID,
-        "title": "Remove from Bundle",
+        "title": "Remove from Bundle (Deprecated)",
         "priority": 5,
         "i18nKey": f"operations.{OPERATION_ID}",
         "description": {
-            "short": "Remove a set of hits from a bundle",
+            "short": "Remove a set of hits from a bundle (deprecated — uses cases)",
             "long": execute.__doc__,
         },
         "roles": ["automation_basic", "actionrunner_basic"],
@@ -137,7 +156,6 @@ def specification():
             {
                 "args": {"bundle_id": []},
                 "options": {},
-                "validation": {"error": {"query": "-howler.bundles:$bundle_id"}},
             }
         ],
         "triggers": VALID_TRIGGERS,

{howler_api-4.0.0.dev1020 → howler_api-4.0.0.dev1044}/howler/actions/transition.py

@@ -9,8 +9,8 @@ from howler.helper.workflow import Workflow, WorkflowException
 from howler.odm.models.action import VALID_TRIGGERS
 from howler.odm.models.howler_data import (
     Assessment,
-    HitStatus,
     HitStatusTransition,
+    Status,
     Vote,
 )
 from howler.odm.models.user import User
@@ -193,15 +193,13 @@ def specification():
         "steps": [
             {
                 "args": {"status": []},
-                "options": {"status": HitStatus.list()},
+                "options": {"status": Status.list()},
                 "validation": {"error": {"query": "-howler.status:$status"}},
             },
             {
                 "args": {"transition": []},
                 "options": {
-                    "transition": {
-                        f"status:{status}": hit_service.get_transitions(status) for status in HitStatus.list()
-                    },
+                    "transition": {f"status:{status}": hit_service.get_transitions(status) for status in Status.list()},
                 },
             },
             {

{howler_api-4.0.0.dev1020 → howler_api-4.0.0.dev1044}/howler/api/__init__.py

@@ -25,7 +25,8 @@ logger = get_logger(__file__)
 
 def make_subapi_blueprint(name, api_version=1):
     """Create a flask Blueprint for a subapi in a standard way."""
-    return Blueprint(name, name, url_prefix="/".join([API_PREFIX, f"v{api_version}", name]))
+    full_name = f"v{api_version}_{name}"
+    return Blueprint(full_name, full_name, url_prefix="/".join([API_PREFIX, f"v{api_version}", name]))
 
 
 def _make_api_response(

{howler_api-4.0.0.dev1020 → howler_api-4.0.0.dev1044}/howler/api/socket.py

@@ -7,11 +7,11 @@ from flask import Blueprint, request
 from opentelemetry import trace
 
 import howler.services.event_service as event_service
+import howler.services.viewer_service as viewer_service
 from howler.api import ok, unauthorized
 from howler.common.logging import get_logger
-from howler.datastore.operations import OdmHelper
 from howler.helper.ws import ConnectionClosed, Server
-from howler.odm.models.hit import Hit
+from howler.security import api_login
 from howler.security.socket import websocket_auth, ws_response
 from howler.utils.socket_utils import check_action
 
@@ -24,13 +24,16 @@ socket_api._doc = "Endpoints concerning websocket connectivity between the clien
 logger = get_logger(__file__)
 tracer = trace.get_tracer(__name__)
 
-hit_helper = OdmHelper(Hit)
-
 
 @tracer.start_as_current_span(f"{__name__}.emit")
 @socket_api.route("/emit/<event>", methods=["POST"])
 def emit(event: str):
-    """Emit an event to all listening websockets"""
+    """Emit an event to all listening websockets.
+
+    .. deprecated::
+        This endpoint is deprecated. Events are now propagated via Redis pubsub
+        and no longer require a dedicated websocket pod.
+    """
     if "Authorization" not in request.headers:
         return unauthorized(err="Missing authorization header")
 
@@ -49,10 +52,25 @@ def emit(event: str):
     return ok()
 
 
+@tracer.start_as_current_span(f"{__name__}.get_viewers")
+@socket_api.route("/viewers/<entity_id>", methods=["GET"])
+@api_login(audit=False, required_priv=["R"])
+def get_viewers(entity_id: str, **kwargs):
+    """Get the list of users currently viewing the specified entity
+
+    Variables:
+    entity_id       => The ID of the entity to get viewers for
+
+    Result Example:
+    ["user1", "user2"]
+    """
+    return ok(viewer_service.get_viewers(entity_id))
+
+
 @tracer.start_as_current_span(f"{__name__}.connect")
 @socket_api.route("/connect", websocket=True)  # type: ignore
 @websocket_auth(required_priv=["R"])
-def connect(ws: Server, *args: Any, ws_id: str, **kwargs):
+def connect(ws: Server, *args: Any, ws_id: str, **kwargs):  # noqa: C901
     """Connect to the server to monitor for updates via websocket
 
     Variables:
@@ -78,10 +96,20 @@ def connect(ws: Server, *args: Any, ws_id: str, **kwargs):
         logger.debug("Sending action: %s", data)
         ws.send(ws_response("action", data))
 
+    def send_case(data: dict[str, Any]):
+        logger.debug("Sending case update: %s", data.get("case", {}).get("case_id", "unknown"))
+        ws.send(ws_response("cases", data))
+
+    def send_viewers_update(data: dict[str, Any]):
+        logger.debug("Sending viewers update: %s", data.get("id", "unknown"))
+        ws.send(ws_response("viewers_update", data))
+
     try:
         event_service.on("hits", send_hit)
         event_service.on("broadcast", send_broadcast)
         event_service.on("action", send_action)
+        event_service.on("cases", send_case)
+        event_service.on("viewers_update", send_viewers_update)
         while ws.connected:
             data = ws.receive(10)
             if data:
@@ -113,6 +141,8 @@ def connect(ws: Server, *args: Any, ws_id: str, **kwargs):
         event_service.off("hits", send_hit)
         event_service.off("broadcast", send_broadcast)
         event_service.off("action", send_action)
+        event_service.off("cases", send_case)
+        event_service.off("viewers_update", send_viewers_update)
 
         for id, action, broadcast in outstanding_actions:
             outstanding_actions = check_action(id, action, broadcast, outstanding_actions=outstanding_actions, **kwargs)