howler-api 4.0.0.dev1044__tar.gz → 4.0.0.dev1062__tar.gz

{howler_api-4.0.0.dev1044 → howler_api-4.0.0.dev1062}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: howler-api
-Version: 4.0.0.dev1044
+Version: 4.0.0.dev1062
 Summary: Howler - API server
 License: MIT
 Keywords: howler,alerting,gc,canada,cse-cst,cse,cst,cyber,cccs

{howler_api-4.0.0.dev1044 → howler_api-4.0.0.dev1062}/howler/api/v2/search.py

@@ -117,6 +117,9 @@ def search(indexes: str, **kwargs):
         }
     )
 
+    # NOTE: This means index searches must be either ALL access controlled or none of them havbe access control.
+    # Otherwise, the access control requirements on one index will cause the other index to return no items.
+    # This is pretty reasonable constraint, as all the relevant, searchable items support classifications.
     if has_access_control(index_list):
         params["access_control"] = user["access_control"]
 
@@ -127,8 +130,7 @@ def search(indexes: str, **kwargs):
         return bad_request(err="There was no search query.")
 
     metadata = params.pop("metadata", [])
-    access_control = params.pop("access_control", None)
-    result = search_service.search(indexes, query, access_control=access_control, **params)
+    result = search_service.search(indexes, query, access_control=params.pop("access_control", None), **params)
 
     if metadata and any(idx in index_list for idx in ["hit"]):
         hit_service.augment_metadata(result["items"], metadata, user)

{howler_api-4.0.0.dev1044 → howler_api-4.0.0.dev1062}/howler/helper/search.py

@@ -5,7 +5,7 @@ from howler.datastore.collection import ESCollection
 from howler.odm.models.user import User
 
 # List of indices where queries are protected with classification access control
-ACCESS_CONTROLLED_INDICES: set[str] = {"hit"}
+ACCESS_CONTROLLED_INDICES: set[str] = {"hit", "observable", "case"}
 
 ADMIN_INDEX_MAP: dict[str, Callable[[], ESCollection]] = {}
 

{howler_api-4.0.0.dev1044 → howler_api-4.0.0.dev1062}/howler/odm/models/case.py

@@ -2,6 +2,7 @@ from typing import Any, Optional
 
 from howler import odm
 from howler.common.exceptions import HowlerValueError
+from howler.config import CLASSIFICATION
 from howler.odm.constants import Status
 from howler.odm.mixins import DatastoreMixin
 from howler.utils.compat import StrEnum
@@ -120,6 +121,12 @@ class CaseEnrichment(odm.Model):
 @odm.model(index=True, store=True, description="Case model with path-based items, enrichments, rules, and tasks.")
 class Case(DatastoreMixin["Case"], odm.Model):
     case_id: str = odm.UUID(description="A unique identifier for this case.")
+    classification: str = odm.Classification(
+        is_user_classification=False,
+        copyto="__text__",
+        default=CLASSIFICATION.UNRESTRICTED,
+        description="Maximum classification for the case",
+    )
     title: str = odm.Keyword(description="Case title.")
     summary: str = odm.Text(description="Short case summary.")
     overview: str = odm.Optional(odm.Text(description="Markdown overview of the case."))

{howler_api-4.0.0.dev1044 → howler_api-4.0.0.dev1062}/howler/odm/random_data.py

@@ -809,7 +809,7 @@ def create_cases(ds: HowlerDatastore, num_cases: int = 5):
         for idx, related_case_id in enumerate(selected_related_case_ids, start=1):
             items.append(
                 {
-                    "path": f"cases/Related Case {idx}",
+                    "path": f"Related Case {idx}",
                     "type": "case",
                     "value": related_case_id,
                 }

{howler_api-4.0.0.dev1044 → howler_api-4.0.0.dev1062}/howler/services/case_service.py

@@ -429,6 +429,11 @@ def append_case(case_id: str, item: CaseItem) -> Case:
     the referenced case is not already present in the parent case. It then persists the updated
     parent case.
 
+    Case items are always placed at the root of the case structure (no subfolders).
+    If the supplied ``item.path`` contains folder segments (e.g. ``"folder/child-case"``),
+    those segments are stripped and only the last path component is retained.  A log
+    entry is recorded whenever normalization changes the original path.
+
     Args:
         case_id: Unique identifier of the parent case to append the reference to.
         item: A CaseItem whose ``value`` is the ID of an existing case to reference.
@@ -453,6 +458,40 @@ def append_case(case_id: str, item: CaseItem) -> Case:
     if referenced_case is None:
         raise NotFoundException(f"Referenced case {item.value} not found, cannot be added to case")
 
+    # Enforce root placement: case items must not live inside subfolders.
+    # Strip any leading folder segments, keeping only the last path component.
+    original_path = item.path
+    if original_path and "/" in original_path:
+        stripped_path = original_path.strip("/")
+        root_path = stripped_path.split("/")[-1] if stripped_path else None
+    else:
+        root_path = original_path
+
+    if not root_path:
+        item.path = item.value
+    elif root_path != original_path:
+        logger.info(
+            "Case item path '%s' contains folder segments; normalizing to root path '%s'",
+            original_path,
+            root_path,
+        )
+        item.path = root_path
+        _case.log.append(
+            CaseLog(
+                {
+                    "timestamp": "NOW",
+                    "key": "items",
+                    "previous_value": original_path,
+                    "new_value": root_path,
+                    "user": "system",
+                    "explanation": (
+                        f"Case item path normalized from '{original_path}' to '{root_path}': "
+                        "case references must be placed at the root of the case structure."
+                    ),
+                }
+            )
+        )
+
     _case.items.append(item)
 
     if not datastore().case.save(_case.case_id, _case):

{howler_api-4.0.0.dev1044 → howler_api-4.0.0.dev1062}/howler/services/search_service.py

@@ -56,7 +56,7 @@ def _normalize_indexes(indexes: str | list[str]) -> str:
         if index in {"*", "_all"} or "-" in index or "*" in index:
             normalized_indexes.append(index)
         else:
-            normalized_indexes.append(f"{APP_NAME}-{index}_hot")
+            normalized_indexes.append(f"{APP_NAME}-{index}")
 
     return ",".join(normalized_indexes)
 

{howler_api-4.0.0.dev1044 → howler_api-4.0.0.dev1062}/pyproject.toml

@@ -152,7 +152,7 @@ suppress-none-returning = true
 [tool.poetry]
 package-mode = true
 name = "howler-api"
-version = "4.0.0.dev1044"
+version = "4.0.0.dev1062"
 description = "Howler - API server"
 authors = [
     "Canadian Centre for Cyber Security <howler@cyber.gc.ca>",