howler-api 4.0.0.dev1121__tar.gz → 4.0.0.dev1141__tar.gz

{howler_api-4.0.0.dev1121 → howler_api-4.0.0.dev1141}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: howler-api
-Version: 4.0.0.dev1121
+Version: 4.0.0.dev1141
 Summary: Howler - API server
 License: MIT
 Keywords: howler,alerting,gc,canada,cse-cst,cse,cst,cyber,cccs

{howler_api-4.0.0.dev1121 → howler_api-4.0.0.dev1141}/howler/api/v2/case.py

@@ -63,7 +63,7 @@ def create_case(user: User, **kwargs):
 @generate_swagger_docs()
 @case_api.route("/<id>", methods=["GET"])
 @api_login(audit=True, required_priv=["R"])
-def get_case(id: str, **kwargs):
+def get_case(id: str, user: User, **kwargs):
     """Get a case.
 
     Variables:
@@ -77,11 +77,13 @@ def get_case(id: str, **kwargs):
         ...case    # The requested case, if it exists
     }
     """
-    case = datastore().case.get_if_exists(key=id, as_obj=False)
+    case = datastore().case.get(id, as_obj=False)
 
     if not case:
         return not_found(err="Case %s does not exist" % id)
 
+    case_service.filter_case_items_by_classification(case, user.classification)
+
     return ok(case)
 
 

{howler_api-4.0.0.dev1121 → howler_api-4.0.0.dev1141}/howler/api/v2/search.py

@@ -12,6 +12,7 @@ from howler.common.logging import get_logger
 from howler.common.swagger import generate_swagger_docs
 from howler.datastore.exceptions import SearchException
 from howler.helper.search import get_collection, has_access_control
+from howler.odm.models.user import User
 from howler.security import api_login
 from howler.services import hit_service, lucene_service, search_service
 
@@ -51,7 +52,7 @@ def generate_params(request: Request, fields: list[str], multi_fields: list[str]
 @generate_swagger_docs()
 @search_api.route("/<indexes>", methods=["GET", "POST"])
 @api_login(required_priv=["R"])
-def search(indexes: str, **kwargs):
+def search(indexes: str, user: User, **kwargs):
     """Search through specified index for a given query. Uses lucene search syntax for query.
 
     Variables:
@@ -91,8 +92,6 @@ def search(indexes: str, **kwargs):
      "next_deep_paging_id": "asX3f...342",  # ID to pass back for the next page during deep paging
      "items": []}                           # List of results
     """
-    user = kwargs["user"]
-
     index_list = indexes.split(",")
 
     fields = [
@@ -117,12 +116,6 @@ def search(indexes: str, **kwargs):
         }
     )
 
-    # NOTE: This means index searches must be either ALL access controlled or none of them havbe access control.
-    # Otherwise, the access control requirements on one index will cause the other index to return no items.
-    # This is pretty reasonable constraint, as all the relevant, searchable items support classifications.
-    if has_access_control(index_list):
-        params["access_control"] = user["access_control"]
-
     params["sort"] = [entry for entry in params.get("sort", "").split(",") if entry] or search_service.DEFAULT_SORT
 
     query = req_data.get("query", None)
@@ -130,7 +123,7 @@ def search(indexes: str, **kwargs):
         return bad_request(err="There was no search query.")
 
     metadata = params.pop("metadata", [])
-    result = search_service.search(indexes, query, access_control=params.pop("access_control", None), **params)
+    result = search_service.search(indexes, query, user=user, **params)
 
     if metadata and any(idx in index_list for idx in ["hit"]):
         hit_service.augment_metadata(result["items"], metadata, user)

{howler_api-4.0.0.dev1121 → howler_api-4.0.0.dev1141}/howler/odm/models/case.py

@@ -79,6 +79,14 @@ class CaseItem(odm.Model):
     type: str = odm.Enum(values=CaseItemTypes, description="Type of case item.")
     value: str = odm.Keyword(description="String reference value for the item (ID, URL, or token).")
     visible: bool = odm.Boolean(default=True, description="Whether the item is visible/accessible in the frontend.")
+    classification: Optional[str] = odm.Optional(
+        odm.Classification(
+            is_user_classification=False,
+            copyto="__text__",
+            default=CLASSIFICATION.UNRESTRICTED,
+            description="Classification of the related record. Automatically populated for hit and event items.",
+        )
+    )
 
 
 @odm.model(index=True, store=True, description="Rule used to place/query data into case paths.")

{howler_api-4.0.0.dev1121 → howler_api-4.0.0.dev1141}/howler/services/case_service.py

@@ -12,6 +12,7 @@ from prometheus_client import Counter
 from howler.common.exceptions import HowlerValueError, InvalidDataException, NotFoundException
 from howler.common.loader import APP_NAME, datastore
 from howler.common.logging import get_logger
+from howler.config import CLASSIFICATION
 from howler.datastore.exceptions import DataStoreException
 from howler.odm.models.case import Case, CaseItem, CaseItemTypes, CaseLog, CaseRule
 from howler.odm.models.ecs.related import Related
@@ -150,6 +151,28 @@ def delete_cases(case_ids: set[str]) -> bool:
     return ds.case.delete_by_query(f"case_id:({' OR '.join(case_ids)})")
 
 
+def filter_case_items_by_classification(_case: dict, user_classification: str):
+    """Remove items from a case dict that exceed the user's classification.
+
+    Items without a ``classification`` value are always included. Items with a
+    classification are only included when ``CLASSIFICATION.is_accessible``
+    confirms the requesting user can see them.
+
+    Args:
+        case: Raw case dict (as returned by ``as_obj=False`` datastore calls).
+        user_classification: The requesting user's maximum classification string.
+    """
+    if "items" not in _case:
+        return
+
+    _case["items"] = [
+        item
+        for item in _case["items"]
+        if item.get("classification") is None
+        or CLASSIFICATION.is_accessible(user_classification, item["classification"])
+    ]
+
+
 def get_last_resolved_time(case: Case) -> datetime | None:
     """Return the timestamp of the most recent resolution of a case.
 
@@ -389,6 +412,8 @@ def append_hit(case_id: str, item: CaseItem) -> Case:
     if hit is None:
         raise NotFoundException(f"Hit {item.value} not found, cannot be added to case")
 
+    item.classification = hit.classification
+
     _case.items.append(item)
 
     if not ds.case.save(_case.case_id, _case):
@@ -436,6 +461,8 @@ def append_event(case_id: str, item: CaseItem) -> Case:
     if event is None:
         raise NotFoundException(f"Event {item.value} not found, cannot be added to case")
 
+    item.classification = event.classification
+
     _case.items.append(item)
 
     if not ds.case.save(_case.case_id, _case):

{howler_api-4.0.0.dev1121 → howler_api-4.0.0.dev1141}/howler/services/search_service.py

@@ -9,6 +9,9 @@ from howler.common.loader import APP_NAME, datastore
 from howler.datastore.collection import parse_sort
 from howler.datastore.exceptions import SearchException, SearchRetryException
 from howler.datastore.types import SearchResult
+from howler.helper.search import has_access_control
+from howler.odm.models.user import User
+from howler.services import case_service
 
 DEFAULT_OFFSET = 0
 DEFAULT_ROW_SIZE = 25
@@ -61,7 +64,7 @@ def _normalize_indexes(indexes: str | list[str]) -> str:
     return ",".join(normalized_indexes)
 
 
-def _format_items(hits: list[dict[str, Any]]) -> list[dict[str, Any]]:
+def _format_items(hits: list[dict[str, Any]], user_classification: str | None) -> list[dict[str, Any]]:
     """Formats Elasticsearch search hits into a standardized item format.
 
     Extracts the _source content from each hit.
@@ -82,6 +85,9 @@ def _format_items(hits: list[dict[str, Any]]) -> list[dict[str, Any]]:
             if raw_index:
                 source["__index"] = raw_index.replace(f"{APP_NAME}-", "").replace("_hot", "")
 
+            if source.get("__index") == "case" and user_classification:
+                case_service.filter_case_items_by_classification(source, user_classification)
+
             items.append(source)
 
     return items
@@ -99,7 +105,7 @@ def search(  # noqa: C901
     timeout: int | None = None,
     track_total_hits: bool = False,
     metadata: list[str] | None = None,
-    access_control: str | None = None,
+    user: User | None = None,
 ) -> SearchResult[dict[str, Any]]:
     """Search through specified index for a given query. Uses lucene search syntax for query.
 
@@ -137,8 +143,11 @@ def search(  # noqa: C901
     else:
         parsed_filters = filters
 
-    if access_control:
-        parsed_filters.append(access_control)
+    # NOTE: This means index searches must be either ALL access controlled or none of them have access control.
+    # Otherwise, the access control requirements on one index will cause the other index to return no items.
+    # This is pretty reasonable constraint, as all the relevant, searchable items support classifications.
+    if user and user.access_control and has_access_control(indexes):
+        parsed_filters.append(user.access_control)
 
     if query is None:
         query = "id:*"
@@ -197,7 +206,7 @@ def search(  # noqa: C901
         "offset": int(offset),
         "rows": len(hits),
         "total": int(total),
-        "items": _format_items(hits),
+        "items": _format_items(hits, user.classification if user else None),
     }
 
     next_deep_paging_id = result.get("_scroll_id")

{howler_api-4.0.0.dev1121 → howler_api-4.0.0.dev1141}/pyproject.toml

@@ -152,7 +152,7 @@ suppress-none-returning = true
 [tool.poetry]
 package-mode = true
 name = "howler-api"
-version = "4.0.0.dev1121"
+version = "4.0.0.dev1141"
 description = "Howler - API server"
 authors = [
     "Canadian Centre for Cyber Security <howler@cyber.gc.ca>",