howler-api 4.0.0.dev799__tar.gz → 4.0.0.dev803__tar.gz

{howler_api-4.0.0.dev799 → howler_api-4.0.0.dev803}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: howler-api
-Version: 4.0.0.dev799
+Version: 4.0.0.dev803
 Summary: Howler - API server
 License: MIT
 Keywords: howler,alerting,gc,canada,cse-cst,cse,cst,cyber,cccs

{howler_api-4.0.0.dev799 → howler_api-4.0.0.dev803}/howler/api/socket.py

@@ -7,11 +7,11 @@ from flask import Blueprint, request
 from opentelemetry import trace
 
 import howler.services.event_service as event_service
+import howler.services.viewer_service as viewer_service
 from howler.api import ok, unauthorized
 from howler.common.logging import get_logger
-from howler.datastore.operations import OdmHelper
 from howler.helper.ws import ConnectionClosed, Server
-from howler.odm.models.hit import Hit
+from howler.security import api_login
 from howler.security.socket import websocket_auth, ws_response
 from howler.utils.socket_utils import check_action
 
@@ -24,8 +24,6 @@ socket_api._doc = "Endpoints concerning websocket connectivity between the clien
 logger = get_logger(__file__)
 tracer = trace.get_tracer(__name__)
 
-hit_helper = OdmHelper(Hit)
-
 
 @tracer.start_as_current_span(f"{__name__}.emit")
 @socket_api.route("/emit/<event>", methods=["POST"])
@@ -49,10 +47,25 @@ def emit(event: str):
     return ok()
 
 
+@tracer.start_as_current_span(f"{__name__}.get_viewers")
+@socket_api.route("/viewers/<entity_id>", methods=["GET"])
+@api_login(audit=False, required_priv=["R"])
+def get_viewers(entity_id: str, **kwargs):
+    """Get the list of users currently viewing the specified entity
+
+    Variables:
+    entity_id       => The ID of the entity to get viewers for
+
+    Result Example:
+    ["user1", "user2"]
+    """
+    return ok(viewer_service.get_viewers(entity_id))
+
+
 @tracer.start_as_current_span(f"{__name__}.connect")
 @socket_api.route("/connect", websocket=True)  # type: ignore
 @websocket_auth(required_priv=["R"])
-def connect(ws: Server, *args: Any, ws_id: str, **kwargs):
+def connect(ws: Server, *args: Any, ws_id: str, **kwargs):  # noqa: C901
     """Connect to the server to monitor for updates via websocket
 
     Variables:
@@ -78,10 +91,20 @@ def connect(ws: Server, *args: Any, ws_id: str, **kwargs):
         logger.debug("Sending action: %s", data)
         ws.send(ws_response("action", data))
 
+    def send_case(data: dict[str, Any]):
+        logger.debug("Sending case update: %s", data.get("case", {}).get("case_id", "unknown"))
+        ws.send(ws_response("cases", data))
+
+    def send_viewers_update(data: dict[str, Any]):
+        logger.debug("Sending viewers update: %s", data.get("id", "unknown"))
+        ws.send(ws_response("viewers_update", data))
+
     try:
         event_service.on("hits", send_hit)
         event_service.on("broadcast", send_broadcast)
         event_service.on("action", send_action)
+        event_service.on("cases", send_case)
+        event_service.on("viewers_update", send_viewers_update)
         while ws.connected:
             data = ws.receive(10)
             if data:
@@ -113,6 +136,8 @@ def connect(ws: Server, *args: Any, ws_id: str, **kwargs):
         event_service.off("hits", send_hit)
         event_service.off("broadcast", send_broadcast)
         event_service.off("action", send_action)
+        event_service.off("cases", send_case)
+        event_service.off("viewers_update", send_viewers_update)
 
         for id, action, broadcast in outstanding_actions:
             outstanding_actions = check_action(id, action, broadcast, outstanding_actions=outstanding_actions, **kwargs)

{howler_api-4.0.0.dev799 → howler_api-4.0.0.dev803}/howler/api/v2/ingest.py

@@ -120,15 +120,20 @@ def delete(indexes: str, user: User, **kwargs):
      "success": True             # Deleting the hits succeded
     }
     """
-    hit_ids = request.json
+    ids = request.json
 
-    if hit_ids is None:
+    if ids is None:
         return bad_request(err="No hit ids were sent.")
 
     if "admin" not in user["type"]:
         return forbidden(err="Cannot delete hit, only administrators are permitted to delete.")
 
-    index_list = indexes.split(",")  # noqa: F841
+    index_list = indexes.split(",")
+
+    ds = datastore()
+
+    if non_existing_hit_ids := [id for id in ids if all(not ds[index].exists(id) for index in index_list)]:
+        return not_found(err=f"Record ids [{','.join(non_existing_hit_ids)}] do not exist.")
 
     # TODO: Reimplement in a generic function
     # hit_service.delete_hits(hit_ids, indexes=index_list)

{howler_api-4.0.0.dev799 → howler_api-4.0.0.dev803}/howler/odm/helper.py

@@ -249,8 +249,6 @@ def generate_useful_hit(  # noqa: C901
     except IndexError:
         pass
 
-    hit.howler.viewers = []
-
     hit.howler.dossier = [
         Lead(
             {
@@ -446,8 +444,6 @@ def generate_useful_observable(  # noqa: C901
         ),
     ]
 
-    observable.howler.viewers = []
-
     return observable
 
 

{howler_api-4.0.0.dev799 → howler_api-4.0.0.dev803}/howler/odm/models/howler_data.py

@@ -293,7 +293,3 @@ class HowlerData(odm.Model):
     dossier: list[Lead] = odm.List(
         odm.Compound(Lead), default=[], description="A list of leads forming the dossier associated with this hit"
     )
-    viewers: list[str] = odm.List(
-        odm.Keyword(description="A list of users currently viewing the hit"),
-        default=[],
-    )

{howler_api-4.0.0.dev799 → howler_api-4.0.0.dev803}/howler/odm/models/observable.py

@@ -101,10 +101,6 @@ class ObservableData(odm.Model):
         default=[],
         description="A list of changes to the observable with timestamps and attribution.",
     )
-    viewers: list[str] = odm.List(
-        odm.Keyword(description="A list of users currently viewing the observable"),
-        default=[],
-    )
 
 
 @odm.model(

{howler_api-4.0.0.dev799 → howler_api-4.0.0.dev803}/howler/services/case_service.py

@@ -4,11 +4,11 @@ This module provides functionality for creating, updating, retrieving, and manag
 cases - collections of security alerts and investigation data organized by analysts.
 """
 
-from typing import Any, cast, overload
+from typing import Any, overload
 
 from prometheus_client import Counter
 
-from howler.common.exceptions import InvalidDataException, NotFoundException
+from howler.common.exceptions import HowlerValueError, InvalidDataException, NotFoundException
 from howler.common.loader import APP_NAME, datastore
 from howler.common.logging import get_logger
 from howler.datastore.exceptions import DataStoreException
@@ -17,6 +17,7 @@ from howler.odm.models.ecs.related import Related
 from howler.odm.models.hit import Hit
 from howler.odm.models.observable import Observable
 from howler.odm.models.user import User
+from howler.services import event_service
 
 logger = get_logger(__file__)
 
@@ -51,7 +52,14 @@ def create_case(_case: dict, user: str = None) -> Case:  # type: ignore
         append_case_item(case.case_id, item=CaseItem(item))
 
     if items:
-        return cast(Case, datastore().case.get(case.case_id))
+        updated_case = datastore().case.get(case.case_id)
+
+        if not updated_case:
+            raise HowlerValueError("Error occurred when creating case")
+
+        case = updated_case
+
+    event_service.emit("cases", {"case": case.as_primitives()})
 
     return case
 
@@ -218,6 +226,8 @@ def update_case(case_id: str, case_data: dict[str, Any], user: User) -> Case:
     case.updated = "NOW"
     ds.case.save(case_id, case)
 
+    event_service.emit("cases", {"case": case.as_primitives()})
+
     return case
 
 
@@ -329,6 +339,10 @@ def append_hit(case_id: str, item: CaseItem) -> Case:
 
     _sync_case_metadata(_case.case_id)
 
+    updated_case = ds.case.get(_case.case_id)
+    if updated_case:
+        event_service.emit("cases", {"case": updated_case.as_primitives()})
+
     return _case
 
 
@@ -371,6 +385,10 @@ def append_observable(case_id: str, item: CaseItem) -> Case:
     _add_backreference(observable, _case.case_id)
     _sync_case_metadata(case_id)
 
+    updated_case = ds.case.get(_case.case_id)
+    if updated_case:
+        event_service.emit("cases", {"case": updated_case.as_primitives()})
+
     return _case
 
 
@@ -410,6 +428,8 @@ def append_case(case_id: str, item: CaseItem) -> Case:
     if not datastore().case.save(_case.case_id, _case):
         raise DataStoreException(f"Failed to save {_case.case_id} with new item {item.value}")
 
+    event_service.emit("cases", {"case": _case.as_primitives()})
+
     return _case
 
 
@@ -473,6 +493,8 @@ def append_reference(case_id: str, item: CaseItem) -> Case:
     if not datastore().case.save(_case.case_id, _case):
         raise DataStoreException(f"Failed to save {_case.case_id} with new item {item.value}")
 
+    event_service.emit("cases", {"case": _case.as_primitives()})
+
     return _case
 
 
@@ -646,6 +668,10 @@ def remove_case_items(case_id: str, values: list[str]):
 
     _sync_case_metadata(case_id)
 
+    updated_case = ds.case.get(_case.case_id)
+    if updated_case:
+        event_service.emit("cases", {"case": updated_case.as_primitives()})
+
     return _case
 
 
@@ -692,4 +718,6 @@ def rename_case_item(case_id: str, item_value: str, new_path: str) -> Case:
     if not ds.case.save(_case.case_id, _case):
         raise DataStoreException("Failed to save case after item rename")
 
+    event_service.emit("cases", {"case": _case.as_primitives()})
+
     return _case

howler_api-4.0.0.dev803/howler/services/viewer_service.py

@@ -0,0 +1,43 @@
+"""Viewer service for tracking active viewers of entities (hits, cases, observables) in Redis.
+
+Stores viewer presence as ephemeral Redis sets with TTL, replacing the
+previous approach of persisting viewers directly in the ODM/ElasticSearch.
+"""
+
+from howler.config import redis
+from howler.remote.datatypes import retry_call
+from howler.services import event_service
+
+VIEWER_KEY_PREFIX = "viewers"
+VIEWER_TTL = 3600  # 1 hour
+
+
+def _key(entity_id: str) -> str:
+    return f"{VIEWER_KEY_PREFIX}:{entity_id}"
+
+
+def add_viewer(entity_id: str, username: str) -> None:
+    """Record that a user is viewing the given entity."""
+    key = _key(entity_id)
+    retry_call(redis.sadd, key, username)
+    retry_call(redis.expire, key, VIEWER_TTL)
+    _emit_update(entity_id)
+
+
+def remove_viewer(entity_id: str, username: str) -> None:
+    """Record that a user has stopped viewing the given entity."""
+    retry_call(redis.srem, _key(entity_id), username)
+    _emit_update(entity_id)
+
+
+def get_viewers(entity_id: str) -> list[str]:
+    """Return the list of usernames currently viewing the given entity."""
+    members = retry_call(redis.smembers, _key(entity_id))
+    return sorted(m.decode() if isinstance(m, bytes) else m for m in members)
+
+
+def _emit_update(entity_id: str) -> None:
+    event_service.emit(
+        "viewers_update",
+        {"id": entity_id, "viewers": get_viewers(entity_id)},
+    )

{howler_api-4.0.0.dev799 → howler_api-4.0.0.dev803}/howler/utils/socket_utils.py

@@ -1,12 +1,8 @@
 from howler.common.logging import get_logger
-from howler.datastore.operations import OdmHelper
-from howler.odm.models.hit import Hit
-from howler.services import event_service, hit_service
+from howler.services import event_service, viewer_service
 
 logger = get_logger(__file__)
 
-hit_helper = OdmHelper(Hit)
-
 
 def check_action(
     id: str, action: str, broadcast: bool, outstanding_actions: list[tuple[str, str, bool]] = [], **kwargs
@@ -35,27 +31,10 @@ def check_action(
         outstanding_actions = [a for a in outstanding_actions if a[1] != "stop_typing"]
 
     elif action == "viewing":
-        if hit_service.exists(id):
-            outstanding_actions.append((id, "stop_viewing", False))
-            hit_service.update_hit(
-                id,
-                [
-                    hit_helper.list_add(
-                        "howler.viewers",
-                        kwargs["username"],
-                        silent=True,
-                        if_missing=True,
-                    )
-                ],
-                user=kwargs["username"],
-            )
+        outstanding_actions.append((id, "stop_viewing", False))
+        viewer_service.add_viewer(id, kwargs["username"])
     elif action == "stop_viewing":
-        if hit_service.exists(id):
-            hit_service.update_hit(
-                id,
-                [hit_helper.list_remove("howler.viewers", kwargs["username"], silent=True)],
-                user=kwargs["username"],
-            )
+        viewer_service.remove_viewer(id, kwargs["username"])
         outstanding_actions = [a for a in outstanding_actions if a[1] != "stop_viewing"]
 
     return outstanding_actions

{howler_api-4.0.0.dev799 → howler_api-4.0.0.dev803}/pyproject.toml

@@ -152,7 +152,7 @@ suppress-none-returning = true
 [tool.poetry]
 package-mode = true
 name = "howler-api"
-version = "4.0.0.dev799"
+version = "4.0.0.dev803"
 description = "Howler - API server"
 authors = [
     "Canadian Centre for Cyber Security <howler@cyber.gc.ca>",