howler-api 4.0.0.dev841__tar.gz → 4.0.0.dev846__tar.gz

{howler_api-4.0.0.dev841 → howler_api-4.0.0.dev846}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: howler-api
-Version: 4.0.0.dev841
+Version: 4.0.0.dev846
 Summary: Howler - API server
 License: MIT
 Keywords: howler,alerting,gc,canada,cse-cst,cse,cst,cyber,cccs
@@ -28,7 +28,7 @@ Requires-Dist: chevron (==0.14.0)
 Requires-Dist: elasticsearch (==8.19.3)
 Requires-Dist: flasgger (>=0.9.7.1,<0.10.0.0)
 Requires-Dist: flask (==3.1.3)
-Requires-Dist: flask-caching (==2.3.1)
+Requires-Dist: flask-caching (==2.4.0)
 Requires-Dist: gevent (>=25.9.1,<26.0.0)
 Requires-Dist: gunicorn (==23.0.0)
 Requires-Dist: luqum (>=1.0.0,<2.0.0)
@@ -38,7 +38,7 @@ Requires-Dist: opentelemetry-instrumentation-flask (==0.61b0)
 Requires-Dist: opentelemetry-sdk (==1.40.0)
 Requires-Dist: packaging (<25.0)
 Requires-Dist: passlib (==1.7.4)
-Requires-Dist: prometheus-client (==0.24.1)
+Requires-Dist: prometheus-client (==0.25.0)
 Requires-Dist: pydantic (>=2.11.4,<3.0.0)
 Requires-Dist: pydantic-settings[yaml] (>=2.9.1,<3.0.0)
 Requires-Dist: pydash (>=8.0.5,<9.0.0)
@@ -51,10 +51,10 @@ Requires-Dist: python-dotenv (>=1.1.0,<2.0.0)
 Requires-Dist: pytz (>=2025.2,<2026.0)
 Requires-Dist: pyyaml (==6.0.3)
 Requires-Dist: redis (==4.6.0)
-Requires-Dist: requests (==2.32.5)
+Requires-Dist: requests (==2.33.1)
 Requires-Dist: tzdata (>=2026.1,<2027.0)
 Requires-Dist: validators (>=0.34,<0.36)
-Requires-Dist: wsproto (==1.2.0)
+Requires-Dist: wsproto (==1.3.2)
 Project-URL: Documentation, https://cybercentrecanada.github.io/howler/developer/backend/
 Project-URL: Homepage, https://cybercentrecanada.github.io/howler/
 Project-URL: Repository, https://github.com/CybercentreCanada/howler-api

{howler_api-4.0.0.dev841 → howler_api-4.0.0.dev846}/howler/actions/__init__.py

@@ -2,8 +2,10 @@ import importlib
 import os
 import re
 from pathlib import Path
+from types import ModuleType
 from typing import Any, Optional
 
+from howler.common.loader import datastore
 from howler.common.logging import get_logger
 from howler.odm.models.user import User
 from howler.plugins import get_plugins
@@ -12,6 +14,9 @@ logger = get_logger(__file__)
 
 PLUGIN_PATH = Path(os.environ.get("HWL_PLUGIN_DIRECTORY", "/etc/howler/plugins"))
 
+# Roles that grant advanced hit limits
+ADVANCED_ROLES = {"automation_advanced", "actionrunner_advanced", "admin"}
+
 
 def __sanitize_specification(spec: dict[str, Any]) -> dict[str, Any]:
     """Adapt the specification for use in the UI
@@ -71,6 +76,68 @@ def __sanitize_report(report: list[dict[str, Any]]) -> list[dict[str, Any]]:
     return sanitized
 
 
+def _get_operation(operation_id: str) -> ModuleType | None:
+    """Find and return an operation module by ID."""
+    operation = None
+    try:
+        operation = importlib.import_module(f"howler.actions.{operation_id}")
+    except ImportError:
+        pass
+
+    if not operation:
+        for plugin in get_plugins():
+            if not plugin.modules.operations:
+                continue
+
+            operation = next(
+                (operation for operation in plugin.modules.operations if operation.OPERATION_ID == operation_id), None
+            )
+
+            if operation:
+                break
+
+    return operation
+
+
+def check_hit_limit(
+    query: str, user: User, max_hits_basic: int | None, max_hits_advanced: int | None
+) -> dict[str, Any] | None:
+    """Check if the user exceeds hit count limits. Returns error dict if exceeded, None otherwise.
+
+    Args:
+        query: The query to check hit count for (should be the effective query the operation will execute).
+        user: The user executing the action.
+        max_hits_basic: Maximum hits allowed for basic users (None for no limit).
+        max_hits_advanced: Maximum hits allowed for advanced users (None for no limit).
+
+    Returns:
+        Error dict if limit exceeded, None otherwise.
+    """
+    is_advanced = bool(ADVANCED_ROLES & set(user["type"]))
+    limit = max_hits_advanced if is_advanced else max_hits_basic
+
+    if limit is not None:
+        hit_count = datastore().hit.search(query, rows=0)["total"]
+        if hit_count > limit:
+            return {
+                "query": query,
+                "outcome": "error",
+                "title": "Hit limit exceeded",
+                "message": (
+                    f"This action affects {hit_count} hits, but you can only process {limit} at a time. "
+                    "Contact an administrator for bulk operations."
+                ),
+            }
+    return None
+
+
+def _check_hit_limit(operation: ModuleType, query: str, user: User) -> dict[str, Any] | None:
+    """Central hit limit check using raw query. Skipped if operation sets SKIP_CENTRAL_LIMIT."""
+    max_hits_basic = getattr(operation, "MAX_HITS_BASIC", None)
+    max_hits_advanced = getattr(operation, "MAX_HITS_ADVANCED", None)
+    return check_hit_limit(query, user, max_hits_basic, max_hits_advanced)
+
+
 def execute(
     operation_id: str,
     query: str,
@@ -89,23 +156,7 @@ def execute(
     Returns:
         list[dict[str, Any]]: A report on the execution
     """
-    operation = None
-    try:
-        operation = importlib.import_module(f"howler.actions.{operation_id}")
-    except ImportError:
-        pass
-
-    if not operation:
-        for plugin in get_plugins():
-            if not plugin.modules.operations:
-                continue
-
-            operation = next(
-                (operation for operation in plugin.modules.operations if operation.OPERATION_ID == operation_id), None
-            )
-
-            if operation:
-                break
+    operation = _get_operation(operation_id)
 
     if not operation:
         return [
@@ -117,9 +168,21 @@ def execute(
             }
         ]
 
-    user_roles: set[str] = set(user["type"] if user else [])
-    missing_roles = set(operation.specification()["roles"]) - user_roles
-    if missing_roles:
+    if not user:
+        return [
+            {
+                "query": query,
+                "outcome": "error",
+                "title": "Authentication required",
+                "message": "You must be logged in to execute actions.",
+            }
+        ]
+
+    user_roles = set(user["type"])
+    is_admin = "admin" in user_roles
+    required_roles = set(operation.specification()["roles"])
+    has_roles = required_roles & user_roles
+    if not is_admin and not has_roles:
         return [
             {
                 "query": query,
@@ -127,11 +190,18 @@ def execute(
                 "title": "Insufficient permissions",
                 "message": (
                     f"The operation ID provided ({operation_id}) requires permissions you do not have "
-                    f"({', '.join(missing_roles)}). Contact HOWLER Support for more information."
+                    f"(missing one of: {', '.join(sorted(required_roles))}). "
+                    "Contact HOWLER Support for more information."
                 ),
             }
         ]
 
+    # Skip central limit check if operation handles it locally with transformed query
+    if not getattr(operation, "SKIP_CENTRAL_LIMIT", False):
+        limit_error = _check_hit_limit(operation, query, user)
+        if limit_error:
+            return [limit_error]
+
     report = operation.execute(query=query, request_id=request_id, user=user, **kwargs)
 
     return __sanitize_report(report)

{howler_api-4.0.0.dev841 → howler_api-4.0.0.dev846}/howler/actions/add_label.py

@@ -10,6 +10,8 @@ from howler.utils.str_utils import sanitize_lucene_query
 hit_helper = OdmHelper(Hit)
 
 OPERATION_ID = "add_label"
+MAX_HITS_BASIC = 20
+MAX_HITS_ADVANCED = 1000
 
 CATEGORIES = list(Label.fields().keys())
 
@@ -99,7 +101,7 @@ def specification():
             "short": "Add a label to a hit",
             "long": execute.__doc__,
         },
-        "roles": ["automation_basic"],
+        "roles": ["automation_basic", "actionrunner_basic"],
         "steps": [
             {
                 "args": {"category": [], "label": []},

{howler_api-4.0.0.dev841 → howler_api-4.0.0.dev846}/howler/actions/add_to_bundle.py

@@ -2,16 +2,21 @@
 
 from typing import Optional
 
+from howler.actions import check_hit_limit
 from howler.common.exceptions import NotFoundException
 from howler.common.loader import datastore
 from howler.odm.models.action import VALID_TRIGGERS
+from howler.odm.models.user import User
 from howler.services import bundle_compat_service, case_service
 from howler.utils.str_utils import sanitize_lucene_query
 
 OPERATION_ID = "add_to_bundle"
+MAX_HITS_BASIC = 10
+MAX_HITS_ADVANCED = 1000
+SKIP_CENTRAL_LIMIT = True  # This operation transforms the query, handles limit check locally
 
 
-def execute(query: str, bundle_id: Optional[str] = None, **kwargs):
+def execute(query: str, bundle_id: Optional[str] = None, user: Optional[User] = None, **kwargs):  # noqa: C901
     """Add a set of hits matching the query to the specified bundle (deprecated — uses cases).
 
     Args:
@@ -44,7 +49,14 @@ def execute(query: str, bundle_id: Optional[str] = None, **kwargs):
             return report
 
         ds = datastore()
-        matching_hits = ds.hit.search(query, rows=1000)["items"]
+
+        # Check hit limit against the query before searching
+        if user:
+            limit_error = check_hit_limit(query, user, MAX_HITS_BASIC, MAX_HITS_ADVANCED)
+            if limit_error:
+                return [limit_error]
+
+        matching_hits = ds.hit.search(query, rows=MAX_HITS_ADVANCED)["items"]
 
         if not matching_hits:
             report.append(
@@ -125,7 +137,7 @@ def specification():
             "short": "Add a set of hits to a bundle (deprecated — uses cases)",
             "long": execute.__doc__,
         },
-        "roles": ["automation_basic"],
+        "roles": ["automation_basic", "actionrunner_basic"],
         "steps": [
             {
                 "args": {"bundle_id": []},

{howler_api-4.0.0.dev841 → howler_api-4.0.0.dev846}/howler/actions/change_field.py

@@ -65,7 +65,7 @@ def specification():
             "short": "Change one of the fields of a hit",
             "long": execute.__doc__,
         },
-        "roles": ["automation_advanced", "admin"],
+        "roles": ["automation_advanced", "actionrunner_advanced", "admin"],
         "steps": [
             {
                 "args": {"field": [], "value": []},

{howler_api-4.0.0.dev841 → howler_api-4.0.0.dev846}/howler/actions/demote.py

@@ -15,6 +15,8 @@ from howler.odm.models.user import User
 from howler.utils.str_utils import sanitize_lucene_query
 
 OPERATION_ID = "demote"
+MAX_HITS_BASIC = 10
+MAX_HITS_ADVANCED = 1000
 
 ESCALATIONS = [esc for esc in Escalation.list() if esc != Escalation.EVIDENCE]
 
@@ -131,7 +133,7 @@ def specification():
             "short": "Demote a hit",
             "long": execute.__doc__,
         },
-        "roles": ["automation_basic"],
+        "roles": ["automation_basic", "actionrunner_basic"],
         "steps": [
             {
                 "args": {"escalation": []},

{howler_api-4.0.0.dev841 → howler_api-4.0.0.dev846}/howler/actions/example_plugin.py

@@ -67,7 +67,7 @@ def specification():
         },
         # What roles should be necessary to run this action? In general, automation_basic should always be required,
         # while automation_advanced should be set when this action could be dangerous or costly in terms of resources.
-        "roles": ["automation_basic"],
+        "roles": ["automation_basic", "actionrunner_basic"],
         # What data should the user be required to provide? This is split intop steps, so arguments can depend on each
         # other, giving basic control flow for specifying arguments.
         "steps": [

{howler_api-4.0.0.dev841 → howler_api-4.0.0.dev846}/howler/actions/prioritization.py

@@ -6,6 +6,8 @@ from howler.odm.models.hit import Hit
 hit_helper = OdmHelper(Hit)
 
 OPERATION_ID = "prioritization"
+MAX_HITS_BASIC = 10
+MAX_HITS_ADVANCED = 1000
 
 VALID_FIELDS = ["reliability", "severity", "volume", "confidence", "score"]
 
@@ -82,7 +84,7 @@ def specification():
             "short": "Change one of the prioritization fields of a hit",
             "long": execute.__doc__,
         },
-        "roles": ["automation_basic"],
+        "roles": ["automation_basic", "actionrunner_basic"],
         "steps": [
             {
                 "args": {"field": [], "value": []},

{howler_api-4.0.0.dev841 → howler_api-4.0.0.dev846}/howler/actions/promote.py

@@ -13,6 +13,8 @@ from howler.odm.models.howler_data import (
 from howler.utils.str_utils import sanitize_lucene_query
 
 OPERATION_ID = "promote"
+MAX_HITS_BASIC = 10
+MAX_HITS_ADVANCED = 1000
 
 ESCALATIONS = [esc for esc in Escalation.list() if esc != Escalation.MISS]
 
@@ -118,7 +120,7 @@ def specification():
             "short": "Promote a hit",
             "long": execute.__doc__,
         },
-        "roles": ["automation_basic"],
+        "roles": ["automation_basic", "actionrunner_basic"],
         "steps": [
             {
                 "args": {"escalation": []},

{howler_api-4.0.0.dev841 → howler_api-4.0.0.dev846}/howler/actions/remove_from_bundle.py

@@ -2,16 +2,21 @@
 
 from typing import Optional
 
+from howler.actions import check_hit_limit
 from howler.common.exceptions import NotFoundException
 from howler.common.loader import datastore
 from howler.odm.models.action import VALID_TRIGGERS
+from howler.odm.models.user import User
 from howler.services import bundle_compat_service, case_service
 from howler.utils.str_utils import sanitize_lucene_query
 
 OPERATION_ID = "remove_from_bundle"
+MAX_HITS_BASIC = 10
+MAX_HITS_ADVANCED = 1000
+SKIP_CENTRAL_LIMIT = True  # This operation transforms the query, handles limit check locally
 
 
-def execute(query: str, bundle_id: Optional[str] = None, **kwargs):
+def execute(query: str, bundle_id: Optional[str] = None, user: Optional[User] = None, **kwargs):  # noqa: C901
     """Remove a set of hits matching the query from the specified bundle (deprecated — uses cases).
 
     Args:
@@ -44,7 +49,14 @@ def execute(query: str, bundle_id: Optional[str] = None, **kwargs):
             return report
 
         ds = datastore()
-        matching_hits = ds.hit.search(query, rows=1000)["items"]
+
+        # Check hit limit against the query before searching
+        if user:
+            limit_error = check_hit_limit(query, user, MAX_HITS_BASIC, MAX_HITS_ADVANCED)
+            if limit_error:
+                return [limit_error]
+
+        matching_hits = ds.hit.search(query, rows=MAX_HITS_ADVANCED)["items"]
 
         if not matching_hits:
             report.append(
@@ -139,7 +151,7 @@ def specification():
             "short": "Remove a set of hits from a bundle (deprecated — uses cases)",
             "long": execute.__doc__,
         },
-        "roles": ["automation_basic"],
+        "roles": ["automation_basic", "actionrunner_basic"],
         "steps": [
             {
                 "args": {"bundle_id": []},

{howler_api-4.0.0.dev841 → howler_api-4.0.0.dev846}/howler/actions/remove_label.py

@@ -10,6 +10,8 @@ from howler.utils.str_utils import sanitize_lucene_query
 hit_helper = OdmHelper(Hit)
 
 OPERATION_ID = "remove_label"
+MAX_HITS_BASIC = 20
+MAX_HITS_ADVANCED = 1000
 
 CATEGORIES = list(Label.fields().keys())
 
@@ -99,7 +101,7 @@ def specification():
             "short": "Remove a label from a hit",
             "long": execute.__doc__,
         },
-        "roles": ["automation_basic"],
+        "roles": ["automation_basic", "actionrunner_basic"],
         "steps": [
             {
                 "args": {"category": [], "label": []},

{howler_api-4.0.0.dev841 → howler_api-4.0.0.dev846}/howler/actions/transition.py

@@ -1,6 +1,7 @@
 import inspect
 from typing import Optional, cast
 
+from howler.actions import check_hit_limit
 from howler.common.exceptions import InvalidDataException, NotFoundException
 from howler.common.loader import datastore
 from howler.common.logging import get_logger
@@ -17,6 +18,9 @@ from howler.services import event_service, hit_service
 from howler.utils.list_utils import flatten_list
 
 OPERATION_ID = "transition"
+MAX_HITS_BASIC = 10
+MAX_HITS_ADVANCED = 1000
+SKIP_CENTRAL_LIMIT = True  # This operation transforms the query, handles limit check locally
 
 log = get_logger(__file__)
 
@@ -70,8 +74,17 @@ def execute(
         status (str): The status from which to transition.
         transition (str): The transition to attempt to execute.
     """
-    rows = 1000 if "automation_advanced" in user.type else 10
-    hits = datastore().hit.search(f"({query}) AND howler.status:{status}", rows=rows, fl="howler.id")
+    # Build effective query with status filter
+    effective_query = f"({query}) AND howler.status:{status}"
+
+    # Check hit limit against the effective query (not raw query)
+    limit_error = check_hit_limit(effective_query, user, MAX_HITS_BASIC, MAX_HITS_ADVANCED)
+    if limit_error:
+        return [limit_error]
+
+    is_advanced = "automation_advanced" in user.type or "actionrunner_advanced" in user.type or "admin" in user.type
+    rows = MAX_HITS_ADVANCED if is_advanced else MAX_HITS_BASIC
+    hits = datastore().hit.search(effective_query, rows=rows, fl="howler.id")
 
     ids = [hit.howler.id for hit in hits["items"]]
 
@@ -176,7 +189,7 @@ def specification():
             "short": "Transition a hit",
             "long": execute.__doc__,
         },
-        "roles": ["automation_basic"],
+        "roles": ["automation_basic", "actionrunner_basic"],
         "steps": [
             {
                 "args": {"status": []},

{howler_api-4.0.0.dev841 → howler_api-4.0.0.dev846}/howler/api/v1/action.py

@@ -23,7 +23,11 @@ action_api._doc = "Endpoints relating to bulk actions and automation"  # type: i
 
 @generate_swagger_docs()
 @action_api.route("/")
-@api_login(audit=False, check_xsrf_token=False, required_type=["automation_basic"])
+@api_login(
+    audit=False,
+    check_xsrf_token=False,
+    required_type=["admin", "automation_basic", "automation_advanced", "actionrunner_basic", "actionrunner_advanced"],
+)
 def get_actions(**_) -> Response:
     """Get a list of existing actions
 
@@ -43,7 +47,7 @@ def get_actions(**_) -> Response:
 
 @generate_swagger_docs()
 @action_api.route("/", methods=["POST"])
-@api_login(audit=False, check_xsrf_token=False, required_type=["automation_basic"])
+@api_login(audit=False, check_xsrf_token=False, required_type=["admin", "automation_basic", "automation_advanced"])
 def add_action(user: User, **_) -> Response:
     """Create a new action
 
@@ -97,7 +101,7 @@ def add_action(user: User, **_) -> Response:
 @api_login(
     audit=False,
     check_xsrf_token=False,
-    required_type=["automation_basic"],
+    required_type=["admin", "automation_basic", "automation_advanced"],
 )
 def update_action(id: str, user: User, **_) -> Response:
     """Update an existing action
@@ -164,7 +168,7 @@ def update_action(id: str, user: User, **_) -> Response:
 
 @generate_swagger_docs()
 @action_api.route("/<id>", methods=["DELETE"])
-@api_login(audit=True, check_xsrf_token=False, required_type=["automation_basic"])
+@api_login(audit=True, check_xsrf_token=False, required_type=["admin", "automation_basic", "automation_advanced"])
 def delete_action(id: str, user: User, **kwargs) -> Response:
     """Delete an existing action
 
@@ -200,7 +204,11 @@ def delete_action(id: str, user: User, **kwargs) -> Response:
 
 @generate_swagger_docs()
 @action_api.route("/<id>/execute", methods=["POST"])
-@api_login(audit=True, check_xsrf_token=False, required_type=["automation_basic"])
+@api_login(
+    audit=True,
+    check_xsrf_token=False,
+    required_type=["admin", "automation_basic", "automation_advanced", "actionrunner_basic", "actionrunner_advanced"],
+)
 def execute_action(id: str, **kwargs) -> Response:
     """Execute one or more actions on a given query
 
@@ -274,7 +282,11 @@ def execute_action(id: str, **kwargs) -> Response:
 
 @generate_swagger_docs()
 @action_api.route("/operations")
-@api_login(audit=False, check_xsrf_token=False, required_type=["automation_basic"])
+@api_login(
+    audit=False,
+    check_xsrf_token=False,
+    required_type=["admin", "automation_basic", "automation_advanced", "actionrunner_basic", "actionrunner_advanced"],
+)
 def get_operations(**_) -> Response:
     """Get a list of operations the user can run on a query
 
@@ -294,7 +306,11 @@ def get_operations(**_) -> Response:
 
 @generate_swagger_docs()
 @action_api.route("/execute", methods=["POST"])
-@api_login(audit=True, check_xsrf_token=False, required_type=["automation_basic"])
+@api_login(
+    audit=True,
+    check_xsrf_token=False,
+    required_type=["admin", "automation_basic", "automation_advanced", "actionrunner_basic", "actionrunner_advanced"],
+)
 def execute_operations(**kwargs) -> Response:
     """Execute one or more operations on a given query
 

{howler_api-4.0.0.dev841 → howler_api-4.0.0.dev846}/howler/api/v1/user.py

@@ -128,9 +128,7 @@ def add_user_account(username, **_):
         data["name"] = data["uname"]
 
     # Add dynamic classification group
-    data["classification"] = user_service.get_dynamic_classification(
-        cast(str | None, data.get("classification", None)), data["email"]
-    )
+    data["classification"] = user_service.get_dynamic_classification(data)
 
     # Clear non user account data
     avatar = data.pop("avatar", None)
@@ -290,7 +288,7 @@ def set_user_account(username: str, **kwargs):  # noqa: C901
             data.pop("new_pass_confirm", None)
 
         # Apply dynamic classification
-        data["classification"] = user_service.get_dynamic_classification(data["classification"], data["email"])
+        data["classification"] = user_service.get_dynamic_classification(data)
 
         ret_val = user_service.save_user_account(username, data, kwargs["user"])
         return ok({"success": ret_val})