howler-api 4.1.0.dev1436__tar.gz → 4.1.0.dev1460__tar.gz

{howler_api-4.1.0.dev1436 → howler_api-4.1.0.dev1460}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: howler-api
-Version: 4.1.0.dev1436
+Version: 4.1.0.dev1460
 Summary: Howler - API server
 License: MIT
 Keywords: howler,alerting,gc,canada,cse-cst,cse,cst,cyber,cccs

{howler_api-4.1.0.dev1436 → howler_api-4.1.0.dev1460}/howler/api/v2/search.py

@@ -7,7 +7,7 @@ from elasticsearch import BadRequestError
 from elasticsearch._sync.client.indices import IndicesClient
 from flask import request
 
-from howler.api import bad_request, internal_error, make_subapi_blueprint, ok
+from howler.api import bad_request, forbidden, internal_error, make_subapi_blueprint, ok
 from howler.common.loader import datastore
 from howler.common.logging import get_logger
 from howler.common.logging.audit import audit
@@ -17,6 +17,7 @@ from howler.helper.search import get_collection, has_access_control
 from howler.odm.models.user import User
 from howler.security import api_login
 from howler.services import hit_service, lucene_service, search_service
+from howler.services.search_service import SensitiveUserFieldsException
 from howler.utils.net_utils import generate_params
 
 SUB_API = "search"
@@ -98,7 +99,10 @@ def search(indexes: str, user: User, **kwargs):
         }
     )
 
-    params["sort"] = [entry for entry in params.get("sort", "").split(",") if entry] or search_service.DEFAULT_SORT
+    if params.get("sort"):
+        params["sort"] = [entry for entry in params["sort"].split(",") if entry]
+    else:
+        params.pop("sort", None)
 
     query = req_data.get("query", None)
     if not query:
@@ -110,6 +114,8 @@ def search(indexes: str, user: User, **kwargs):
 
     try:
         result = search_service.search(indexes, query, user=user, **params)
+    except SensitiveUserFieldsException as e:
+        return forbidden(err=e.message)
     except (SearchException, BadRequestError) as e:
         logger.exception(f"SearchException on query {query}")
         return bad_request(err=f"SearchException on query {query}: {str(e)}")

{howler_api-4.1.0.dev1436 → howler_api-4.1.0.dev1460}/howler/cronjobs/action_queue_worker.py

@@ -13,7 +13,7 @@ from apscheduler.schedulers.base import BaseScheduler
 from howler.common.logging import get_logger
 from howler.config import config
 from howler.odm.models.action import VALID_TRIGGERS
-from howler.services.action_service import _get_action_queue, process_action_batch
+from howler.services.action_service import TriggeredAction, get_action_queue, process_action_batch
 
 logger = get_logger(__file__)
 
@@ -33,7 +33,7 @@ def run_worker(trigger: str) -> None:  # pragma: no cover – long-running loop,
         logger.info("Action queue worker disabled by configuration, not starting for trigger=%s", trigger)
         return
 
-    queue = _get_action_queue(trigger)
+    queue = get_action_queue(trigger)
     logger.info(
         "Action queue worker started for trigger=%s (batch_size=%d, timeout=%ds)",
         trigger,
@@ -41,7 +41,7 @@ def run_worker(trigger: str) -> None:  # pragma: no cover – long-running loop,
         BATCH_TIMEOUT,
     )
 
-    batch: list[dict] = []
+    batch: list[TriggeredAction] = []
 
     while True:
         try:

{howler_api-4.1.0.dev1436 → howler_api-4.1.0.dev1460}/howler/services/action_service.py

@@ -1,5 +1,6 @@
 import json
-from typing import Any, Optional
+from collections import defaultdict
+from typing import Any, Optional, TypedDict
 
 from flask import Response
 
@@ -18,11 +19,19 @@ from howler.utils.str_utils import sanitize_lucene_query
 
 logger = get_logger(__file__)
 
+
+class TriggeredAction(TypedDict):
+    """Type for triggered actions"""
+
+    hit_ids: list[str]
+    uname: str | None
+
+
 # Per-trigger persistent queues for buffering action execution requests.
-_action_queues: dict[str, NamedQueue[dict]] = {}
+_action_queues: dict[str, NamedQueue[TriggeredAction]] = {}
 
 
-def _get_action_queue(trigger: str) -> NamedQueue[dict]:
+def get_action_queue(trigger: str) -> NamedQueue[TriggeredAction]:
     """Return the action queue for *trigger*, creating it on first use.
 
     Raises:
@@ -65,10 +74,10 @@ def enqueue_action_execution(hit_ids: list[str], trigger: str = "create", user:
         return
 
     try:
-        _get_action_queue(trigger).push(
+        get_action_queue(trigger).push(
             {
                 "hit_ids": hit_ids,
-                "user": user.as_primitives() if user is not None and hasattr(user, "as_primitives") else user,
+                "uname": user.uname if user else None,
             }
         )
     except Exception:
@@ -77,7 +86,7 @@ def enqueue_action_execution(hit_ids: list[str], trigger: str = "create", user:
         bulk_execute_on_query(query, trigger=trigger, user=user)
 
 
-def process_action_batch(trigger: str, items: list[dict]) -> None:
+def process_action_batch(trigger: str, items: list[TriggeredAction]) -> None:
     """Process a batch of queued action execution requests for a single trigger.
 
     Groups items by user and issues a single coalesced
@@ -90,26 +99,23 @@ def process_action_batch(trigger: str, items: list[dict]) -> None:
     if not items:
         return
 
-    groups: dict[str | None, tuple[list[str], Any]] = {}
+    groups: dict[str | None, list[str]] = defaultdict(list)
 
     for item in items:
-        user_data = item.get("user")
-        user_key = user_data["uname"] if isinstance(user_data, dict) and "uname" in user_data else None
-
-        if user_key not in groups:
-            groups[user_key] = ([], user_data)
+        uname = item.get("uname")
 
-        groups[user_key][0].extend(item["hit_ids"])
+        groups[uname].extend(item["hit_ids"])
 
-    for user_key, (hit_ids, user_data) in groups.items():
+    for uname, hit_ids in groups.items():
         # Deduplicate IDs within a batch group
         unique_ids = list(dict.fromkeys(hit_ids))
         query = f"howler.id:({' OR '.join(sanitize_lucene_query(h) for h in unique_ids)})"
 
         try:
-            bulk_execute_on_query(query, trigger=trigger, user=user_data)
+            user = datastore().user.get(uname)
+            bulk_execute_on_query(query, trigger=trigger, user=user)
         except Exception:
-            logger.exception("Error processing action batch for trigger=%s user=%s", trigger, user_key)
+            logger.exception("Error processing action batch for trigger=%s user=%s", trigger, uname)
 
 
 def validate_action(new_action: Any) -> Optional[Response]:  # noqa: C901

{howler_api-4.1.0.dev1436 → howler_api-4.1.0.dev1460}/howler/services/search_service.py

@@ -10,7 +10,7 @@ from howler.common.logging import get_logger
 from howler.datastore.collection import parse_sort
 from howler.datastore.exceptions import SearchException, SearchRetryException
 from howler.datastore.types import SearchResult
-from howler.helper.search import get_collection, has_access_control
+from howler.helper.search import get_collection, get_default_sort, has_access_control
 from howler.odm.models.user import User
 from howler.services import case_service
 from howler.utils.indexes import get_logical_index_name, normalize_indexes
@@ -20,10 +20,15 @@ DEFAULT_ROW_SIZE = 25
 DEFAULT_SORT: list[dict[str, str]] = [{"_id": "asc"}]
 DEFAULT_SEARCH_FIELD = "__text__"
 SCROLL_TIMEOUT = "5m"
+SENSITIVE_USER_FIELDS = ["password", "apikeys", "*"]
 
 logger = get_logger(__file__)
 
 
+class SensitiveUserFieldsException(SearchException):
+    """Raised when a user search requests protected source fields."""
+
+
 def _format_items(hits: list[dict[str, Any]], user_classification: str | None) -> list[dict[str, Any]]:
     """Formats Elasticsearch search hits into a standardized item format.
 
@@ -93,6 +98,14 @@ def search(  # noqa: C901
     """
     del metadata
 
+    index_list = _parse_index_list(indexes)
+    if (
+        fl is not None
+        and "user" in index_list
+        and any(sensitive_field in fl for sensitive_field in SENSITIVE_USER_FIELDS)
+    ):
+        raise SensitiveUserFieldsException("Invalid fields to retrieve.")
+
     client: Elasticsearch = datastore().ds.client
     parsed_indexes = normalize_indexes(indexes)
 
@@ -113,7 +126,12 @@ def search(  # noqa: C901
         query = "id:*"
 
     if sort is None:
-        sort = DEFAULT_SORT
+        default_sorts = [get_default_sort(index, user) for index in _parse_index_list(indexes)] if user else []
+        default_sort = default_sorts[0] if default_sorts else None
+        if default_sort is not None and all(index_sort == default_sort for index_sort in default_sorts):
+            sort = default_sort
+        else:
+            sort = DEFAULT_SORT
 
     if rows is None:
         rows = DEFAULT_ROW_SIZE

{howler_api-4.1.0.dev1436 → howler_api-4.1.0.dev1460}/pyproject.toml

@@ -152,7 +152,7 @@ suppress-none-returning = true
 [tool.poetry]
 package-mode = true
 name = "howler-api"
-version = "4.1.0.dev1436"
+version = "4.1.0.dev1460"
 description = "Howler - API server"
 authors = [
     "Canadian Centre for Cyber Security <howler@cyber.gc.ca>",