howler-api 4.1.0.dev1468__tar.gz → 4.1.0.dev1502__tar.gz

{howler_api-4.1.0.dev1468 → howler_api-4.1.0.dev1502}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: howler-api
-Version: 4.1.0.dev1468
+Version: 4.1.0.dev1502
 Summary: Howler - API server
 License: MIT
 Keywords: howler,alerting,gc,canada,cse-cst,cse,cst,cyber,cccs

{howler_api-4.1.0.dev1468 → howler_api-4.1.0.dev1502}/howler/api/base.py

@@ -1,7 +1,7 @@
 from flask import Blueprint, current_app, request
 
 from howler.api import API_PREFIX, ok
-from howler.security import api_login
+from howler.security.login import api_login
 
 api = Blueprint("api", __name__, url_prefix=API_PREFIX)
 

{howler_api-4.1.0.dev1468 → howler_api-4.1.0.dev1502}/howler/api/socket.py

@@ -11,7 +11,7 @@ import howler.services.viewer_service as viewer_service
 from howler.api import ok, unauthorized
 from howler.common.logging import get_logger
 from howler.helper.ws import ConnectionClosed, Server
-from howler.security import api_login
+from howler.security.login import api_login
 from howler.security.socket import websocket_auth, ws_response
 from howler.utils.socket_utils import check_action
 

{howler_api-4.1.0.dev1468 → howler_api-4.1.0.dev1502}/howler/api/v1/__init__.py

@@ -1,7 +1,7 @@
 from flask import Blueprint
 
 from howler.api import ok
-from howler.security import api_login
+from howler.security.login import api_login
 from howler.services import docs_service
 
 API_PREFIX = "/api/v1"

{howler_api-4.1.0.dev1468 → howler_api-4.1.0.dev1502}/howler/api/v1/action.py

@@ -12,7 +12,7 @@ from howler.common.swagger import generate_swagger_docs
 from howler.config import CLASSIFICATION
 from howler.odm.models.action import Action
 from howler.odm.models.user import User
-from howler.security import api_login
+from howler.security.login import api_login
 from howler.services import action_service
 
 SUB_API = "action"

{howler_api-4.1.0.dev1468 → howler_api-4.1.0.dev1502}/howler/api/v1/analytic.py

@@ -20,7 +20,7 @@ from howler.datastore.exceptions import DataStoreException
 from howler.datastore.operations import OdmHelper
 from howler.odm.models.analytic import Analytic, Comment, Notebook, TriageOptions
 from howler.odm.models.user import User
-from howler.security import api_login
+from howler.security.login import api_login
 from howler.services import analytic_service, user_service
 
 MAX_COMMENT_LEN = 5000

{howler_api-4.1.0.dev1468 → howler_api-4.1.0.dev1502}/howler/api/v1/auth.py

@@ -31,7 +31,7 @@ from howler.common.logging import get_logger
 from howler.common.swagger import generate_swagger_docs
 from howler.config import config
 from howler.odm.models.user import ApiKey, User
-from howler.security import api_login
+from howler.security.login import api_login
 from howler.security.utils import generate_random_secret
 from howler.services import jwt_service
 from howler.utils.str_utils import default_string_value

{howler_api-4.1.0.dev1468 → howler_api-4.1.0.dev1502}/howler/api/v1/clue.py

@@ -10,7 +10,7 @@ from howler.common.logging import get_logger
 from howler.common.swagger import generate_swagger_docs
 from howler.config import cache, config
 from howler.plugins import get_plugins
-from howler.security import api_login
+from howler.security.login import api_login
 from howler.utils.constants import TESTING
 
 SUB_API = "clue"

{howler_api-4.1.0.dev1468 → howler_api-4.1.0.dev1502}/howler/api/v1/dossier.py

@@ -13,7 +13,7 @@ from howler.common.logging import get_logger
 from howler.common.swagger import generate_swagger_docs
 from howler.odm.models.dossier import Dossier
 from howler.odm.models.user import User
-from howler.security import api_login
+from howler.security.login import api_login
 from howler.services import dossier_service
 
 SUB_API = "dossier"

{howler_api-4.1.0.dev1468 → howler_api-4.1.0.dev1502}/howler/api/v1/help.py

@@ -1,7 +1,7 @@
 from howler.api import make_subapi_blueprint, ok
 from howler.common.swagger import generate_swagger_docs
 from howler.config import CLASSIFICATION
-from howler.security import api_login
+from howler.security.login import api_login
 
 SUB_API = "help"
 classification_definition = CLASSIFICATION.get_parsed_classification_definition()

{howler_api-4.1.0.dev1468 → howler_api-4.1.0.dev1502}/howler/api/v1/hit.py

@@ -29,7 +29,7 @@ from howler.helper.workflow import WorkflowException
 from howler.odm.models.hit import Hit
 from howler.odm.models.howler_data import Comment, HitOperationType, HitStatusTransition
 from howler.odm.models.user import User
-from howler.security import api_login
+from howler.security.login import api_login
 from howler.services import action_service, analytic_service, comms_service, correlation_service, hit_service
 from howler.utils.constants import DEBUG_FORCE_REFRESH
 from howler.utils.str_utils import sanitize_lucene_query

{howler_api-4.1.0.dev1468 → howler_api-4.1.0.dev1502}/howler/api/v1/notebook.py

@@ -2,7 +2,7 @@ from flask import request
 
 from howler.api import bad_request, internal_error, make_subapi_blueprint, ok
 from howler.common.swagger import generate_swagger_docs
-from howler.security import api_login
+from howler.security.login import api_login
 from howler.services import notebook_service
 
 SUB_API = "notebook"

{howler_api-4.1.0.dev1468 → howler_api-4.1.0.dev1502}/howler/api/v1/overview.py

@@ -17,7 +17,7 @@ from howler.common.logging import get_logger
 from howler.common.swagger import generate_swagger_docs
 from howler.odm.models.overview import Overview
 from howler.odm.models.user import User
-from howler.security import api_login
+from howler.security.login import api_login
 from howler.utils.str_utils import sanitize_lucene_query
 
 SUB_API = "overview"

{howler_api-4.1.0.dev1468 → howler_api-4.1.0.dev1502}/howler/api/v1/search.py

@@ -16,7 +16,7 @@ from howler.common.swagger import generate_swagger_docs
 from howler.datastore.exceptions import SearchException
 from howler.helper.search import get_collection, get_default_sort, has_access_control, list_all_fields
 from howler.odm.models.user import User
-from howler.security import api_login
+from howler.security.login import api_login
 from howler.services import hit_service, lucene_service
 from howler.utils.net_utils import generate_params
 

{howler_api-4.1.0.dev1468 → howler_api-4.1.0.dev1502}/howler/api/v1/template.py

@@ -18,7 +18,7 @@ from howler.common.swagger import generate_swagger_docs
 from howler.datastore.operations import OdmHelper
 from howler.odm.models.template import Template
 from howler.odm.models.user import User
-from howler.security import api_login
+from howler.security.login import api_login
 from howler.utils.str_utils import sanitize_lucene_query
 
 SUB_API = "template"

{howler_api-4.1.0.dev1468 → howler_api-4.1.0.dev1502}/howler/api/v1/tool.py

@@ -12,7 +12,7 @@ from howler.datastore.operations import OdmHelper
 from howler.odm.base import _Field
 from howler.odm.models.hit import Hit
 from howler.odm.models.user import User
-from howler.security import api_login
+from howler.security.login import api_login
 from howler.services import action_service, analytic_service, correlation_service, hit_service
 from howler.utils.constants import DEBUG_FORCE_REFRESH
 from howler.utils.dict_utils import flatten

{howler_api-4.1.0.dev1468 → howler_api-4.1.0.dev1502}/howler/api/v1/user.py

@@ -21,7 +21,7 @@ from howler.common.swagger import generate_swagger_docs
 from howler.config import config
 from howler.helper.oauth import fetch_groups
 from howler.odm.models.user import User
-from howler.security import api_login
+from howler.security.login import api_login
 from howler.security.utils import check_password_requirements, get_password_hash, get_password_requirement_message
 
 SUB_API = "user"

{howler_api-4.1.0.dev1468 → howler_api-4.1.0.dev1502}/howler/api/v1/view.py

@@ -12,7 +12,7 @@ from howler.common.swagger import generate_swagger_docs
 from howler.datastore.exceptions import SearchException
 from howler.odm.models.user import User
 from howler.odm.models.view import View
-from howler.security import api_login
+from howler.security.login import api_login
 
 SUB_API = "view"
 view_api = make_subapi_blueprint(SUB_API, api_version=1)

{howler_api-4.1.0.dev1468 → howler_api-4.1.0.dev1502}/howler/api/v2/__init__.py

@@ -1,7 +1,7 @@
 from flask import Blueprint
 
 from howler.api import ok
-from howler.security import api_login
+from howler.security.login import api_login
 from howler.services import docs_service
 
 API_PREFIX = "/api/v2"

{howler_api-4.1.0.dev1468 → howler_api-4.1.0.dev1502}/howler/api/v2/case.py

@@ -12,7 +12,7 @@ from howler.common.swagger import generate_swagger_docs
 from howler.datastore.exceptions import DataStoreException
 from howler.odm.models.case import Case, CaseItem
 from howler.odm.models.user import User
-from howler.security import api_login
+from howler.security.login import api_login
 from howler.services import case_service
 
 SUB_API = "case"

{howler_api-4.1.0.dev1468 → howler_api-4.1.0.dev1502}/howler/api/v2/fuzzy.py

@@ -6,7 +6,7 @@ from howler.common.logging.audit import audit
 from howler.common.swagger import generate_swagger_docs
 from howler.datastore.exceptions import SearchException
 from howler.helper.search import has_access_control
-from howler.security import api_login
+from howler.security.login import api_login
 from howler.services import fuzzy_service
 
 SUB_API = "fuzzy"

{howler_api-4.1.0.dev1468 → howler_api-4.1.0.dev1502}/howler/api/v2/ingest.py

@@ -18,7 +18,7 @@ from howler.datastore.operations import OdmHelper, OdmUpdateOperation
 from howler.odm.models.event import Event
 from howler.odm.models.hit import Hit
 from howler.odm.models.user import User
-from howler.security import api_login
+from howler.security.login import api_login
 from howler.services import correlation_service, event_service, hit_service
 from howler.utils.dict_utils import flatten
 

{howler_api-4.1.0.dev1468 → howler_api-4.1.0.dev1502}/howler/api/v2/search.py

@@ -15,7 +15,7 @@ from howler.common.swagger import generate_swagger_docs
 from howler.datastore.exceptions import SearchException
 from howler.helper.search import get_collection, has_access_control
 from howler.odm.models.user import User
-from howler.security import api_login
+from howler.security.login import api_login
 from howler.services import hit_service, lucene_service, search_service
 from howler.services.search_service import SensitiveUserFieldsException
 from howler.utils.net_utils import generate_params

{howler_api-4.1.0.dev1468 → howler_api-4.1.0.dev1502}/howler/cronjobs/action_queue_worker.py

@@ -50,16 +50,18 @@ def run_worker(trigger: str) -> None:  # pragma: no cover – long-running loop,
             if item is not None:
                 batch.append(item)
 
-            if len(batch) % 10 == 0 or len(batch) >= BATCH_SIZE:
+            if len(batch) > 0 and (len(batch) % 10 == 0 or len(batch) >= BATCH_SIZE):
                 logger.info("Batch size: %s", len(batch))
 
             if len(batch) >= BATCH_SIZE or (item is None and batch):
                 finalized_batch = [*batch]
                 batch = []
-                logger.debug("Processing action batch of %d item(s) for trigger=%s", len(batch), trigger)
+                logger.debug("Processing action batch of %d item(s) for trigger=%s", len(finalized_batch), trigger)
                 try:
                     process_action_batch(trigger, finalized_batch)
-                    logger.info("Action batch complete: %d item(s) processed for trigger=%s", len(batch), trigger)
+                    logger.info(
+                        "Action batch complete: %d item(s) processed for trigger=%s", len(finalized_batch), trigger
+                    )
                 except Exception:
                     logger.exception("Error processing action batch for trigger=%s", trigger)
         except Exception:

{howler_api-4.1.0.dev1468 → howler_api-4.1.0.dev1502}/howler/odm/models/config.py

@@ -4,7 +4,7 @@ import os
 from pathlib import Path
 from typing import Literal, Optional
 
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, Field, field_validator
 from pydantic_settings import BaseSettings, PydanticBaseSettingsSource, SettingsConfigDict, YamlConfigSettingsSource
 
 from howler.common.logging.format import HWL_DATE_FORMAT, HWL_LOG_FORMAT
@@ -476,6 +476,10 @@ class System(BaseModel):
     """
 
     type: Literal["production", "staging", "development"] = Field(default="development", description="Type of system")
+    encryption_key: str | None = Field(
+        default=None,
+        description="32-byte secret used to encrypt JWE payloads such as queued authorization tokens.",
+    )
     retention: Retention = Retention()
     "Retention Configuration"
     view_cleanup: ViewCleanup = ViewCleanup()
@@ -485,6 +489,14 @@ class System(BaseModel):
     action_queue: ActionQueue = ActionQueue()
     "Action Queue Worker Configuration"
 
+    @field_validator("encryption_key")
+    @classmethod
+    def validate_encryption_key(cls, value: str | None) -> str | None:
+        if value is not None and len(value.encode("utf-8")) != 32:
+            raise ValueError("System encryption_key must be exactly 32 bytes when UTF-8 encoded")
+
+        return value
+
 
 class UI(BaseModel):
     """User interface and web server configuration.

{howler_api-4.1.0.dev1468 → howler_api-4.1.0.dev1502}/howler/security/utils.py

@@ -7,6 +7,7 @@ from urllib.parse import urlparse
 from opentelemetry import trace
 from passlib.hash import bcrypt
 
+from howler.common.exceptions import HowlerValueError
 from howler.config import config
 
 tracer = trace.get_tracer(__name__)
@@ -185,3 +186,12 @@ def get_disco_url(host_url: Optional[str]):
             return config.discovery.url
     else:
         return config.discovery.url
+
+
+def encryption_key() -> bytes:
+    """Return the configured encryption key for JWE payloads."""
+    secret_key = config.system.encryption_key
+    if secret_key is None:
+        raise HowlerValueError("System encryption_key must be configured before encrypting tokens")
+
+    return secret_key.encode("utf-8")

{howler_api-4.1.0.dev1468 → howler_api-4.1.0.dev1502}/howler/services/action_service.py

@@ -1,8 +1,9 @@
 import json
 from collections import defaultdict
+from importlib.util import find_spec
 from typing import Any, Optional, TypedDict
 
-from flask import Response
+from flask import Response, has_request_context, request
 
 from howler import actions
 from howler.api import bad_request
@@ -14,6 +15,7 @@ from howler.config import config
 from howler.odm.models.action import VALID_TRIGGERS, Action
 from howler.odm.models.user import User
 from howler.remote.datatypes.queues.named import NamedQueue
+from howler.services import auth_service
 from howler.utils.constants import TESTING
 from howler.utils.str_utils import sanitize_lucene_query
 
@@ -25,12 +27,30 @@ class TriggeredAction(TypedDict):
 
     hit_ids: list[str]
     uname: str | None
+    auth_token: str | None
 
 
 # Per-trigger persistent queues for buffering action execution requests.
 _action_queues: dict[str, NamedQueue[TriggeredAction]] = {}
 
 
+def _is_builtin_operation(operation_id: str) -> bool:
+    """Return whether an operation is implemented by Howler's built-in actions package."""
+    return find_spec(f"howler.actions.{operation_id}") is not None
+
+
+def _request_auth_token() -> str | None:
+    """Extract the credential portion of the current request's authorization header."""
+    if not has_request_context():
+        return None
+
+    authorization = request.headers.get("Authorization")
+    if authorization is None or " " not in authorization:
+        return None
+
+    return authorization.split(" ", maxsplit=1)[1]
+
+
 def get_action_queue(trigger: str) -> NamedQueue[TriggeredAction]:
     """Return the action queue for *trigger*, creating it on first use.
 
@@ -51,7 +71,7 @@ def get_action_queue(trigger: str) -> NamedQueue[TriggeredAction]:
     return _action_queues[trigger]
 
 
-def enqueue_action_execution(hit_ids: list[str], trigger: str = "create", user: Optional[User] = None) -> None:
+def enqueue_action_execution(hit_ids: str | list[str], trigger: str = "create", user: Optional[User] = None) -> None:
     """Buffer action execution by pushing to a Redis queue.
 
     When the action queue is disabled in configuration, falls back to
@@ -65,25 +85,44 @@ def enqueue_action_execution(hit_ids: list[str], trigger: str = "create", user:
     if not hit_ids:
         return
 
+    if not isinstance(hit_ids, list):
+        hit_ids = [hit_ids]
+
     if trigger not in VALID_TRIGGERS:
         raise HowlerValueError(f"Invalid trigger {trigger!r}. Must be one of {VALID_TRIGGERS}")
 
+    auth_token = _request_auth_token()
+
     if not config.system.action_queue.enabled:
+        logger.debug(
+            "Executing actions for trigger %s on hit id(s) [%s] with user %s",
+            trigger,
+            ", ".join(hit_ids),
+            user.uname if user else "NO_USER",
+        )
+
         query = f"howler.id:({' OR '.join(sanitize_lucene_query(h) for h in hit_ids)})"
-        bulk_execute_on_query(query, trigger=trigger, user=user)
+        bulk_execute_on_query(query, trigger=trigger, user=user, auth_token=auth_token)
         return
 
     try:
+        logger.debug(
+            "Enqueuing actions for trigger %s on hit id(s) [%s] with user %s",
+            trigger,
+            ", ".join(hit_ids),
+            user.uname if user else "NO_USER",
+        )
         get_action_queue(trigger).push(
             {
                 "hit_ids": hit_ids,
                 "uname": user.uname if user else None,
+                "auth_token": auth_service.encrypt_token(auth_token),
             }
         )
     except Exception:
         logger.exception("Failed to enqueue action execution, falling back to direct execution")
         query = f"howler.id:({' OR '.join(sanitize_lucene_query(h) for h in hit_ids)})"
-        bulk_execute_on_query(query, trigger=trigger, user=user)
+        bulk_execute_on_query(query, trigger=trigger, user=user, auth_token=auth_token)
 
 
 def process_action_batch(trigger: str, items: list[TriggeredAction]) -> None:
@@ -99,21 +138,26 @@ def process_action_batch(trigger: str, items: list[TriggeredAction]) -> None:
     if not items:
         return
 
-    groups: dict[str | None, list[str]] = defaultdict(list)
+    groups: dict[tuple[str | None, str | None], list[str]] = defaultdict(list)
 
     for item in items:
         uname = item.get("uname")
+        try:
+            auth_token = auth_service.decrypt_token(item.get("auth_token"))
+        except Exception:
+            logger.exception("Unable to decrypt queued authorization token for user=%s", uname)
+            auth_token = None
 
-        groups[uname].extend(item["hit_ids"])
+        groups[(uname, auth_token)].extend(item["hit_ids"])
 
-    for uname, hit_ids in groups.items():
+    for (uname, auth_token), hit_ids in groups.items():
         # Deduplicate IDs within a batch group
         unique_ids = list(dict.fromkeys(hit_ids))
         query = f"howler.id:({' OR '.join(sanitize_lucene_query(h) for h in unique_ids)})"
 
         try:
             user = datastore().user.get(uname)
-            bulk_execute_on_query(query, trigger=trigger, user=user)
+            bulk_execute_on_query(query, trigger=trigger, user=user, auth_token=auth_token)
         except Exception:
             logger.exception("Error processing action batch for trigger=%s user=%s", trigger, uname)
 
@@ -153,7 +197,9 @@ def validate_action(new_action: Any) -> Optional[Response]:  # noqa: C901
     return None
 
 
-def bulk_execute_on_query(query: str, trigger: str = "create", user: Optional[User] = None):
+def bulk_execute_on_query(
+    query: str, trigger: str = "create", user: Optional[User] = None, auth_token: str | None = None
+):
     """Execute the operations specified in registered actions on the given query"""
     storage = datastore()
 
@@ -195,6 +241,10 @@ def bulk_execute_on_query(query: str, trigger: str = "create", user: Optional[Us
             if not user:
                 raise NotImplementedError("Running actions without a user object is not currently supported")
 
+            if auth_token is not None and not _is_builtin_operation(operation.operation_id):
+                logger.debug("Appending auth token to external operation %s", operation.operation_id)
+                parsed_data["auth_token"] = auth_token
+
             report = actions.execute(
                 operation_id=operation.operation_id,
                 query=intersected_query,

{howler_api-4.1.0.dev1468 → howler_api-4.1.0.dev1502}/howler/services/auth_service.py

@@ -1,9 +1,12 @@
 import base64
 import hashlib
 import hmac
+import os
 from datetime import datetime
 from typing import Optional, Union
 
+import jwt
+from cryptography.hazmat.primitives.ciphers.aead import AESGCM
 from flask import request
 from opentelemetry import trace
 
@@ -22,7 +25,7 @@ from howler.odm.models.user import User
 from howler.remote.datatypes import retry_call
 from howler.remote.datatypes.queues.named import NamedQueue
 from howler.remote.datatypes.set import ExpiringSet
-from howler.security.utils import generate_random_secret, verify_password
+from howler.security.utils import encryption_key, generate_random_secret, verify_password
 
 logger = get_logger(__file__)
 tracer = trace.get_tracer(__name__)
@@ -39,6 +42,46 @@ _APIKEY_CACHE_TTL: int = 600  # 10 minutes
 # Derive the HMAC key from the configured secret
 _HMAC_KEY: bytes = hashlib.sha256(config.auth.hmac_secret_key.encode()).digest()
 
+_NON_JWT_TOKEN_PREFIX = "aesgcm:"  # noqa: S105
+_AES_GCM_NONCE_LENGTH = 12
+
+
+def _is_jwt(token: str) -> bool:
+    """Return whether *token* has the compact three-segment JWT format."""
+    if token.count(".") != 2:
+        return False
+
+    try:
+        return "alg" in jwt.get_unverified_header(token)
+    except jwt.InvalidTokenError:
+        return False
+
+
+def encrypt_token(token: str | None) -> str | None:
+    """Encrypt an authorization token before it is serialized into Redis."""
+    if token is None:
+        return None
+
+    if _is_jwt(token):
+        return jwt_service.encrypt_token(token)
+
+    nonce = os.urandom(_AES_GCM_NONCE_LENGTH)
+    ciphertext = AESGCM(encryption_key()).encrypt(nonce, token.encode("utf-8"), None)
+    return _NON_JWT_TOKEN_PREFIX + base64.urlsafe_b64encode(nonce + ciphertext).decode("ascii")
+
+
+def decrypt_token(encrypted_token: str | None) -> str | None:
+    """Decrypt a queued authorization token after reading it from Redis."""
+    if encrypted_token is None:
+        return None
+
+    if not encrypted_token.startswith(_NON_JWT_TOKEN_PREFIX):
+        return jwt_service.decrypt_token(encrypted_token)
+
+    payload = base64.urlsafe_b64decode(encrypted_token.removeprefix(_NON_JWT_TOKEN_PREFIX))
+    nonce, ciphertext = payload[:_AES_GCM_NONCE_LENGTH], payload[_AES_GCM_NONCE_LENGTH:]
+    return AESGCM(encryption_key()).decrypt(nonce, ciphertext, None).decode("utf-8")
+
 
 def _apikey_cache_key(username: str, key_name: str) -> str:
     """Build the Redis key that identifies a cached apikey verification.

{howler_api-4.1.0.dev1468 → howler_api-4.1.0.dev1502}/howler/services/correlation_service.py

@@ -345,7 +345,7 @@ def run_worker() -> None:  # pragma: no cover – long-running loop, tested via
             if item is not None:
                 batch.append(item)
 
-            if len(batch) % 10 == 0 or len(batch) >= BATCH_SIZE:
+            if len(batch) > 0 and (len(batch) % 10 == 0 or len(batch) >= BATCH_SIZE):
                 logger.info("Batch size: %s", len(batch))
 
             if len(batch) >= BATCH_SIZE or (item is None and batch):

{howler_api-4.1.0.dev1468 → howler_api-4.1.0.dev1502}/howler/services/hit_service.py

@@ -684,7 +684,7 @@ def transition_hit(
     workflow: Workflow = get_hit_workflow()
 
     # Log hit that will be transitioned
-    logger.debug("Transitioning (%s)", hit)
+    logger.debug("Transitioning hit %s with transition %s", hit["howler"]["id"], transition)
 
     # Process each hit (primary + children) with the workflow transition
     hit_status = hit["howler"]["status"]
@@ -727,7 +727,7 @@ def transition_hit(
         datastore().hit.commit()
 
         # Enqueue action execution for all hits
-        action_service.enqueue_action_execution([hit_id], trigger=trigger, user=user)
+        action_service.enqueue_action_execution(hit_id, trigger=trigger, user=user)
 
         # Emit events for processed hit to notify other systems
         updated_hit, new_version = datastore().hit.get(hit_id, as_obj=True, version=True)
@@ -736,6 +736,9 @@ def transition_hit(
         )
 
         updated_hit, new_version = datastore().hit.get(hit_id, as_obj=True, version=True)
+    else:
+        logger.debug("Transition %s does not require executing bulk actions", transition)
+
     return updated_hit, new_version
 
 

{howler_api-4.1.0.dev1468 → howler_api-4.1.0.dev1502}/howler/services/jwt_service.py

@@ -6,14 +6,35 @@ from typing import Any, Optional, cast
 
 import jwt
 import requests
+from authlib.jose import JsonWebEncryption
 from jwt.api_jwk import PyJWK
 
 from howler.common.exceptions import ForbiddenException, HowlerKeyError, HowlerValueError
 from howler.common.logging import get_logger
 from howler.config import cache, config
+from howler.security.utils import encryption_key
 
 logger = get_logger(__file__)
 
+_jwe = JsonWebEncryption()
+_JWE_HEADER = {"alg": "A256GCMKW", "enc": "A256GCM"}
+
+
+def encrypt_token(auth_token: str | None) -> str | None:
+    """Encrypt an authorization token before it is serialized into Redis."""
+    if auth_token is None:
+        return None
+
+    return _jwe.serialize_compact(_JWE_HEADER, auth_token.encode("utf-8"), encryption_key()).decode("ascii")
+
+
+def decrypt_token(encrypted_auth_token: str | None) -> str | None:
+    """Decrypt a queued authorization token for in-memory action execution."""
+    if encrypted_auth_token is None:
+        return None
+
+    return _jwe.deserialize_compact(encrypted_auth_token, encryption_key())["payload"].decode("utf-8")
+
 
 def get_jwk(access_token: str) -> PyJWK:
     """Get the JSON Web Key associated with the given JWT"""

{howler_api-4.1.0.dev1468 → howler_api-4.1.0.dev1502}/pyproject.toml

@@ -60,7 +60,7 @@ module = ["howler.odm.base", "test", "test.*"]
 ignore_errors = true
 
 [[tool.mypy.overrides]]
-module = "howler.security"
+module = "howler.security.login"
 disable_error_code = "attr-defined"
 
 [[tool.mypy.overrides]]
@@ -133,7 +133,7 @@ suppress-none-returning = true
 "build_scripts/*" = ["D", "ANN", "S", "N818", "T20", "TRY"]
 "howler/app.py" = ["E402"]
 "howler/odm/random*.py" = ["C901", "S105", "S311", "E402"]
-"howler/security/__init__.py" = ["TRY301"]
+"howler/security/login.py" = ["TRY301"]
 "howler/external/*.py" = ["T20"]
 "howler/odm/helper.py" = ["S311"]
 "howler/common/classification.py" = ["D", "ANN", "C901", "TRY"]
@@ -152,7 +152,7 @@ suppress-none-returning = true
 [tool.poetry]
 package-mode = true
 name = "howler-api"
-version = "4.1.0.dev1468"
+version = "4.1.0.dev1502"
 description = "Howler - API server"
 authors = [
     "Canadian Centre for Cyber Security <howler@cyber.gc.ca>",