psengine 2.4.1__tar.gz → 2.4.2__tar.gz

{psengine-2.4.1 → psengine-2.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: psengine
-Version: 2.4.1
+Version: 2.4.2
 Summary: psengine is a simple, yet elegant, library for rapid development of integrations with Recorded Future.
 Author-email: Moise Medici <moise.medici@recordedfuture.com>, Patrick Kinsella <patrick.kinsella@recordedfuture.com>, Ernest Bartosevic <ernest.bartosevic@recordedfuture.com>
 License-Expression: MIT

{psengine-2.4.1 → psengine-2.4.2}/psengine/constants.py

@@ -23,7 +23,7 @@ DEFAULT_MAX_WORKERS = 10
 # Recorded Future API
 #####################
 RF_TOKEN_ENV_VAR = 'RF_TOKEN'  # noqa: S105
-RF_TOKEN_VALIDATION_REGEX = r'^[a-f0-9]{32}$'  # noqa: S105
+RF_TOKEN_VALIDATION_REGEX = r'^[a-z0-9]{32}$'  # noqa: S105
 
 #####################
 # Recorded Future Portal

{psengine-2.4.1 → psengine-2.4.2}/psengine/detection/detection_mgr.py

@@ -93,7 +93,7 @@ class DetectionMgr:
         data = {
             'filter': filters,
             'tagged_entities': tagged_entities,
-            'limit': SEARCH_LIMIT,
+            'limit': min(SEARCH_LIMIT, max_results) if max_results else SEARCH_LIMIT,
         }
 
         data = DetectionRuleSearchOut.model_validate(data)

{psengine-2.4.1 → psengine-2.4.2}/psengine/malware_intel/malware_intel.py

@@ -89,6 +89,8 @@ class SandboxReport(RFBaseModel):
 
 
 def _split_time(value: str):
+    if not value:
+        return value
     return value.split('T')[0]
 
 
@@ -101,7 +103,9 @@ class MalwareReportIn(RFBaseModel):
         str, BeforeValidator(Validators.convert_relative_time), AfterValidator(_split_time)
     ]
     end_date: Annotated[
-        str, BeforeValidator(Validators.convert_relative_time), AfterValidator(_split_time)
+        Optional[str],
+        BeforeValidator(Validators.convert_relative_time),
+        AfterValidator(_split_time),
     ]
     my_enterprise: bool
     limit: int = Field(ge=1, le=10)

{psengine-2.4.1 → psengine-2.4.2}/psengine/malware_intel/malware_intel_mgr.py

@@ -12,7 +12,7 @@
 ##############################################################################################
 
 import logging
-from typing import Annotated
+from typing import Annotated, Optional
 
 from pydantic import validate_call
 from typing_extensions import Doc
@@ -48,7 +48,9 @@ class MalwareIntelMgr:
         start_date: Annotated[
             str, Doc('The starting date, format YYYY-MM-DD or relative like -1d.')
         ],
-        end_date: Annotated[str, Doc('The ending date, format YYYY-MM-DD or relative like -1d.')],
+        end_date: Annotated[
+            Optional[str], Doc('The ending date, format YYYY-MM-DD or relative like -1d.')
+        ] = None,
         my_enterprise: Annotated[
             bool, Doc('If the report has been submitted by your enterprise.')
         ] = False,

{psengine-2.4.1 → psengine-2.4.2}/psengine/playbook_alerts/playbook_alert_mgr.py

@@ -141,9 +141,9 @@ class PlaybookAlertMgr:
         alerts_per_page: Annotated[
             Optional[int], Doc('Number of alerts per page (pagination).')
         ] = Field(ge=1, le=10000, default=ALERTS_PER_PAGE),
-        max_results: Annotated[
-            Optional[int], Doc('Maximum number of alerts to fetch.')
-        ] = DEFAULT_LIMIT,
+        max_results: Annotated[Optional[int], Doc('Maximum number of alerts to fetch.')] = Field(
+            ge=1, le=10_000, default=DEFAULT_LIMIT
+        ),
         order_by: Annotated[
             Optional[str], Doc('Field to order alerts by, e.g. `created` or `updated`.')
         ] = None,
@@ -229,7 +229,7 @@ class PlaybookAlertMgr:
         ),
         max_results: Annotated[
             Optional[int], Doc('Maximum total number of alerts to fetch.')
-        ] = DEFAULT_LIMIT,
+        ] = Field(ge=1, le=10_000, default=DEFAULT_LIMIT),
         order_by: Annotated[
             Optional[str], Doc('Field to order alerts by, e.g. `created` or `updated`.')
         ] = None,
@@ -286,7 +286,7 @@ class PlaybookAlertMgr:
             data=request_body,
             max_results=max_results,
             results_path='data',
-            offset_key='from',
+            offset_key='offset',
         )
 
         # To avoid a breaking change have to reconstruct the SearchResponse model manually

{psengine-2.4.1 → psengine-2.4.2}/psengine/rf_client.py

@@ -184,8 +184,13 @@ class RFClient(BaseHTTPClient):
         **kwargs,
     ):
         if 'next_offset' in json_response:
+            current_len = 0
             while 'next_offset' in json_response:
                 data[offset_key] = json_response['next_offset']
+                data['limit'] = min(data['limit'], max_results - current_len)
+                if data['limit'] <= 0:
+                    break
+
                 json_response = self.request(
                     method=method,
                     url=url,
@@ -202,11 +207,15 @@ class RFClient(BaseHTTPClient):
                     if any(len(v) >= max_results for v in dict_results.values()):
                         dict_results = {k: v[:max_results] for k, v in dict_results.items()}
                         break
+                    current_len = max(len(v) for v in dict_results.values())
+
                 else:
                     all_results += self._get_matches(results_expr, json_response)
-                    if len(all_results) >= max_results:
+                    current_len = len(all_results)
+                    if current_len >= max_results:
                         all_results = all_results[:max_results]
                         break
+
         else:
             seen = json_response['counts']['returned']
             if json_response['counts']['total'] > max_results:
@@ -324,6 +333,9 @@ class RFClient(BaseHTTPClient):
                 with suppress(KeyError):
                     dict_results[str(expr)].extend(self._get_matches(expr, json_response))
 
+        if len(all_results) >= max_results:
+            return all_results[:max_results]
+
         if method.lower() == 'get':
             return self._request_paged_get(
                 url=url,
@@ -340,6 +352,8 @@ class RFClient(BaseHTTPClient):
             )
 
         if method.lower() == 'post':
+            data['limit'] = min(data['limit'], max_results - len(all_results))
+
             return self._request_paged_post(
                 url=url,
                 method=method,

{psengine-2.4.1 → psengine-2.4.2}/psengine.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: psengine
-Version: 2.4.1
+Version: 2.4.2
 Summary: psengine is a simple, yet elegant, library for rapid development of integrations with Recorded Future.
 Author-email: Moise Medici <moise.medici@recordedfuture.com>, Patrick Kinsella <patrick.kinsella@recordedfuture.com>, Ernest Bartosevic <ernest.bartosevic@recordedfuture.com>
 License-Expression: MIT

{psengine-2.4.1 → psengine-2.4.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "psengine"
-version = "2.4.1"
+version = "2.4.2"
 readme = "README.md"
 license = "MIT"
 requires-python = ">=3.9, <3.14"