synapse 2.161.0__py311-none-any.whl → 2.163.0__py311-none-any.whl

synapse/models/infotech.py

@@ -1143,10 +1143,11 @@ class ItModule(s_module.CoreModule):
                     ('url', ('inet:url', {}), {
                         'doc': 'The URL that documents the ATT&CK group.',
                     }),
+
                     ('tag', ('syn:tag', {}), {
-                        'doc': 'The synapse tag used to annotate nodes included in this ATT&CK group ID.',
-                        'ex': 'cno.mitre.g0100',
-                    }),
+                        'deprecated': True,
+                        'doc': 'Deprecated. Please use a risk:threat:tag.'}),
+
                     ('references', ('array', {'type': 'inet:url', 'uniq': True}), {
                         'doc': 'An array of URLs that document the ATT&CK group.',
                     }),
@@ -1171,12 +1172,12 @@ class ItModule(s_module.CoreModule):
                         'disp': {'hint': 'text'},
                     }),
                     ('url', ('inet:url', {}), {
-                        'doc': 'The URL that documents the ATT&CK tactic.',
-                    }),
+                        'doc': 'The URL that documents the ATT&CK tactic.'}),
+
                     ('tag', ('syn:tag', {}), {
-                        'doc': 'The synapse tag used to annotate nodes included in this ATT&CK tactic.',
-                        'ex': 'cno.mitre.ta0100',
-                    }),
+                        'deprecated': True,
+                        'doc': 'Deprecated.'}),
+
                     ('references', ('array', {'type': 'inet:url', 'uniq': True}), {
                         'doc': 'An array of URLs that document the ATT&CK tactic.',
                     }),
@@ -1199,12 +1200,12 @@ class ItModule(s_module.CoreModule):
                         'disp': {'hint': 'text'},
                     }),
                     ('url', ('inet:url', {}), {
-                        'doc': 'The URL that documents the ATT&CK technique.',
-                    }),
+                        'doc': 'The URL that documents the ATT&CK technique.'}),
+
                     ('tag', ('syn:tag', {}), {
-                        'doc': 'The synapse tag used to annotate nodes included in this ATT&CK technique.',
-                        'ex': 'cno.mitre.t0100',
-                    }),
+                        'deprecated': True,
+                        'doc': 'Deprecated. Please use ou:technique:tag.'}),
+
                     ('references', ('array', {'type': 'inet:url', 'uniq': True}), {
                         'doc': 'An array of URLs that document the ATT&CK technique.',
                     }),
@@ -1234,12 +1235,12 @@ class ItModule(s_module.CoreModule):
                         'doc': 'If deprecated, this field may contain the current value for the software.',
                     }),
                     ('url', ('inet:url', {}), {
-                        'doc': 'The URL that documents the ATT&CK software.',
-                    }),
+                        'doc': 'The URL that documents the ATT&CK software.'}),
+
                     ('tag', ('syn:tag', {}), {
-                        'doc': 'The synapse tag used to annotate nodes included in this ATT&CK software.',
-                        'ex': 'cno.mitre.s0100',
-                    }),
+                        'deprecated': True,
+                        'doc': 'Deprecated. Please use risk:tool:software:tag.'}),
+
                     ('references', ('array', {'type': 'inet:url', 'uniq': True}), {
                         'doc': 'An array of URLs that document the ATT&CK software.',
                     }),
@@ -1261,12 +1262,12 @@ class ItModule(s_module.CoreModule):
                         'disp': {'hint': 'text'},
                     }),
                     ('url', ('inet:url', {}), {
-                        'doc': 'The URL that documents the ATT&CK mitigation.',
-                    }),
+                        'doc': 'The URL that documents the ATT&CK mitigation.'}),
+
                     ('tag', ('syn:tag', {}), {
-                        'doc': 'The synapse tag used to annotate nodes included in this ATT&CK mitigation.',
-                        'ex': 'cno.mitre.m0100',
-                    }),
+                        'deprecated': True,
+                        'doc': 'Deprecated. Please use risk:mitigation:tag.'}),
+
                     ('references', ('array', {'type': 'inet:url', 'uniq': True}), {
                         'doc': 'An array of URLs that document the ATT&CK mitigation.',
                     }),
@@ -1314,10 +1315,11 @@ class ItModule(s_module.CoreModule):
                         'doc': 'The time that the campaign was created by Mitre.'}),
                     ('updated', ('time', {}), {
                         'doc': 'The time that the campaign was last updated by Mitre.'}),
+
                     ('tag', ('syn:tag', {}), {
-                        'doc': 'The synapse tag used to annotate nodes included in this ATT&CK campaign.',
-                        'ex': 'cno.mitre.c0028',
-                    }),
+                        'deprecated': True,
+                        'doc': 'Deprecated. Please use ou:campaign:tag.'}),
+
                 )),
                 ('it:mitre:attack:flow', {}, (
                     ('name', ('str', {}), {

synapse/models/orgs.py

@@ -346,6 +346,9 @@ class OuModule(s_module.CoreModule):
                     ('name', ('str', {}), {
                         'doc': 'The friendly name of the id number type.',
                     }),
+                    ('url', ('inet:url', {}), {
+                        'doc': 'The official URL of the issuer.',
+                    }),
                 )),
                 ('ou:id:number', {}, (
                     ('type', ('ou:id:type', {}), {

synapse/models/proj.py

@@ -52,8 +52,11 @@ class ProjectModule(s_module.CoreModule):
                         'doc': 'A collection of tickets related to a topic.',
                     }),
                     ('proj:ticket', ('guid', {}), {
-                        'doc': 'A ticket in a ticketing system.',
-                    }),
+                        'doc': 'A ticket in a ticketing system.'}),
+
+                    ('proj:project:type:taxonomy', ('taxonomy', {}), {
+                        'doc': 'A type taxonomy for projects.'}),
+
                     ('proj:sprint', ('guid', {}), {
                         'doc': 'A timeboxed period to complete a set amount of work.',
                     }),
@@ -70,11 +73,15 @@ class ProjectModule(s_module.CoreModule):
 
                 'forms': (
 
+                    ('proj:project:type:taxonomy', {}, {}),
                     ('proj:project', {}, (
 
                         ('name', ('str', {'lower': True, 'onespace': True}), {
                             'doc': 'The project name.'}),
 
+                        ('type', ('proj:project:type:taxonomy', {}), {
+                            'doc': 'The project type.'}),
+
                         ('desc', ('str', {}), {
                             'disp': {'hint': 'text'},
                             'doc': 'The project description.'}),

synapse/models/risk.py

@@ -23,6 +23,15 @@ class CvssV3(s_types.Str):
             mesg = exc.get('mesg')
             raise s_exc.BadTypeValu(name=self.name, valu=text, mesg=mesg) from None
 
+alertstatus = (
+    (0, 'new'),
+    (10, 'enrichment'),
+    (20, 'todo'),
+    (30, 'analysis'),
+    (40, 'remediation'),
+    (50, 'done'),
+)
+
 class RiskModule(s_module.CoreModule):
 
     def getModelDefs(self):
@@ -281,17 +290,31 @@ class RiskModule(s_module.CoreModule):
 
                 )),
                 ('risk:mitigation', {}, (
+
                     ('vuln', ('risk:vuln', {}), {
                         'doc': 'The vulnerability that this mitigation addresses.'}),
+
                     ('name', ('str', {}), {
                         'doc': 'A brief name for this risk mitigation.'}),
+
                     ('desc', ('str', {}), {
                         'disp': {'hint': 'text'},
                         'doc': 'A description of the mitigation approach for the vulnerability.'}),
+
                     ('software', ('it:prod:softver', {}), {
                         'doc': 'A software version which implements a fix for the vulnerability.'}),
+
                     ('hardware', ('it:prod:hardware', {}), {
                         'doc': 'A hardware version which implements a fix for the vulnerability.'}),
+
+                    ('reporter', ('ou:org', {}), {
+                        'doc': 'The organization reporting on the mitigation.'}),
+
+                    ('reporter:name', ('ou:name', {}), {
+                        'doc': 'The name of the organization reporting on the mitigation.'}),
+
+                    ('tag', ('syn:tag', {}), {
+                        'doc': 'The tag used to annotate nodes which have the mitigation in place.'}),
                 )),
                 ('risk:vulnname', {}, ()),
                 ('risk:vuln:type:taxonomy', {}, ()),
@@ -598,6 +621,9 @@ class RiskModule(s_module.CoreModule):
                         'disp': {'hint': 'text'},
                         'doc': 'A free-form description / overview of the alert.'}),
 
+                    ('status', ('int', {'enums': alertstatus}), {
+                        'doc': 'The status of the alert.'}),
+
                     ('benign', ('bool', {}), {
                         'doc': 'Set to true if the alert has been confirmed benign. Set to false if malicious.'}),
 
@@ -611,6 +637,12 @@ class RiskModule(s_module.CoreModule):
                         'ex': 'benign.false_positive',
                         'doc': 'A verdict about why the alert is malicious or benign, as a taxonomy entry.'}),
 
+                    ('assignee', ('syn:user', {}), {
+                        'doc': 'The Synapse user who is assigned to investigate the alert.'}),
+
+                    ('ext:assignee', ('ps:contact', {}), {
+                        'doc': 'The alert assignee contact information from an external system.'}),
+
                     ('engine', ('it:prod:softver', {}), {
                         'doc': 'The software that generated the alert.'}),
 

synapse/telepath.py

@@ -598,6 +598,7 @@ class Proxy(s_base.Base):
         self.tasks = {}
         self.shares = {}
 
+        self._ahainfo = {}
         self.sharinfo = {}
         self.methinfo = {}
 
@@ -902,6 +903,7 @@ class Proxy(s_base.Base):
             raise s_exc.LinkShutDown(mesg=mesg)
 
         self.sess = self.synack[1].get('sess')
+        self._ahainfo = self.synack[1].get('ahainfo', {})
         self.sharinfo = self.synack[1].get('sharinfo', {})
         self.methinfo = self.sharinfo.get('meths', {})
 

synapse/tests/files/rstorm/testsvc.py

@@ -8,10 +8,17 @@ class TestsvcApi(s_cell.CellApi, s_stormsvc.StormSvc):
         {
             'name': 'testsvc',
             'version': (0, 0, 1),
+            'onload': '''
+                $lib.time.sleep($lib.globals.get(onload_sleep, 0))
+                $lib.globals.set(testsvc, testsvc-done)
+            ''',
             'commands': (
                 {
                     'name': 'testsvc.test',
-                    'storm': '$lib.print($lib.service.get($cmdconf.svciden).test())',
+                    'storm': '''
+                        $lib.print($lib.service.get($cmdconf.svciden).test())
+                        $lib.print($lib.globals.get(testsvc))
+                    ''',
                 },
             )
         },

synapse/tests/files/stormpkg/testpkg.yaml

@@ -31,6 +31,10 @@ modules:
               type: dict
               desc: A status dictionary.
 
+onload: |
+  $lib.time.sleep($lib.globals.get(onload_sleep, 0))
+  $lib.globals.set(testpkg, testpkg-done)
+
 external_modules:
     - name: testext
       package: synapse.tests.files

synapse/tests/test_axon.py

@@ -985,10 +985,10 @@ bar baz",vv
 
             q = f'''
             $fields = $lib.list(
-                $lib.dict(name=file, sha256=$sha256, filename=file),
-                $lib.dict(name=zip_password, value=test),
-                $lib.dict(name=dict, value=$lib.dict(foo=bar)),
-                $lib.dict(name=bytes, value=$bytes)
+                ({{'name':'file', 'sha256':$sha256, 'filename':'file'}}),
+                ({{'name':'zip_password', 'value':'test'}}),
+                ({{'name':'dict', 'value':({{'foo':'bar'}}) }}),
+                ({{'name':'bytes', 'value':$bytes}})
             )
             $resp = $lib.inet.http.post("https://127.0.0.1:{port}/api/v1/pushfile",
                                         fields=$fields, ssl_verify=(0))

synapse/tests/test_cortex.py

@@ -4028,7 +4028,7 @@ class CortexBasicTest(s_t_utils.SynTest):
             self.len(1, nodes)
             self.eq('baz', nodes[0].ndef[1])
 
-            q = '$d = $lib.dict("field 1"=foo, "field 2"=bar) [test:str=$d.\'field 1\']'
+            q = '$d = ({"field 1": "foo", "field 2": "bar"}) [test:str=$d.\'field 1\']'
             nodes = await core.nodes(q)
             self.len(1, nodes)
             self.eq('foo', nodes[0].ndef[1])
@@ -4906,7 +4906,7 @@ class CortexBasicTest(s_t_utils.SynTest):
             pode = podes[0]
             self.true(s_node.tagged(pode, '#foo'))
 
-            nodes = await core.nodes('$d = $lib.dict(foo=bar) [test:str=yop +#$d.foo]')
+            nodes = await core.nodes('$d = ({"foo": "bar"}) [test:str=yop +#$d.foo]')
             self.len(1, nodes)
             self.nn(nodes[0].getTag('bar'))
 
@@ -4952,7 +4952,7 @@ class CortexBasicTest(s_t_utils.SynTest):
             pode = podes[0]
             self.true(s_node.tagged(pode, '#timetag'))
 
-            nodes = await core.nodes('$d = $lib.dict(foo="") [test:str=yop +?#$d.foo +#tag1]')
+            nodes = await core.nodes('$d = ({"foo": ""}) [test:str=yop +?#$d.foo +#tag1]')
             self.len(1, nodes)
             self.none(nodes[0].getTag('foo.*'))
             self.nn(nodes[0].getTag('tag1'))
@@ -4991,7 +4991,7 @@ class CortexBasicTest(s_t_utils.SynTest):
             self.eq([n.ndef[0] for n in nodes], [*['test:str', 'inet:ipv4'] * 3])
 
             # non-runsafe iteration over a dictionary
-            q = '''$dict=$lib.dict(key1=valu1, key2=valu2) [(test:str=test1) (test:str=test2)]
+            q = '''$dict=({"key1": "valu1", "key2": "valu2"}) [(test:str=test1) (test:str=test2)]
             for ($key, $valu) in $dict {
                 [:hehe=$valu]
             }
@@ -5004,14 +5004,14 @@ class CortexBasicTest(s_t_utils.SynTest):
                 self.eq(node.get('hehe'), 'valu2')
 
             # None values don't yield anything
-            q = '''$foo = $lib.dict()
+            q = '''$foo = ({})
             for $name in $foo.bar { [ test:str=$name ] }
             '''
             nodes = await core.nodes(q)
             self.len(0, nodes)
 
             # Even with a inbound node, zero loop iterations will not yield inbound nodes.
-            q = '''test:str=test1 $foo = $lib.dict()
+            q = '''test:str=test1 $foo = ({})
             for $name in $foo.bar { [ test:str=$name ] }
             '''
             nodes = await core.nodes(q)
@@ -6312,11 +6312,11 @@ class CortexBasicTest(s_t_utils.SynTest):
 
                     # Use dyncalls, not direct object access.
                     asdfhash_h = '2413fb3709b05939f04cf2e92f7d0897fc2596f9ad0b8a9ea855c7bfebaae892'
-                    size, sha2 = await core.callStorm('return( $lib.bytes.put($buf) )',
+                    size, sha2 = await core.callStorm('return( $lib.axon.put($buf) )',
                                                       {'vars': {'buf': b'asdfasdf'}})
                     self.eq(size, 8)
                     self.eq(sha2, asdfhash_h)
-                    self.true(await core.callStorm('return( $lib.bytes.has($hash) )',
+                    self.true(await core.callStorm('return( $lib.axon.has($hash) )',
                                                    {'vars': {'hash': asdfhash_h}}))
 
                 unset = False

synapse/tests/test_daemon.py

@@ -56,6 +56,25 @@ class DaemonTest(s_t_utils.SynTest):
                 async with await s_telepath.openurl(f'tcp://127.0.0.1:{port}/foo') as foo:
                     pass
 
+    async def test_dmon_ahainfo(self):
+
+        async with await s_daemon.Daemon.anit() as dmon:
+
+            host, port = await dmon.listen('tcp://127.0.0.1:0')
+            dmon.share('*', Foo())
+
+            async with await s_telepath.openurl(f'tcp://127.0.0.1:{port}') as proxy:
+                self.eq(proxy._ahainfo, {})
+
+        ahainfo = {'name': 'test.loop.vertex.link'}
+        async with await s_daemon.Daemon.anit(ahainfo=ahainfo) as dmon:
+
+            host, port = await dmon.listen('tcp://127.0.0.1:0')
+            dmon.share('*', Foo())
+
+            async with await s_telepath.openurl(f'tcp://127.0.0.1:{port}') as proxy:
+                self.eq(proxy._ahainfo, ahainfo)
+
 class SvcApi(s_cell.CellApi, s_stormsvc.StormSvc):
     _storm_svc_name = 'foo'
     _storm_svc_pkgs = (  # type:  ignore

synapse/tests/test_lib_ast.py

@@ -495,7 +495,7 @@ class AstTest(s_test.SynTest):
             self.none(await core.callStorm('$foo = $lib.null return($foo.bar.baz)'))
 
             q = '''
-            $d = $lib.dict(foo=bar, bar=baz, baz=biz)
+            $d = ({"foo": "bar", "bar": "baz", "baz": "biz"})
             for ($key, $val) in $d {
                 [ test:str=$d.$key ]
             }
@@ -506,7 +506,7 @@ class AstTest(s_test.SynTest):
             self.eq(set(['bar', 'baz', 'biz']), reprs)
 
             q = '''
-            $data = $lib.dict(foo=$lib.dict(bar=$lib.dict(woot=final)))
+            $data = ({"foo": ({"bar": ({"woot": "final"}) }) })
             $varkey=woot
             [ test:str=$data.foo.bar.$varkey ]
             '''
@@ -520,11 +520,11 @@ class AstTest(s_test.SynTest):
 
             $f = var
             $g = tar
-            $de = $lib.dict(car=$f, zar=$g)
-            $dd = $lib.dict(mar=$de)
-            $dc = $lib.dict(bar=$dd)
-            $db = $lib.dict(var=$dc)
-            $foo = $lib.dict(woot=$db)
+            $de = ({"car": $f, "zar": $g})
+            $dd = ({"mar": $de})
+            $dc = ({"bar": $dd})
+            $db = ({"var": $dc})
+            $foo = ({"woot": $db})
             [ test:str=$foo.woot.var.$bar.mar.$car ]
             '''
             nodes = await core.nodes(q)
@@ -532,7 +532,7 @@ class AstTest(s_test.SynTest):
             self.eq('var', nodes[0].repr())
 
             q = '''
-            $data = $lib.dict('vertex project'=foobar)
+            $data = ({'vertex project': 'foobar'})
             $"spaced key" = 'vertex project'
             [ test:str = $data.$"spaced key" ]
             '''
@@ -541,7 +541,7 @@ class AstTest(s_test.SynTest):
             self.eq('foobar', nodes[0].repr())
 
             q = '''
-            $data = $lib.dict('bar baz'=woot)
+            $data = ({'bar baz': "woot"})
             $'new key' = 'bar baz'
             [ test:str=$data.$'new key' ]
             '''
@@ -550,9 +550,9 @@ class AstTest(s_test.SynTest):
             self.eq('woot', nodes[0].repr())
 
             q = '''
-            $bottom = $lib.dict(lastkey=synapse)
-            $subdata = $lib.dict('bar baz'=$bottom)
-            $data = $lib.dict(vertex=$subdata)
+            $bottom = ({"lastkey": "synapse"})
+            $subdata = ({'bar baz': $bottom})
+            $data = ({"vertex": $subdata})
             $'new key' = 'bar baz'
             $'over key' = vertex
             [ test:str=$data.$'over key'.$"new key".lastkey ]
@@ -562,7 +562,7 @@ class AstTest(s_test.SynTest):
             self.eq('synapse', nodes[0].repr())
 
             q = '''
-            $data = $lib.dict(foo=bar)
+            $data = ({"foo": "bar"})
             $key = nope
             [ test:str=$data.$key ]
             '''
@@ -1850,7 +1850,7 @@ class AstTest(s_test.SynTest):
 
             q = '''
                 $x = asdf
-                $y = $lib.dict()
+                $y = ({})
 
                 $y.foo = bar
                 $y."baz faz" = hehe
@@ -1870,7 +1870,7 @@ class AstTest(s_test.SynTest):
             self.eq(nodes[5].ndef[1], 'qwer')
 
             # non-runtsafe test
-            q = '''$dict = $lib.dict()
+            q = '''$dict = ({})
             [(test:str=key1 :hehe=val1) (test:str=key2 :hehe=val2)]
             $key=$node.value()
             $dict.$key=:hehe
@@ -2754,7 +2754,7 @@ class AstTest(s_test.SynTest):
             opts = {'vars': {'asdf': b'asdf'}}
             await core.nodes('[ file:bytes=$asdf ]', opts=opts)
             await core.axon.put(b'asdf')
-            self.len(1, await core.nodes('file:bytes +$lib.bytes.has(:sha256)'))
+            self.len(1, await core.nodes('file:bytes +$lib.axon.has(:sha256)'))
 
     async def test_ast_walkcond(self):
 
@@ -2822,7 +2822,7 @@ class AstTest(s_test.SynTest):
             mesgs = await core.stormlist(q, opts={'vars': {'ret': 'foo'}})
             self.stormIsInErr('Cannot find name [squeeeeeee]', mesgs)
 
-            q = '$ret=$lib.dict(bar=$ret)'
+            q = '$ret=({"bar": $ret})'
             mesgs = await core.stormlist(q)
             self.stormIsInErr('Missing variable: ret', mesgs)
 

synapse/tests/test_lib_grammar.py

@@ -119,7 +119,7 @@ Queries = [
     '#test.bar -#test <+- *',
     '#test.bar -#test <- *',
     '$bar=5.5.5.5 [ inet:ipv4=$bar ]',
-    '$blah = $lib.dict(foo=vertex.link) [ inet:fqdn=$blah.foo ]',
+    '$blah = ({"foo": "vertex.link"}) [ inet:fqdn=$blah.foo ]',
     '($tick, $tock) = .seen',
     '.created',
     '.created<2010',
@@ -585,7 +585,7 @@ Queries = [
     ''' [(ou:org=c71cd602f73af5bed208da21012fdf54 :loc=us )]''',
     'function x(y, z) { return ($( $x - $y ) ) }',
     'function echo(arg, arg2=default) { return ($arg) }',
-    '$name = asdf $foo = $lib.dict() $foo.bar = asdf $foo."bar baz" = asdf $foo.$name = asdf',
+    '$name = asdf $foo = ({}) $foo.bar = asdf $foo."bar baz" = asdf $foo.$name = asdf',
     '[test:str=a] switch $node.form() { hehe: {[+#baz]} }',
     '[test:str=a] switch $woot { hehe: {[+#baz]} }',
     '[test:str=c] switch $woot { hehe: {[+#baz]} *: {[+#jaz]} }',
@@ -830,7 +830,7 @@ _ParseResults = [
     'Query: [LiftTag: [TagName: [Const: test, Const: bar]], FiltOper: [Const: -, TagCond: [TagMatch: [Const: test]]], PivotIn: [], isjoin=True]',
     'Query: [LiftTag: [TagName: [Const: test, Const: bar]], FiltOper: [Const: -, TagCond: [TagMatch: [Const: test]]], PivotIn: [], isjoin=False]',
     'Query: [SetVarOper: [Const: bar, Const: 5.5.5.5], EditNodeAdd: [FormName: [Const: inet:ipv4], Const: =, VarValue: [Const: bar]]]',
-    'Query: [SetVarOper: [Const: blah, FuncCall: [VarDeref: [VarValue: [Const: lib], Const: dict], CallArgs: [], CallKwargs: [CallKwarg: [Const: foo, Const: vertex.link]]]], EditNodeAdd: [FormName: [Const: inet:fqdn], Const: =, VarDeref: [VarValue: [Const: blah], Const: foo]]]',
+    'Query: [SetVarOper: [Const: blah, DollarExpr: [ExprDict: [Const: foo, Const: vertex.link]]], EditNodeAdd: [FormName: [Const: inet:fqdn], Const: =, VarDeref: [VarValue: [Const: blah], Const: foo]]]',
     "Query: [VarListSetOper: [VarList: ['tick', 'tock'], UnivPropValue: [UnivProp: [Const: .seen]]]]",
     'Query: [LiftProp: [Const: .created]]',
     'Query: [LiftPropBy: [Const: .created, Const: <, Const: 2010]]',
@@ -1241,7 +1241,7 @@ _ParseResults = [
     'Query: [EditParens: [EditNodeAdd: [FormName: [Const: ou:org], Const: =, Const: c71cd602f73af5bed208da21012fdf54], EditPropSet: [RelProp: [Const: loc], Const: =, Const: us]]]',
     'Query: [Function: [Const: x, FuncArgs: [Const: y, Const: z], Query: [Return: [DollarExpr: [ExprNode: [VarValue: [Const: x], Const: -, VarValue: [Const: y]]]]]]]',
     'Query: [Function: [Const: echo, FuncArgs: [Const: arg, CallKwarg: [Const: arg2, Const: default]], Query: [Return: [VarValue: [Const: arg]]]]]',
-    'Query: [SetVarOper: [Const: name, Const: asdf], SetVarOper: [Const: foo, FuncCall: [VarDeref: [VarValue: [Const: lib], Const: dict], CallArgs: [], CallKwargs: []]], SetItemOper: [VarValue: [Const: foo], Const: bar, Const: asdf], SetItemOper: [VarValue: [Const: foo], Const: bar baz, Const: asdf], SetItemOper: [VarValue: [Const: foo], VarValue: [Const: name], Const: asdf]]',
+    'Query: [SetVarOper: [Const: name, Const: asdf], SetVarOper: [Const: foo, DollarExpr: [ExprDict: []]], SetItemOper: [VarValue: [Const: foo], Const: bar, Const: asdf], SetItemOper: [VarValue: [Const: foo], Const: bar baz, Const: asdf], SetItemOper: [VarValue: [Const: foo], VarValue: [Const: name], Const: asdf]]',
     'Query: [EditNodeAdd: [FormName: [Const: test:str], Const: =, Const: a], SwitchCase: [FuncCall: [VarDeref: [VarValue: [Const: node], Const: form], CallArgs: [], CallKwargs: []], CaseEntry: [Const: hehe, SubQuery: [Query: [EditTagAdd: [TagName: [Const: baz]]]]]]]',
     'Query: [EditNodeAdd: [FormName: [Const: test:str], Const: =, Const: a], SwitchCase: [VarValue: [Const: woot], CaseEntry: [Const: hehe, SubQuery: [Query: [EditTagAdd: [TagName: [Const: baz]]]]]]]',
     'Query: [EditNodeAdd: [FormName: [Const: test:str], Const: =, Const: c], SwitchCase: [VarValue: [Const: woot], CaseEntry: [Const: hehe, SubQuery: [Query: [EditTagAdd: [TagName: [Const: baz]]]]], CaseEntry: [SubQuery: [Query: [EditTagAdd: [TagName: [Const: jaz]]]]]]]',

synapse/tests/test_lib_rstorm.py

@@ -21,7 +21,7 @@ HI
 .. storm-pre:: [ inet:ipv6=0 ]
 .. storm-pkg:: synapse/tests/files/stormpkg/testpkg.yaml
 .. storm:: --hide-props testpkgcmd foo
-.. storm:: --hide-query $lib.print(secret)
+.. storm:: --hide-query $lib.print(secret) $lib.print($lib.globals.get(testpkg))
 .. storm:: --hide-query file:bytes
 .. storm-svc:: synapse.tests.files.rstorm.testsvc.Testsvc test {"secret": "jupiter"}
 .. storm:: testsvc.test
@@ -44,6 +44,7 @@ HI
 ::
 
     secret
+    testpkg-done
 
 ::
 
@@ -53,6 +54,7 @@ HI
 
     > testsvc.test
     jupiter
+    testsvc-done
 
 '''
 
@@ -259,6 +261,17 @@ HI
 .. storm-cortex:: path.to.NewpCell
 '''
 
+pkg_onload_timeout = '''
+.. storm-cortex:: default
+.. storm-pre:: $lib.globals.set(onload_sleep, 2)
+.. storm-pkg:: synapse/tests/files/stormpkg/testpkg.yaml
+'''
+
+svc_onload_timeout = '''
+.. storm-cortex:: default
+.. storm-pre:: $lib.globals.set(onload_sleep, 2)
+.. storm-svc:: synapse.tests.files.rstorm.testsvc.Testsvc test {"secret": "jupiter"}
+'''
 
 async def get_rst_text(rstfile):
     async with await s_rstorm.StormRst.anit(rstfile) as rstorm:
@@ -339,7 +352,7 @@ class RStormLibTest(s_test.SynTest):
             self.isin('inet:ipv4=5.6.7.8', text)  # one mock at a time
             self.isin('it:dev:str=notjson', text)  # one mock at a time
 
-            # multi reqest in 1 rstorm command
+            # multi request in 1 rstorm command
             path = s_common.genpath(dirn, 'http_multi.rst')
             with s_common.genfile(path) as fd:
                 fd.write(multi_rst_in_http.encode())
@@ -496,6 +509,29 @@ class RStormLibTest(s_test.SynTest):
             with self.raises(s_exc.NoSuchCtor):
                 await get_rst_text(path)
 
+            # onload failures
+
+            try:
+                oldv = s_rstorm.ONLOAD_TIMEOUT
+                s_rstorm.ONLOAD_TIMEOUT = 0.1
+
+                path = s_common.genpath(dirn, 'pkg_onload_timeout.rst')
+                with s_common.genfile(path) as fd:
+                    fd.write(pkg_onload_timeout.encode())
+                with self.raises(s_exc.SynErr) as ectx:
+                    await get_rst_text(path)
+                self.eq('Package onload failed to run for testpkg', ectx.exception.errinfo['mesg'])
+
+                path = s_common.genpath(dirn, 'svc_onload_timeout.rst')
+                with s_common.genfile(path) as fd:
+                    fd.write(svc_onload_timeout.encode())
+                with self.raises(s_exc.SynErr) as ectx:
+                    await get_rst_text(path)
+                self.eq('Package onload failed to run for service test', ectx.exception.errinfo['mesg'])
+
+            finally:
+                s_rstorm.ONLOAD_TIMEOUT = oldv
+
     async def test_rstorm_cli(self):
 
         with self.getTestDir() as dirn: