voidaccess 1.6.3__tar.gz → 1.7.1__tar.gz

{voidaccess-1.6.3/voidaccess.egg-info → voidaccess-1.7.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: voidaccess
-Version: 1.6.3
+Version: 1.7.1
 Summary: Dark web OSINT CLI — automated threat intelligence from query to report
 Author: VoidAccess
 License-Expression: MIT
@@ -20,10 +20,16 @@ Requires-Dist: typer>=0.12
 Requires-Dist: rich>=13
 Requires-Dist: textual>=0.60
 Requires-Dist: click>=8.0
+Requires-Dist: fastapi>=0.115
 Requires-Dist: aiohttp>=3.9
 Requires-Dist: aiohttp-socks>=0.8
+Requires-Dist: alembic>=1.13
+Requires-Dist: apscheduler>=3.10
+Requires-Dist: pillow>=10.0
 Requires-Dist: sqlalchemy>=2.0
 Requires-Dist: aiosqlite>=0.20
+Requires-Dist: filelock>=3.14
+Requires-Dist: numpy>=1.26
 Requires-Dist: langchain>=0.2
 Requires-Dist: langchain-openai>=0.1
 Requires-Dist: langchain-anthropic>=0.1
@@ -35,7 +41,19 @@ Requires-Dist: httpx>=0.27
 Requires-Dist: spacy>=3.7
 Requires-Dist: beautifulsoup4>=4.12
 Requires-Dist: feedparser>=6.0
+Requires-Dist: networkx>=3.0
+Requires-Dist: pydantic>=2.7
+Requires-Dist: python-jose[cryptography]>=3.3
+Requires-Dist: passlib[bcrypt]>=1.7
+Requires-Dist: slowapi>=0.1.9
+Requires-Dist: redis>=5.0
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: openai>=1.30
+Requires-Dist: cryptography>=42.0
 Requires-Dist: python-dateutil>=2.9
+Requires-Dist: langdetect>=1.0
+Requires-Dist: pyvis>=0.3
+Requires-Dist: urllib3>=2.2
 Requires-Dist: trafilatura>=1.6
 Requires-Dist: requests>=2.31
 Requires-Dist: python-socks>=2.4
@@ -44,6 +62,25 @@ Requires-Dist: stix2>=3.0.2
 Provides-Extra: dev
 Requires-Dist: pytest; extra == "dev"
 Requires-Dist: pytest-asyncio; extra == "dev"
+Provides-Extra: nlp
+Requires-Dist: sentence-transformers>=3.0; extra == "nlp"
+Requires-Dist: torch>=2.3; extra == "nlp"
+Requires-Dist: transformers>=4.42; extra == "nlp"
+Provides-Extra: vector
+Requires-Dist: chromadb>=0.5; extra == "vector"
+Requires-Dist: sentence-transformers>=3.0; extra == "vector"
+Requires-Dist: torch>=2.3; extra == "vector"
+Provides-Extra: telegram
+Requires-Dist: telethon>=1.36; extra == "telegram"
+Provides-Extra: js
+Requires-Dist: playwright>=1.45; extra == "js"
+Provides-Extra: all
+Requires-Dist: chromadb>=0.5; extra == "all"
+Requires-Dist: playwright>=1.45; extra == "all"
+Requires-Dist: sentence-transformers>=3.0; extra == "all"
+Requires-Dist: telethon>=1.36; extra == "all"
+Requires-Dist: torch>=2.3; extra == "all"
+Requires-Dist: transformers>=4.42; extra == "all"
 Dynamic: license-file
 
 <div align="center">
@@ -67,9 +104,17 @@ Commercial threat intelligence platforms often charge prohibitive annual fees fo
 
 ---
 
-## What's New in v1.6.3
+## What's New in v1.7.1
+- STIX export now produces real bundles with entities and relationships again.
+- Entity extraction on CVE/financial queries now returns the expected entity mix instead of collapsing to organization-name noise.
+- Confidence scores now show multi-value spread that reflects source quality, extraction method, and corroboration.
+- Entity readback now includes rows linked through `InvestigationEntityLink` and dedupes canonical collisions correctly.
 
-- **Release candidate alignment** — release metadata, package metadata, and docs now all report `v1.6.3`.
+---
+
+## What's New in the Previous Release
+
+- **Dependency optional-extras split** — `sentence-transformers`, `torch`, `transformers`, `telethon`, and `playwright` are now optional extras: `voidaccess[nlp]`, `voidaccess[telegram]`, `voidaccess[js]`, and `voidaccess[all]`.
 - **Optional clearnet ScrapingAnt integration** — paste sites and RSS feeds can now be routed through ScrapingAnt. Affects clearnet scraping only; Tor, `.onion`, GitHub, and GitLab traffic are never affected.
 - **Three independent products** — Web Scraping API, Residential Proxy transport, and Datacenter Proxy transport are documented separately so the API key is not conflated with the proxy credentials.
 - **One-shot CLI flags** — `voidaccess investigate --use-scraping-api` and `voidaccess investigate --use-proxies` select the REST API or proxy transport for a single run.
@@ -79,7 +124,7 @@ Commercial threat intelligence platforms often charge prohibitive annual fees fo
 
 ---
 
-## What's New in v1.6.3
+## What's New in v1.6.4
 
 - 37 new entity types across crypto, credentials, messaging, and network/forensic indicators.
 - YARA, Snort, Suricata, and IOC package ZIP exports.
@@ -273,7 +318,7 @@ Export formats:
 
 ## Actor Intelligence
 
-VoidAccess v1.6.3 persists actor profiles across investigations in `actor_profiles`, with linked aliases and infrastructure in `actor_aliases` and `actor_infrastructure`. Profiles are populated from threat actor, ransomware group, and handle entities, then enriched with co-occurring infrastructure and timeline events.
+VoidAccess v1.7.1 persists actor profiles across investigations in `actor_profiles`, with linked aliases and infrastructure in `actor_aliases` and `actor_infrastructure`. Profiles are populated from threat actor, ransomware group, and handle entities, then enriched with co-occurring infrastructure and timeline events.
 
 Cross-alias resolution scores five signals: shared infrastructure, shared PGP, string similarity, temporal co-activity, and co-investigation. Use `voidaccess actors` to list profiles, `voidaccess actor <handle>` for the full profile, `voidaccess actor <handle> --timeline` for chronology, and `voidaccess actor <handle> --note "text"` for analyst notes.
 
@@ -541,5 +586,3 @@ To report a security vulnerability, see [docs/SECURITY.md](docs/SECURITY.md).
 MIT License. See [LICENSE](LICENSE) for details.
 
 
-
-

{voidaccess-1.6.3 → voidaccess-1.7.1}/README.md

@@ -19,9 +19,17 @@ Commercial threat intelligence platforms often charge prohibitive annual fees fo
 
 ---
 
-## What's New in v1.6.3
+## What's New in v1.7.1
+- STIX export now produces real bundles with entities and relationships again.
+- Entity extraction on CVE/financial queries now returns the expected entity mix instead of collapsing to organization-name noise.
+- Confidence scores now show multi-value spread that reflects source quality, extraction method, and corroboration.
+- Entity readback now includes rows linked through `InvestigationEntityLink` and dedupes canonical collisions correctly.
 
-- **Release candidate alignment** — release metadata, package metadata, and docs now all report `v1.6.3`.
+---
+
+## What's New in the Previous Release
+
+- **Dependency optional-extras split** — `sentence-transformers`, `torch`, `transformers`, `telethon`, and `playwright` are now optional extras: `voidaccess[nlp]`, `voidaccess[telegram]`, `voidaccess[js]`, and `voidaccess[all]`.
 - **Optional clearnet ScrapingAnt integration** — paste sites and RSS feeds can now be routed through ScrapingAnt. Affects clearnet scraping only; Tor, `.onion`, GitHub, and GitLab traffic are never affected.
 - **Three independent products** — Web Scraping API, Residential Proxy transport, and Datacenter Proxy transport are documented separately so the API key is not conflated with the proxy credentials.
 - **One-shot CLI flags** — `voidaccess investigate --use-scraping-api` and `voidaccess investigate --use-proxies` select the REST API or proxy transport for a single run.
@@ -31,7 +39,7 @@ Commercial threat intelligence platforms often charge prohibitive annual fees fo
 
 ---
 
-## What's New in v1.6.3
+## What's New in v1.6.4
 
 - 37 new entity types across crypto, credentials, messaging, and network/forensic indicators.
 - YARA, Snort, Suricata, and IOC package ZIP exports.
@@ -225,7 +233,7 @@ Export formats:
 
 ## Actor Intelligence
 
-VoidAccess v1.6.3 persists actor profiles across investigations in `actor_profiles`, with linked aliases and infrastructure in `actor_aliases` and `actor_infrastructure`. Profiles are populated from threat actor, ransomware group, and handle entities, then enriched with co-occurring infrastructure and timeline events.
+VoidAccess v1.7.1 persists actor profiles across investigations in `actor_profiles`, with linked aliases and infrastructure in `actor_aliases` and `actor_infrastructure`. Profiles are populated from threat actor, ransomware group, and handle entities, then enriched with co-occurring infrastructure and timeline events.
 
 Cross-alias resolution scores five signals: shared infrastructure, shared PGP, string similarity, temporal co-activity, and co-investigation. Use `voidaccess actors` to list profiles, `voidaccess actor <handle>` for the full profile, `voidaccess actor <handle> --timeline` for chronology, and `voidaccess actor <handle> --note "text"` for analyst notes.
 
@@ -491,7 +499,5 @@ To report a security vulnerability, see [docs/SECURITY.md](docs/SECURITY.md).
 ## License
 
 MIT License. See [LICENSE](LICENSE) for details.
-
-
-
-
+
+

{voidaccess-1.6.3 → voidaccess-1.7.1}/api/routes/actors.py

@@ -17,6 +17,7 @@ from __future__ import annotations
 
 import logging
 import os
+import uuid
 from typing import Optional
 
 from fastapi import APIRouter, Depends, HTTPException, Query
@@ -99,7 +100,7 @@ def _user_owned_investigation_ids_subq(session, user_id: int):
 
 def _profile_accessible(session, profile_id: str, user_id: int) -> bool:
     """True when at least one investigation linked to the profile is owned by the user."""
-    from db.models import ActorAlias, ActorInfrastructure, Investigation
+    from db.models import ActorAlias, ActorInfrastructure
 
     inv_ids_subq = _user_owned_investigation_ids_subq(session, user_id)
     alias_match = (
@@ -151,7 +152,6 @@ async def list_actors(
         ActorProfile,
         ActorAlias,
         ActorInfrastructure,
-        Investigation,
     )
 
     try:
@@ -258,6 +258,35 @@ async def get_actor(
     return profile
 
 
+@router.get("/{node_id}/profile")
+async def get_actor_profile_by_node(
+    node_id: str,
+    investigation_id: str = Query(..., description="Investigation ID"),
+    current_user: CurrentUser = Depends(get_current_user),
+) -> dict:
+    """Return the graph actor profile for a node inside one investigation."""
+    _db_required()
+    try:
+        inv_uuid = uuid.UUID(investigation_id)
+    except ValueError:
+        raise HTTPException(status_code=422, detail="Invalid investigation ID format")
+    from db.queries import get_investigation_by_id_or_run
+    from graph import build_graph_from_db_cached, get_actor_profile
+
+    with _session() as session:
+        inv = get_investigation_by_id_or_run(session, inv_uuid)
+        if inv is None:
+            raise HTTPException(status_code=404, detail="Investigation not found")
+        if str(inv.user_id) != str(current_user.user.id):
+            raise HTTPException(status_code=403, detail="Forbidden")
+        graph = build_graph_from_db_cached(investigation_id=inv.id)
+
+    profile = get_actor_profile(graph, node_id)
+    if not profile:
+        raise HTTPException(status_code=404, detail="Graph node not found")
+    return profile
+
+
 @router.get("/{handle}/investigations")
 async def get_actor_investigations(
     handle: str,
@@ -732,4 +761,4 @@ def uuid_value(s):
         import uuid as _uuid
         return _uuid.UUID(str(s))
     except (ValueError, TypeError):
-        return None
+        return None