voidaccess 1.7.0__tar.gz → 1.7.1__tar.gz

{voidaccess-1.7.0/voidaccess.egg-info → voidaccess-1.7.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: voidaccess
-Version: 1.7.0
+Version: 1.7.1
 Summary: Dark web OSINT CLI — automated threat intelligence from query to report
 Author: VoidAccess
 License-Expression: MIT
@@ -104,7 +104,15 @@ Commercial threat intelligence platforms often charge prohibitive annual fees fo
 
 ---
 
-## What's New in v1.7.0
+## What's New in v1.7.1
+- STIX export now produces real bundles with entities and relationships again.
+- Entity extraction on CVE/financial queries now returns the expected entity mix instead of collapsing to organization-name noise.
+- Confidence scores now show multi-value spread that reflects source quality, extraction method, and corroboration.
+- Entity readback now includes rows linked through `InvestigationEntityLink` and dedupes canonical collisions correctly.
+
+---
+
+## What's New in the Previous Release
 
 - **Dependency optional-extras split** — `sentence-transformers`, `torch`, `transformers`, `telethon`, and `playwright` are now optional extras: `voidaccess[nlp]`, `voidaccess[telegram]`, `voidaccess[js]`, and `voidaccess[all]`.
 - **Optional clearnet ScrapingAnt integration** — paste sites and RSS feeds can now be routed through ScrapingAnt. Affects clearnet scraping only; Tor, `.onion`, GitHub, and GitLab traffic are never affected.
@@ -310,7 +318,7 @@ Export formats:
 
 ## Actor Intelligence
 
-VoidAccess v1.7.0 persists actor profiles across investigations in `actor_profiles`, with linked aliases and infrastructure in `actor_aliases` and `actor_infrastructure`. Profiles are populated from threat actor, ransomware group, and handle entities, then enriched with co-occurring infrastructure and timeline events.
+VoidAccess v1.7.1 persists actor profiles across investigations in `actor_profiles`, with linked aliases and infrastructure in `actor_aliases` and `actor_infrastructure`. Profiles are populated from threat actor, ransomware group, and handle entities, then enriched with co-occurring infrastructure and timeline events.
 
 Cross-alias resolution scores five signals: shared infrastructure, shared PGP, string similarity, temporal co-activity, and co-investigation. Use `voidaccess actors` to list profiles, `voidaccess actor <handle>` for the full profile, `voidaccess actor <handle> --timeline` for chronology, and `voidaccess actor <handle> --note "text"` for analyst notes.
 
@@ -578,5 +586,3 @@ To report a security vulnerability, see [docs/SECURITY.md](docs/SECURITY.md).
 MIT License. See [LICENSE](LICENSE) for details.
 
 
-
-

{voidaccess-1.7.0 → voidaccess-1.7.1}/README.md

@@ -19,7 +19,15 @@ Commercial threat intelligence platforms often charge prohibitive annual fees fo
 
 ---
 
-## What's New in v1.7.0
+## What's New in v1.7.1
+- STIX export now produces real bundles with entities and relationships again.
+- Entity extraction on CVE/financial queries now returns the expected entity mix instead of collapsing to organization-name noise.
+- Confidence scores now show multi-value spread that reflects source quality, extraction method, and corroboration.
+- Entity readback now includes rows linked through `InvestigationEntityLink` and dedupes canonical collisions correctly.
+
+---
+
+## What's New in the Previous Release
 
 - **Dependency optional-extras split** — `sentence-transformers`, `torch`, `transformers`, `telethon`, and `playwright` are now optional extras: `voidaccess[nlp]`, `voidaccess[telegram]`, `voidaccess[js]`, and `voidaccess[all]`.
 - **Optional clearnet ScrapingAnt integration** — paste sites and RSS feeds can now be routed through ScrapingAnt. Affects clearnet scraping only; Tor, `.onion`, GitHub, and GitLab traffic are never affected.
@@ -225,7 +233,7 @@ Export formats:
 
 ## Actor Intelligence
 
-VoidAccess v1.7.0 persists actor profiles across investigations in `actor_profiles`, with linked aliases and infrastructure in `actor_aliases` and `actor_infrastructure`. Profiles are populated from threat actor, ransomware group, and handle entities, then enriched with co-occurring infrastructure and timeline events.
+VoidAccess v1.7.1 persists actor profiles across investigations in `actor_profiles`, with linked aliases and infrastructure in `actor_aliases` and `actor_infrastructure`. Profiles are populated from threat actor, ransomware group, and handle entities, then enriched with co-occurring infrastructure and timeline events.
 
 Cross-alias resolution scores five signals: shared infrastructure, shared PGP, string similarity, temporal co-activity, and co-investigation. Use `voidaccess actors` to list profiles, `voidaccess actor <handle>` for the full profile, `voidaccess actor <handle> --timeline` for chronology, and `voidaccess actor <handle> --note "text"` for analyst notes.
 
@@ -493,5 +501,3 @@ To report a security vulnerability, see [docs/SECURITY.md](docs/SECURITY.md).
 MIT License. See [LICENSE](LICENSE) for details.
 
 
-
-

{voidaccess-1.7.0 → voidaccess-1.7.1}/api/routes/actors.py

@@ -17,6 +17,7 @@ from __future__ import annotations
 
 import logging
 import os
+import uuid
 from typing import Optional
 
 from fastapi import APIRouter, Depends, HTTPException, Query
@@ -99,7 +100,7 @@ def _user_owned_investigation_ids_subq(session, user_id: int):
 
 def _profile_accessible(session, profile_id: str, user_id: int) -> bool:
     """True when at least one investigation linked to the profile is owned by the user."""
-    from db.models import ActorAlias, ActorInfrastructure, Investigation
+    from db.models import ActorAlias, ActorInfrastructure
 
     inv_ids_subq = _user_owned_investigation_ids_subq(session, user_id)
     alias_match = (
@@ -151,7 +152,6 @@ async def list_actors(
         ActorProfile,
         ActorAlias,
         ActorInfrastructure,
-        Investigation,
     )
 
     try:
@@ -258,6 +258,35 @@ async def get_actor(
     return profile
 
 
+@router.get("/{node_id}/profile")
+async def get_actor_profile_by_node(
+    node_id: str,
+    investigation_id: str = Query(..., description="Investigation ID"),
+    current_user: CurrentUser = Depends(get_current_user),
+) -> dict:
+    """Return the graph actor profile for a node inside one investigation."""
+    _db_required()
+    try:
+        inv_uuid = uuid.UUID(investigation_id)
+    except ValueError:
+        raise HTTPException(status_code=422, detail="Invalid investigation ID format")
+    from db.queries import get_investigation_by_id_or_run
+    from graph import build_graph_from_db_cached, get_actor_profile
+
+    with _session() as session:
+        inv = get_investigation_by_id_or_run(session, inv_uuid)
+        if inv is None:
+            raise HTTPException(status_code=404, detail="Investigation not found")
+        if str(inv.user_id) != str(current_user.user.id):
+            raise HTTPException(status_code=403, detail="Forbidden")
+        graph = build_graph_from_db_cached(investigation_id=inv.id)
+
+    profile = get_actor_profile(graph, node_id)
+    if not profile:
+        raise HTTPException(status_code=404, detail="Graph node not found")
+    return profile
+
+
 @router.get("/{handle}/investigations")
 async def get_actor_investigations(
     handle: str,
@@ -732,4 +761,4 @@ def uuid_value(s):
         import uuid as _uuid
         return _uuid.UUID(str(s))
     except (ValueError, TypeError):
-        return None
+        return None