voidaccess 1.7.0__tar.gz → 1.7.2__tar.gz

{voidaccess-1.7.0 → voidaccess-1.7.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: voidaccess
-Version: 1.7.0
+Version: 1.7.2
 Summary: Dark web OSINT CLI — automated threat intelligence from query to report
 Author: VoidAccess
 License-Expression: MIT
@@ -104,7 +104,16 @@ Commercial threat intelligence platforms often charge prohibitive annual fees fo
 
 ---
 
-## What's New in v1.7.0
+## What's New in v1.7.2
+- STIX export relationship generation is bounded and semantic, avoiding page-level cartesian edge explosions at larger entity counts.
+- Repeated NER false positives for threat actor handles and organization names are filtered before persistence.
+- MISP/Sigma/API query paths no longer use the SQLAlchemy subquery-in-`IN()` pattern that produced warnings.
+- Optional configuration warnings are summarized once per process.
+- Refined LLM query output is persisted as a short search string, not explanatory Markdown.
+
+---
+
+## What's New in the Previous Release
 
 - **Dependency optional-extras split** — `sentence-transformers`, `torch`, `transformers`, `telethon`, and `playwright` are now optional extras: `voidaccess[nlp]`, `voidaccess[telegram]`, `voidaccess[js]`, and `voidaccess[all]`.
 - **Optional clearnet ScrapingAnt integration** — paste sites and RSS feeds can now be routed through ScrapingAnt. Affects clearnet scraping only; Tor, `.onion`, GitHub, and GitLab traffic are never affected.
@@ -310,7 +319,7 @@ Export formats:
 
 ## Actor Intelligence
 
-VoidAccess v1.7.0 persists actor profiles across investigations in `actor_profiles`, with linked aliases and infrastructure in `actor_aliases` and `actor_infrastructure`. Profiles are populated from threat actor, ransomware group, and handle entities, then enriched with co-occurring infrastructure and timeline events.
+VoidAccess v1.7.1 persists actor profiles across investigations in `actor_profiles`, with linked aliases and infrastructure in `actor_aliases` and `actor_infrastructure`. Profiles are populated from threat actor, ransomware group, and handle entities, then enriched with co-occurring infrastructure and timeline events.
 
 Cross-alias resolution scores five signals: shared infrastructure, shared PGP, string similarity, temporal co-activity, and co-investigation. Use `voidaccess actors` to list profiles, `voidaccess actor <handle>` for the full profile, `voidaccess actor <handle> --timeline` for chronology, and `voidaccess actor <handle> --note "text"` for analyst notes.
 
@@ -577,6 +586,3 @@ To report a security vulnerability, see [docs/SECURITY.md](docs/SECURITY.md).
 
 MIT License. See [LICENSE](LICENSE) for details.
 
-
-
-

{voidaccess-1.7.0 → voidaccess-1.7.2}/README.md

@@ -19,7 +19,16 @@ Commercial threat intelligence platforms often charge prohibitive annual fees fo
 
 ---
 
-## What's New in v1.7.0
+## What's New in v1.7.2
+- STIX export relationship generation is bounded and semantic, avoiding page-level cartesian edge explosions at larger entity counts.
+- Repeated NER false positives for threat actor handles and organization names are filtered before persistence.
+- MISP/Sigma/API query paths no longer use the SQLAlchemy subquery-in-`IN()` pattern that produced warnings.
+- Optional configuration warnings are summarized once per process.
+- Refined LLM query output is persisted as a short search string, not explanatory Markdown.
+
+---
+
+## What's New in the Previous Release
 
 - **Dependency optional-extras split** — `sentence-transformers`, `torch`, `transformers`, `telethon`, and `playwright` are now optional extras: `voidaccess[nlp]`, `voidaccess[telegram]`, `voidaccess[js]`, and `voidaccess[all]`.
 - **Optional clearnet ScrapingAnt integration** — paste sites and RSS feeds can now be routed through ScrapingAnt. Affects clearnet scraping only; Tor, `.onion`, GitHub, and GitLab traffic are never affected.
@@ -225,7 +234,7 @@ Export formats:
 
 ## Actor Intelligence
 
-VoidAccess v1.7.0 persists actor profiles across investigations in `actor_profiles`, with linked aliases and infrastructure in `actor_aliases` and `actor_infrastructure`. Profiles are populated from threat actor, ransomware group, and handle entities, then enriched with co-occurring infrastructure and timeline events.
+VoidAccess v1.7.1 persists actor profiles across investigations in `actor_profiles`, with linked aliases and infrastructure in `actor_aliases` and `actor_infrastructure`. Profiles are populated from threat actor, ransomware group, and handle entities, then enriched with co-occurring infrastructure and timeline events.
 
 Cross-alias resolution scores five signals: shared infrastructure, shared PGP, string similarity, temporal co-activity, and co-investigation. Use `voidaccess actors` to list profiles, `voidaccess actor <handle>` for the full profile, `voidaccess actor <handle> --timeline` for chronology, and `voidaccess actor <handle> --note "text"` for analyst notes.
 
@@ -492,6 +501,3 @@ To report a security vulnerability, see [docs/SECURITY.md](docs/SECURITY.md).
 
 MIT License. See [LICENSE](LICENSE) for details.
 
-
-
-

{voidaccess-1.7.0 → voidaccess-1.7.2}/api/routes/actors.py

@@ -17,11 +17,12 @@ from __future__ import annotations
 
 import logging
 import os
+import uuid
 from typing import Optional
 
 from fastapi import APIRouter, Depends, HTTPException, Query
 from pydantic import BaseModel, Field
-from sqlalchemy import or_
+from sqlalchemy import or_, select
 
 from api.auth import CurrentUser, get_current_user
 
@@ -87,26 +88,22 @@ def _db_required() -> None:
         raise HTTPException(status_code=503, detail="Database not configured")
 
 
-def _user_owned_investigation_ids_subq(session, user_id: int):
+def _user_owned_investigation_ids_select(user_id: int):
     from db.models import Investigation
 
-    return (
-        session.query(Investigation.id)
-        .filter(Investigation.user_id == user_id)
-        .subquery()
-    )
+    return select(Investigation.id).where(Investigation.user_id == user_id)
 
 
 def _profile_accessible(session, profile_id: str, user_id: int) -> bool:
     """True when at least one investigation linked to the profile is owned by the user."""
-    from db.models import ActorAlias, ActorInfrastructure, Investigation
+    from db.models import ActorAlias, ActorInfrastructure
 
-    inv_ids_subq = _user_owned_investigation_ids_subq(session, user_id)
+    inv_ids_select = _user_owned_investigation_ids_select(user_id)
     alias_match = (
         session.query(ActorAlias.id)
         .filter(
             ActorAlias.actor_id == profile_id,
-            ActorAlias.source_investigation_id.in_(inv_ids_subq),
+            ActorAlias.source_investigation_id.in_(inv_ids_select),
         )
         .first()
     )
@@ -116,7 +113,7 @@ def _profile_accessible(session, profile_id: str, user_id: int) -> bool:
         session.query(ActorInfrastructure.id)
         .filter(
             ActorInfrastructure.actor_id == profile_id,
-            ActorInfrastructure.source_investigation_id.in_(inv_ids_subq),
+            ActorInfrastructure.source_investigation_id.in_(inv_ids_select),
         )
         .first()
     )
@@ -145,20 +142,15 @@ async def list_actors(
     users since the seed is public data.
     """
     _db_required()
-    from sqlalchemy import select
-
     from db.models import (
         ActorProfile,
         ActorAlias,
         ActorInfrastructure,
-        Investigation,
     )
 
     try:
         with _session() as session:
-            user_inv_ids = _user_owned_investigation_ids_subq(
-                session, current_user.user.id
-            )
+            user_inv_ids = _user_owned_investigation_ids_select(current_user.user.id)
 
             # Subquery of profile IDs visible to this user
             visible_alias = select(ActorAlias.actor_id).where(
@@ -176,13 +168,13 @@ async def list_actors(
             )
             if search:
                 pattern = f"%{search.lower()}%"
-                alias_subq = select(ActorAlias.actor_id).where(
+                alias_select = select(ActorAlias.actor_id).where(
                     ActorAlias.alias_value.ilike(pattern)
                 )
                 q = q.filter(
                     or_(
                         ActorProfile.canonical_handle.ilike(pattern),
-                        ActorProfile.id.in_(alias_subq),
+                        ActorProfile.id.in_(alias_select),
                     )
                 )
 
@@ -258,6 +250,35 @@ async def get_actor(
     return profile
 
 
+@router.get("/{node_id}/profile")
+async def get_actor_profile_by_node(
+    node_id: str,
+    investigation_id: str = Query(..., description="Investigation ID"),
+    current_user: CurrentUser = Depends(get_current_user),
+) -> dict:
+    """Return the graph actor profile for a node inside one investigation."""
+    _db_required()
+    try:
+        inv_uuid = uuid.UUID(investigation_id)
+    except ValueError:
+        raise HTTPException(status_code=422, detail="Invalid investigation ID format")
+    from db.queries import get_investigation_by_id_or_run
+    from graph import build_graph_from_db_cached, get_actor_profile
+
+    with _session() as session:
+        inv = get_investigation_by_id_or_run(session, inv_uuid)
+        if inv is None:
+            raise HTTPException(status_code=404, detail="Investigation not found")
+        if str(inv.user_id) != str(current_user.user.id):
+            raise HTTPException(status_code=403, detail="Forbidden")
+        graph = build_graph_from_db_cached(investigation_id=inv.id)
+
+    profile = get_actor_profile(graph, node_id)
+    if not profile:
+        raise HTTPException(status_code=404, detail="Graph node not found")
+    return profile
+
+
 @router.get("/{handle}/investigations")
 async def get_actor_investigations(
     handle: str,
@@ -284,9 +305,7 @@ async def get_actor_investigations(
 
     try:
         with _session() as session:
-            user_inv_ids = _user_owned_investigation_ids_subq(
-                session, current_user.user.id
-            )
+            user_inv_ids = _user_owned_investigation_ids_select(current_user.user.id)
             all_ids = [
                 uuid_value(s)
                 for s in profile.get("investigation_ids", [])
@@ -732,4 +751,4 @@ def uuid_value(s):
         import uuid as _uuid
         return _uuid.UUID(str(s))
     except (ValueError, TypeError):
-        return None
+        return None

{voidaccess-1.7.0 → voidaccess-1.7.2}/api/routes/entities.py

@@ -57,14 +57,12 @@ async def list_entities(
 
         with get_session() as session:
             user_inv_ids = (
-                session.query(Investigation.id)
-                .filter(Investigation.user_id == current_user.user.id)
-                .subquery()
+                sa.select(Investigation.id)
+                .where(Investigation.user_id == current_user.user.id)
             )
             linked_entity_ids = (
-                session.query(InvestigationEntityLink.entity_id)
-                .filter(InvestigationEntityLink.investigation_id.in_(user_inv_ids))
-                .subquery()
+                sa.select(InvestigationEntityLink.entity_id)
+                .where(InvestigationEntityLink.investigation_id.in_(user_inv_ids))
             )
             q = session.query(Entity).filter(
                 sa.or_(
@@ -749,14 +747,12 @@ def _assert_entity_accessible(session, entity_id: uuid.UUID, user_id: int) -> No
     from db.models import Entity, Investigation, InvestigationEntityLink  # noqa: PLC0415
 
     user_inv_ids = (
-        session.query(Investigation.id)
-        .filter(Investigation.user_id == user_id)
-        .subquery()
+        sa.select(Investigation.id)
+        .where(Investigation.user_id == user_id)
     )
     linked_entity_ids = (
-        session.query(InvestigationEntityLink.entity_id)
-        .filter(InvestigationEntityLink.investigation_id.in_(user_inv_ids))
-        .subquery()
+        sa.select(InvestigationEntityLink.entity_id)
+        .where(InvestigationEntityLink.investigation_id.in_(user_inv_ids))
     )
     accessible = (
         session.query(Entity.id)