Implementation of API v2 endpoints to get comments

Author: c8y3

source/app/blueprints/rest/v2/events_routes/comments.py

@@ -25,10 +25,12 @@
 from app.blueprints.rest.endpoints import response_api_not_found
 from app.blueprints.rest.endpoints import response_api_created
 from app.blueprints.rest.endpoints import response_api_error
+from app.blueprints.rest.endpoints import response_api_success
 from app.blueprints.rest.parsing import parse_pagination_parameters
 from app.iris_engine.access_control.iris_user import iris_current_user
 from app.business.comments import comments_get_filtered_by_event
 from app.business.comments import comments_create_for_event
+from app.business.comments import comments_get_for_event
 from app.business.events import events_get
 from app.business.errors import ObjectNotFoundError
 from app.models.cases import CasesEvent
@@ -73,6 +75,17 @@ def create(self, event_identifier):
         except ObjectNotFoundError:
             return response_api_not_found()
 
+    def read(self, event_identifier, identifier):
+        try:
+            event = self._get_event(event_identifier, [CaseAccessLevel.read_only, CaseAccessLevel.full_access])
+            comment = comments_get_for_event(event, identifier)
+            result = self._schema.dump(comment)
+            return response_api_success(result)
+        except ValidationError as e:
+            return response_api_error('Data error', data=e.normalized_messages())
+        except ObjectNotFoundError:
+            return response_api_not_found()
+
 
 events_comments_blueprint = Blueprint('events_comments', __name__, url_prefix='/<int:event_identifier>/comments')
 comments_operations = CommentsOperations()
@@ -88,3 +101,9 @@ def get_event_comments(event_identifier):
 @ac_api_requires()
 def create_event_comment(event_identifier):
     return comments_operations.create(event_identifier)
+
+
+@events_comments_blueprint.get('/<int:identifier>')
+@ac_api_requires()
+def get_event_comment(event_identifier, identifier):
+    return comments_operations.read(event_identifier, identifier)

source/app/blueprints/rest/v2/evidences_routes/comments.py

@@ -25,10 +25,12 @@
 from app.blueprints.rest.endpoints import response_api_not_found
 from app.blueprints.rest.endpoints import response_api_created
 from app.blueprints.rest.endpoints import response_api_error
+from app.blueprints.rest.endpoints import response_api_success
 from app.iris_engine.access_control.iris_user import iris_current_user
 from app.blueprints.rest.parsing import parse_pagination_parameters
 from app.business.comments import comments_get_filtered_by_evidence
 from app.business.comments import comments_create_for_evidence
+from app.business.comments import comments_get_for_evidence
 from app.models.models import CaseReceivedFile
 from app.business.evidences import evidences_get
 from app.business.errors import ObjectNotFoundError
@@ -74,18 +76,35 @@ def create(self, evidence_identifier):
         except ObjectNotFoundError:
             return response_api_not_found()
 
+    def read(self, event_identifier, identifier):
+        try:
+            evidence = self._get_evidence(event_identifier, [CaseAccessLevel.read_only, CaseAccessLevel.full_access])
+            comment = comments_get_for_evidence(evidence, identifier)
+            result = self._schema.dump(comment)
+            return response_api_success(result)
+        except ValidationError as e:
+            return response_api_error('Data error', data=e.normalized_messages())
+        except ObjectNotFoundError:
+            return response_api_not_found()
+
 
 evidences_comments_blueprint = Blueprint('evidences_comments', __name__, url_prefix='/<int:evidence_identifier>/comments')
 comments_operations = CommentsOperations()
 
 
 @evidences_comments_blueprint.get('')
 @ac_api_requires()
-def get_evidences_comments(evidence_identifier):
+def get_evidence_comments(evidence_identifier):
     return comments_operations.get(evidence_identifier)
 
 
 @evidences_comments_blueprint.post('')
 @ac_api_requires()
-def create_evidences_comment(evidence_identifier):
+def create_evidence_comment(evidence_identifier):
     return comments_operations.create(evidence_identifier)
+
+
+@evidences_comments_blueprint.get('/<int:identifier>')
+@ac_api_requires()
+def get_evidence_comment(evidence_identifier, identifier):
+    return comments_operations.read(evidence_identifier, identifier)

source/app/blueprints/rest/v2/iocs_routes/comments.py

@@ -26,9 +26,11 @@
 from app.blueprints.rest.endpoints import response_api_not_found
 from app.blueprints.rest.endpoints import response_api_created
 from app.blueprints.rest.endpoints import response_api_error
+from app.blueprints.rest.endpoints import response_api_success
 from app.blueprints.rest.parsing import parse_pagination_parameters
 from app.business.comments import comments_get_filtered_by_ioc
 from app.business.comments import comments_create_for_ioc
+from app.business.comments import comments_get_for_ioc
 from app.business.iocs import iocs_get
 from app.business.errors import ObjectNotFoundError
 from app.schema.marshables import CommentSchema
@@ -72,6 +74,17 @@ def create(self, ioc_identifier):
         except ObjectNotFoundError:
             return response_api_not_found()
 
+    def read(self, ioc_identifier, identifier):
+        try:
+            ioc = self._get_ioc(ioc_identifier, [CaseAccessLevel.read_only, CaseAccessLevel.full_access])
+            comment = comments_get_for_ioc(ioc, identifier)
+            result = self._schema.dump(comment)
+            return response_api_success(result)
+        except ValidationError as e:
+            return response_api_error('Data error', data=e.normalized_messages())
+        except ObjectNotFoundError:
+            return response_api_not_found()
+
 
 iocs_comments_blueprint = Blueprint('iocs_comments', __name__, url_prefix='/<int:ioc_identifier>/comments')
 comments_operations = CommentsOperations()
@@ -87,3 +100,9 @@ def get_iocs_comments(ioc_identifier):
 @ac_api_requires()
 def create_iocs_comment(ioc_identifier):
     return comments_operations.create(ioc_identifier)
+
+
+@iocs_comments_blueprint.get('/<int:identifier>')
+@ac_api_requires()
+def get_ioc_comment(ioc_identifier, identifier):
+    return comments_operations.read(ioc_identifier, identifier)

source/app/blueprints/rest/v2/notes_routes/comments.py

@@ -26,9 +26,11 @@
 from app.blueprints.rest.endpoints import response_api_not_found
 from app.blueprints.rest.endpoints import response_api_created
 from app.blueprints.rest.endpoints import response_api_error
+from app.blueprints.rest.endpoints import response_api_success
 from app.blueprints.rest.parsing import parse_pagination_parameters
 from app.business.comments import comments_get_filtered_by_note
 from app.business.comments import comments_create_for_note
+from app.business.comments import comments_get_for_note
 from app.business.notes import notes_get
 from app.business.errors import ObjectNotFoundError
 from app.schema.marshables import CommentSchema
@@ -73,6 +75,17 @@ def create(self, note_identifier):
         except ObjectNotFoundError:
             return response_api_not_found()
 
+    def read(self, note_identifier, identifier):
+        try:
+            note = self._get_note(note_identifier, [CaseAccessLevel.read_only, CaseAccessLevel.full_access])
+            comment = comments_get_for_note(note, identifier)
+            result = self._schema.dump(comment)
+            return response_api_success(result)
+        except ValidationError as e:
+            return response_api_error('Data error', data=e.normalized_messages())
+        except ObjectNotFoundError:
+            return response_api_not_found()
+
 
 notes_comments_blueprint = Blueprint('notes_comments', __name__, url_prefix='/<int:note_identifier>/comments')
 comments_operations = CommentsOperations()
@@ -88,3 +101,9 @@ def get_notes_comments(note_identifier):
 @ac_api_requires()
 def create_notes_comment(note_identifier):
     return comments_operations.create(note_identifier)
+
+
+@notes_comments_blueprint.get('/<int:identifier>')
+@ac_api_requires()
+def get_note_comment(note_identifier, identifier):
+    return comments_operations.read(note_identifier, identifier)

source/app/blueprints/rest/v2/tasks_routes/comments.py

@@ -27,8 +27,10 @@
 from app.blueprints.rest.parsing import parse_pagination_parameters
 from app.blueprints.rest.endpoints import response_api_created
 from app.blueprints.rest.endpoints import response_api_error
+from app.blueprints.rest.endpoints import response_api_success
 from app.business.comments import comments_get_filtered_by_task
 from app.business.comments import comments_create_for_task
+from app.business.comments import comments_get_for_task
 from app.business.tasks import tasks_get
 from app.business.errors import ObjectNotFoundError
 from app.schema.marshables import CommentSchema
@@ -73,6 +75,17 @@ def create(self, task_identifier):
         except ObjectNotFoundError:
             return response_api_not_found()
 
+    def read(self, task_identifier, identifier):
+        try:
+            task = self._get_task(task_identifier, [CaseAccessLevel.read_only, CaseAccessLevel.full_access])
+            comment = comments_get_for_task(task, identifier)
+            result = self._schema.dump(comment)
+            return response_api_success(result)
+        except ValidationError as e:
+            return response_api_error('Data error', data=e.normalized_messages())
+        except ObjectNotFoundError:
+            return response_api_not_found()
+
 
 tasks_comments_blueprint = Blueprint('tasks_comments', __name__, url_prefix='/<int:task_identifier>/comments')
 comments_operations = CommentsOperations()
@@ -88,3 +101,9 @@ def get_tasks_comments(task_identifier):
 @ac_api_requires()
 def create_tasks_comment(task_identifier):
     return comments_operations.create(task_identifier)
+
+
+@tasks_comments_blueprint.get('/<int:identifier>')
+@ac_api_requires()
+def get_task_comment(task_identifier, identifier):
+    return comments_operations.read(task_identifier, identifier)

source/app/business/comments.py

@@ -40,6 +40,12 @@
 from app.datamgmt.case.case_tasks_db import add_comment_to_task
 from app.datamgmt.case.case_events_db import add_comment_to_event
 from app.datamgmt.case.case_assets_db import get_case_asset_comment
+from app.datamgmt.case.case_rfiles_db import get_case_evidence_comment
+from app.datamgmt.case.case_iocs_db import get_case_ioc_comment
+from app.datamgmt.case.case_notes_db import get_case_note_comment
+from app.datamgmt.case.case_tasks_db import get_case_task_comment
+from app.datamgmt.case.case_events_db import get_case_event_comment
+from app.datamgmt.case.case_events_db import get_case_event_comment
 from app.iris_engine.module_handler.module_handler import call_modules_hook
 from app.iris_engine.utils.tracker import track_activity
 from app.models.comments import Comments
@@ -246,3 +252,38 @@ def comments_get_for_asset(asset: CaseAssets, identifier) -> Comments:
     if comment is None:
         raise ObjectNotFoundError
     return comment
+
+
+def comments_get_for_evidence(evidence: CaseReceivedFile, identifier) -> Comments:
+    comment = get_case_evidence_comment(evidence.id, identifier)
+    if comment is None:
+        raise ObjectNotFoundError
+    return comment
+
+
+def comments_get_for_ioc(ioc: Ioc, identifier) -> Comments:
+    comment = get_case_ioc_comment(ioc.ioc_id, identifier)
+    if comment is None:
+        raise ObjectNotFoundError
+    return comment
+
+
+def comments_get_for_note(note: Notes, identifier) -> Comments:
+    comment = get_case_note_comment(note.note_id, identifier)
+    if comment is None:
+        raise ObjectNotFoundError
+    return comment
+
+
+def comments_get_for_task(task: CaseTasks, identifier) -> Comments:
+    comment = get_case_task_comment(task.id, identifier)
+    if comment is None:
+        raise ObjectNotFoundError
+    return comment
+
+
+def comments_get_for_event(event: CasesEvent, identifier) -> Comments:
+    comment = get_case_event_comment(event.event_id, identifier)
+    if comment is None:
+        raise ObjectNotFoundError
+    return comment

tests/tests_rest_comments.py

@@ -514,3 +514,58 @@ def test_get_assets_comment_should_return_200(self):
 
         response = self._subject.get(f'/api/v2/assets/{object_identifier}/comments/{identifier}', {})
         self.assertEqual(200, response.status_code)
+
+    def test_get_evidences_comment_should_return_200(self):
+        case_identifier = self._subject.create_dummy_case()
+        body = {'filename': 'filename'}
+        response = self._subject.create(f'/api/v2/cases/{case_identifier}/evidences', body).json()
+        object_identifier = response['id']
+        response = self._subject.create(f'/api/v2/evidences/{object_identifier}/comments', {}).json()
+        identifier = response['comment_id']
+        response = self._subject.get(f'/api/v2/evidences/{object_identifier}/comments/{identifier}', {})
+        self.assertEqual(200, response.status_code)
+
+    def test_get_iocs_comment_should_return_200(self):
+        case_identifier = self._subject.create_dummy_case()
+        body = {'ioc_type_id': 1, 'ioc_tlp_id': 2, 'ioc_value': '8.8.8.8', 'ioc_description': 'rewrw', 'ioc_tags': ''}
+        response = self._subject.create(f'/api/v2/cases/{case_identifier}/iocs', body).json()
+        object_identifier = response['ioc_id']
+        response = self._subject.create(f'/api/v2/iocs/{object_identifier}/comments', {}).json()
+        identifier = response['comment_id']
+        response = self._subject.get(f'/api/v2/iocs/{object_identifier}/comments/{identifier}', {})
+        self.assertEqual(200, response.status_code)
+
+    def test_get_notes_comment_should_return_200(self):
+        case_identifier = self._subject.create_dummy_case()
+        response = self._subject.create(f'/api/v2/cases/{case_identifier}/notes-directories',
+                                        {'name': 'directory_name'}).json()
+        directory_identifier = response['id']
+        body = {'directory_id': directory_identifier}
+        response = self._subject.create(f'/api/v2/cases/{case_identifier}/notes', body).json()
+        object_identifier = response['note_id']
+        response = self._subject.create(f'/api/v2/notes/{object_identifier}/comments', {}).json()
+        identifier = response['comment_id']
+        response = self._subject.get(f'/api/v2/notes/{object_identifier}/comments/{identifier}', {})
+        self.assertEqual(200, response.status_code)
+
+    def test_get_tasks_comment_should_return_200(self):
+        case_identifier = self._subject.create_dummy_case()
+        body = {'task_assignees_id': [], 'task_status_id': 1, 'task_title': 'dummy title'}
+        response = self._subject.create(f'/api/v2/cases/{case_identifier}/tasks', body).json()
+        object_identifier = response['id']
+        response = self._subject.create(f'/api/v2/tasks/{object_identifier}/comments', {}).json()
+        identifier = response['comment_id']
+        response = self._subject.get(f'/api/v2/tasks/{object_identifier}/comments/{identifier}', {})
+        self.assertEqual(200, response.status_code)
+
+    def test_get_events_comment_should_return_200(self):
+        case_identifier = self._subject.create_dummy_case()
+        body = {'event_title': 'title', 'event_category_id': 1,
+                'event_date': '2025-03-26T00:00:00.000', 'event_tz': '+00:00',
+                'event_assets': [], 'event_iocs': []}
+        response = self._subject.create(f'/api/v2/cases/{case_identifier}/events', body).json()
+        object_identifier = response['event_id']
+        response = self._subject.create(f'/api/v2/events/{object_identifier}/comments', {}).json()
+        identifier = response['comment_id']
+        response = self._subject.get(f'/api/v2/events/{object_identifier}/comments/{identifier}', {})
+        self.assertEqual(200, response.status_code)