Merge pull request #914 from dfir-iris/api_v2_create_object_comment

Api v2 create object comment

Author: whikernel

.github/workflows/ci.yml

@@ -185,7 +185,13 @@ jobs:
           PYTHONUNBUFFERED=true python -m unittest --verbose
       - name: Stop development server
         run: |
+          docker compose logs app > ${{ runner.temp }}/iriswebapp_app.log
           docker compose down
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: Test API iriswebapp_app logs
+          path: ${{ runner.temp }}/iriswebapp_app.log
 
   test-database-migration:
     name: Database migration tests

source/app/blueprints/access_controls.py

@@ -48,7 +48,7 @@
 from app.datamgmt.manage.manage_access_control_db import user_has_client_access
 from app.datamgmt.manage.manage_users_db import get_user
 from app.iris_engine.access_control.iris_user import iris_current_user
-from app.iris_engine.access_control.utils import ac_fast_check_user_has_case_access
+from app.business.access_controls import ac_fast_check_user_has_case_access
 from app.iris_engine.access_control.utils import ac_get_effective_permissions_of_user
 from app.iris_engine.utils.tracker import track_activity
 from app.models.authorization import Permissions

source/app/blueprints/graphql/permissions.py

@@ -25,7 +25,7 @@
 from app.blueprints.access_controls import get_case_access_from_api
 from app.iris_engine.access_control.iris_user import iris_current_user
 from app.iris_engine.access_control.utils import ac_get_effective_permissions_of_user
-from app.iris_engine.access_control.utils import ac_fast_check_current_user_has_case_access
+from app.business.access_controls import ac_fast_check_current_user_has_case_access
 
 
 class PermissionDeniedError(Exception):

source/app/blueprints/pages/manage/manage_cases_routes.py

@@ -34,7 +34,7 @@
 from app.datamgmt.manage.manage_cases_db import get_case_protagonists
 from app.datamgmt.manage.manage_common import get_severities_list
 from app.forms import AddCaseForm
-from app.iris_engine.access_control.utils import ac_fast_check_current_user_has_case_access
+from app.business.access_controls import ac_fast_check_current_user_has_case_access
 from app.iris_engine.access_control.utils import ac_current_user_has_permission
 from app.models.authorization import CaseAccessLevel
 from app.models.authorization import Permissions

source/app/blueprints/rest/alerts_routes.py

@@ -1019,6 +1019,7 @@ def alert_comment_edit(alert_id, com_id):
 
 
 @alerts_rest_blueprint.route('/alerts/<int:alert_id>/comments/add', methods=['POST'])
+@endpoint_deprecated('POST', '/api/v2/alerts/{alert_identifier}/comments')
 @ac_api_requires(Permissions.alerts_write)
 def case_comment_add(alert_id):
     """

source/app/blueprints/rest/case/case_assets_routes.py

@@ -47,7 +47,7 @@
 from app.datamgmt.manage.manage_attribute_db import get_default_custom_attributes
 from app.datamgmt.manage.manage_users_db import get_user_cases_fast
 from app.datamgmt.states import get_assets_state
-from app.iris_engine.access_control.utils import ac_fast_check_current_user_has_case_access
+from app.business.access_controls import ac_fast_check_current_user_has_case_access
 from app.iris_engine.module_handler.module_handler import call_modules_hook
 from app.iris_engine.utils.tracker import track_activity
 from app.models.models import AnalysisStatus
@@ -349,6 +349,7 @@ def case_comment_asset_list(cur_id, caseid):
 
 
 @case_assets_rest_blueprint.route('/case/assets/<int:cur_id>/comments/add', methods=['POST'])
+@endpoint_deprecated('POST', '/api/v2/assets/{asset_identifier}/comments')
 @ac_requires_case_identifier(CaseAccessLevel.full_access)
 @ac_api_requires()
 def case_comment_asset_add(cur_id, caseid):

source/app/blueprints/rest/case/case_evidences_routes.py

@@ -152,6 +152,7 @@ def case_comment_evidence_list(cur_id, caseid):
 
 
 @case_evidences_rest_blueprint.route('/case/evidences/<int:cur_id>/comments/add', methods=['POST'])
+@endpoint_deprecated('POST', '/api/v2/evidences/{evidence_identifier}/comments')
 @ac_requires_case_identifier(CaseAccessLevel.full_access)
 @ac_api_requires()
 def case_comment_evidence_add(cur_id, caseid):

source/app/blueprints/rest/case/case_ioc_routes.py

@@ -45,7 +45,7 @@
 from app.datamgmt.case.case_iocs_db import get_tlps_dict
 from app.datamgmt.manage.manage_attribute_db import get_default_custom_attributes
 from app.datamgmt.states import get_ioc_state
-from app.iris_engine.access_control.utils import ac_fast_check_current_user_has_case_access
+from app.business.access_controls import ac_fast_check_current_user_has_case_access
 from app.iris_engine.module_handler.module_handler import call_modules_hook
 from app.iris_engine.utils.tracker import track_activity
 from app.models.authorization import CaseAccessLevel
@@ -259,6 +259,7 @@ def case_comment_ioc_list(cur_id, caseid):
 
 
 @case_ioc_rest_blueprint.route('/case/ioc/<int:cur_id>/comments/add', methods=['POST'])
+@endpoint_deprecated('POST', '/api/v2/iocs/{ioc_identifier}/comments')
 @ac_requires_case_identifier(CaseAccessLevel.full_access)
 @ac_api_requires()
 def case_comment_ioc_add(cur_id, caseid):

source/app/blueprints/rest/case/case_notes_routes.py

@@ -404,6 +404,7 @@ def case_comment_note_list(cur_id, caseid):
 
 
 @case_notes_rest_blueprint.route('/case/notes/<int:cur_id>/comments/add', methods=['POST'])
+@endpoint_deprecated('POST', '/api/v2/notes/{note_identifier}/comments')
 @ac_requires_case_identifier(CaseAccessLevel.full_access)
 @ac_api_requires()
 def case_comment_note_add(cur_id, caseid):

source/app/blueprints/rest/case/case_routes.py

@@ -38,9 +38,8 @@
 from app.datamgmt.manage.manage_groups_db import get_group_with_members
 from app.datamgmt.manage.manage_users_db import get_user
 from app.datamgmt.manage.manage_users_db import get_users_list_restricted_from_case
-from app.datamgmt.manage.manage_users_db import set_user_case_access
+from app.business.access_controls import set_user_case_access, ac_fast_check_user_has_case_access
 from app.business.cases import cases_export_to_json
-from app.iris_engine.access_control.utils import ac_fast_check_user_has_case_access
 from app.iris_engine.access_control.utils import ac_set_case_access_for_users
 from app.iris_engine.utils.tracker import track_activity
 from app.models.models import CaseStatus
@@ -243,21 +242,29 @@ def user_cac_set_case(caseid):
 
     try:
 
-        success, logs = set_user_case_access(user.id, data.get('case_id'), data.get('access_level'))
+        case_identifier = data.get('case_id')
+        access_level = data.get('access_level')
+
+        if user.id is None or type(user.id) is not int:
+            return response_error('Invalid user id')
+        if case_identifier is None or type(case_identifier) is not int:
+            return response_error('Invalid case id')
+        if access_level is None or type(access_level) is not int:
+            return response_error('Invalid access level')
+        if CaseAccessLevel.has_value(access_level) is False:
+            return response_error('Invalid access level')
+
+        set_user_case_access(user.id, case_identifier, access_level)
         track_activity('case access set to {} for user {}'.format(data.get('access_level'), user.name), caseid)
         add_obj_history_entry(case, 'access changed to {} for user {}'.format(data.get('access_level'), user.name))
 
         db.session.commit()
+        return response_success(msg=f'Case access set to {access_level} for user {user.id}')
 
     except Exception as e:
         log.error(f'Error while setting case access for user: {e}')
         log.error(traceback.format_exc())
-        return response_error(msg=str(e))
-
-    if success:
-        return response_success(msg=logs)
-
-    return response_error(msg=logs)
+        return response_error(str(e))
 
 
 @case_rest_blueprint.route('/case/update-status', methods=['POST'])