dextmorgn
dd9caf2cb1
fix(api): enforce object-level authorization on Flow update/delete/read
...
Flow update, delete, and ID-based read never checked caller identity
against the target record, so any authenticated user could tamper with
or delete another user's Flow by UUID, and the list endpoint returned
every user's flows unfiltered. Added a nullable owner_id column (NULL
= pre-existing flows, readable by all but not editable via the API),
stamp it on create, and check ownership in FlowService before mutating
or returning a single Flow.
Fixes GHSA-qvx2-6v5v-wwrg.
2026-08-23 13:10:11 +02:00
Eric Howard and Eric
86b254bbf9
Custom types replaced with proper custom_types_category value
2026-06-06 18:48:05 -04:00
Eric
f0b0b9bf82
Added category to custom types to reorginize into desired categories
2026-06-06 18:38:35 -04:00
dextmorgn
b317e08e57
feat(api): authenticate SSE via header, drop query-param auth and dead route
2026-06-03 11:28:41 +02:00
dextmorgn
1d409d7929
fix(scan): persist results to existing details column, errors to error column
...
The Scan model exposes details (JSON) and error (Text) columns, but the
enricher/flow tasks assigned to scan.results — a non-mapped attribute.
SQLAlchemy accepted the assignment silently, so commit() never persisted
it and the data was lost. Success paths now write scan.details; failure
paths write scan.error. ScanCreate.results renamed to details to match.
Scan repository tests pass.
2026-05-30 19:02:14 +02:00
dextmorgn
c9d594a8e7
fix(api): load AUTH_SECRET from validated core.auth source
...
deps.py read AUTH_SECRET via os.getenv() before load_dotenv() ran,
yielding None when the secret was only present in .env. Import the
already-validated AUTH_SECRET from core.auth (loads dotenv first and
raises if unset) instead of re-reading it. Removes the dup + ordering bug.
2026-05-30 18:44:07 +02:00
dextmorgn
bb502379bd
feat(api): add collaborator endpoints, profile update, user search and backfill migration
...
- Add GET/POST/PUT/DELETE /investigations/{id}/collaborators endpoints
- Inject current_user_role in all investigation responses
- Add GET/PUT /auth/me for profile management
- Add GET /auth/users/search for share dialog autocomplete
- Add ProfileUpdate schema with extra=forbid
- Add email to ProfileRead
- Add backfill migration for existing investigations missing owner role entries
2026-04-11 14:44:28 +02:00
dextmorgn
972763343e
feat(api): add type detection route and service
...
Add POST /api/types/detect endpoint that detects the type of a text input
by iterating registered types and calling their detect() classmethod.
Returns detected type with fields and primary field pre-filled.
Falls back to Phrase when no type matches.
2026-03-15 12:35:46 +01:00
dextmorgn
2ea40c4eae
feat(api): add input and output type to enricher template
2026-03-09 19:38:42 +01:00
gustavorps
b2cfc67117
fix(app): removing slashes
2026-02-17 04:49:46 -03:00
dextmorgn
6494cee2d0
feat(api): update key service
2026-02-16 09:16:05 +01:00
dextmorgn
eef214bdfa
feat(api): custom types updates
2026-02-14 15:34:28 +01:00
dextmorgn
599fc8353d
feat(api): increate prompt chat length
2026-02-12 23:40:12 +01:00
dextmorgn
a764704fbe
feat(api): progress on templates
2026-02-12 22:04:28 +01:00
dextmorgn
19ee40c46d
feat(app): chat context
2026-02-12 22:04:28 +01:00
dextmorgn
07f32c983a
feat: use ai sdk useChat
2026-02-12 22:04:21 +01:00
dextmorgn
a461f9997d
feat: progress on enricher templates
2026-02-12 22:03:28 +01:00
dextmorgn
53a03575cd
feat(api): enrichers from templates
2026-02-12 22:03:04 +01:00
dextmorgn
177953b216
feat(api): use repositories in services
2026-02-07 17:23:16 +01:00
dextmorgn
2372678bda
feat(api): use dedicated services for business logic
2026-02-05 22:37:31 +01:00
dextmorgn
5977832a1a
feat(api): refactor to use nodeLabel, and proper usage of graphService
2026-01-21 17:19:24 +01:00
dextmorgn
be0880e77d
feat(api) update export json schema
2026-01-11 19:30:38 +01:00
dextmorgn
27c9e91c92
feat(api): add json import support
2026-01-10 18:07:14 +01:00
dextmorgn
1d184bae3b
feat(api): update export schema
2026-01-07 22:03:31 +01:00
dextmorgn
6cc8bf25c0
feat(api): export route
2026-01-07 21:44:02 +01:00
dextmorgn
c4408c2f3e
feat(api): update edge label
2026-01-05 21:45:53 +01:00
dextmorgn
e812f3c855
feat(app): get_current_user_sse
2025-12-17 10:17:42 +01:00
dextmorgn
a15ce33df4
fix(api): patch missing permissions on api routes
2025-12-17 10:16:54 +01:00
dextmorgn
0577080b4e
feat(api): add DNSRecord to raw_material
2025-12-15 16:07:59 +01:00
dextmorgn
6633cc5f4a
fix(api): returned parsed node after insert
2025-12-10 15:15:30 +01:00
dextmorgn
5bb7fae4bd
refactor(api): better batch import
2025-12-05 15:47:43 +01:00
dextmorgn
152a30c92a
feat(api): update flowsint_enrichers registry
2025-11-30 12:50:01 +01:00
dextmorgn
f039d92234
fix(api): typo in icon for social account
2025-11-29 14:08:58 +01:00
dextmorgn
7692fc76f6
feat(api): type registry + better import
2025-11-28 20:08:09 +01:00
dextmorgn
6412b1afe8
feat(api): dedicated sketch event route for refresh
2025-11-27 22:20:28 +01:00
dextmorgn
2123ea5b8d
feat: complete refactor
2025-11-27 17:16:41 +01:00
dextmorgn
59493c108f
feat(api): actions on nodes
2025-11-24 16:42:39 +01:00
dextmorgn
f7ef075ca9
feat(api): usage of whole node object instead of label for transforms
2025-11-21 12:54:33 +01:00
dextmorgn
e3e6effdbe
fix(api): node edit
2025-11-20 18:21:57 +01:00
dextmorgn
7b91bb2442
feat: type validation + simplified transform system
2025-11-19 22:13:38 +01:00
dextmorgn
d0a05046d1
feat(api): add Port type and ip_to_port transform to available items
2025-11-18 12:55:44 +01:00
dextmorgn
238a4087c9
feat(api): add Username to raw-material for flows
2025-11-18 11:03:52 +01:00
dextmorgn
c51205dec3
feat(api): change SocialProfile to SocialAccount
2025-11-17 16:53:45 +01:00
dextmorgn
0427c7919c
feat(api): nodes positions
2025-11-14 17:42:54 +01:00
dextmorgn
d3cf91d120
feat(app): upgrade graph to use pixi
2025-11-14 15:59:39 +01:00
dextmorgn
8e587a7340
feat(api): use of graph_repository to import nodes + add created_at on nodes
2025-11-12 22:43:12 +01:00
dextmorgn
0f4b8c247e
refactor(api): usage of graph_repository for all neo4j actions
2025-11-12 19:36:39 +01:00
dextmorgn
f348a1bcf8
fix(app): logs timestamps
...
fix #38
2025-11-12 19:11:30 +01:00
dextmorgn
951599cb8c
fix: social_profile typo
2025-11-12 00:53:49 +01:00
dextmorgn
3294065ee3
feat(api): add permission checks for analysis and sketches
2025-11-11 20:13:13 +01:00
dextmorgn
Eric HowardandEric
dextmorgn
gustavorps