Replace category drilldown with a search bar over a flat type list.
GET /types gains a flat=true param that flattens categories server-side
(custom types included); useActionItems(true) opts into it while every
other caller keeps the nested default.
launch_enricher took payload.sketch_id on trust: any authenticated caller
could dispatch an enricher against a sketch belonging to someone else, and the
worker would write its findings into that sketch.
EnricherService gains get_sketch_for_launch, the same lookup launch_flow has
used since ac485e2c: resolve the sketch, then _check_permission for "update"
on its investigation. No role row means no access, so an unknown sketch 404s
and a viewer or a stranger gets 403, matching the flow route's responses.
The check runs before the graph read, so a denied caller never reaches Neo4j
and never queues a task.
Unlike FlowService's copy, the sketch id is parsed to a UUID first.
SketchRepository.get_by_id binds it as one, so a non-UUID string reached
SQLAlchemy and raised, which would have turned a bad id into a 500 instead of
a denial.
EnricherCreate/EnricherRead/EnricherUpdate had no importer anywhere in the
repo and were the whole content of app/api/schemas/enricher.py, so the module
goes with them.
get_enrichers' custom-type branch returns [] before reaching the
wobbly_type=True registry listing. The early return stays (why a published
custom type lists no enrichers is a separate question); the line it strands
does not.
EnricherBase.set_params() had no caller and no dynamic-dispatch site;
resolve_params/async_init assign self.params directly.
flowsint-api/app/utils.py — deleted entirely. Nothing imports it (its
one plausibly-used function, extract_input_schema_flow, is actually
imported from flowsint_core.utils everywhere it's called); it was a
never-referenced full duplicate of the core module.
flowsint_core/utils.py and flowsint_enrichers/utils.py — dropped
get_domain_from_ssl (identical in both, zero callers anywhere in the
repo) and its now-unused ssl/socket/Tuple/cast imports.
flowsint_enrichers/utils.py further trimmed to just get_root_domain,
its only function actually imported anywhere (domain/to_root_domain.py).
The rest (is_valid_ip, resolve_type, extract_enricher, flatten, ...)
had zero callers and zero test coverage — dead since the file was
apparently copy-pasted from flowsint_core/utils.py rather than reusing
it directly.
Last batch of real fixes plus one more scoped override:
- DockerTool.get_image() read cls.image as a class attribute, but
__init__ only ever sets it on the instance (self.image = ...) — real
bug (would AttributeError if get_image() were ever called before an
instance existed with a subclass not also declaring image at class
level). Declared `image: str` on the base to document what's
actually relied on: subclasses set it as a class attribute, __init__
shadows it per-instance with the tagged form.
- ReconCrawlTool.version() was declared -> str but its body was a bare
`pass` (returns None) — no callers exist, so raises NotImplementedError
with a comment instead of guessing a fake version string.
- ReconCrawlTool.launch()'s args param defaulted to None but the body
calls args.get(...) unconditionally — real crash risk if ever called
without args (never observed since the one caller always passes a
dict), guarded with `args = args or {}`.
- Extended flowsint-core's tests.* override (assignment, override) for
the same InputType/OutputType-pattern reason as the existing entries:
MockEnricher/ResolveEnricher fixtures reassign InputType/OutputType
and vary scan()/postprocess() signatures per the documented pattern,
same as production enrichers.
- permissions.py, alembic/env.py, and one alembic migration's untyped
params/standard-boilerplate arg-type gaps.
Ratchet is now clean except the accepted import-untyped debt (86
errors — cross-package imports needing py.typed markers project-wide,
deliberately out of scope: adding them earlier in this branch
ballooned the count from 478 to 1423 by unmasking the full ~2200
pre-existing backlog instead of shrinking it).
Verified: all 4 packages' test suites pass (397 + 32 + 6 + 54).
Without known_first_party, isort's own-package detection depends on
which files it's given: sorted alone, a file inside flowsint_enrichers
gets flowsint_enrichers imports grouped separately from flowsint_core/
flowsint_types; sorted together with the rest of the workspace (as
`make lint` and CI do), they collapse into one group. lint-staged only
ever passes the staged subset, so a commit could pass the pre-commit
hook locally and still fail `make lint` in CI — silently, since both
are "isort says it's fine," just about different file sets.
Pin the four packages as known_first_party in all four pyproject.toml
so grouping is the same regardless of invocation scope. The rest of
the diff is isort re-normalizing ~100 files to the now-consistent
order — import statements only, verified against the diff.
Each is a real defect, not style — flake8 just never ran before to
catch them:
- logger.py: bare `except:` around a queue drain swallowed everything
including KeyboardInterrupt/SystemExit instead of just queue.Empty
- dockertool.py: bare `except:` narrowed to Exception
- permissions.py: duplicate `HTTPException` import, dead code
- test_registry.py: `test_get_by_lower_key` was defined twice — the
second definition silently shadowed the first, so only one ever ran
- to_ports.py / test_investigation_repository.py: assigned-but-unused
local variables, dead code
- to_whois.py / to_infos.py: documented pyflakes false positive
(OutputType is a class attr, resolves fine at def-time) — noqa'd
with an explanation instead of restructuring working code
- E712 (`== True`/`== False` → `is True`/`is False`) across 7 test
files, F541 (f-strings with no placeholders) across 5 enrichers,
E402 (import order) noqa'd in 2 files where the order is deliberate
(env vars set before import; documented circular-import workaround)
Flow update, delete, and ID-based read never checked caller identity
against the target record, so any authenticated user could tamper with
or delete another user's Flow by UUID, and the list endpoint returned
every user's flows unfiltered. Added a nullable owner_id column (NULL
= pre-existing flows, readable by all but not editable via the API),
stamp it on create, and check ownership in FlowService before mutating
or returning a single Flow.
Fixes GHSA-qvx2-6v5v-wwrg.
The Scan model exposes details (JSON) and error (Text) columns, but the
enricher/flow tasks assigned to scan.results — a non-mapped attribute.
SQLAlchemy accepted the assignment silently, so commit() never persisted
it and the data was lost. Success paths now write scan.details; failure
paths write scan.error. ScanCreate.results renamed to details to match.
Scan repository tests pass.
allow_origins was ["*"] together with allow_credentials=True, which is
both insecure and rejected by browsers for credentialed requests. Read a
comma-separated ALLOWED_ORIGINS env var instead, defaulting to the Vite
dev origin http://localhost:5173. Documented in .env.example.
deps.py read AUTH_SECRET via os.getenv() before load_dotenv() ran,
yielding None when the secret was only present in .env. Import the
already-validated AUTH_SECRET from core.auth (loads dotenv first and
raises if unset) instead of re-reading it. Removes the dup + ordering bug.
Add POST /api/types/detect endpoint that detects the type of a text input
by iterating registered types and calling their detect() classmethod.
Returns detected type with fields and primary field pre-filled.
Falls back to Phrase when no type matches.
dextmorgn
Eric HowardandEric
Melih Daskiran
dextmorgn
gustavorps