
    <iw<                        S r SSKJr  SSKJrJr  SSKJr  SSKJ	r	J
r
JrJr  SSKJrJrJr  SSKJr  SSKJr   SS	KJr  SS
KJr  SSKJr  Sr/ SQr " S S\5      r " S S\	5      r " S S\
5      rg! \ a    Sr N0f = f)z(Python STIX2 TAXIICollection Source/Sink    )	HTTPError)v20v21)	_STIXBase)DataSink
DataSourceDataSourceErrorDataStoreMixin)Filter	FilterSetapply_common_filters)parse)deduplicate)r   )r   )ValidationErrorTF)added_afteridtypeversionc                   0   ^  \ rS rSrSrSU 4S jjrSrU =r$ )TAXIICollectionStore   a  Provides an interface to a local/remote TAXII Collection
of STIX data. TAXIICollectionStore is a wrapper
around a paired TAXIICollectionSink and TAXIICollectionSource.

Args:
    collection (taxii2.Collection): TAXII Collection instance
    allow_custom (bool): whether to allow custom STIX content to be
        pushed/retrieved. Defaults to True for TAXIICollectionSource
        side(retrieving data) and False for TAXIICollectionSink
        side(pushing data). However, when parameter is supplied, it will
        be applied to both TAXIICollectionSource/Sink.
    items_per_page (int): How many STIX objects to request per call
        to TAXII Server. The value can be tuned, but servers may override
        if their internal limit is surpassed. Used by TAXIICollectionSource

c                 ^   > Uc  SnSnOU=pT[         [        U ]  [        XUS9[	        XS9S9  g )NTF)allow_customitems_per_pager   )sourcesink)superr   __init__TAXIICollectionSourceTAXIICollectionSink)self
collectionr   r   allow_custom_sourceallow_custom_sink	__class__s         O/home/james-whalen/.local/lib/python3.13/site-packages/stix2/datastore/taxii.pyr   TAXIICollectionStore.__init__+   sF    "& %6BB"D2(ftu$ZP 	3 	
     )N  )__name__
__module____qualname____firstlineno____doc__r   __static_attributes____classcell__r&   s   @r'   r   r      s     

 

r)   r   c                   :   ^  \ rS rSrSrSU 4S jjrSS jrSrU =r$ )r!   8   a   Provides an interface for pushing STIX objects to a local/remote
TAXII Collection endpoint.

Args:
    collection (taxii2.Collection): TAXII2 Collection instance
    allow_custom (bool): Whether to allow custom STIX content to be
        added to the TAXIICollectionSink. Default: False

c                    > [         [        U ]  5         [        (       d  [	        S5      e UR
                  (       a  Xl        O[        S5      eX l
        g ! [        [        4 a  n[        SU5      eS nAff = f)NzAtaxii2client library is required for usage of TAXIICollectionSinkzlThe TAXII Collection object provided does not have write access to the underlying linked Collection resourcezThe underlying TAXII Collection resource defined in the supplied TAXII Collection object provided could not be reached. Receved error:)r   r!   r   _taxii2_clientImportError	can_writer#   r	   r   r   r   )r"   r#   r   er&   s       r'   r   TAXIICollectionSink.__init__B   s}    !413~abb	##",%D  ) ?+ 	!STU 	s   A A A6%A11A6c                 \   [        U[        5      (       a}  US   S:X  a  UR                  SSS9nGOSU;   a.  [        R                  " XR
                  S9R                  SSS9nGO[        R                  " XR
                  S9R                  SSS9nGO[        U[        5      (       a  US   S:X  a$  [        XR
                  US9R                  SSS9nGO=SU;   a.  [        R                  " XR
                  S9R                  SSS9nGO	[        R                  " XR
                  S9R                  SSS9nO[        U[        5      (       a  U H  nU R                  XBS	9  M     g
[        U[        5      (       a  [        XR
                  US9nUS   S:X  a  UR                  SSS9nOkSU;   a-  [        R                  " XR
                  S9R                  SSS9nO8[        R                  " XR
                  S9R                  SSS9nO[        S5      eU R                  R                  U5        g
)a  Add/push STIX content to TAXII Collection endpoint

Args:
    stix_data (STIX object OR dict OR str OR list): valid STIX2
        content in a STIX object (or Bundle), STIX object dict (or
        Bundle dict), or a STIX2 json encoded string, or list of
        any of the following.
    version (str): If present, it forces the parser to use the version
        provided. Otherwise, the library will make the best effort based
        on checking the "spec_version" property.

r   bundlezutf-8F)encodingensure_asciispec_versionr   r   r   )r   Nznstix_data must be as STIX object(or list of),json formatted STIX (or list of), or a json formatted STIX bundle)
isinstancer   	serializer   Bundler   r   dictr   listaddstr	TypeErrorr#   add_objects)r"   	stix_datar   r=   objs        r'   rG   TAXIICollectionSink.addX   s    i++ H,",,gE,R9,I<M<MNXXbix}X~I<M<MNXXbix}X~	4(( H,y7H7HRYZddnu  EJd  K9,I<M<MNXXbix}X~I<M<MNXXbix}X~	4(( . !	3''i6G6GQXYI H,",,gE,R9,I<M<MNXXbix}X~I<M<MNXXbix}X~   M  N  N##F+r)   )r   r#   )FN)	r,   r-   r.   r/   r0   r   rG   r1   r2   r3   s   @r'   r!   r!   8   s    ),5, 5,r)   r!   c                   T   ^  \ rS rSrSrS	U 4S jjrS
S jrS
S jrSS jrS r	Sr
U =r$ )r       a  Provides an interface for searching/retrieving STIX objects
from a local/remote TAXII Collection endpoint.

Args:
    collection (taxii2.Collection): TAXII Collection instance
    allow_custom (bool): Whether to allow custom STIX content to be
        added to the FileSystemSink. Default: True
    items_per_page (int): How many STIX objects to request per call
        to TAXII Server. The value can be tuned, but servers may override
        if their internal limit is surpassed.

c                    > [         [        U ]  5         [        (       d  [	        S5      e UR
                  (       a  Xl        O[        S5      eX l
        X0l        g ! [        [        4 a  n[        SU5      eS nAff = f)NzCtaxii2client library is required for usage of TAXIICollectionSourcezkThe TAXII Collection object provided does not have read access to the underlying linked Collection resourcezThe underlying TAXII Collection resource defined in the supplied TAXII Collection object provided could not be reached. Recieved error:)r   r    r   r7   r8   can_readr#   r	   r   r   r   r   )r"   r#   r   r   r:   r&   s        r'   r   TAXIICollectionSource.__init__   s    #T35~cdd	""",%D  ), ?+ 	!TUV 	s   A A A<+A77A<c                    [        5       nU R                  (       a  UR                  U R                  5        U(       a  UR                  U5         U R                  R	                  U5      S   n[        [        XT5      5      n[        U5      (       a%  [        US   U R                  US9nUS   U:w  a  SnU$ SnU$ ! [         a2  nUR                  R                  S:X  a  / n SnANd[        SU5      eSnAff = f)a  Retrieve STIX object from local/remote STIX Collection
endpoint.

Args:
    stix_id (str): The STIX ID of the STIX object to be retrieved.
    version (str): If present, it forces the parser to use the version
        provided. Otherwise, the library will make the best effort based
        on checking the "spec_version" property.
    _composite_filters (FilterSet): collection of filters passed from
        the parent CompositeDataSource, not user supplied

Returns:
    (STIX object): STIX object that has the supplied STIX ID.
        The STIX object is received from TAXII has dict, parsed into
        a python STIX object and then returned

objects  z(TAXII Collection resource returned errorNr   rA   r   )r   filtersrG   r#   
get_objectrF   r   r   responsestatus_coder	   lenr   r   )r"   stix_idr   _composite_filtersquery	stix_objsstix_objr:   s           r'   getTAXIICollectionSource.get   s    & <<IIdll#II()
	U227;IFI0BCH x==Xa[t7H7HRYZH~(  H!  	Uzz%%, %&PRSTT	Us   2B; ;
C7C2&C22C7c           	          [        SSU5      [        SSS5      /nU R                  XCS9nU Vs/ s H  n[        X`R                  US9PM     nnU Vs/ s H  ofS   U:X  d  M  UPM     nnU$ s  snf s  snf )a"  Retrieve STIX object from local/remote TAXII Collection
endpoint, all versions of it

Args:
    stix_id (str): The STIX ID of the STIX objects to be retrieved.
    version (str): If present, it forces the parser to use the version
        provided. Otherwise, the library will make the best effort based
        on checking the "spec_version" property.
    _composite_filters (FilterSet): collection of filters passed from the parent
        CompositeDataSource, not user supplied

Returns:
    (see query() as all_versions() is just a wrapper)

r   =r   all)r^   r]   rA   )r   r^   r   r   )r"   r\   r   r]   r^   all_datar`   all_data_cleans           r'   all_versions"TAXIICollectionSource.all_versions   s    $ 4g&9c5)

 ::E:Q fnnemYaE(1B1BGTemn 4<Y8x~QX?X(8Y o Zs   A,A1"A1c           	         [        U5      nU R                  (       a  UR                  U R                  5        U(       a  UR                  U5        U R                  U5      n[	        S U 5       5      n/ n[        U R                  [        R                  5      (       a  [        R                  O[        R                  n U" U R                  R                  4SU R                  0UD6 H$  nUR                  UR                  S/ 5      5        M&     ['        U5      nUR)                  U5        [+        [-        Xa5      5      nU V
s/ s H  n
[/        XR0                  US9PM     nn
U$ ! [         aK  n	U	R                   R"                  S:X  a  [%        SU	5      eU	R                   R"                  S:w  a  e  Sn	A	NSn	A	ff = fs  sn
f )	a  Search and retreive STIX objects based on the complete query

A "complete query" includes the filters from the query, the filters
attached to MemorySource, and any filters passed from a
CompositeDataSource (i.e. _composite_filters)

Args:
    query (list): list of filters to search on
    version (str): If present, it forces the parser to use the version
        provided. Otherwise, the library will make the best effort based
        on checking the "spec_version" property.
    _composite_filters (FilterSet): collection of filters passed from
        the CompositeDataSource, not user supplied

Returns:
    (list): list of STIX objects that matches the supplied
        query. The STIX objects are received from TAXII as dicts,
        parsed into python STIX objects and then returned.

c              3   P   #    U  H  oR                   UR                  4v   M     g 7frN   )propertyvalue).0fs     r'   	<genexpr>.TAXIICollectionSource.query.<locals>.<genexpr>'  s     !OA::qww"7s   $&per_requestrU   rV   zThe requested STIX objects for the TAXII Collection resource defined in the supplied TAXII Collection object are either not found or access is denied. Received error: i  NrA   )r   rW   rG   _parse_taxii_filtersrE   rB   r#   tcv21
Collectionas_pagestcv20get_objectsr   extendra   r   rY   rZ   r	   r   removerF   r   r   r   )r"   r^   r   r]   taxii_filterstaxii_filters_dictrf   paged_requestresourcer:   stix_obj_dictr_   s               r'   r^   TAXIICollectionSource.query  s   * %  <<IIdll#II() 11%8 "!O!OO *4T__eFVFV*W*W]b]k]k	)$//*E*E}SWSfSf}j|}Y ;< ~( x( 	]#,X=> qyypx_lU=7H7HRYZpx	y7  	zz%%,%012  ''3. /	2 zs    ?AE& F>&
F;0AF66F;c                     / nU H<  nUR                   [        ;   d  M  UR                  S:X  d  M+  UR                  U5        M>     U$ )a  Parse out TAXII filters that the TAXII server can filter on

Does not put in TAXII spec format as the TAXII2Client (that we use)
does this for us.

Note:
    Currently, the TAXII2Client can handle TAXII filters where the
    filter value is list, as both a comma-seperated string or python
    list.

    For instance - "?match[type]=indicator,sighting" can be in a
    filter in any of these formats:

    Filter("type", "=", "indicator,sighting")
    Filter("type", "=", ["indicator", "sighting"])

Args:
    query (list): list of filters to extract which ones are TAXII
        specific.

Returns:
    A list of TAXII filters that meet the TAXII filtering parameters.

rd   )rl   TAXII_FILTERSopappend)r"   r^   r{   filter_s       r'   rs   *TAXIICollectionSource._parse_taxii_filtersL  sB    2 G=0WZZ35F$$W-  r)   )r   r#   r   )Tr+   )NN)NNN)r,   r-   r.   r/   r0   r   ra   rh   r^   rs   r1   r2   r3   s   @r'   r    r       s*    -.0d@DL r)   r    N) r0   requests.exceptionsr   stix2r   r   
stix2.baser   stix2.datastorer   r   r	   r
   stix2.datastore.filtersr   r   r   stix2.parsingr   stix2.utilsr   taxii2clientrw   rt   taxii2client.exceptionsr   r7   r8   r   r   r!   r    r*   r)   r'   <module>r      s    . )     L K  #))7N
 9
> 
<U,( U,p[J [{  Ns   A4 4A?>A?