Update modified timestamps on save (closes #1191)

.github/workflows/feedtest.yml

@@ -3,7 +3,6 @@ name: Test feeds
 on:
   schedule:
     - cron: '0 6 * * 3' # Run every Wednesday at 06:00 UTC
-  pull_request:
 
 jobs:
   debug:

core/schemas/audit.py

@@ -72,22 +72,23 @@ def log_timeline(
         if not action:
             action = "update" if old else "create"
         if old:
-            old_dump = old.model_dump()
-            new_dump = new.model_dump()
+            old_dump = old.model_dump(exclude=["modified"])
+            new_dump = new.model_dump(exclude=["modified"])
             # only retain fields that are different
             for key in old_dump:
                 if old_dump[key] == new_dump[key]:
                     del new_dump[key]
             details = new_dump
         else:
             details = new.model_dump()
-    TimelineLog(
-        timestamp=datetime.datetime.now(),
-        actor=username,
-        target_id=new.extended_id,
-        action=action,
-        details=details,
-    ).save()
+    if details:
+        TimelineLog(
+            timestamp=datetime.datetime.now(),
+            actor=username,
+            target_id=new.extended_id,
+            action=action,
+            details=details,
+        ).save()
 
 
 def log_timeline_tags(actor: str, obj: "AllObjectTypes", old_tags: list[str]):

core/schemas/dfiq.py

@@ -165,6 +165,10 @@ def load(cls, object: dict):
             return TYPE_MAPPING[object["type"]](**object)
         return cls(**object)
 
+    def save(self, *args, **kwargs) -> "DFIQBase":
+        self.modified = now()
+        return super().save(*args, **kwargs)
+
     @classmethod
     def parse_yaml(cls, yaml_string: str) -> dict[str, Any]:
         try:

core/schemas/entity.py

@@ -46,6 +46,10 @@ def load(cls, object: dict) -> "EntityTypes":
             raise ValueError("Attempted to instantiate an undefined entity type.")
         return loader(**object)
 
+    def save(self, *args, **kwargs) -> "Entity":
+        self.modified = now()
+        return super().save(*args, **kwargs)
+
     @classmethod
     def is_valid(cls, object: "Entity") -> bool:
         return False

core/schemas/indicator.py

@@ -69,6 +69,10 @@ def load(cls, object: dict) -> "IndicatorTypes":
             raise ValueError("Attempted to instantiate an undefined indicator type.")
         return loader(**object)
 
+    def save(self, *args, **kwargs) -> "Indicator":
+        self.modified = now()
+        return super().save(*args, **kwargs)
+
     def match(self, value: str) -> Any | None:
         raise NotImplementedError
 

core/schemas/observable.py

@@ -1,5 +1,3 @@
-# TODO Observable value normalization
-
 import datetime
 import io
 import os
@@ -38,10 +36,12 @@ class Observable(YetiTagModel, database_arango.ArangoYetiConnector):
     _root_type: Literal["observable"] = "observable"
 
     value: str = Field(min_length=1)
-    created: datetime.datetime = Field(default_factory=now)
     context: list[dict] = []
     last_analysis: dict[str, datetime.datetime] = {}
 
+    created: datetime.datetime = Field(default_factory=now)
+    modified: datetime.datetime = Field(default_factory=now)
+
     @computed_field(return_type=Literal["observable"])
     @property
     def root_type(self):
@@ -53,6 +53,10 @@ def load(cls, object: dict) -> "ObservableTypes":  # noqa: F821
             return TYPE_MAPPING[object["type"]](**object)
         raise ValueError("Attempted to instantiate an undefined observable type.")
 
+    def save(self, *args, **kwargs) -> "Observable":
+        self.modified = now()
+        return super().save(*args, **kwargs)
+
     @computed_field
     def is_valid(self) -> bool:
         valid = True
@@ -110,6 +114,7 @@ def delete_context(
             else:
                 del self.context[idx]
                 break
+
         return self.save()
 
 

core/web/apiv2/dfiq.py

@@ -283,7 +283,9 @@ def patch(httpreq: Request, request: PatchDFIQRequest, dfiq_id) -> dfiq.DFIQType
             detail=f"DFIQ type mismatch: {db_dfiq.type} != {update_data.type}",
         )
     db_dfiq.get_tags()
-    updated_dfiq = db_dfiq.model_copy(update=update_data.model_dump())
+    updated_dfiq = db_dfiq.model_copy(
+        update=update_data.model_dump(exclude=["created"])
+    )
     new = updated_dfiq.save()
     audit.log_timeline(httpreq.state.username, new, old=db_dfiq)
     new.update_parents()