AIL-framework/bin/lib/Tracker.py

#!/usr/bin/env python3
# -*-coding:UTF-8 -*
import json
import os
import logging
import logging.config
import re
import sys
import time
import uuid
import yara
import datetime
import base64

import math

from collections import defaultdict
from markupsafe import escape
from textblob import TextBlob
from nltk.tokenize import RegexpTokenizer

sys.path.append(os.environ['AIL_BIN'])
##################################
# Import Project packages
##################################
from packages import Date
from lib.ail_core import get_objects_tracked, get_object_all_subtypes, get_objects_retro_hunted
from lib import ail_logger
from lib import ail_orgs
from lib import ConfigLoader
from lib import item_basic
from lib import Tag

# LOGS
logging.config.dictConfig(ail_logger.get_config(name='modules'))
logger = logging.getLogger()

config_loader = ConfigLoader.ConfigLoader()
r_cache = config_loader.get_redis_conn("Redis_Cache")
r_tracker = config_loader.get_db_conn("Kvrocks_Trackers")
config_loader = None

# NLTK tokenizer
TOKENIZER = None

def init_tokenizer():
    global TOKENIZER
    TOKENIZER = RegexpTokenizer('[\&\~\:\;\,\.\(\)\{\}\|\[\]\\\\/\-/\=\'\"\%\$\?\@\+\#\_\^\<\>\!\*\n\r\t\s]+',
                                gaps=True, discard_empty=True)

def get_special_characters():
    special_characters = set('[<>~!?@#$%^&*|()_-+={}":;,.\'\n\r\t]/\\')
    special_characters.add('\\s')
    return special_characters

###############
#### UTILS ####
def is_valid_uuid_v4(curr_uuid):
    if not curr_uuid:
        return False
    curr_uuid = curr_uuid.replace('-', '')
    try:
        uuid_test = uuid.UUID(hex=curr_uuid, version=4)
        return uuid_test.hex == curr_uuid
    except:
        return False

def is_valid_regex(tracker_regex):
    try:
        re.compile(tracker_regex)
        return True
    except:
        return False

def is_valid_mail(email):
    email_regex = r'[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,6}'
    email_regex = re.compile(email_regex)
    result = email_regex.match(email)
    if result:
        return True
    else:
        return False

def verify_mail_list(mail_list):
    for mail in mail_list:
        if not is_valid_mail(mail):
            return {'status': 'error', 'reason': 'Invalid email', 'value': mail}, 400
    return None

## -- UTILS -- ##
#################

###################
####  TRACKER  ####

class Tracker:
    def __init__(self, tracker_uuid):
        self.uuid = tracker_uuid

    def get_uuid(self):
        return self.uuid

    def exists(self):
        return r_tracker.exists(f'tracker:{self.uuid}')

    def _get_field(self, field):
        return r_tracker.hget(f'tracker:{self.uuid}', field)

    def _set_field(self, field, value):
        r_tracker.hset(f'tracker:{self.uuid}', field, value)

    def get_date(self):
        return self._get_field('date')

    def get_last_change(self, r_str=False):
        last_change = self._get_field('last_change')
        if r_str and last_change:
            last_change = datetime.datetime.fromtimestamp(float(last_change)).strftime('%Y-%m-%d %H:%M:%S')
        return last_change

    def get_first_seen(self):
        return self._get_field('first_seen')

    def get_last_seen(self):
        return self._get_field('last_seen')

    def _set_first_seen(self, date):
        self._set_field('first_seen', date)

    def _set_last_seen(self, date):
        self._set_field('last_seen', date)

    def _exist_date(self, date):
        return r_tracker.exists(f'tracker:objs:{self.uuid}:{date}')

    # TODO: ADD CACHE ???
    def update_daterange(self, date=None):
        first_seen = self.get_first_seen()
        # Added Object
        if date:
            date = int(date)
            first_seen = self.get_first_seen()
            # if op == 'add':
            if not first_seen:
                self._set_first_seen(date)
                self._set_last_seen(date)
            else:
                first_seen = int(first_seen)
                last_seen = int(self.get_last_seen())
                if date < first_seen:
                    self._set_first_seen(date)
                if date > last_seen:
                    self._set_last_seen(date)
        else:
            last_seen = self.get_last_seen()
            if first_seen and last_seen:
                valid_first_seen = self._exist_date(first_seen)
                valid_last_seen = self._exist_date(last_seen)
                # update first seen
                if not valid_first_seen:
                    for date in Date.get_daterange(first_seen, last_seen):
                        if self._exist_date(date):
                            self._set_first_seen(date)
                            valid_first_seen = True
                            break
                # update last seen
                if not valid_last_seen:
                    for date in reversed(Date.get_daterange(first_seen, last_seen)):
                        if self._exist_date(date):
                            self._set_first_seen(date)
                            valid_last_seen = True
                            break
                if not valid_first_seen or not valid_last_seen:
                    r_tracker.hdel(f'tracker:{self.uuid}', 'first_seen')
                    r_tracker.hdel(f'tracker:{self.uuid}', 'last_seen')

    def get_description(self):
        return self._get_field('description')

    ## LEVEL ##

    def get_level(self):
        level = int(self._get_field('level'))
        if not level:
            level = 0
        return int(level)

    def set_level(self, level, org_uuid):
        tracker_type = self.get_type()
        if level == 0:  # user only
            user_id = self.get_user()
            r_tracker.sadd(f'user:tracker:{user_id}', self.uuid)
            r_tracker.sadd(f'user:tracker:{user_id}:{tracker_type}', self.uuid)
        elif level == 1:  # global
            r_tracker.sadd('global:tracker', self.uuid)
            r_tracker.sadd(f'global:tracker:{tracker_type}', self.uuid)
        elif level == 2:  # org only
            r_tracker.sadd(f'org:tracker:{org_uuid}', self.uuid)
            r_tracker.sadd(f'org:tracker:{org_uuid}:{tracker_type}', self.uuid)
            self.add_to_org(org_uuid)
        self._set_field('level', level)

    def reset_level(self, old_level, new_level, new_org_uuid):
        if old_level == 0:
            user_id = self.get_user()
            r_tracker.srem(f'user:tracker:{user_id}', self.uuid)
            r_tracker.srem(f'user:tracker:{user_id}:{self.get_type()}', self.uuid)
        elif old_level == 1:
            r_tracker.srem('global:tracker', self.uuid)
            r_tracker.srem(f'global:tracker:{self.get_type()}', self.uuid)
        # Org
        elif old_level == 2:
            old_org = self.get_org()
            r_tracker.srem(f'org:tracker:{old_org}', self.uuid)
            r_tracker.srem(f'org:tracker:{old_org}:{self.get_type()}', self.uuid)
            ail_orgs.remove_obj_to_org(old_org, 'tracker', self.uuid)
        self.set_level(new_level, new_org_uuid)

    def check_level(self, user_org, user_id):
        level = self.get_level()
        if level == 1:
            return True
        elif level == 0:
            return self.get_user() == user_id
        elif level == 2:
            return self.get_org() == user_org

    def is_level_user(self):
        return self.get_level() == 0

    def is_level_org(self):
        return self.get_level() == 2

    def is_level_global(self):
        return self.get_level() == 1

    ## ORG ##

    def get_creator_org(self):
        return self._get_field('creator_org')

    def get_org(self):
        return self._get_field('org')

    def add_to_org(self, org_uuid):
        self._set_field('org', org_uuid)
        ail_orgs.add_obj_to_org(org_uuid, 'tracker', self.uuid)

    ## -ORG- ##

    def get_filters(self):
        filters = self._get_field('filters')
        if not filters:
            return {}
        else:
            return json.loads(filters)

    def set_filters(self, filters):
        if filters:
            self._set_field('filters', json.dumps(filters))

    def del_filters(self, tracker_type, to_track):
        filters = self.get_filters()
        if not filters:
            filters = get_objects_tracked()
        for obj_type in filters:
            r_tracker.srem(f'trackers:objs:{tracker_type}:{obj_type}', to_track)
            r_tracker.srem(f'trackers:uuid:{tracker_type}:{to_track}', f'{self.uuid}:{obj_type}')
        r_tracker.hdel(f'tracker:{self.uuid}', 'filters')

    def get_tracked(self):
        return self._get_field('tracked')

    def get_type(self):
        return self._get_field('type')

    def get_tags(self):
        return r_tracker.smembers(f'tracker:tags:{self.uuid}')

    def _set_tags(self, tags):
        for tag in tags:
            r_tracker.sadd(f'tracker:tags:{self.uuid}', tag)
            Tag.create_custom_tag(tag)  # TODO CUSTOM TAGS

    def _del_tags(self):
        return r_tracker.delete(f'tracker:tags:{self.uuid}')

    def mail_export(self):
        return r_tracker.exists(f'tracker:mail:{self.uuid}')

    def get_mails(self):
        return r_tracker.smembers(f'tracker:mail:{self.uuid}')

    def _set_mails(self, mails):
        for mail in mails:
            r_tracker.sadd(f'tracker:mail:{self.uuid}', escape(mail))

    def _del_mails(self):
        r_tracker.delete(f'tracker:mail:{self.uuid}')

    def get_user(self):
        return self._get_field('user_id')

    def webhook_export(self):
        webhook = self.get_webhook()
        return webhook is not None and webhook

    def get_webhook(self):
        return r_tracker.hget(f'tracker:{self.uuid}', 'webhook')

    def get_sparkline(self, nb_day=6):
        date_range_sparkline = Date.get_date_range(nb_day)
        sparkline = []
        for date in date_range_sparkline:
            nb_seen_this_day = self.get_nb_objs_by_date(date)
            if nb_seen_this_day is None:
                nb_seen_this_day = 0
            sparkline.append(int(nb_seen_this_day))
        return sparkline

    def get_rule(self):
        yar_path = self.get_tracked()
        return yara.compile(filepath=os.path.join(get_yara_rules_dir(), yar_path))

    def get_meta(self, options):
        if not options:
            options = set()
        meta = {'uuid': self.uuid,
                'tracked': self.get_tracked(),  # TODO TO CHECK
                'type': self.get_type(),
                'date': self.get_date(),
                'first_seen': self.get_first_seen(),
                'last_seen': self.get_last_seen()}
        if 'org' in options:
            meta['org'] = self.get_org()
            if 'org_name' in options:
                meta['org_name'] = ail_orgs.Organisation(self.get_org()).get_name()
        if 'user' in options:
            meta['user'] = self.get_user()
        if 'level' in options:
            meta['level'] = self.get_level()
        if 'description' in options:
            meta['description'] = self.get_description()
        if 'nb_objs' in options:
            meta['nb_objs'] = self.get_nb_objs()
        if 'tags' in options:
            meta['tags'] = self.get_tags()
        if 'filters' in options:
            meta['filters'] = self.get_filters()
        if 'mails' in options:
            meta['mails'] = self.get_mails()
        if 'webhooks' in options:
            meta['webhook'] = self.get_webhook()
        if 'sparkline' in options:
            meta['sparkline'] = self.get_sparkline(6)
        return meta

    def _add_to_dashboard(self, obj_type, subtype, obj_id):
        mess = f'{self.uuid}:{int(time.time())}:{obj_type}:{subtype}:{obj_id}'
        if self.is_level_user():
            user = self.get_user()
            r_tracker.lpush(f'trackers:user:{user}', mess)
            r_tracker.ltrim(f'trackers:user:{user}', 0, 9)
        else:
            r_tracker.lpush('trackers:dashboard', mess)
            r_tracker.ltrim(f'trackers:dashboard', 0, 9)

    def get_nb_objs_by_type(self, obj_type):
        return r_tracker.scard(f'tracker:objs:{self.uuid}:{obj_type}')

    def get_objs_by_type(self, obj_type):
        return r_tracker.smembers(f'tracker:objs:{self.uuid}:{obj_type}')

    def get_nb_objs(self):
        objs = {}
        for obj_type in get_objects_tracked():
            nb = self.get_nb_objs_by_type(obj_type)
            if nb:
                objs[obj_type] = nb
        return objs

    def get_objs(self):
        objs = []
        for obj_type in get_objects_tracked():
            for obj in self.get_objs_by_type(obj_type):
                subtype, obj_id = obj.split(':', 1)
                objs.append((obj_type, subtype, obj_id))
        return objs

    def get_nb_objs_by_date(self, date):
        return r_tracker.scard(f'tracker:objs:{self.uuid}:{date}')

    def get_objs_by_date(self, date):
        return r_tracker.smembers(f'tracker:objs:{self.uuid}:{date}')

    def get_objs_by_daterange(self, date_from, date_to):
        objs = set()
        for date in Date.get_daterange(date_from, date_to):
            objs |= self.get_objs_by_date(date)
        return objs

    def get_obj_dates(self, obj_type, subtype, obj_id):
        return r_tracker.smembers(f'obj:tracker:{obj_type}:{subtype}:{obj_id}:{self.uuid}')

    # - TODO Data Retention TO Implement - #
    # Or Daily/Monthly Global DB Cleanup:
    #    Iterate on each tracker:
    #       Iterate on each Obj:
    #           Iterate on each date:
    #               Delete from tracker range if date limit exceeded
    # - TODO
    def add(self, obj_type, subtype, obj_id, date=None):
        if not subtype:
            subtype = ''
        if not date:
            date = Date.get_today_date_str()

        new_obj_date = r_tracker.sadd(f'tracker:objs:{self.uuid}:{date}', f'{obj_type}:{subtype}:{obj_id}')
        r_tracker.sadd(f'obj:trackers:{obj_type}:{subtype}:{obj_id}', self.uuid)

        # Only save object match date - Needed for the DB Cleaner
        r_tracker.sadd(f'obj:tracker:{obj_type}:{subtype}:{obj_id}:{self.uuid}', date)
        r_tracker.sadd(f'tracker:objs:{self.uuid}:{obj_type}', f'{subtype}:{obj_id}')

        if new_obj_date:
            self.update_daterange(date)

        self._add_to_dashboard(obj_type, subtype, obj_id)

    def remove(self, obj_type, subtype, obj_id):
        if not subtype:
            subtype = ''

        for date in self.get_obj_dates(obj_type, subtype, obj_id):
            r_tracker.srem(f'tracker:objs:{self.uuid}:{date}', f'{obj_type}:{subtype}:{obj_id}')
            r_tracker.srem(f'obj:tracker:{obj_type}:{subtype}:{obj_id}:{self.uuid}', date)

        r_tracker.srem(f'obj:trackers:{obj_type}:{subtype}:{obj_id}', self.uuid)
        r_tracker.srem(f'tracker:objs:{self.uuid}:{obj_type}', f'{subtype}:{obj_id}')
        self.update_daterange()

    # TODO escape custom tags
    # TODO escape mails ????
    def create(self, tracker_type, to_track, org, user_id, level, description=None, filters={}, tags=[], mails=[], webhook=None):
        if self.exists():
            raise Exception('Error: Tracker already exists')

        # YARA
        if tracker_type == 'yara_custom' or tracker_type == 'yara_default':
            to_track = save_yara_rule(tracker_type, to_track, tracker_uuid=self.uuid)
            tracker_type = 'yara'

        elif tracker_type == 'typosquatting':

            from ail_typo_squatting import runAll

            domain = to_track.split(" ")[0]
            typo_generation = runAll(domain=domain, limit=math.inf, formatoutput="text", pathOutput="-", verbose=False) # TODO REPLACE LIMIT BY -1
            for typo in typo_generation:
                r_tracker.sadd(f'tracker:typosquatting:{to_track}', typo)

        # create metadata
        self._set_field('tracked', to_track)
        self._set_field('type', tracker_type)
        self._set_field('date', datetime.date.today().strftime("%Y%m%d"))
        self._set_field('creator_org', org)
        self._set_field('user_id', user_id)
        if description:
            self._set_field('description', escape(description))
        if webhook:
            self._set_field('webhook', webhook)

        # create all tracker set
        r_tracker.sadd(f'all:tracker:{tracker_type}', to_track)
        # create tracker - uuid map
        r_tracker.sadd(f'all:tracker_uuid:{tracker_type}:{to_track}', self.uuid)
        r_tracker.sadd('trackers:all', self.uuid)
        r_tracker.sadd(f'trackers:all:{tracker_type}', self.uuid)

        # TRACKER LEVEL
        self.set_level(level, org)

        # create tracker tags list
        if tags:
            self._set_tags(tags)

        # create tracker mail notification list
        if mails:
            self._set_mails(mails)

        # Filters
        if not filters:
            filters = {}
            for obj_type in get_objects_tracked():
                filters[obj_type] = {}
        else:
            self.set_filters(filters)
        for obj_type in filters:
            r_tracker.sadd(f'trackers:objs:{tracker_type}:{obj_type}', to_track)
            r_tracker.sadd(f'trackers:uuid:{tracker_type}:{to_track}', f'{self.uuid}:{obj_type}')

        self._set_field('last_change', time.time())

        # toggle refresh module tracker list/set
        trigger_trackers_refresh(tracker_type)
        return self.uuid

    def edit(self, tracker_type, to_track, level, org, description=None, filters={}, tags=[], mails=[], webhook=None):

        # edit tracker
        old_type = self.get_type()
        old_to_track = self.get_tracked()
        old_level = self.get_level()
        user_id = self.get_user()

        # YARA
        if tracker_type == 'yara_custom' or tracker_type == 'yara_default':
            # create yara rule
            if tracker_type == 'yara_default' and old_type == 'yara':
                if not is_default_yara_rule(old_to_track):
                    filepath = get_yara_rule_file_by_tracker_name(old_to_track)
                    if filepath:
                        os.remove(filepath)
            to_track = save_yara_rule(tracker_type, to_track, tracker_uuid=self.uuid)
            tracker_type = 'yara'

        # TODO TYPO EDIT
        elif tracker_type == 'typosquatting':
            pass

        if tracker_type != old_type:
            # LEVEL
            self.reset_level(old_level, level, org)
            # Delete OLD YARA Rule File
            if old_type == 'yara':
                if not is_default_yara_rule(old_to_track):
                    filepath = get_yara_rule_file_by_tracker_name(old_to_track)
                    if filepath:
                        os.remove(filepath)
            if old_type == 'typosquatting':
                r_tracker.delete(f'tracker:typosquatting:{old_to_track}')
            self._set_field('type', tracker_type)

            # create all tracker set
            r_tracker.srem(f'all:tracker:{old_type}', old_to_track)
            r_tracker.sadd(f'all:tracker:{tracker_type}', to_track)
            # create tracker - uuid map
            r_tracker.srem(f'all:tracker_uuid:{old_type}:{old_to_track}', self.uuid)
            r_tracker.sadd(f'all:tracker_uuid:{tracker_type}:{to_track}', self.uuid)
            # create all tracker set by type
            r_tracker.srem(f'trackers:all:{old_type}', self.uuid)
            r_tracker.sadd(f'trackers:all:{tracker_type}', self.uuid)

        # Same Type

        # LEVEL
        self.reset_level(old_level, level, org)

        # To Track Edited
        if to_track != old_to_track:
            self._set_field('tracked', to_track)

        self._set_field('description', description)
        self._set_field('webhook', webhook)

        # Tags
        nb_old_tags = r_tracker.scard(f'tracker:tags:{self.uuid}')
        if nb_old_tags > 0 or tags:
            self._del_tags()
            self._set_tags(tags)

        # Mails
        nb_old_mails = r_tracker.scard(f'tracker:mail:{self.uuid}')
        if nb_old_mails > 0 or mails:
            self._del_mails()
            self._set_mails(mails)

        # Filters
        self.del_filters(old_type, old_to_track)
        if not filters:
            filters = {}
            for obj_type in get_objects_tracked():
                filters[obj_type] = {}
        else:
            self.set_filters(filters)
        for obj_type in filters:
            r_tracker.sadd(f'trackers:objs:{tracker_type}:{obj_type}', to_track)
            r_tracker.sadd(f'trackers:uuid:{tracker_type}:{to_track}', f'{self.uuid}:{obj_type}')

        self._set_field('last_change', time.time())

        # Refresh Trackers
        trigger_trackers_refresh(tracker_type)
        if tracker_type != old_type:
            trigger_trackers_refresh(old_type)
        return self.uuid

    def delete(self):
        for obj in self.get_objs():
            self.remove(obj[0], obj[1], obj[2])

        tracker_type = self.get_type()
        tracked = self.get_tracked()

        if tracker_type == 'typosquatting':
            r_tracker.delete(f'tracker:typosquatting:{tracked}')
        elif tracker_type == 'yara':
            if not is_default_yara_rule(tracked):
                filepath = get_yara_rule_file_by_tracker_name(tracked)
                if filepath:
                    os.remove(filepath)

        # Filters
        filters = get_objects_tracked()
        for obj_type in filters:
            r_tracker.srem(f'trackers:objs:{tracker_type}:{obj_type}', tracked)
            r_tracker.srem(f'trackers:uuid:{tracker_type}:{tracked}', f'{self.uuid}:{obj_type}')

        self._del_mails()
        self._del_tags()

        level = self.get_level()

        if level == 0:  # user only
            user = self.get_user()
            r_tracker.srem(f'user:tracker:{user}', self.uuid)
            r_tracker.srem(f'user:tracker:{user}:{tracker_type}', self.uuid)
        elif level == 1:  # global
            r_tracker.srem('global:tracker', self.uuid)
            r_tracker.srem(f'global:tracker:{tracker_type}', self.uuid)
        elif level == 2:
            org = self.get_org()
            r_tracker.srem(f'org:tracker:{org}', self.uuid)
            r_tracker.srem(f'org:tracker:{org}:{tracker_type}', self.uuid)

        r_tracker.srem(f'all:tracker:{tracker_type}', tracked)
        # tracker - uuid map
        r_tracker.srem(f'all:tracker_uuid:{tracker_type}:{tracked}', self.uuid)
        r_tracker.srem('trackers:all', self.uuid)
        r_tracker.srem(f'trackers:all:{tracker_type}', self.uuid)
        ail_orgs.remove_obj_to_org(self.get_org(), 'tracker', self.uuid)
        # meta
        r_tracker.delete(f'tracker:{self.uuid}')
        trigger_trackers_refresh(tracker_type)


def create_tracker(tracker_type, to_track, org, user_id, level, description=None, filters={}, tags=[], mails=[], webhook=None, tracker_uuid=None):
    if not tracker_uuid:
        tracker_uuid = str(uuid.uuid4())
    tracker = Tracker(tracker_uuid)
    return tracker.create(tracker_type, to_track, org, user_id, level, description=description, filters=filters, tags=tags,
                          mails=mails, webhook=webhook)

def _re_create_tracker(tracker_type, tracker_uuid, to_track, org, user_id, level, description=None, filters={}, tags=[], mails=[], webhook=None, first_seen=None, last_seen=None):
    create_tracker(tracker_type, to_track, org, user_id, level, description=description, filters=filters,
                   tags=tags, mails=mails, webhook=webhook, tracker_uuid=tracker_uuid)

def get_trackers_types():
    return ['word', 'set', 'regex', 'typosquatting', 'yara']

def get_trackers():
    return r_tracker.smembers(f'trackers:all')

def get_trackers_by_type(tracker_type):
    return r_tracker.smembers(f'trackers:all:{tracker_type}')

def _get_tracked_by_obj_type(tracker_type, obj_type):
    return r_tracker.smembers(f'trackers:objs:{tracker_type}:{obj_type}')

def get_trackers_by_tracked_obj_type(tracker_type, obj_type, tracked):
    trackers_uuid = set()
    for res in r_tracker.smembers(f'trackers:uuid:{tracker_type}:{tracked}'):
        tracker_uuid, tracker_obj_type = res.split(':', 1)
        if tracker_obj_type == obj_type:
            trackers_uuid.add(tracker_uuid)
    return trackers_uuid

def get_trackers_by_tracked(tracker_type, tracked):
    return r_tracker.smembers(f'all:tracker_uuid:{tracker_type}:{tracked}')

def get_user_trackers_by_tracked(tracker_type, tracked, user_id):
    user_trackers = get_user_trackers(user_id, tracker_type=tracker_type)
    trackers_uuid = get_trackers_by_tracked(tracker_type, tracked)
    return trackers_uuid.intersection(user_trackers)

def get_trackers_tracked_by_type(tracker_type):
    return r_tracker.smembers(f'all:tracker:{tracker_type}')

def get_global_trackers(tracker_type=None):
    if tracker_type:
        return r_tracker.smembers(f'global:tracker:{tracker_type}')
    else:
        return r_tracker.smembers('global:tracker')

def get_user_trackers(user_id, tracker_type=None):
    if tracker_type:
        return r_tracker.smembers(f'user:tracker:{user_id}:{tracker_type}')
    else:
        return r_tracker.smembers(f'user:tracker:{user_id}')

def get_org_trackers(org, tracker_type=None):
    if tracker_type:
        return r_tracker.smembers(f'org:tracker:{org}:{tracker_type}')
    else:
        return r_tracker.smembers(f'org:tracker:{org}')

def get_nb_global_trackers(tracker_type=None):
    if tracker_type:
        return r_tracker.scard(f'global:tracker:{tracker_type}')
    else:
        return r_tracker.scard('global:tracker')

def get_nb_user_trackers(user_id, tracker_type=None):
    if tracker_type:
        return r_tracker.scard(f'user:tracker:{user_id}:{tracker_type}')
    else:
        return r_tracker.scard(f'user:tracker:{user_id}')

def get_nb_org_trackers(org, tracker_type=None):
    if tracker_type:
        return r_tracker.scard(f'org:tracker:{org}:{tracker_type}')
    else:
        return r_tracker.scard(f'org:tracker:{org}')


def get_user_trackers_meta(user_id, tracker_type=None):
    metas = []
    for tracker_uuid in get_user_trackers(user_id, tracker_type=tracker_type):
        tracker = Tracker(tracker_uuid)
        metas.append(tracker.get_meta(options={'description', 'mails', 'org', 'org_name', 'sparkline', 'tags'}))
    return metas

def get_global_trackers_meta(tracker_type=None):
    metas = []
    for tracker_uuid in get_global_trackers(tracker_type=tracker_type):
        tracker = Tracker(tracker_uuid)
        metas.append(tracker.get_meta(options={'description', 'mails', 'org', 'org_name', 'sparkline', 'tags'}))
    return metas

def get_org_trackers_meta(user_org, tracker_type=None):
    metas = []
    for tracker_uuid in get_org_trackers(user_org, tracker_type=tracker_type):
        tracker = Tracker(tracker_uuid)
        metas.append(tracker.get_meta(options={'description', 'mails', 'org', 'org_name', 'sparkline', 'tags'}))
    return metas

def get_users_trackers_meta():
    trackers = []
    for tracker_uuid in get_trackers():
        tracker = Tracker(tracker_uuid)
        if tracker.is_level_user():
            trackers.append(tracker.get_meta(options={'mails', 'sparkline', 'tags'}))
    return trackers

def get_orgs_trackers_meta():
    trackers = []
    for tracker_uuid in get_trackers():
        tracker = Tracker(tracker_uuid)
        if tracker.is_level_org():
            trackers.append(tracker.get_meta(options={'mails', 'sparkline', 'tags'}))
    return trackers

def get_trackers_graph_by_day(l_trackers, num_day=31, date_from=None, date_to=None):
    if date_from and date_to:
        date_range = Date.substract_date(date_from, date_to)
    else:
        date_range = Date.get_date_range(num_day)
    list_tracker_stats = []
    for tracker_uuid in l_trackers:
        dict_tracker_data = []
        tracker = Tracker(tracker_uuid)
        for date_day in date_range:
            nb_seen_this_day = tracker.get_nb_objs_by_date(date_day)
            if nb_seen_this_day is None:
                nb_seen_this_day = 0
            dict_tracker_data.append({"date": date_day, "value": int(nb_seen_this_day)})
        list_tracker_stats.append({"name": tracker.get_tracked(), "Data": dict_tracker_data})
    return list_tracker_stats

def get_trackers_dashboard(user_org, user_id):
    trackers = []
    for raw in r_tracker.lrange('trackers:dashboard', 0, -1):
        tracker_uuid, timestamp, obj_type, subtype, obj_id = raw.split(':', 4)
        tracker = Tracker(tracker_uuid)
        if not tracker.check_level(user_org, user_id):
            continue
        meta = tracker.get_meta(options={'description', 'tags'})
        if not meta.get('type'):
            meta['type'] = 'Tracker DELETED'
        timestamp = datetime.datetime.fromtimestamp(float(timestamp)).strftime('%Y-%m-%d %H:%M:%S')
        meta['timestamp'] = timestamp
        trackers.append(meta)
    return trackers

def get_user_dashboard(user_id):  # TODO SORT + REMOVE OLDER ROWS (trim)
    trackers = []
    for raw in r_tracker.lrange(f'trackers:user:{user_id}', 0, -1):
        tracker_uuid, timestamp, obj_type, subtype, obj_id = raw.split(':', 4)
        tracker = Tracker(tracker_uuid)
        meta = tracker.get_meta(options={'tags'})
        timestamp = datetime.datetime.fromtimestamp(float(timestamp)).strftime('%Y-%m-%d %H:%M:%S')
        meta['timestamp'] = timestamp
        trackers.append(meta)

    return trackers

def get_trackers_stats(user_org, user_id):
    stats = {'all': 0}
    for tracker_type in get_trackers_types():
        nb_global = get_nb_global_trackers(tracker_type=tracker_type)
        nb_user = get_nb_user_trackers(user_id, tracker_type=tracker_type)
        nb_org = get_nb_org_trackers(user_org, tracker_type=tracker_type)
        stats[tracker_type] = nb_global + nb_user + nb_org
        stats['all'] += nb_global + nb_user + nb_org
    return stats


## Cache ##
# TODO API: Check Tracker type
def trigger_trackers_refresh(tracker_type):
    r_cache.set(f'tracker:refresh:{tracker_type}', time.time())

def get_tracker_last_updated_by_type(tracker_type):
    epoch_update = r_cache.get(f'tracker:refresh:{tracker_type}')
    if not epoch_update:
        epoch_update = 0
    return float(epoch_update)
# - Cache - #

## Objects ##

def is_obj_tracked(obj_type, subtype, obj_id):
    return r_tracker.exists(f'obj:trackers:{obj_type}:{subtype}:{obj_id}')

def get_obj_trackers(obj_type, subtype, obj_id):
    return r_tracker.smembers(f'obj:trackers:{obj_type}:{subtype}:{obj_id}')

def delete_obj_trackers(obj_type, subtype, obj_id):
    for tracker_uuid in get_obj_trackers(obj_type, subtype, obj_id):
        tracker = Tracker(tracker_uuid)
        tracker.remove(obj_type, subtype, obj_id)

######################
#### TRACKERS ACL ####

## LEVEL ##
def is_tracker_global_level(tracker_uuid):
    return int(r_tracker.hget(f'tracker:{tracker_uuid}', 'level')) == 1

def is_tracked_in_global_level(tracked, tracker_type):
    for tracker_uuid in get_trackers_by_tracked(tracker_type, tracked):
        tracker = Tracker(tracker_uuid)
        if tracker.is_level_global():
            return True
    return False

def is_tracked_in_user_level(tracked, tracker_type, user_id):
    trackers_uuid = get_user_trackers_by_tracked(tracker_type, tracked, user_id)
    if trackers_uuid:
        return True
    else:
        return False

## API ##
def api_check_tracker_uuid(tracker_uuid):
    if not is_valid_uuid_v4(tracker_uuid):
        return {"status": "error", "reason": "Invalid uuid"}, 400
    if not r_tracker.exists(f'tracker:{tracker_uuid}'):
        return {"status": "error", "reason": "Unknown uuid"}, 404
    return None

def api_check_tracker_acl(tracker_uuid, user_org, user_id, user_role, action):
    res = api_check_tracker_uuid(tracker_uuid)
    if res:
        return res
    tracker = Tracker(tracker_uuid)
    if not ail_orgs.check_obj_access_acl(tracker, user_org, user_id, user_role, action):
        return {"status": "error", "reason": "Access Denied"}, 403

def api_is_allowed_to_edit_tracker_level(tracker_uuid, user_org, user_id, user_role, new_level):
    tracker = Tracker(tracker_uuid)
    if not ail_orgs.check_acl_edit_level(tracker, user_org, user_id, user_role, new_level):
        return {"status": "error", "reason": "Access Denied - Tracker level"}, 403

## --ACL-- ##

#### FIX DB #### TODO ###################################################################
def fix_tracker_stats_per_day(tracker_uuid):
    tracker = Tracker(tracker_uuid)
    date_from = tracker.get_date()
    date_to = Date.get_today_date_str()
    # delete stats
    r_tracker.delete(f'tracker:stat:{tracker_uuid}')
    r_tracker.hdel(f'tracker:{tracker_uuid}', 'first_seen')
    r_tracker.hdel(f'tracker:{tracker_uuid}', 'last_seen')
    # create new stats
    for date_day in Date.substract_date(date_from, date_to):
        date_day = int(date_day)

        nb_items = r_tracker.scard(f'tracker:item:{tracker_uuid}:{date_day}')
        if nb_items:
            r_tracker.zincrby(f'tracker:stat:{tracker_uuid}', nb_items, int(date_day))

            # update first_seen/last_seen
            tracker.update_daterange(date_day)

def fix_tracker_item_link(tracker_uuid):
    tracker = Tracker(tracker_uuid)
    date_from = tracker.get_first_seen()
    date_to = tracker.get_last_seen()

    if date_from and date_to:
        for date_day in Date.substract_date(date_from, date_to):
            l_items = r_tracker.smembers(f'tracker:item:{tracker_uuid}:{date_day}')
            for item_id in l_items:
                r_tracker.sadd(f'obj:trackers:item:{item_id}', tracker_uuid)

def fix_all_tracker_uuid_list():
    r_tracker.delete(f'trackers:all')
    for tracker_type in get_trackers_types():
        r_tracker.delete(f'trackers:all:{tracker_type}')
        for tracked in get_trackers_tracked_by_type(tracker_type):
            l_tracker_uuid = get_trackers_by_tracked(tracker_type, tracked)
            for tracker_uuid in l_tracker_uuid:
                r_tracker.sadd(f'trackers:all', tracker_uuid)
                r_tracker.sadd(f'trackers:all:{tracker_type}', tracker_uuid)

## --FIX DB-- ##

#### CREATE TRACKER ####
def api_validate_tracker_to_add(to_track, tracker_type, nb_words=1):
    if tracker_type == 'regex':
        if not is_valid_regex(to_track):
            return {"status": "error", "reason": "Invalid regex"}, 400
    elif tracker_type == 'word' or tracker_type == 'set':
        # force lowercase
        to_track = to_track.lower()
        word_set = set(to_track)
        set_inter = word_set.intersection(get_special_characters())
        if set_inter:
            return {"status": "error",
                    "reason": f'special character(s) not allowed: {set_inter}',
                    "message": "Please use a python regex or remove all special characters"}, 400
        words = to_track.split()
        # not a word
        if tracker_type == 'word' and len(words) > 1:
            tracker_type = 'set'

        # output format: tracker1,tracker2,tracker3;2
        if tracker_type == 'set':
            try:
                nb_words = int(nb_words)
            except TypeError:
                nb_words = 1
            if nb_words == 0:
                nb_words = 1

            words_set = set(words)
            words_set = sorted(words_set)
            if nb_words > len(words_set):
                nb_words = len(words_set)

            to_track = ",".join(words_set)
            to_track = f"{to_track};{nb_words}"
    elif tracker_type == 'typosquatting':
        to_track = to_track.lower()
        # Take only the first term
        domain = to_track.split(" ")
        if len(domain) > 1:
            return {"status": "error", "reason": "Only one domain is accepted at a time"}, 400
        if "." not in to_track:
            return {"status": "error", "reason": "Invalid domain name"}, 400

    elif tracker_type == 'yara_custom':
        if not is_valid_yara_rule(to_track):
            return {"status": "error", "reason": "Invalid custom Yara Rule"}, 400
    elif tracker_type == 'yara_default':
        if not is_valid_default_yara_rule(to_track):
            return {"status": "error", "reason": "The Yara Rule doesn't exist"}, 400
    else:
        return {"status": "error", "reason": "Incorrect type"}, 400
    return {"status": "success", "tracked": to_track, "type": tracker_type}, 200

def api_add_tracker(dict_input, org, user_id):
    to_track = dict_input.get('tracked', None)
    if not to_track:
        return {"status": "error", "reason": "Tracker not provided"}, 400
    tracker_type = dict_input.get('type', None)
    if not tracker_type:
        return {"status": "error", "reason": "Tracker type not provided"}, 400
    nb_words = dict_input.get('nb_words', 1)
    description = dict_input.get('description', '')
    description = escape(description)
    webhook = dict_input.get('webhook', '')
    webhook = escape(webhook)
    res = api_validate_tracker_to_add(to_track, tracker_type, nb_words=nb_words)
    if res[1] != 200:
        return res
    to_track = res[0]['tracked']
    tracker_type = res[0]['type']

    tags = dict_input.get('tags', [])
    mails = dict_input.get('mails', [])
    res = verify_mail_list(mails)
    if res:
        return res

    # Filters # TODO MOVE ME
    filters = dict_input.get('filters', {})
    if filters:
        if filters.keys() == set(get_objects_tracked()) and set(filters['pgp'].get('subtypes', [])) == {'mail', 'name'}:
            filters = {}
        for obj_type in filters:
            if obj_type not in get_objects_tracked():
                return {"status": "error", "reason": "Invalid Tracker Object type"}, 400

            if obj_type == 'pgp':
                if set(filters['pgp'].get('subtypes', [])) == {'mail', 'name'}:
                    filters['pgp'].pop('subtypes')

            for filter_name in filters[obj_type]:
                if filter_name not in {'mimetypes', 'sources', 'subtypes'}:
                    return {"status": "error", "reason": "Invalid Filter"}, 400
                elif filter_name == 'mimetypes': # TODO
                    pass
                elif filter_name == 'sources':
                    if obj_type == 'item':
                        res = item_basic.verify_sources_list(filters['item']['sources'])
                        if res:
                            return res
                    else:
                        return {"status": "error", "reason": "Invalid Filter sources"}, 400
                elif filter_name == 'subtypes':
                    obj_subtypes = set(get_object_all_subtypes(obj_type))
                    for subtype in filters[obj_type]['subtypes']:
                        if subtype not in obj_subtypes:
                            return {"status": "error", "reason": "Invalid Tracker Object subtype"}, 400

    level = dict_input.get('level', 1)
    try:
        level = int(level)
    except TypeError:
        level = 1
    if level not in range(0, 3):
        level = 1

    tracker_uuid = create_tracker(tracker_type, to_track, org, user_id, level, description=description, filters=filters,
                                  tags=tags, mails=mails, webhook=webhook)

    return {'tracked': to_track, 'type': tracker_type, 'uuid': tracker_uuid}, 200

def api_edit_tracker(dict_input, user_org, user_id, user_role):
    tracker_uuid = dict_input.get('uuid')
    res = api_check_tracker_acl(tracker_uuid, user_org, user_id, user_role, 'edit')
    if res:
        return res

    tracker = Tracker(tracker_uuid)

    to_track = dict_input.get('tracked', None)
    if not to_track:
        return {"status": "error", "reason": "Tracker not provided"}, 400
    tracker_type = dict_input.get('type', None)
    if not tracker_type:
        return {"status": "error", "reason": "Tracker type not provided"}, 400

    level = dict_input.get('level', 1)
    try:
        level = int(level)
    except TypeError:
        level = 1
    if level not in range(0, 3):
        level = 1
    res = api_is_allowed_to_edit_tracker_level(tracker_uuid, user_org, user_id, user_role, level)
    if res:
        return res

    nb_words = dict_input.get('nb_words', 1)
    description = dict_input.get('description', '')
    description = escape(description)
    webhook = dict_input.get('webhook', '')
    webhook = escape(webhook)
    res = api_validate_tracker_to_add(to_track, tracker_type, nb_words=nb_words)
    if res[1] != 200:
        return res
    to_track = res[0]['tracked']
    tracker_type = res[0]['type']

    tags = dict_input.get('tags', [])
    mails = dict_input.get('mails', [])
    res = verify_mail_list(mails)
    if res:
        return res

    # Filters # TODO MOVE ME
    filters = dict_input.get('filters', {})
    if filters:
        if filters.keys() == set(get_objects_tracked()) and set(filters['pgp'].get('subtypes', [])) == {'mail', 'name'}:
            if not filters['decoded'] and not filters['item']:
                filters = {}
        for obj_type in filters:
            if obj_type not in get_objects_tracked():
                return {"status": "error", "reason": "Invalid Tracker Object type"}, 400

            if obj_type == 'pgp':
                if set(filters['pgp'].get('subtypes', [])) == {'mail', 'name'}:
                    filters['pgp'].pop('subtypes')

            for filter_name in filters[obj_type]:
                if filter_name not in {'mimetypes', 'sources', 'subtypes'}:
                    return {"status": "error", "reason": "Invalid Filter"}, 400
                elif filter_name == 'mimetypes':  # TODO
                    pass
                elif filter_name == 'sources':
                    if obj_type == 'item':
                        res = item_basic.verify_sources_list(filters['item']['sources'])
                        if res:
                            return res
                    else:
                        return {"status": "error", "reason": "Invalid Filter sources"}, 400
                elif filter_name == 'subtypes':
                    obj_subtypes = set(get_object_all_subtypes(obj_type))
                    for subtype in filters[obj_type]['subtypes']:
                        if subtype not in obj_subtypes:
                            return {"status": "error", "reason": "Invalid Tracker Object subtype"}, 400

    tracker.edit(tracker_type, to_track, level, user_org, description=description, filters=filters,
                 tags=tags, mails=mails, webhook=webhook)
    return {'tracked': to_track, 'type': tracker_type, 'uuid': tracker_uuid}, 200


def api_delete_tracker(data, user_org, user_id, user_role):
    tracker_uuid = data.get('uuid')
    res = api_check_tracker_acl(tracker_uuid, user_org, user_id, user_role, 'delete')
    if res:
        return res

    tracker = Tracker(tracker_uuid)
    return tracker.delete(), 200

def api_tracker_add_object(data, user_org, user_id, user_role):
    tracker_uuid = data.get('uuid')
    res = api_check_tracker_acl(tracker_uuid, user_org, user_id, user_role, 'edit')
    if res:
        return res
    tracker = Tracker(tracker_uuid)
    object_gid = data.get('gid')
    date = data.get('date')
    if date:
        if not Date.validate_str_date(date):
            date = None
    try:
        obj_type, subtype, obj_id = object_gid.split(':', 2)
    except (AttributeError, IndexError):
        return {"status": "error", "reason": "Invalid Object"}, 400
    return tracker.add(obj_type, subtype, obj_id, date=date), 200

def api_tracker_remove_object(data, user_org, user_id, user_role):
    tracker_uuid = data.get('uuid')
    res = api_check_tracker_acl(tracker_uuid, user_org, user_id, user_role, 'edit')
    if res:
        return res

    tracker = Tracker(tracker_uuid)
    object_gid = data.get('gid')
    try:
        obj_type, subtype, obj_id = object_gid.split(':', 2)
    except (AttributeError, IndexError):
        return {"status": "error", "reason": "Invalid Object"}, 400
    return tracker.remove(obj_type, subtype, obj_id), 200

## -- CREATE TRACKER -- ##

####################
#### WORD - SET ####

def get_tracked_words():
    to_track = {}
    for obj_type in get_objects_tracked():
        to_track[obj_type] = _get_tracked_by_obj_type('word', obj_type)
    return to_track

def get_tracked_sets():
    to_track = {}
    for obj_type in get_objects_tracked():
        to_track[obj_type] = []
        for tracked in _get_tracked_by_obj_type('set', obj_type):
            res = tracked.split(';')
            nb_words = int(res[1])
            words_set = res[0].split(',')
            to_track[obj_type].append({'words': words_set, 'nb': nb_words, 'tracked': tracked})
    return to_track

def get_text_word_frequency(content, filtering=True):
    content = content.lower()
    words_dict = defaultdict(int)

    if filtering:
        if TOKENIZER is None:
            init_tokenizer()
        blob = TextBlob(content, tokenizer=TOKENIZER)
    else:
        blob = TextBlob(content)
    for word in blob.tokens:
        words_dict[word] += 1
    return words_dict

###############
#### REGEX ####

def get_tracked_regexs():
    to_track = {}
    for obj_type in get_objects_tracked():
        to_track[obj_type] = []
        for tracked in _get_tracked_by_obj_type('regex', obj_type):
            to_track[obj_type].append({'regex': re.compile(tracked), 'tracked': tracked})
    return to_track

########################
#### TYPO SQUATTING ####

def get_tracked_typosquatting_domains(tracked):
    return r_tracker.smembers(f'tracker:typosquatting:{tracked}')

def get_tracked_typosquatting():
    to_track = {}
    for obj_type in get_objects_tracked():
        to_track[obj_type] = []
        for tracked in _get_tracked_by_obj_type('typosquatting', obj_type):
            to_track[obj_type].append({'domains': get_tracked_typosquatting_domains(tracked), 'tracked': tracked})
    return to_track

##############
#### YARA ####
def get_yara_rules_dir():
    return os.path.join(os.environ['AIL_BIN'], 'trackers', 'yara')

def get_yara_rules_default_dir():
    return os.path.join(os.environ['AIL_BIN'], 'trackers', 'yara', 'ail-yara-rules', 'rules')

# # TODO: cache + update
def get_all_default_yara_rules_types():
    yara_dir = get_yara_rules_default_dir()
    all_yara_types = next(os.walk(yara_dir))[1]
    # save in cache ?
    return all_yara_types

# # TODO: cache + update
def get_all_default_yara_files():
    yara_dir = get_yara_rules_default_dir()
    all_default_yara_files = {}
    for rules_type in get_all_default_yara_rules_types():
        all_default_yara_files[rules_type] = os.listdir(os.path.join(yara_dir, rules_type))
    return all_default_yara_files

def get_all_default_yara_rules_by_type(yara_types):
    all_default_yara_files = get_all_default_yara_files()
    if yara_types in all_default_yara_files:
        return all_default_yara_files[yara_types]
    else:
        return []

def get_all_tracked_yara_files(filter_disabled=False):
    yara_files = r_tracker.smembers('all:tracker:yara')
    if not yara_files:
        yara_files = []
    if filter_disabled:
        pass
    return yara_files

def get_tracked_yara_rules():
    to_track = {}
    for obj_type in get_objects_tracked():
        rules = {}
        for tracked in _get_tracked_by_obj_type('yara', obj_type):
            rule = os.path.join(get_yara_rules_dir(), tracked)
            if not os.path.exists(rule):
                logger.critical(f"Yara rule don't exists {tracked} : {obj_type}")
            else:
                rules[tracked] = rule
        to_track[obj_type] = yara.compile(filepaths=rules)
    return to_track

def reload_yara_rules():
    yara_files = get_all_tracked_yara_files()
    # {uuid: filename}
    rule_dict = {}
    for yar_path in yara_files:
        for tracker_uuid in get_trackers_by_tracked('yara', yar_path):
            rule_dict[tracker_uuid] = os.path.join(get_yara_rules_dir(), yar_path)
    for tracker_uuid in rule_dict:
        if not os.path.isfile(rule_dict[tracker_uuid]):
            # TODO IGNORE + LOGS
            raise Exception(f"Error: {rule_dict[tracker_uuid]} doesn't exists")
    rules = yara.compile(filepaths=rule_dict)
    return rules

def is_valid_yara_rule(yara_rule):
    try:
        yara.compile(source=yara_rule)
        return True
    except:
        return False

def is_default_yara_rule(tracked_yara_name):
    yara_dir = get_yara_rules_dir()
    filename = os.path.join(yara_dir, tracked_yara_name)
    filename = os.path.realpath(filename)
    try:
        if tracked_yara_name.split('/')[0] == 'custom-rules':
            return False
    except:
        return False
    if not os.path.commonprefix([filename, yara_dir]) == yara_dir:
        return False
    else:
        if os.path.isfile(filename):
            return True
    return False

def is_valid_default_yara_rule(yara_rule, verbose=True):
    yara_dir = get_yara_rules_default_dir()
    filename = os.path.join(yara_dir, yara_rule)
    filename = os.path.realpath(filename)
    # incorrect filename
    if not os.path.commonprefix([filename, yara_dir]) == yara_dir:
        if verbose:
            print('error: file transversal')
            print(yara_dir)
            print(filename)
        return False
    else:
        if os.path.isfile(filename):
            return True
        else:
            return False

def save_yara_rule(yara_rule_type, yara_rule, tracker_uuid=None):
    if yara_rule_type == 'yara_custom':
        if not tracker_uuid:
            tracker_uuid = str(uuid.uuid4())
        filename = os.path.join('custom-rules', tracker_uuid + '.yar')
        with open(os.path.join(get_yara_rules_dir(), filename), 'w') as f:
            f.write(str(yara_rule))
    elif yara_rule_type == 'yara_default':
        filename = os.path.join('ail-yara-rules', 'rules', yara_rule)
    return filename

def get_yara_rule_file_by_tracker_name(tracked_yara_name):
    yara_dir = get_yara_rules_dir()
    filename = os.path.join(yara_dir, tracked_yara_name)
    filename = os.path.realpath(filename)
    if not os.path.commonprefix([filename, yara_dir]) == yara_dir:
        print('error: file transversal')
        print(yara_dir)
        print(filename)
        return None
    return filename

def get_yara_rule_content(yara_rule):
    yara_dir = get_yara_rules_dir()
    filename = os.path.join(yara_dir, yara_rule)
    filename = os.path.realpath(filename)

    # incorrect filename
    if not os.path.commonprefix([filename, yara_dir]) == yara_dir:
        return ''  # # TODO: throw exception

    with open(filename, 'r') as f:
        rule_content = f.read()
    return rule_content

def api_get_default_rule_content(default_yara_rule):
    yara_dir = get_yara_rules_default_dir()
    filename = os.path.join(yara_dir, default_yara_rule)
    filename = os.path.realpath(filename)
    if not os.path.commonprefix([filename, yara_dir]) == yara_dir:
        return {'status': 'error', 'reason': 'file traversal detected'}, 400

    if not os.path.isfile(filename):
        return {'status': 'error', 'reason': 'yara rule not found'}, 400

    with open(filename, 'r') as f:
        rule_content = f.read()
    return {'rule_name': default_yara_rule, 'content': rule_content}, 200


def get_yara_rule_content_restapi(request_dict):
    rule_name = request_dict.get('rule_name', None)
    if not request_dict:
        return {'status': 'error', 'reason': 'Malformed JSON'}, 400
    if not rule_name:
        return {'status': 'error', 'reason': 'Mandatory parameter(s) not provided'}, 400
    yara_dir = get_yara_rules_dir()
    filename = os.path.join(yara_dir, rule_name)
    filename = os.path.realpath(filename)
    if not os.path.commonprefix([filename, yara_dir]) == yara_dir:
        return {'status': 'error', 'reason': 'File Path Traversal'}, 400
    if not os.path.isfile(filename):
        return {'status': 'error', 'reason': 'yara rule not found'}, 400
    with open(filename, 'r') as f:
        rule_content = f.read()
    rule_content = base64.b64encode((rule_content.encode('utf-8'))).decode('UTF-8')
    return {'status': 'success', 'content': rule_content}, 200

## -- YARA -- ##

######################
#### RETRO - HUNT ####

# state: pending/running/completed/paused

class RetroHunt:

    def __init__(self, task_uuid):
        self.uuid = task_uuid

    def exists(self):
        return r_tracker.exists(f'retro_hunt:{self.uuid}')

    def _get_field(self, field):
        return r_tracker.hget(f'retro_hunt:{self.uuid}', field)

    def _set_field(self, field, value):
        return r_tracker.hset(f'retro_hunt:{self.uuid}', field, value)

    ## LEVEL ##

    def get_level(self):
        level = int(self._get_field('level'))
        if not level:
            level = 1
        return int(level)

    def set_level(self, level, org_uuid):
        if level == 1:  # global
            r_tracker.sadd('retro_hunts', self.uuid)
        elif level == 2:  # org only
            self.add_to_org(org_uuid)
        self._set_field('level', level)

    def delete_level(self, level=None):
        if not level:
            level = self.get_level()
        if level == 1:
            r_tracker.srem('retro_hunts', self.uuid)
        # Org
        elif level == 2:
            ail_orgs.remove_obj_to_org(self.get_org(), 'retro_hunt', self.uuid)

    def reset_level(self, old_level, new_level, new_org_uuid):
        self.delete_level(old_level)
        self.set_level(new_level, new_org_uuid)

    def check_level(self, user_org):
        level = self.get_level()
        if level == 1:
            return True
        elif level == 2:
            return self.get_org() == user_org

    ## ORG ##

    def get_creator_org(self):
        return self._get_field('creator_org')

    def get_org(self):
        return self._get_field('org')

    def add_to_org(self, org_uuid):
        self._set_field('org', org_uuid)
        ail_orgs.add_obj_to_org(org_uuid, 'retro_hunt', self.uuid)

    ## -ORG- ##

    def get_creator(self):
        return self._get_field('creator')

    def get_date(self):
        return self._get_field('date')

    def get_last_analyzed(self):
        return self._get_field('last')

    def set_last_analyzed(self, obj_type, subtype, obj_id):
        return self._set_field('last', f'{obj_type}:{subtype}:{obj_id}')

    def get_last_analyzed_cache(self):
        r_cache.hget(f'retro_hunt:task:{self.uuid}', 'obj')

    def set_last_analyzed_cache(self, obj_type, subtype, obj_id):
        r_cache.hset(f'retro_hunt:task:{self.uuid}', 'obj', f'{obj_type}:{subtype}:{obj_id}')

    def get_name(self):
        return self._get_field('name')

    def get_description(self):
        return self._get_field('description')

    def get_timeout(self):
        res = self._get_field('timeout')
        if res:
            return int(res)
        else:
            return 30  # # TODO: FIXME use instance limit

    def get_filters(self):
        filters = self._get_field('filters')
        if not filters:
            return {}
        else:
            return json.loads(filters)

    def set_filters(self, filters):
        if filters:
            self._set_field('filters', json.dumps(filters))

    def get_tags(self):
        return r_tracker.smembers(f'retro_hunt:tags:{self.uuid}')

    def get_mails(self):
        return r_tracker.smembers(f'retro_hunt:mails:{self.uuid}')

    def get_state(self):
        return self._get_field('state')

    def _set_state(self, new_state):
        curr_state = self.get_state()
        if curr_state:
            r_tracker.srem(f'retro_hunt:task:{curr_state}', self.uuid)
        r_tracker.sadd(f'retro_hunts:{new_state}', self.uuid)
        self._set_field('state', new_state)

    def get_rule(self, r_compile=False):
        rule = self._get_field('rule')
        if r_compile:
            rule = os.path.join(get_yara_rules_dir(), rule)
            rule_dict = {self.uuid: os.path.join(get_yara_rules_dir(), rule)}
            rule = yara.compile(filepaths=rule_dict)
        return rule

    # add timeout ?
    def get_meta(self, options=set()):
        meta = {'uuid': self.uuid,
                'name': self.get_name(),
                'state': self.get_state(),
                'rule': self.get_rule(),
                }
        if 'creator' in options:
            meta['creator'] = self.get_creator()
        if 'date' in options:
            meta['date'] = self.get_date()
        if 'description' in options:
            meta['description'] = self.get_description()
        if 'level' in options:
            meta['level'] = self.get_level()
        if 'mails' in options:
            meta['mails'] = self.get_mails()
        if 'nb_match' in options:
            meta['nb_match'] = self.get_nb_match()
        if 'nb_objs' in options:
            meta['nb_objs'] = self.get_nb_objs()
        if 'org' in options:
            meta['org'] = self.get_org()
            if 'org_name' in options:
                meta['org_name'] = ail_orgs.Organisation(self.get_org()).get_name()
        if 'progress' in options:
            meta['progress'] = self.get_progress()
        if 'filters' in options:
            meta['filters'] = self.get_filters()
        if 'tags' in options:
            meta['tags'] = self.get_tags()
        return meta

    def is_paused(self):
        return r_tracker.sismember('retro_hunts:paused', self.uuid)

    def to_pause(self):
        to_pause = r_cache.hget(f'retro_hunt:{self.uuid}', 'pause')
        if to_pause:
            return True
        else:
            return False

    def pause(self):
        self._set_state('paused')
        r_cache.hset(f'retro_hunt:{self.uuid}', 'pause', time.time())
        self.clear_cache()

    def resume(self):
        r_cache.hdel(f'retro_hunt:{self.uuid}', 'pause')
        self._set_state('pending')

    def is_running(self):
        return r_tracker.sismember('retro_hunts:running', self.uuid)

    def run(self): # TODO ADD MORE CHECK
        self._set_state('running')

    def complete(self):
        self._set_state('completed')
        self.clear_cache()
        r_tracker.hdel(f'retro_hunt:{self.uuid}', 'last')

    def get_progress(self):
        if self.get_state() == 'completed':
            progress = 100
        else:
            progress = r_cache.hget(f'retro_hunt:{self.uuid}', 'progress')
            if not progress:
                progress = self._get_field('progress')
        return progress

    def set_progress(self, progress):
        res = r_cache.hset(f'retro_hunt:{self.uuid}', 'progress', progress)
        if res:
            self._set_field('progress', progress)

    def get_nb_match(self):
        return self._get_field('nb_match')

    def _incr_nb_match(self):
        r_tracker.hincrby(f'retro_hunt:{self.uuid}', 'nb_match', 1)

    def _decr_nb_match(self):
        r_tracker.hincrby(f'retro_hunt:{self.uuid}', 'nb_match', -1)

    def _set_nb_match(self, nb_match):
        self._set_field('nb_match', nb_match)

    def clear_cache(self):
        r_cache.delete(f'retro_hunt:{self.uuid}')

    def get_nb_objs_by_type(self, obj_type):
        return r_tracker.scard(f'retro_hunt:objs:{self.uuid}:{obj_type}')

    def get_objs_by_type(self, obj_type):
        return r_tracker.smembers(f'retro_hunt:objs:{self.uuid}:{obj_type}')

    def get_nb_objs(self):
        objs = {}
        for obj_type in get_objects_retro_hunted():
            nb = self.get_nb_objs_by_type(obj_type)
            if nb:
                objs[obj_type] = nb
        return objs

    def get_objs(self):
        objs = []
        for obj_type in get_objects_retro_hunted():
            for obj in self.get_objs_by_type(obj_type):
                subtype, obj_id = obj.split(':', 1)
                objs.append((obj_type, subtype, obj_id))
        return objs

    def add(self, obj_type, subtype, obj_id):
        # match by object type:
        r_tracker.sadd(f'retro_hunt:objs:{self.uuid}:{obj_type}', f'{subtype}:{obj_id}')
        # MAP object -> retro hunt
        r_tracker.sadd(f'obj:retro_hunts:{obj_type}:{subtype}:{obj_id}', self.uuid)
        self._incr_nb_match()

    def remove(self, obj_type, subtype, obj_id):
        # match by object type:
        r_tracker.srem(f'retro_hunt:objs:{self.uuid}:{obj_type}', f'{subtype}:{obj_id}')
        # MAP object -> retro hunt
        r_tracker.srem(f'obj:retro_hunts:{obj_type}:{subtype}:{obj_id}', self.uuid)
        self._decr_nb_match()

    def create(self, org_uuid, user_id, level, name, rule, description=None, filters=[], mails=[], tags=[], timeout=30, state='pending'):
        if self.exists():
            raise Exception('Error: Retro Hunt Task already exists')

        self._set_field('name', escape(name))

        self._set_field('rule', rule)

        self._set_field('date', datetime.date.today().strftime("%Y%m%d"))
        self._set_field('name', escape(name))
        self._set_field('creator_org', org_uuid)
        self._set_field('creator', user_id)
        if description:
            self._set_field('description', description)
        if timeout:
            self._set_field('timeout', int(timeout))
        for tag in tags:
            # tag = escape(tag)
            r_tracker.sadd(f'retro_hunt:tags:{self.uuid}', tag)
            Tag.create_custom_tag(tag)
        for mail in mails:
            r_tracker.sadd(f'retro_hunt:mails:{self.uuid}', escape(mail))

        if filters:
            self.set_filters(filters)

        self.set_level(level, org_uuid)
        r_tracker.sadd('retro_hunts:all', self.uuid)

        # add to pending tasks
        if state not in ('pending', 'completed', 'paused'):
            state = 'pending'
        self._set_state(state)

    def delete(self):
        if self.is_running() and self.get_state() not in ['completed', 'paused']:
            return None

        # Delete custom rule
        rule = self.get_rule()
        if not is_default_yara_rule(rule):
            filepath = get_yara_rule_file_by_tracker_name(rule)
            if filepath:
                os.remove(filepath)

        self.delete_level()

        r_tracker.srem('retro_hunts:pending', self.uuid)
        r_tracker.delete(f'retro_hunts:{self.uuid}')
        r_tracker.delete(f'retro_hunt:tags:{self.uuid}')
        r_tracker.delete(f'retro_hunt:mails:{self.uuid}')

        for obj in self.get_objs():
            self.remove(obj[0], obj[1], obj[2])

        r_tracker.srem('retro_hunts:all', self.uuid)
        r_tracker.srem('retro_hunts:pending', self.uuid)
        r_tracker.srem('retro_hunts:paused', self.uuid)
        r_tracker.srem('retro_hunts:completed', self.uuid)

        self.clear_cache()
        return self.uuid

def create_retro_hunt(user_org, user_id, level, name, rule_type, rule, description=None, filters=[], mails=[], tags=[], timeout=30, state='pending', task_uuid=None):
    if not task_uuid:
        task_uuid = str(uuid.uuid4())
    retro_hunt = RetroHunt(task_uuid)
    # rule_type: yara_default - yara custom
    rule = save_yara_rule(rule_type, rule, tracker_uuid=retro_hunt.uuid)
    retro_hunt.create(user_org, user_id, level, name, rule, description=description, mails=mails, tags=tags,
                      timeout=timeout, filters=filters, state=state)
    return retro_hunt.uuid

# TODO
# def _re_create_retro_hunt_task(name, rule, date, date_from, date_to, creator, sources, tags, mails, timeout, description, task_uuid, state='pending', nb_match=0, last_id=None):
#     retro_hunt = RetroHunt(task_uuid)
#     retro_hunt.create(name, rule, date_from, date_to, creator, description=description, mails=mails, tags=tags,
#                       timeout=timeout, sources=sources, state=state)
#     if last_id:
#         set_retro_hunt_last_analyzed(task_uuid, last_id)
#     retro_hunt._set_nb_match(nb_match)
#     retro_hunt._set_field('date', date)

## ? ? ?
# set tags
# set mails
# limit mail

# SET Retro Hunts

def get_all_retro_hunt_tasks():
    return r_tracker.smembers('retro_hunts:all')

def get_retro_hunts_global():
    return r_tracker.smembers('retro_hunts')

def get_retro_hunts_org(org_uuid):
    return ail_orgs.get_org_objs_by_type(org_uuid, 'retro_hunt')

def get_retro_hunts_orgs():
    retros = []
    for retro_uuid in get_all_retro_hunt_tasks():
        retro = RetroHunt(retro_uuid)
        if retro.get_level() == 2:
            retros.append(retro_uuid)
    return retros

def get_retro_hunt_pending_tasks():
    return r_tracker.smembers('retro_hunts:pending')

def get_retro_hunt_running_tasks():
    return r_tracker.smembers('retro_hunts:running')

def get_retro_hunt_paused_tasks():
    return r_tracker.smembers('retro_hunts:paused')

def get_retro_hunt_completed_tasks():
    return r_tracker.smembers('retro_hunts:completed')

## Change STATES ##

def get_retro_hunt_task_to_start():
    task_uuid = r_tracker.spop('retro_hunts:pending')
    if task_uuid:
        retro_hunt = RetroHunt(task_uuid)
        retro_hunt.run()
    return task_uuid

## Metadata ##

def get_retro_hunt_metas(trackers_uuid):
    tasks = []
    for task_uuid in trackers_uuid:
        retro_hunt = RetroHunt(task_uuid)
        tasks.append(retro_hunt.get_meta(options={'date', 'progress', 'org', 'org_name', 'nb_match', 'tags'}))
    return tasks

## Objects ##

def is_obj_retro_hunted(obj_type, subtype, obj_id):
    return r_tracker.exists(f'obj:retro_hunts:{obj_type}:{subtype}:{obj_id}')

def get_obj_retro_hunts(obj_type, subtype, obj_id):
    return r_tracker.smembers(f'obj:retro_hunts:{obj_type}:{subtype}:{obj_id}')

def delete_obj_retro_hunts(obj_type, subtype, obj_id):
    for retro_uuid in get_obj_retro_hunts(obj_type, subtype, obj_id):
        retro_hunt = RetroHunt(retro_uuid)
        retro_hunt.remove(obj_type, subtype, obj_id)

####  ACL  ####

def api_check_retro_hunt_acl(retro_hunt, user_org, user_id, user_role, action):
    if not ail_orgs.check_obj_access_acl(retro_hunt, user_org, user_id, user_role, action):
        return {"status": "error", "reason": "Access Denied"}, 403

# TODO
def api_is_allowed_to_edit_retro_hunt_level(retro_hunt, user_org, user_id, user_role, new_level):
    if not ail_orgs.check_acl_edit_level(retro_hunt, user_org, user_id, user_role, new_level):
        return {"status": "error", "reason": "Access Denied - Tracker level"}, 403

####  API  ####

def api_check_retro_hunt_task_uuid(task_uuid):
    if not is_valid_uuid_v4(task_uuid):
        return {"status": "error", "reason": "Invalid uuid"}, 400
    retro_hunt = RetroHunt(task_uuid)
    if not retro_hunt.exists():
        return {"status": "error", "reason": "Unknown uuid"}, 404
    return None

def api_pause_retro_hunt_task(user_org, user_id, user_role, task_uuid):
    res = api_check_retro_hunt_task_uuid(task_uuid)
    if res:
        return res
    retro_hunt = RetroHunt(task_uuid)
    res = api_check_retro_hunt_acl(retro_hunt, user_org, user_id, user_role, 'edit')
    if res:
        return res
    task_state = retro_hunt.get_state()
    if task_state not in ['pending', 'running']:
        return {"status": "error", "reason": f"Task {task_uuid} not paused, current state: {task_state}"}, 400
    retro_hunt.pause()
    return task_uuid, 200

def api_resume_retro_hunt_task(user_org, user_id, user_role, task_uuid):
    res = api_check_retro_hunt_task_uuid(task_uuid)
    if res:
        return res
    retro_hunt = RetroHunt(task_uuid)
    res = api_check_retro_hunt_acl(retro_hunt, user_org, user_id, user_role, 'edit')
    if res:
        return res
    if not retro_hunt.is_paused():
        return {"status": "error",
                "reason": f"Task {task_uuid} not paused, current state: {retro_hunt.get_state()}"}, 400
    retro_hunt.resume()
    return task_uuid, 200

def api_validate_rule_to_add(rule, rule_type):
    if rule_type == 'yara_custom':
        if not is_valid_yara_rule(rule):
            return {"status": "error", "reason": "Invalid custom Yara Rule"}, 400
    elif rule_type == 'yara_default':
        if not is_valid_default_yara_rule(rule):
            return {"status": "error", "reason": "The Yara Rule doesn't exist"}, 400
    else:
        return {"status": "error", "reason": "Incorrect type"}, 400
    return {"status": "success", "rule": rule, "type": rule_type}, 200

def api_create_retro_hunt_task(dict_input, user_org, user_id):
    # # TODO: API: check mandatory arg
    # # TODO: TIMEOUT

    # timeout=30
    rule = dict_input.get('rule', None)
    if not rule:
        return {"status": "error", "reason": "Retro Hunt Rule not provided"}, 400
    task_type = dict_input.get('type', None)
    if not task_type:
        return {"status": "error", "reason": "type not provided"}, 400

    # Level
    level = dict_input.get('level', 1)
    try:
        level = int(level)
    except TypeError:
        level = 1
    if level not in range(1, 3):
        level = 1

    # # TODO: limit
    name = dict_input.get('name', '')
    name = escape(name)
    name = name[:60]
    # # TODO: limit
    description = dict_input.get('description', '')
    description = escape(description)
    description = description[:1000]

    res = api_validate_rule_to_add(rule, task_type)
    if res[1] != 200:
        return res

    tags = dict_input.get('tags', [])    # TODO escape custom tags
    mails = dict_input.get('mails', [])  # TODO escape mails
    res = verify_mail_list(mails)
    if res:
        return res

    # Filters # TODO MOVE ME
    filters = dict_input.get('filters', {})
    if filters:
        if filters.keys() == get_objects_retro_hunted():
            filters = {}
        for obj_type in filters:
            if obj_type not in get_objects_retro_hunted():
                return {"status": "error", "reason": "Invalid Tracker Object type"}, 400

            for filter_name in filters[obj_type]:
                if filter_name not in {'date_from', 'date_to', 'mimetypes', 'sources', 'subtypes'}:
                    return {"status": "error", "reason": "Invalid Filter"}, 400
                elif filter_name == 'date_from':
                    if not Date.validate_str_date(filters[obj_type]['date_from']):
                        return {"status": "error", "reason": "Invalid date_from"}, 400
                elif filter_name == 'date_to':
                    if not Date.validate_str_date(filters[obj_type]['date_from']):
                        return {"status": "error", "reason": "Invalid date_to"}, 400
                elif filter_name == 'mimetypes':  # TODO sanityze mimetypes
                    pass
                elif filter_name == 'sources':
                    if obj_type == 'item':
                        res = item_basic.verify_sources_list(filters['item']['sources'])
                        if res:
                            return res
                    else:
                        return {"status": "error", "reason": "Invalid Filter sources"}, 400
                elif filter_name == 'subtypes':
                    obj_subtypes = set(get_object_all_subtypes(obj_type))
                    for subtype in filters[obj_type]['subtypes']:
                        if subtype not in obj_subtypes:
                            return {"status": "error", "reason": "Invalid Tracker Object subtype"}, 400

            if 'date_from' and 'date_to' in filters:
                res = Date.api_validate_str_date_range(filters[obj_type]['date_from'], filters[obj_type]['date_to'])
                if res:
                    return res

    task_uuid = create_retro_hunt(user_org, user_id, level, name, task_type, rule, description=description,
                                  mails=mails, tags=tags, timeout=30, filters=filters)
    return {'name': name, 'rule': rule, 'type': task_type, 'uuid': task_uuid}, 200

def api_delete_retro_hunt_task(user_org, user_id, user_role, task_uuid):
    res = api_check_retro_hunt_task_uuid(task_uuid)
    if res:
        return res
    retro_hunt = RetroHunt(task_uuid)
    res = api_check_retro_hunt_acl(retro_hunt, user_org, user_id, user_role, 'delete')
    if res:
        return res
    if retro_hunt.is_running() and retro_hunt.get_state() not in ['completed', 'paused']:
        return {"status": "error", "reason": "You can't delete a running task"}, 400
    else:
        return retro_hunt.delete(), 200

################################################################################
################################################################################
################################################################################
################################################################################

#### DB FIX ####

# def _fix_db_custom_tags():
#     for tag in get_trackers_tags():
#         if not Tag.is_taxonomie_tag(tag) and not Tag.is_galaxy_tag(tag):
#             Tag.create_custom_tag(tag)

#### -- ####


# if __name__ == '__main__':

    # _fix_db_custom_tags()
    # fix_all_tracker_uuid_list()
    # res = get_all_tracker_uuid()
    # print(len(res))

    # import Term
    # Term.delete_term('5262ab6c-8784-4a55-b0ff-a471018414b4')

    # fix_tracker_stats_per_day('5262ab6c-8784-4a55-b0ff-a471018414b4')

    # tracker_uuid = '5262ab6c-8784-4a55-b0ff-a471018414b4'
    # fix_tracker_item_link(tracker_uuid)
    # res = get_item_all_trackers_uuid('archive/')
    # print(res)

    # res = is_valid_yara_rule('rule dummy {  }')

    # res = create_tracker('test', 'word', 'admin@admin.test', 1, [], [], None, sources=['crawled', 'pastebin.com', 'rt/pastebin.com'])
    # res = create_tracker('circl\.lu', 'regex', 'admin@admin.test', 1, [], [], None, sources=['crawled','pastebin.com'])
    # print(res)

    # t_uuid = '1c2d35b0-9330-4feb-b454-da13007aa9f7'
    # res = get_tracker_sources('ail-yara-rules/rules/crypto/certificate.yar', 'yara')

    # sys.path.append(os.environ['AIL_BIN'])
    # from packages import Term
    # Term.delete_term('074ab4be-6049-45b5-a20e-8125a4e4f500')

    # res = get_items_to_analyze('archive/pastebin.com_pro/2020/05/15', last='archive/pastebin.com_pro/2020/05/15/zkHEgqjQ.gz')
    # get_retro_hunt_task_progress('0', nb_src_done=2)

    # res = set_cache_retro_hunt_task_progress('0', 100)
    # res = get_retro_hunt_task_nb_src_done('0', sources=['pastebin.com_pro', 'alerts/pastebin.com_pro', 'crawled'])
    # print(res)

    # sources = ['pastebin.com_pro', 'alerts/pastebin.com_pro', 'crawled']
    # rule = 'custom-rules/4a8a3d04-f0b6-43ce-8e00-bdf47a8df241.yar'
    # name = 'retro_hunt_test_1'
    # description = 'circl retro hunt first test'
    # tags =  ['retro_circl', 'circl']
    # creator = 'admin@admin.test'
    # date_from = '20200610'
    # date_to = '20210630'

    # res = create_retro_hunt_task(name, rule, date_from, date_to, creator, sources=sources, tags=tags, description=description)

    # get_retro_hunt_nb_item_by_day(['80b402ef-a8a9-4e97-adb6-e090edcfd571'], date_from=None, date_to=None, num_day=31)

    # res = get_retro_hunt_nb_item_by_day(['c625f971-16e6-4331-82a7-b1e1b9efdec1'], date_from='20200610', date_to='20210630')

    # res = delete_retro_hunt_task('598687b6-f765-4f8b-861a-09ad76d0ab34')

    # print(res)