fix(observable-aliases): backfill missing aliases in v6 data

js/packages/cyvest-app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyvest/cyvest-app",
-  "version": "6.1.1",
+  "version": "6.1.2",
   "private": true,
   "scripts": {
     "dev": "vite",

js/packages/cyvest-js/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyvest/cyvest-js",
-  "version": "6.1.1",
+  "version": "6.1.2",
   "type": "module",
   "files": [
     "dist"

js/packages/cyvest-js/src/types.generated.ts

@@ -153,7 +153,7 @@ export interface Observable {
   extra: Extra;
   score: number;
   level: Level;
-  aliases: Aliases;
+  aliases?: Aliases;
   occurrence_count?: number;
   threat_intels: ThreatIntels;
   relationships: Relationships;

js/packages/cyvest-js/tests/helpers.test.ts

@@ -0,0 +1,31 @@
+import { readFileSync } from "node:fs";
+import { describe, expect, it } from "vitest";
+
+import { parseCyvest } from "../src";
+
+describe("parseCyvest", () => {
+  it("accepts resolver metadata stored in observable extra", () => {
+    const fixtureUrl = new URL(
+      "../../cyvest-app/src/investigations/cyvest_visual.json",
+      import.meta.url,
+    );
+    const payload = JSON.parse(readFileSync(fixtureUrl, "utf8"));
+    const observable = payload.observables["obs:file:root"];
+    observable.extra = {
+      resolver_data: {
+        "asset-directory": {
+          profile: {
+            owner: "security",
+            status: "active",
+          },
+        },
+      },
+    };
+
+    const investigation = parseCyvest(payload);
+
+    expect(investigation.observables["obs:file:root"].extra).toEqual(
+      observable.extra,
+    );
+  });
+});

js/packages/cyvest-vis/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyvest/cyvest-vis",
-  "version": "6.1.1",
+  "version": "6.1.2",
   "type": "module",
   "files": [
     "dist"

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "cyvest"
-version = "6.1.1"
+version = "6.1.2"
 description = "Cybersecurity investigation model"
 readme = {file = "README.md", content-type = "text/markdown"}
 requires-python = ">=3.10"

schema/cyvest.schema.json

@@ -487,7 +487,6 @@
         "extra",
         "score",
         "level",
-        "aliases",
         "threat_intels",
         "relationships",
         "key",

src/cyvest/__init__.py

@@ -31,7 +31,7 @@
 from cyvest.proxies import EnrichmentProxy, EvidenceProxy, FindingProxy, ObservableProxy, TagProxy, ThreatIntelProxy
 from cyvest.resolvers import ObservableResolution, ObservableResolver
 
-__version__ = "6.1.1"
+__version__ = "6.1.2"
 
 __all__ = [
     # Core class

src/cyvest/io_serialization.py

@@ -493,10 +493,19 @@ def build_tag(tag_info: dict[str, Any]) -> Tag:
     return cv
 
 
+def _backfill_v6_observable_defaults(data: dict[str, Any]) -> dict[str, Any]:
+    """Backfill defaults added after the initial v6 schema release."""
+    for raw_observable in data.get("observables", {}).values():
+        if isinstance(raw_observable, dict):
+            raw_observable.setdefault("aliases", [])
+
+    return data
+
+
 def migrate_v5_to_v6(data: dict[str, Any]) -> dict[str, Any]:
     """Migrate a serialized Cyvest 5.x investigation to the strict 6.0.0 format."""
     if data.get("schema_version") == "6.0.0":
-        return deepcopy(data)
+        return _backfill_v6_observable_defaults(deepcopy(data))
 
     migrated = deepcopy(data)
     migrated["schema_version"] = "6.0.0"
@@ -507,6 +516,7 @@ def migrate_v5_to_v6(data: dict[str, Any]) -> dict[str, Any]:
         observable = dict(raw_observable)
         observable.setdefault("subtype", None)
         observable.setdefault("namespace", None)
+        observable.setdefault("aliases", [])
         new_key = keys.generate_observable_key(
             str(observable.get("type", "unknown")),
             str(observable.get("value", "")),

src/cyvest/model.py

@@ -354,7 +354,7 @@ class Observable(AliasDumpModel):
     extra: dict[str, Any] = Field(...)
     score: Decimal = Field(...)
     level: Level = Field(...)
-    aliases: list[ObservableAlias] = Field(...)
+    aliases: list[ObservableAlias] = Field(default_factory=list)
     occurrence_count: int = Field(default=1, ge=1)
     threat_intels: list[ThreatIntel] = Field(...)
     relationships: list[Relationship] = Field(...)
@@ -504,8 +504,9 @@ def validate_identity_and_generate_key(self) -> Self:
 
     @model_validator(mode="after")
     def dedupe_aliases(self) -> Self:
-        alias_key_type = tuple[ObservableType | str, ObservableSubtype | str | None, str | None, str]
-        aliases_by_key: dict[alias_key_type, ObservableAlias] = {}
+        aliases_by_key: dict[
+            tuple[ObservableType | str, ObservableSubtype | str | None, str | None, str], ObservableAlias
+        ] = {}
         for alias in self.aliases:
             alias_key = alias.identity_tuple
             existing = aliases_by_key.get(alias_key)

tests/test_v6_models.py

@@ -5,6 +5,7 @@
 import pytest
 
 from cyvest import Cyvest, ObservableSubtype, ObservableType
+from cyvest.io_schema import get_investigation_schema
 from cyvest.io_serialization import load_investigation_dict, migrate_v5_to_v6
 from cyvest.model import Evidence, Observable
 
@@ -69,6 +70,13 @@ def test_command_line_keys_are_sha256_based() -> None:
     assert len(command.key.rsplit(":", 1)[-1]) == 64
 
 
+def test_observable_aliases_are_optional_in_generated_schema() -> None:
+    schema = get_investigation_schema()
+    observable_schema = schema["$defs"]["Observable"]
+
+    assert "aliases" not in observable_schema["required"]
+
+
 def test_evidence_many_to_many_links_survive_roundtrip() -> None:
     cv = Cyvest(investigation_id="01ARZ3NDEKTSV4RRFFQ69G5FAV")
     evidence = cv.evidence(
@@ -201,4 +209,24 @@ def test_migrate_v5_to_v6_rewrites_findings_and_preserves_email() -> None:
     assert migrated["findings"]["fnd:sender"]["evidence_links"] == []
     assert migrated["tags"]["tag:email"]["findings"] == ["fnd:sender"]
     assert migrated["observables"]["obs:email:user@example.com"]["type"] == "email"
+    assert migrated["observables"]["obs:email:user@example.com"]["aliases"] == []
     assert migrated["evidences"] == {}
+
+
+def test_migrate_v6_backfills_missing_observable_aliases() -> None:
+    v6 = {
+        "schema_version": "6.0.0",
+        "investigation_id": "01ARZ3NDEKTSV4RRFFQ69G5FAV",
+        "observables": {
+            "obs:email:user@example.com": {
+                "type": "email",
+                "value": "user@example.com",
+                "key": "obs:email:user@example.com",
+            }
+        },
+    }
+
+    migrated = migrate_v5_to_v6(v6)
+
+    assert migrated["observables"]["obs:email:user@example.com"]["aliases"] == []
+    assert "aliases" not in v6["observables"]["obs:email:user@example.com"]