fix(feed): widen source_ref from VARCHAR(100) to TEXT #1

Merged

hiveiq merged 15 commits from develop into main 2026-06-19 12:01:47 -04:00

Conversation 1 Commits 15 Files Changed 25

+1758 -336

hiveiq commented 2026-06-19 12:00:57 -04:00

Owner

Copy Link

Copy Source

Summary

• source_ref column on threat_ioc was VARCHAR(100), causing value too long for type character varying(100) errors during IOC feed refresh
• OTX pulse names are free-text titles that regularly exceed 100 characters
• V8 Flyway migration widens the column to TEXT (no length limit), consistent with the description column

Test plan

• Merge and deploy to bcos.dev
• Trigger an OTX feed refresh via the IOC Feeds page
• Confirm run completes with SUCCESS status and no column-too-long errors in logs

## Summary - `source_ref` column on `threat_ioc` was `VARCHAR(100)`, causing `value too long for type character varying(100)` errors during IOC feed refresh - OTX pulse names are free-text titles that regularly exceed 100 characters - V8 Flyway migration widens the column to `TEXT` (no length limit), consistent with the `description` column ## Test plan - [ ] Merge and deploy to bcos.dev - [ ] Trigger an OTX feed refresh via the IOC Feeds page - [ ] Confirm run completes with `SUCCESS` status and no column-too-long errors in logs

hiveiq added 15 commits 2026-06-19 12:00:58 -04:00

fix(frontend): remove version string from sidebar, bump to v1.0.0 ... 43b56fb859

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix(posture): page size selector now applies correctly ... d102a4bf61

const → let and pageSizeChange handler was discarding e.detail.size.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feat(aria): Phase 5 — IOC feed refresh from OTX, MalwareBazaar, ThreatFox ... bdc2504635

Adds automated daily IOC ingestion from three external threat feeds:
- AlienVault OTX: subscribed pulses + ATM-keyword searches (requires API key)
- MalwareBazaar (abuse.ch): ATM-tagged malware samples, no key required
- ThreatFox (abuse.ch): ATM malware family IOCs, no key required

Backend:
- IocFeedRun entity + V6 Flyway migration (ioc_feed_run table)
- OtxFeedClient / MalwareBazaarFeedClient / ThreatFoxFeedClient
- IocFeedService: upsert dedup + @Scheduled daily 03:00 refresh
- IocFeedController: GET /status, GET /runs, POST /refresh, POST /refresh/{feed}
- ThreatIoc.IocSource enum extended: OTX, MALWARE_BAZAAR, THREAT_FOX

Frontend:
- IocFeeds.svelte: feed status cards, run history table, manual refresh
- App.svelte: IOC Feeds nav item (📡), version string removed from sidebar
- api.ts: getFeedStatus, getFeedRuns, refreshAllFeeds, refreshFeed

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix(aria): feed clients — @Param binding, auth keys, thread error logging ... 583aff9c2d

- IocFeedRunRepository: add @Param("feedName") to countRunning JPQL query
  (missing binding silently crashed background threads)
- IocFeedController: uncaught exception handler on feed threads so failures
  appear in logs instead of disappearing silently
- MalwareBazaarFeedClient/ThreatFoxFeedClient: abuse.ch now requires API
  key (auth.abuse.ch); add Auth-Key header + isConfigured() skip guard
- application.properties: add aria.feed.malware-bazaar.api-key and
  aria.feed.threat-fox.api-key properties

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix(aria): IOC Feeds — restore app, fix API shapes, canonical UI ... 571d88db4d

Root cause: IocFeeds.svelte called feeds.find() on a Map (backend returned
Map<String,Object> not List) → reactive statement crash → entire Svelte tree
broken, all sidebar nav dead.

Backend:
- /feeds/status now returns List<Map> with feedName/configured/enabled/
  lastRunAt/lastRunStatus/lastIocsAdded/lastIocsUpdated fields
- /feeds/runs now returns full Page<IocFeedRun> (not stripped .getContent())
- IocFeedService.isConfigured(feedName) added for per-feed key check
- Feed order fixed to [OTX, MALWARE_BAZAAR, THREAT_FOX] (deterministic)

Frontend:
- loadFeeds: Array.isArray guard prevents crash if shape is ever wrong
- loadRuns: safe fallback for both Page and plain-array responses
- api.ts refreshFeed URL fixed: /feeds/refresh/{name} not /feeds/{name}/refresh
- IocFeedStatus type: added lastIocsUpdated
- IocFeeds.svelte: Refresh All moved from header to toolbar; all buttons
  use canonical btn/btn-primary/btn-secondary/btn-sm classes; pollInterval
  now calls pollStatus (status-only poll) not full refresh trigger

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

chore(aria): add frontend CLAUDE.md with mandatory UI pattern rules 75ff2b92fd

fix(aria): IOC Feeds table — canonical column CSS matching DevicePosture e288bcdfe9

feat(aria): group Device Posture table by institution with collapsible accordion ... 87ad185711

All institutions expanded by default. Header row shows device count,
avg posture score, and a warning badge when any device scores below 80.
Fetches all records in one call (size=500) instead of paginating.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feat(aria): IOC reported_at, threat stats 24h window, filter sidebar, posture UX ... 1a47e2dea9

- Add reported_at field to threat_ioc (V7 migration) — tracks when the source
  originally published the IOC, distinct from addedAt (ingestion time); wired
  into OTX (created field), MalwareBazaar and ThreatFox (first_seen field),
  and the manual IOC creation endpoint
- Fix threat event stats to use a 24h time window for critical/high counts
  (countBySeverityAndDetectedAtAfter) instead of all-time totals
- Rebuild IOC Management with canonical filter sidebar: collapsible left sidebar
  with per-type toggle pills, active filter chips with individual removal
- DevicePosture: collapse institutions and filter sidebar by default

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix(aria): collapse filter sidebar by default on all pages ... 7ea07440dc

PrecursorAlerts and ThreatEvents were still starting expanded.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

style: standardize ThreatEvents filter chip CSS to canonical template ... b151bf112c

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

style: align all aria pages to canonical TemplatePage layout ... 4dc3636f70

- page-right/content-frame/active-filters now match TemplatePage exactly
- active-filters gets the blue tinted background box (#f0f4ff, border #d0d9f0)
- content-frame uses padding+gap instead of margin-top
- page-right gets padding:0.65rem + gap:0.5rem
- ThreatEvents restructured with content-frame wrapper and toolbar-count
- IocManagement .count renamed to .toolbar-count

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

style: remove light blue background from active-filters chips row ... f7e5158446

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

style: remove bar-filters-active blue highlight from filter sidebar toggle bar ... 7e4b147db8

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix(feed): widen source_ref from VARCHAR(100) to TEXT ... 746b598f4d

OTX pulse names exceed 100 characters, causing a column-too-long error on
IOC feed upsert. TEXT has no length limit and matches the description column.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

johannes approved these changes 2026-06-19 12:01:35 -04:00

hiveiq merged commit e9e1be631c into main 2026-06-19 12:01:47 -04:00

Sign in to join this conversation.

Reviewers

No Reviewers

johannes

Labels

Clear labels

Backend

Service, API, or data-layer work

Breaking

Breaking change that won't be backward compatible

Bug

Something is not working

Dev Verified

Fix verified on bcos.dev by QA — cleared for production release

Documentation

Documentation changes

Enhancement

Improve existing functionality

Feature

New functionality

Frontend

UI / Svelte SPA work

Pattern

For changes to our agent Pattern for detecting hardware faults

Priority

Critical

The priority is critical

Priority

High

The priority is high

Priority

Low

The priority is low

Priority

Medium

The priority is medium

Reopen

Fix was verified but the issue persists or regressed. Reopen and reassign for investigation.

Reviewed

Confirmed

Issue has been confirmed

Reviewed

Duplicate

This issue or pull request already exists

Reviewed

Invalid

Invalid issue

Reviewed

Won't Fix

This issue won't be fixed

Security

This is security issue

Status

Abandoned

Somebody has started to work on this but abandoned work

Status

Blocked

Something is blocking this issue or pull request

Status

Need More Info

Feedback is required to reproduce issue or to continue work

TEST

Tested

Not Fixed

Testing

Issue or pull request related to testing

Verify Fix

Fix has been deployed to production. Verify the issue is resolved before closing.

Verify/Production

Fix deployed to production — verify before closing

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

hiveiq hiveiq-browser johannes tristan (Tristan Smith)

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: hiveiq-src/hiveops-aria#1