Allow osquery external alert

Author: PatBriPerso

app/Models/YnhOsquery.php

@@ -457,6 +457,15 @@ public function message(): string
                 if ($this->isRemoved()) {
                     $msg = "Le paquet {$this->columns['name']} {$this->columns['version']} ({$type}) a été désinstallé.";
                 }
+            } else {
+                $msg = isset($this->columns['text']) ? $this->columns['text'] : "Un événement de type {$this->name} est arrivé.";
+                $msg = isset($this->columns['text'])
+                    ? $this->columns['text']
+                    : "Un événement de type {$this->name} est arrivé. Champs disponibles : " . implode(', ', array_map(
+                        fn($k, $v) => "$k=$v",
+                        array_keys($this->columns),
+                        $this->columns
+                    ));
             }
         }
         return $msg;

resources/themes/cywise/iframes/rules-editor.blade.php

@@ -105,7 +105,7 @@
   const editor = ace.edit("editor");
   editor.setTheme("ace/theme/monokai");
   editor.session.setMode("ace/mode/sql");
-  editor.setValue(@json($rule->query ?? ''));
+  editor.setValue(@json($rule->query ?? 'SELECT * FROM processes WHERE 1==0;'));
 
   const btnDelete = document.querySelector('#delete-rule');
   const btnCreate = document.querySelector('#create-rule');

routes/web.php

@@ -266,11 +266,31 @@
         $server = \App\Models\YnhServer::where('secret', $secret)->first();
 
         if (! $server) {
-            return new JsonResponse([
-                'status' => 'failure',
-                'message' => 'server not found',
-                'payload' => $payload,
-            ], 200, ['Access-Control-Allow-Origin' => '*']);
+            $apiToken = \Wave\ApiKey::query()->where('key', '=', $secret)->first();
+
+            if (! $apiToken) {
+                return new JsonResponse([
+                    'status' => 'failure',
+                    'message' => 'server not found',
+                    'payload' => $payload,
+                ], 200, ['Access-Control-Allow-Origin' => '*']);
+            }
+
+            /** @var \App\Models\User $user */
+            $user = $apiToken->user()->first();
+            $user->actAs();
+
+            $server = \App\Models\YnhServer::where('name', $payload['hostname'])
+                ->where('created_by', $user->id)
+                ->first();
+
+            if (! $server) {
+                return new JsonResponse([
+                    'status' => 'failure',
+                    'message' => 'server not found',
+                    'payload' => $payload,
+                ], 200, ['Access-Control-Allow-Origin' => '*']);
+            }
         }
 
         $events = collect($request->input('lines'))