feat: add HoneypotPayloadViewSet with RBAC-gated download. closes #1460 by opbot-xd · Pull Request #1464 · GreedyBear-Project/GreedyBear

opbot-xd · 2026-07-19T22:25:37Z

Description

Add a DRF ViewSet and RBAC permission class to expose HoneypotPayload data via api/payloads/.

Related issues

Closes Create Authenticated DRF ViewSet for Payloads #1460

Type of change

Bug fix (non-breaking change which fixes an issue).
New feature (non-breaking change which adds functionality).
Breaking change (fix or feature that would cause existing functionality to not work as expected).
Chore (refactoring, dependency updates, CI/CD changes, code cleanup, docs-only changes).

Checklist

Formalities

I have read and understood the rules about how to Contribute to this project.
I chose an appropriate title for the pull request in the form: <feature name>. Closes #999
My branch is based on develop.
The pull request is for the branch develop.
I have reviewed and verified any LLM-generated code included in this PR.

Docs and tests

I documented my code changes with docstrings and/or comments.
I have checked if my changes affect user-facing behavior that is described in the docs. If so, I also included an update to the wiki in the description of this PR.
Linter (Ruff) gave 0 errors. If you have correctly installed pre-commit, it does these checks and adjustments on your behalf.
I have added tests for the feature/bug I solved.
All the tests gave 0 errors.

GUI changes

Ignore this section if you did not make any changes to the GUI.

I have provided a screenshot of the result in the PR.
I have created new frontend tests for the new component or updated existing ones.

Review process

We encourage you to create a draft PR first, even when your changes are incomplete. This way you refine your code while we can track your progress and actively review and help.
If you think your draft PR is ready to be reviewed by the maintainers, click the corresponding button. Your draft PR will become a real PR.
If your changes decrease the overall tests coverage (you will know after the Codecov CI job is done), you should add the required tests to fix the problem.
Every time you make changes to the PR and you think the work is done, you should explicitly ask for a review. After receiving a "change request", address the feedback and click "request re-review" next to the reviewer's profile picture at the top right.

Copilot

Pull request overview

Adds a new DRF read-only API for honeypot-captured payload metadata, plus an RBAC-gated endpoint to download quarantined .vir files for authorized users (staff / threat researchers).

Changes:

Introduces HoneypotPayloadViewSet with list, retrieve (metadata) and download (file stream) actions.
Adds IsThreatResearcherOrAdmin permission and a HoneypotPayloadSerializer that excludes the file field/path.
Registers the new route under /api/payloads and adds tests for permissions and view behavior.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
tests/api/views/test_payload_view.py	Adds API tests for listing, retrieving, and RBAC-gated download behavior.
tests/api/test_permissions.py	Adds unit tests for the new permission class.
api/views/payloads.py	Implements the new read-only payload viewset and download action.
api/views/init.py	Exposes the new viewset via `api.views` imports.
api/urls.py	Registers the `payloads` router endpoint.
api/serializers/payloads.py	Adds serializer for payload metadata (excluding file).
api/serializers/init.py	Re-exports the new serializer module.
api/permissions.py	Adds `IsThreatResearcherOrAdmin` permission and group constant.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

opbot-xd · 2026-07-19T22:32:35Z

Hi @regulartim,
DRF emits an UnorderedObjectListWarning on the list endpoint.

/usr/local/lib/python3.13/site-packages/rest_framework/pagination.py:198: UnorderedObjectListWarning: Pagination may yield inconsistent results with an unordered object_list: <class 'greedybear.models.HoneypotPayload'> QuerySet.

Should I just ignore this or try to fix it by making changes in model like Meta.ordering = ["-id"] or Adding a first_seen timestamp + order by it

It is also reported by copilot in second run.

- Create HoneypotPayloadViewSet at /api/payloads/ (ReadOnly, sha256 lookup) - Add IsThreatResearcherOrAdmin permission class (staff or threat_researcher group) - list/retrieve return metadata only; download action streams .vir file - Add HoneypotPayloadSerializer excluding internal fields - 16 tests covering auth, RBAC, metadata-only responses, and download streaming

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

regulartim · 2026-07-20T07:28:30Z

Hi @opbot-xd !

Should I just ignore this or try to fix it by making changes in model like Meta.ordering = ["-id"] or Adding a first_seen timestamp + order by it

I think ignoring it would introduce a correctness bug on paginated responses. I think Copilot's suggetion of just adding a .order_by("-id") is fine. That said, if you do think that a first_seen filed would provide actual value, feel free to add it. Then you could also introduce Meta.ordering to the model, since you are touching it anyway.

regulartim

Looks good! 👍

One thing I would really like to see: OpenAPI/Swagger schema documentation for the new API endpoint. I already implemented that for the Feeds API and I think it adds a lot of value. See #962 for context.
Basically you create a request and a response serializer and comment its fields adequately. The rest is done by a DRF module. You want to try it? You can just ask me if anything is unclear.

… serializer field descriptions

Copilot

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.

regulartim

Hey @opbot-xd ! The documentation was not wired in correctly. I did that and will push the changes soon. To view the docs, just open /api/schema/swagger-ui/. Maybe you could polish it a bit? Like adding all possible responses to list and retrieve and fix the documented response format for download?

Copilot

Copilot was unable to review this pull request because the user who requested the review is ineligible. To be eligible to request a review, you need a paid Copilot license, or your organization must enable Copilot code review.

- Add explicit 200/401/404 responses to list and retrieve - Fix download 200 response to use OpenApiTypes.BINARY instead of bytes - Add 401 to download action responses

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

opbot-xd · 2026-07-22T22:24:02Z

Hi @regulartim, :D
Polished the schema in the latest commit:

added possible responses for lists and retrieve
for download fixed 200 response from response=bytes to response=OpenApiTypes.BINARY so drf-spectacular correctly emits application/octet-stream in the schema; also added 401

regulartim

Nice, thank you! :)

Copilot AI review requested due to automatic review settings July 19, 2026 22:25

Copilot started reviewing on behalf of opbot-xd July 19, 2026 22:26 View session

Copilot AI reviewed Jul 19, 2026

View reviewed changes

Comment thread api/views/payloads.py

Comment thread api/views/payloads.py Outdated

Comment thread tests/api/views/test_payload_view.py Outdated

Comment thread tests/api/test_permissions.py Outdated

Copilot AI review requested due to automatic review settings July 19, 2026 22:38

opbot-xd force-pushed the feat/payload-viewset-rbac branch from c5d697c to 8dc79d8 Compare July 19, 2026 22:38

Copilot started reviewing on behalf of opbot-xd July 19, 2026 22:38 View session

Copilot AI reviewed Jul 19, 2026

View reviewed changes

Comment thread api/views/payloads.py Outdated

regulartim requested changes Jul 20, 2026

View reviewed changes

feat: add OpenAPI documentation for HoneypotPayloadViewSet and enrich…

d7963e7

… serializer field descriptions

Copilot AI review requested due to automatic review settings July 20, 2026 18:51

Copilot started reviewing on behalf of opbot-xd July 20, 2026 18:52 View session

Copilot AI reviewed Jul 20, 2026

View reviewed changes

Comment thread api/permissions.py

Comment thread api/views/payloads.py

Comment thread api/views/payloads.py Outdated

opbot-xd requested a review from regulartim July 20, 2026 19:15

regulartim requested changes Jul 21, 2026

View reviewed changes

wire in new endpoint for schema generation

260ca62

Copilot AI review requested due to automatic review settings July 21, 2026 07:00

Copilot AI reviewed Jul 21, 2026

docs: polish OpenAPI schema for HoneypotPayloadViewSet

08a9f4f

- Add explicit 200/401/404 responses to list and retrieve - Fix download 200 response to use OpenApiTypes.BINARY instead of bytes - Add 401 to download action responses

Copilot AI review requested due to automatic review settings July 22, 2026 22:17

Copilot AI reviewed Jul 22, 2026

opbot-xd requested a review from regulartim July 22, 2026 22:27

regulartim approved these changes Jul 23, 2026

View reviewed changes

regulartim merged commit a2e13b1 into develop Jul 23, 2026
4 checks passed

Uh oh!

Uh oh!

Conversation

opbot-xd commented Jul 19, 2026

Description

Related issues

Type of change

Checklist

Formalities

Docs and tests

GUI changes

Review process

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

opbot-xd commented Jul 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

regulartim commented Jul 20, 2026

Uh oh!

regulartim left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

regulartim left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

opbot-xd commented Jul 22, 2026

Uh oh!

regulartim left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

opbot-xd commented Jul 19, 2026 •

edited

Loading