From bb26b908b4ccc7dcef4f20f4ccac29a19b5860ee Mon Sep 17 00:00:00 2001
From: Richard Cordovano <rcordovano@basistech.com>
Date: Mon, 21 Jun 2021 09:56:47 -0400
Subject: [PATCH] Add OS acct instances added event, part 1

---
 .../sleuthkit/autopsy/casemodule/Case.java    | 10 +++
 .../events/OsAcctInstancesAddedEvent.java     | 64 +++++++++++++++++++
 2 files changed, 74 insertions(+)
 create mode 100755 Core/src/org/sleuthkit/autopsy/casemodule/events/OsAcctInstancesAddedEvent.java

diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/Case.java b/Core/src/org/sleuthkit/autopsy/casemodule/Case.java
index 19d70deb62..213d45bcc3 100644
--- a/Core/src/org/sleuthkit/autopsy/casemodule/Case.java
+++ b/Core/src/org/sleuthkit/autopsy/casemodule/Case.java
@@ -92,6 +92,7 @@ import org.sleuthkit.autopsy.casemodule.events.HostsRemovedFromPersonEvent;
 import org.sleuthkit.autopsy.casemodule.events.OsAccountsAddedEvent;
 import org.sleuthkit.autopsy.casemodule.events.OsAccountsUpdatedEvent;
 import org.sleuthkit.autopsy.casemodule.events.OsAccountsDeletedEvent;
+import org.sleuthkit.autopsy.casemodule.events.OsAcctInstancesAddedEvent;
 import org.sleuthkit.autopsy.casemodule.events.PersonsAddedEvent;
 import org.sleuthkit.autopsy.casemodule.events.PersonsUpdatedEvent;
 import org.sleuthkit.autopsy.casemodule.events.PersonsDeletedEvent;
@@ -447,6 +448,10 @@ public class Case {
          * One or more OS accounts have been deleted from the case.
          */
         OS_ACCOUNTS_DELETED,
+        /**
+         * One or more OS account instances have been added to the case.
+         */
+        OS_ACCT_INSTANCES_ADDED,
         /**
          * One or more hosts have been added to the case.
          */
@@ -534,6 +539,11 @@ public class Case {
             eventPublisher.publish(new OsAccountsDeletedEvent(event.getOsAccountObjectIds()));
         }
 
+        @Subscribe
+        public void publishOsAccountInstancesAddedEvent(TskEvent.OsAcctInstancesAddedTskEvent event) {
+            eventPublisher.publish(new OsAcctInstancesAddedEvent(event.getOsAccountInstances()));            
+        }
+        
         /**
          * Publishes an autopsy event from the sleuthkit HostAddedEvent
          * indicating that hosts have been created.
diff --git a/Core/src/org/sleuthkit/autopsy/casemodule/events/OsAcctInstancesAddedEvent.java b/Core/src/org/sleuthkit/autopsy/casemodule/events/OsAcctInstancesAddedEvent.java
new file mode 100755
index 0000000000..17b8f31e9a
--- /dev/null
+++ b/Core/src/org/sleuthkit/autopsy/casemodule/events/OsAcctInstancesAddedEvent.java
@@ -0,0 +1,64 @@
+/*
+ * Autopsy Forensic Browser
+ *
+ * Copyright 2021 Basis Technology Corp.
+ * Contact: carrier <at> sleuthkit <dot> org
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.sleuthkit.autopsy.casemodule.events;
+
+import java.util.ArrayList;
+import java.util.List;
+import static org.sleuthkit.autopsy.casemodule.Case.Events.OS_ACCT_INSTANCES_ADDED;
+import org.sleuthkit.datamodel.OsAccountInstance;
+import org.sleuthkit.datamodel.SleuthkitCase;
+import org.sleuthkit.datamodel.TskCoreException;
+
+/**
+ * An application event published when OS accounts are added to the Sleuth Kit
+ * data model for a case.
+ */
+public final class OsAcctInstancesAddedEvent extends TskDataModelChangedEvent<OsAccountInstance, OsAccountInstance> {
+
+    private static final long serialVersionUID = 1L;
+
+    /**
+     * Constructs an application event published when OS account instances are added to
+     * the Sleuth Kit data model for a case.
+     *
+     * @param osAcctInstances The OS account instances that were added.
+     */
+    public OsAcctInstancesAddedEvent(List<OsAccountInstance> osAcctInstances) {
+        super(OS_ACCT_INSTANCES_ADDED.toString(), null, null, osAcctInstances, OsAccountInstance::getInstanceId);
+    }
+
+    /**
+     * Gets the OS accounts that have been added or updated.
+     *
+     * @return The OS accounts.
+     */
+    public List<OsAccountInstance> getOsAccountInstances() {
+        return getNewValue();
+    }
+
+    @Override
+    protected List<OsAccountInstance> getNewValueObjects(SleuthkitCase caseDb, List<Long> ids) throws TskCoreException {
+        List<OsAccountInstance> osAccountInstances = new ArrayList<>();
+        for (Long id : ids) {
+            //RJCTODO
+        }
+        return osAccountInstances;
+    }
+
+}
\ No newline at end of file