From 7c44a1af8cca0f691a54ddb91c3d0e5cea32b581 Mon Sep 17 00:00:00 2001
From: Frank Hassanabad <frank.hassanabad@elastic.co>
Date: Fri, 15 Oct 2021 18:37:36 -0600
Subject: [PATCH] Fixes migration bug where I was deleting attributes (#115098)

## Summary

During the work here: https://github.com/elastic/kibana/pull/113577

I accidentally have introduced a bug where on migration I was deleting the attributes of `ruleThrottle` and `alertThrottle` because I was not using splat correctly.

Added unit and e2e tests to fix this.

### Checklist
- [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios
---
 .../rule_actions/legacy_migrations.test.ts    |  4 ++++
 .../rule_actions/legacy_migrations.ts         |  2 +-
 .../security_and_spaces/tests/migrations.ts   | 21 +++++++++++++++++++
 3 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_actions/legacy_migrations.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_actions/legacy_migrations.test.ts
index 8414aa93c7984..7dd05c5122a61 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_actions/legacy_migrations.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_actions/legacy_migrations.test.ts
@@ -20,6 +20,8 @@ describe('legacy_migrations', () => {
     test('it migrates both a "ruleAlertId" and a actions array with 1 element into the references array', () => {
       const doc = {
         attributes: {
+          ruleThrottle: '1d',
+          alertThrottle: '1d',
           ruleAlertId: '123',
           actions: [
             {
@@ -37,6 +39,8 @@ describe('legacy_migrations', () => {
         )
       ).toEqual({
         attributes: {
+          ruleThrottle: '1d',
+          alertThrottle: '1d',
           actions: [
             {
               actionRef: 'action_0',
diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_actions/legacy_migrations.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_actions/legacy_migrations.ts
index 8a52d3a13f065..aa85898e94a33 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_actions/legacy_migrations.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_actions/legacy_migrations.ts
@@ -245,7 +245,7 @@ export const legacyMigrateRuleAlertId = (
     return {
       ...doc,
       attributes: {
-        ...attributesWithoutRuleAlertId.attributes,
+        ...attributesWithoutRuleAlertId,
         actions: actionsWithRef,
       },
       references: [...existingReferences, ...alertReferences, ...actionsReferences],
diff --git a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/migrations.ts b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/migrations.ts
index d25fb5bfa5899..4c0f21df8c0ff 100644
--- a/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/migrations.ts
+++ b/x-pack/test/detection_engine_api_integration/security_and_spaces/tests/migrations.ts
@@ -65,6 +65,27 @@ export default ({ getService }: FtrProviderContext): void => {
           undefined
         );
       });
+
+      it('migrates legacy siem-detection-engine-rule-actions and retains "ruleThrottle" and "alertThrottle" as the same attributes as before', async () => {
+        const response = await es.get<{
+          'siem-detection-engine-rule-actions': {
+            ruleThrottle: string;
+            alertThrottle: string;
+          };
+        }>({
+          index: '.kibana',
+          id: 'siem-detection-engine-rule-actions:fce024a0-0452-11ec-9b15-d13d79d162f3',
+        });
+        expect(response.statusCode).to.eql(200);
+
+        // "alertThrottle" and "ruleThrottle" should still exist
+        expect(response.body._source?.['siem-detection-engine-rule-actions'].alertThrottle).to.eql(
+          '7d'
+        );
+        expect(response.body._source?.['siem-detection-engine-rule-actions'].ruleThrottle).to.eql(
+          '7d'
+        );
+      });
     });
   });
 };