[RAC][RBAC] - add alert document versioning (elastic#17)

Addresses remaining PR comments. Adds version control to alerts doc update route. Updates tests.

packages/kbn-rule-data-utils/src/technical_field_names.ts

@@ -30,6 +30,7 @@ const ALERT_SEVERITY_VALUE = `${ALERT_NAMESPACE}.severity.value` as const;
 const ALERT_STATUS = `${ALERT_NAMESPACE}.status` as const;
 const ALERT_EVALUATION_THRESHOLD = `${ALERT_NAMESPACE}.evaluation.threshold` as const;
 const ALERT_EVALUATION_VALUE = `${ALERT_NAMESPACE}.evaluation.value` as const;
+const VERSION = '_version' as const;
 
 const fields = {
   TIMESTAMP,
@@ -52,6 +53,7 @@ const fields = {
   ALERT_STATUS,
   ALERT_EVALUATION_THRESHOLD,
   ALERT_EVALUATION_VALUE,
+  VERSION,
 };
 
 export {
@@ -75,6 +77,7 @@ export {
   ALERT_STATUS,
   ALERT_EVALUATION_THRESHOLD,
   ALERT_EVALUATION_VALUE,
+  VERSION,
 };
 
 export type TechnicalRuleDataFieldName = ValuesType<typeof fields>;

x-pack/plugins/lists/server/services/utils/decode_version.ts → packages/kbn-securitysolution-es-utils/src/decode_version/index.ts

@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 // Similar to the src/core/server/saved_objects/version/decode_version.ts

x-pack/plugins/lists/server/services/utils/encode_hit_version.ts → packages/kbn-securitysolution-es-utils/src/encode_hit_version/index.ts

@@ -1,8 +1,9 @@
 /*
  * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
  * or more contributor license agreements. Licensed under the Elastic License
- * 2.0; you may not use this file except in compliance with the Elastic License
- * 2.0.
+ * 2.0 and the Server Side Public License, v 1; you may not use this file except
+ * in compliance with, at your election, the Elastic License 2.0 or the Server
+ * Side Public License, v 1.
  */
 
 /**

packages/kbn-securitysolution-es-utils/src/index.ts

@@ -8,10 +8,12 @@
 
 export * from './bad_request_error';
 export * from './create_boostrap_index';
+export * from './decode_version';
 export * from './delete_all_index';
 export * from './delete_policy';
 export * from './delete_template';
 export * from './elasticsearch_client';
+export * from './encode_hit_version';
 export * from './get_index_aliases';
 export * from './get_index_count';
 export * from './get_index_exists';

src/core/server/ui_settings/routes/delete.ts

@@ -34,10 +34,10 @@ export function registerDeleteRoute(router: IRouter) {
         });
       } catch (error) {
         if (SavedObjectsErrorHelpers.isSavedObjectsClientError(error)) {
-          return response.customError({
+          return {
             body: error,
             statusCode: error.output.statusCode,
-          });
+          };
         }
 
         if (error instanceof CannotOverrideError) {

x-pack/plugins/lists/server/services/items/create_list_item.ts

@@ -15,9 +15,9 @@ import {
   SerializerOrUndefined,
   Type,
 } from '@kbn/securitysolution-io-ts-list-types';
+import { encodeHitVersion } from '@kbn/securitysolution-es-utils';
 
 import { transformListItemToElasticQuery } from '../utils';
-import { encodeHitVersion } from '../utils/encode_hit_version';
 import { IndexEsListItemSchema } from '../../schemas/elastic_query';
 
 export interface CreateListItemOptions {

x-pack/plugins/lists/server/services/items/update_list_item.ts

@@ -12,10 +12,9 @@ import type {
   MetaOrUndefined,
   _VersionOrUndefined,
 } from '@kbn/securitysolution-io-ts-list-types';
+import { decodeVersion, encodeHitVersion } from '@kbn/securitysolution-es-utils';
 
 import { transformListItemToElasticQuery } from '../utils';
-import { decodeVersion } from '../utils/decode_version';
-import { encodeHitVersion } from '../utils/encode_hit_version';
 import { UpdateEsListItemSchema } from '../../schemas/elastic_query';
 
 import { getListItem } from './get_list_item';

x-pack/plugins/lists/server/services/lists/create_list.ts

@@ -19,8 +19,8 @@ import type {
   Type,
 } from '@kbn/securitysolution-io-ts-list-types';
 import type { Version } from '@kbn/securitysolution-io-ts-types';
+import { encodeHitVersion } from '@kbn/securitysolution-es-utils';
 
-import { encodeHitVersion } from '../utils/encode_hit_version';
 import { IndexEsListSchema } from '../../schemas/elastic_query';
 
 export interface CreateListOptions {

x-pack/plugins/lists/server/services/lists/update_list.ts

@@ -15,9 +15,8 @@ import type {
   _VersionOrUndefined,
 } from '@kbn/securitysolution-io-ts-list-types';
 import { VersionOrUndefined } from '@kbn/securitysolution-io-ts-types';
+import { decodeVersion, encodeHitVersion } from '@kbn/securitysolution-es-utils';
 
-import { decodeVersion } from '../utils/decode_version';
-import { encodeHitVersion } from '../utils/encode_hit_version';
 import { UpdateEsListSchema } from '../../schemas/elastic_query';
 
 import { getList } from '.';

x-pack/plugins/lists/server/services/utils/index.ts

@@ -6,9 +6,7 @@
  */
 
 export * from './calculate_scroll_math';
-export * from './decode_version';
 export * from './encode_decode_cursor';
-export * from './encode_hit_version';
 export * from './escape_query';
 export * from './find_source_type';
 export * from './find_source_value';

x-pack/plugins/lists/server/services/utils/transform_elastic_to_list.ts

@@ -7,11 +7,10 @@
 
 import type { estypes } from '@elastic/elasticsearch';
 import type { ListArraySchema } from '@kbn/securitysolution-io-ts-list-types';
+import { encodeHitVersion } from '@kbn/securitysolution-es-utils';
 
 import { SearchEsListSchema } from '../../schemas/elastic_response';
 
-import { encodeHitVersion } from './encode_hit_version';
-
 export interface TransformElasticToListOptions {
   response: estypes.SearchResponse<SearchEsListSchema>;
 }

x-pack/plugins/lists/server/services/utils/transform_elastic_to_list_item.ts

@@ -7,11 +7,11 @@
 
 import type { estypes } from '@elastic/elasticsearch';
 import type { ListItemArraySchema, Type } from '@kbn/securitysolution-io-ts-list-types';
+import { encodeHitVersion } from '@kbn/securitysolution-es-utils';
 
 import { ErrorWithStatusCode } from '../../error_with_status_code';
 import { SearchEsListItemSchema } from '../../schemas/elastic_response';
 
-import { encodeHitVersion } from './encode_hit_version';
 import { findSourceValue } from './find_source_value';
 
 export interface TransformElasticToListItemOptions {

x-pack/plugins/rule_registry/common/assets/field_maps/technical_rule_field_map.ts

@@ -26,6 +26,7 @@ import {
   RULE_UUID,
   TAGS,
   TIMESTAMP,
+  VERSION,
 } from '../../../common/technical_rule_data_field_names';
 import { ecsFieldMap } from './ecs_field_map';
 
@@ -41,6 +42,7 @@ export const technicalRuleFieldMap = {
     RULE_CATEGORY,
     TAGS
   ),
+  [VERSION]: { type: 'number' },
   [OWNER]: { type: 'keyword' },
   [PRODUCER]: { type: 'keyword' },
   [ALERT_UUID]: { type: 'keyword' },

x-pack/plugins/rule_registry/common/constants.ts

@@ -5,4 +5,4 @@
  * 2.0.
  */
 
-export const BASE_RAC_ALERTS_API_PATH = '/api/rac/alerts';
+export const BASE_RAC_ALERTS_API_PATH = '/internal/rac/alerts';

x-pack/plugins/rule_registry/server/alert_data_client/alerts_client.ts

@@ -5,6 +5,7 @@
  * 2.0.
  */
 import { PublicMethodsOf } from '@kbn/utility-types';
+import { decodeVersion, encodeHitVersion } from '@kbn/securitysolution-es-utils';
 import { AlertTypeParams } from '../../../alerting/server';
 import {
   ReadOperations,
@@ -35,9 +36,8 @@ export interface ConstructorOptions {
 
 export interface UpdateOptions<Params extends AlertTypeParams> {
   id: string;
-  data: {
-    status: string;
-  };
+  status: string;
+  _version: string | undefined;
   index: string;
 }
 
@@ -82,7 +82,9 @@ export class AlertsClient {
         // result in a big performance hit. If the client already knows which index the alert
         // belongs to, passing in the index will speed things up
         index: index ?? '.alerts-*',
+        ignore_unavailable: true,
         body: { query: { term: { _id: id } } },
+        seq_no_primary_term: true,
       });
 
       if (!isValidAlert(result.body.hits.hits[0]._source)) {
@@ -91,7 +93,10 @@ export class AlertsClient {
         throw new Error(errorMessage);
       }
 
-      return result.body.hits.hits[0]._source;
+      return {
+        ...result.body.hits.hits[0]._source,
+        _version: encodeHitVersion(result.body.hits.hits[0]),
+      };
     } catch (error) {
       const errorMessage = `Unable to retrieve alert with id of "${id}".`;
       this.logger.debug(errorMessage);
@@ -139,7 +144,8 @@ export class AlertsClient {
 
   public async update<Params extends AlertTypeParams = never>({
     id,
-    data,
+    status,
+    _version,
     index,
   }: UpdateOptions<Params>) {
     try {
@@ -155,19 +161,17 @@ export class AlertsClient {
         entity: AlertingAuthorizationEntity.Alert,
       });
 
-      const updateParameters = {
+      const { body: response } = await this.esClient.update<ParsedTechnicalFields>({
+        ...decodeVersion(_version),
         id,
         index,
         body: {
           doc: {
-            [ALERT_STATUS]: data.status,
+            [ALERT_STATUS]: status,
           },
         },
-      };
-
-      const res = await this.esClient.update<ParsedTechnicalFields, unknown, unknown, unknown>(
-        updateParameters
-      );
+        refresh: 'wait_for',
+      });
 
       this.auditLogger?.log(
         alertAuditEvent({
@@ -176,7 +180,10 @@ export class AlertsClient {
         })
       );
 
-      return res.body;
+      return {
+        ...response,
+        _version: encodeHitVersion(response),
+      };
     } catch (error) {
       this.auditLogger?.log(
         alertAuditEvent({

x-pack/plugins/rule_registry/server/alert_data_client/tests/get.test.ts

@@ -52,6 +52,9 @@ describe('get()', () => {
                 _type: 'alert',
                 _index: '.alerts-observability-apm',
                 _id: 'NoxgpHkBqbdrfX07MqXV',
+                _version: 1,
+                _seq_no: 362,
+                _primary_term: 2,
                 _source: {
                   'rule.id': 'apm.error_rate',
                   message: 'hello world 1',
@@ -67,6 +70,7 @@ describe('get()', () => {
     const result = await alertsClient.get({ id: '1', index: '.alerts-observability-apm' });
     expect(result).toMatchInlineSnapshot(`
       Object {
+        "_version": "WzM2MiwyXQ==",
         "kibana.rac.alert.owner": "apm",
         "kibana.rac.alert.status": "open",
         "message": "hello world 1",
@@ -84,7 +88,9 @@ describe('get()', () => {
               },
             },
           },
+          "ignore_unavailable": true,
           "index": ".alerts-observability-apm",
+          "seq_no_primary_term": true,
         },
       ]
     `);
@@ -112,6 +118,9 @@ describe('get()', () => {
                 _type: 'alert',
                 _index: '.alerts-observability-apm',
                 _id: 'NoxgpHkBqbdrfX07MqXV',
+                _version: 1,
+                _seq_no: 362,
+                _primary_term: 2,
                 _source: {
                   'rule.id': 'apm.error_rate',
                   message: 'hello world 1',
@@ -170,6 +179,9 @@ describe('get()', () => {
                   _type: 'alert',
                   _index: '.alerts-observability-apm',
                   _id: 'NoxgpHkBqbdrfX07MqXV',
+                  _version: 1,
+                  _seq_no: 362,
+                  _primary_term: 2,
                   _source: {
                     'rule.id': 'apm.error_rate',
                     message: 'hello world 1',
@@ -196,6 +208,7 @@ describe('get()', () => {
       });
       expect(result).toMatchInlineSnapshot(`
         Object {
+          "_version": "WzM2MiwyXQ==",
           "kibana.rac.alert.owner": "apm",
           "kibana.rac.alert.status": "open",
           "message": "hello world 1",