[RAM] System action in bulk disable api (#170229)

Fix: #170097
Meta: #160367


## Summary

This PR enables system actions for the Bulk Disable Rule API.

### Checklist

- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios

x-pack/plugins/alerting/server/application/rule/methods/bulk_disable/bulk_disable_rules.test.ts

@@ -27,15 +27,20 @@ import {
  savedObjectWith500Error,
  disabledRuleForBulkDisable1,
  disabledRuleForBulkDisable2,
+ returnedRuleForBulkDisableWithActions1,
+ returnedRuleForBulkDisableWithActions2,
  enabledRuleForBulkOps1,
  enabledRuleForBulkOps2,
+ disabledRuleForBulkOpsWithActions1,
+ disabledRuleForBulkOpsWithActions2,
  returnedRuleForBulkDisable1,
  returnedRuleForBulkDisable2,
  siemRuleForBulkOps1,
  siemRuleForBulkOps2,
 } from '../../../../rules_client/tests/test_helpers';
 import { migrateLegacyActions } from '../../../../rules_client/lib';
 import { ConnectorAdapterRegistry } from '../../../../connector_adapters/connector_adapter_registry';
+import { ActionsClient } from '@kbn/actions-plugin/server';
 
 jest.mock('../../../../task_runner/alert_task_instance', () => ({
  taskInstanceToAlertTaskInstance: jest.fn(),
@@ -95,6 +100,7 @@ const rulesClientParams: jest.Mocked<ConstructorOptions> = {
  isAuthenticationTypeAPIKey: jest.fn(),
  getAuthenticationAPIKey: jest.fn(),
  connectorAdapterRegistry: new ConnectorAdapterRegistry(),
+ isSystemAction: jest.fn(),
  getAlertIndicesAlias: jest.fn(),
  alertsService: null,
 };
@@ -108,6 +114,8 @@ setGlobalDate();
 
 describe('bulkDisableRules', () => {
  let rulesClient: RulesClient;
+ let actionsClient: jest.Mocked<ActionsClient>;
+
  const mockCreatePointInTimeFinderAsInternalUser = (
  response = { saved_objects: [enabledRule1, enabledRule2] }
  ) => {
@@ -143,6 +151,9 @@ describe('bulkDisableRules', () => {
 
  beforeEach(async () => {
  rulesClient = new RulesClient(rulesClientParams);
+ actionsClient = (await rulesClientParams.getActionsClient()) as jest.Mocked<ActionsClient>;
+ rulesClientParams.getActionsClient.mockResolvedValue(actionsClient);
+
  authorization.getFindAuthorizationFilter.mockResolvedValue({
  ensureRuleTypeIsAuthorized() {},
  });
@@ -153,6 +164,7 @@ describe('bulkDisableRules', () => {
  resultedActions: [],
  resultedReferences: [],
  });
+ actionsClient.isSystemAction.mockImplementation((id: string) => id === 'system_action:id');
  });
 
  test('should disable two rule', async () => {
@@ -188,6 +200,39 @@ describe('bulkDisableRules', () => {
  });
  });
 
+ test('should disable two rule and return right actions', async () => {
+ unsecuredSavedObjectsClient.bulkCreate.mockResolvedValue({
+ saved_objects: [disabledRuleForBulkOpsWithActions1, disabledRuleForBulkOpsWithActions2],
+ });
+
+ const result = await rulesClient.bulkDisableRules({ filter: 'fake_filter' });
+
+ expect(unsecuredSavedObjectsClient.bulkCreate).toHaveBeenCalledTimes(1);
+ expect(unsecuredSavedObjectsClient.bulkCreate).toHaveBeenCalledWith(
+ expect.arrayContaining([
+ expect.objectContaining({
+ id: 'id1',
+ attributes: expect.objectContaining({
+ enabled: false,
+ }),
+ }),
+ expect.objectContaining({
+ id: 'id2',
+ attributes: expect.objectContaining({
+ enabled: false,
+ }),
+ }),
+ ]),
+ { overwrite: true }
+ );
+
+ expect(result).toStrictEqual({
+ errors: [],
+ rules: [returnedRuleForBulkDisableWithActions1, returnedRuleForBulkDisableWithActions2],
+ total: 2,
+ });
+ });
+
  test('should try to disable rules, one successful and one with 500 error', async () => {
  unsecuredSavedObjectsClient.bulkCreate.mockResolvedValue({
  saved_objects: [disabledRuleForBulkDisable1, savedObjectWith500Error],
@@ -656,25 +701,25 @@ describe('bulkDisableRules', () => {
  await rulesClient.bulkDisableRules({ filter: 'fake_filter' });
 
  expect(migrateLegacyActions).toHaveBeenCalledTimes(4);
- expect(migrateLegacyActions).toHaveBeenCalledWith(expect.any(Object), {
+ expect(migrateLegacyActions).toHaveBeenNthCalledWith(1, expect.any(Object), {
  attributes: enabledRuleForBulkOps1.attributes,
  ruleId: enabledRuleForBulkOps1.id,
  actions: [],
  references: [],
  });
- expect(migrateLegacyActions).toHaveBeenCalledWith(expect.any(Object), {
+ expect(migrateLegacyActions).toHaveBeenNthCalledWith(2, expect.any(Object), {
  attributes: enabledRuleForBulkOps2.attributes,
  ruleId: enabledRuleForBulkOps2.id,
  actions: [],
  references: [],
  });
- expect(migrateLegacyActions).toHaveBeenCalledWith(expect.any(Object), {
+ expect(migrateLegacyActions).toHaveBeenNthCalledWith(3, expect.any(Object), {
  attributes: expect.objectContaining({ consumer: AlertConsumers.SIEM }),
  ruleId: siemRuleForBulkOps1.id,
  actions: [],
  references: [],
  });
- expect(migrateLegacyActions).toHaveBeenCalledWith(expect.any(Object), {
+ expect(migrateLegacyActions).toHaveBeenNthCalledWith(4, expect.any(Object), {
  attributes: expect.objectContaining({ consumer: AlertConsumers.SIEM }),
  ruleId: siemRuleForBulkOps2.id,
  actions: [],

x-pack/plugins/alerting/server/application/rule/methods/bulk_disable/bulk_disable_rules.ts

@@ -50,6 +50,7 @@ export const bulkDisableRules = async <Params extends RuleParams>(
  }
 
  const { ids, filter } = options;
+ const actionsClient = await context.getActionsClient();
 
  const kueryNodeFilter = ids ? convertRuleIdsToKueryNode(ids) : buildKueryNodeFilter(filter);
  const authorizationFilter = await getAuthorizationFilter(context, { action: 'DISABLE' });
@@ -93,13 +94,17 @@ export const bulkDisableRules = async <Params extends RuleParams>(
  // fix the type cast from SavedObjectsBulkUpdateObject to SavedObjectsBulkUpdateObject
  // when we are doing the bulk disable and this should fix itself
  const ruleType = context.ruleTypeRegistry.get(attributes.alertTypeId!);
- const ruleDomain = transformRuleAttributesToRuleDomain<Params>(attributes as RuleAttributes, {
- id,
- logger: context.logger,
- ruleType,
- references,
- omitGeneratedValues: false,
- });
+ const ruleDomain = transformRuleAttributesToRuleDomain<Params>(
+ attributes as RuleAttributes,
+ {
+ id,
+ logger: context.logger,
+ ruleType,
+ references,
+ omitGeneratedValues: false,
+ },
+ (connectorId: string) => actionsClient.isSystemAction(connectorId)
+ );
 
  try {
  ruleDomainSchema.validate(ruleDomain);

x-pack/plugins/alerting/server/routes/rule/apis/bulk_disable/bulk_disable_rules_route.test.ts

@@ -13,6 +13,13 @@ import { mockHandlerArguments } from '../../../_mock_handler_arguments';
 import { rulesClientMock } from '../../../../rules_client.mock';
 import { RuleTypeDisabledError } from '../../../../lib/errors/rule_type_disabled';
 import { verifyApiAccess } from '../../../../lib/license_api_access';
+import { actionsClientMock } from '@kbn/actions-plugin/server/mocks';
+import {
+ RuleActionTypes,
+ RuleDefaultAction,
+ RuleSystemAction,
+ SanitizedRule,
+} from '../../../../types';
 
 const rulesClient = rulesClientMock.create();
 
@@ -123,4 +130,120 @@ describe('bulkDisableRulesRoute', () => {
 
  expect(res.forbidden).toHaveBeenCalledWith({ body: { message: 'Fail' } });
  });
+
+ describe('actions', () => {
+ const mockedRule: SanitizedRule<{}> = {
+ id: '1',
+ alertTypeId: '1',
+ schedule: { interval: '10s' },
+ params: {
+ bar: true,
+ },
+ createdAt: new Date(),
+ updatedAt: new Date(),
+ actions: [
+ {
+ group: 'default',
+ id: '2',
+ actionTypeId: 'test',
+ params: {
+ foo: true,
+ },
+ uuid: '123-456',
+ type: RuleActionTypes.DEFAULT,
+ },
+ ],
+ consumer: 'bar',
+ name: 'abc',
+ tags: ['foo'],
+ enabled: false,
+ muteAll: false,
+ notifyWhen: 'onActionGroupChange',
+ createdBy: '',
+ updatedBy: '',
+ apiKeyOwner: '',
+ throttle: '30s',
+ mutedInstanceIds: [],
+ executionStatus: {
+ status: 'unknown',
+ lastExecutionDate: new Date('2020-08-20T19:23:38Z'),
+ },
+ revision: 0,
+ };
+
+ const action: RuleDefaultAction = {
+ actionTypeId: 'test',
+ group: 'default',
+ id: '2',
+ params: {
+ foo: true,
+ },
+ uuid: '123-456',
+ type: RuleActionTypes.DEFAULT,
+ };
+
+ const systemAction: RuleSystemAction = {
+ actionTypeId: 'test-2',
+ id: 'system_action-id',
+ params: {
+ foo: true,
+ },
+ uuid: '123-456',
+ type: RuleActionTypes.SYSTEM,
+ };
+
+ const mockedRules: Array<SanitizedRule<{}>> = [
+ { ...mockedRule, actions: [action, systemAction] },
+ ];
+
+ const bulkDisableActionsResult = {
+ rules: mockedRules,
+ errors: [],
+ total: 1,
+ skipped: [],
+ };
+
+ it('removes the type from the actions correctly before sending the response', async () => {
+ const licenseState = licenseStateMock.create();
+ const router = httpServiceMock.createRouter();
+ const actionsClient = actionsClientMock.create();
+ actionsClient.isSystemAction.mockImplementation((id: string) => id === 'system_action-id');
+
+ bulkDisableRulesRoute({ router, licenseState });
+ const [_, handler] = router.patch.mock.calls[0];
+
+ rulesClient.bulkDisableRules.mockResolvedValueOnce(bulkDisableActionsResult);
+
+ const [context, req, res] = mockHandlerArguments(
+ { rulesClient, actionsClient },
+ {
+ body: bulkDisableRequest,
+ },
+ ['ok']
+ );
+
+ const routeRes = await handler(context, req, res);
+
+ // @ts-expect-error: body exists
+ expect(routeRes.body.rules[0].actions).toEqual([
+ {
+ connector_type_id: 'test',
+ group: 'default',
+ id: '2',
+ params: {
+ foo: true,
+ },
+ uuid: '123-456',
+ },
+ {
+ connector_type_id: 'test-2',
+ id: 'system_action-id',
+ params: {
+ foo: true,
+ },
+ uuid: '123-456',
+ },
+ ]);
+ });
+ });
 });

x-pack/plugins/alerting/server/rules_client/lib/siem_legacy_actions/migrate_legacy_actions.ts

@@ -7,15 +7,13 @@
 
 import Boom from '@hapi/boom';
 import { i18n } from '@kbn/i18n';
-
 import { AlertConsumers } from '@kbn/rule-data-utils';
-
 import type { SavedObjectReference } from '@kbn/core/server';
 import type { RulesClientContext } from '../..';
 import { RawRuleAction, RawRule } from '../../../types';
 import { validateActions } from '../validate_actions';
-import { injectReferencesIntoActions } from '../../common';
 import { retrieveMigratedLegacyActions } from './retrieve_migrated_legacy_actions';
+import { transformRawActionsToDomainActions } from '../../../application/rule/transforms/transform_raw_actions_to_domain_actions';
 
 type MigrateLegacyActions = (
  context: RulesClientContext,
@@ -66,7 +64,12 @@ export const migrateLegacyActions: MigrateLegacyActions = async (
  // set to undefined to avoid both per-actin and rule level values clashing
  throttle: undefined,
  notifyWhen: undefined,
- actions: injectReferencesIntoActions(ruleId, legacyActions, legacyActionsReferences),
+ actions: transformRawActionsToDomainActions({
+ ruleId,
+ actions: legacyActions,
+ references: legacyActionsReferences,
+ isSystemAction: context.isSystemAction,
+ }),
  });
  };