[Cases] Validate page and perPage parameters in find APIs (#161111)

Connected to #146945 ## Summary | Description | Limit | Done? | Documented? | ------------- | ---- | :---: | ---- | | Total number of cases/user actions/comments per page | 100 | ✅ | No | N/A | | Maximum number of cases/user actions/comments returned from the API | 10.000 | ✅ | No | N/A | ### Checklist Delete any items that are not applicable to this PR. - [x] Any text added follows [EUI's writing guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses sentence case text and includes [i18n support](https://github.com/elastic/kibana/blob/main/packages/kbn-i18n/README.md) - [x] [Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html) was added for features that require explanation or tutorials - [x] [Unit or functional tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html) were updated or added to match the most common scenarios ### Release Notes Max value for perPage parameter in find Cases API is now 100. Max value for perPage parameter in find User Actions API is now 100. Max value for perPage parameter in find Comments API is now 100. --------- Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: lcawl <lcawley@elastic.co>
elastic · Jul 5, 2023 · f43601d · f43601d
1 parent 16528cf
commit f43601d
Show file tree

Hide file tree

Showing 21 changed files with 505 additions and 342 deletions.
diff --git a/docs/api-generated/cases/case-apis-passthru.asciidoc b/docs/api-generated/cases/case-apis-passthru.asciidoc
@@ -859,7 +859,7 @@ Any modifications made to this file will be overwritten.
 
       <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The page number to return. default: 1 </div><div class="param">perPage (optional)</div>
 
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The number of items to return. default: 20 </div><div class="param">sortOrder (optional)</div>
+      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The number of items to return. Limited to 100 items. default: 20 </div><div class="param">sortOrder (optional)</div>
 
       <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; Determines the sort order. default: desc </div><div class="param">types (optional)</div>
 
@@ -951,7 +951,7 @@ Any modifications made to this file will be overwritten.
 
       <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The page number to return. default: 1 </div><div class="param">perPage (optional)</div>
 
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The number of items to return. default: 20 </div><div class="param">sortOrder (optional)</div>
+      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The number of items to return. Limited to 100 items. default: 20 </div><div class="param">sortOrder (optional)</div>
 
       <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; Determines the sort order. default: desc </div><div class="param">types (optional)</div>
 
@@ -1278,7 +1278,7 @@ Any modifications made to this file will be overwritten.
 
       <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The page number to return. default: 1 </div><div class="param">perPage (optional)</div>
 
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The number of items to return. default: 20 </div><div class="param">reporters (optional)</div>
+      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The number of items to return. Limited to 100 items. default: 20 </div><div class="param">reporters (optional)</div>
 
       <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; Filters the returned cases by the user name of the reporter. default: null </div><div class="param">search (optional)</div>
 
@@ -1471,7 +1471,7 @@ Any modifications made to this file will be overwritten.
 
       <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The page number to return. default: 1 </div><div class="param">perPage (optional)</div>
 
-      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The number of items to return. default: 20 </div><div class="param">reporters (optional)</div>
+      <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; The number of items to return. Limited to 100 items. default: 20 </div><div class="param">reporters (optional)</div>
 
       <div class="param-desc"><span class="param-type">Query Parameter</span> &mdash; Filters the returned cases by the user name of the reporter. default: null </div><div class="param">search (optional)</div>
 
@@ -4156,7 +4156,6 @@ Any modifications made to this file will be overwritten.
     <li><a href="#findCaseConnectorsDefaultSpace_200_response_inner_config"><code>findCaseConnectorsDefaultSpace_200_response_inner_config</code> - </a></li>
     <li><a href="#findCasesDefaultSpace_200_response"><code>findCasesDefaultSpace_200_response</code> - </a></li>
     <li><a href="#findCasesDefaultSpace_assignees_parameter"><code>findCasesDefaultSpace_assignees_parameter</code> - </a></li>
-    <li><a href="#findCasesDefaultSpace_category_parameter"><code>findCasesDefaultSpace_category_parameter</code> - </a></li>
     <li><a href="#findCasesDefaultSpace_owner_parameter"><code>findCasesDefaultSpace_owner_parameter</code> - </a></li>
     <li><a href="#findCasesDefaultSpace_searchFields_parameter"><code>findCasesDefaultSpace_searchFields_parameter</code> - </a></li>
     <li><a href="#getCaseCommentDefaultSpace_200_response"><code>getCaseCommentDefaultSpace_200_response</code> - </a></li>
@@ -4580,6 +4579,7 @@ Any modifications made to this file will be overwritten.
 <div class="param">settings </div><div class="param-desc"><span class="param-type"><a href="#settings">settings</a></span>  </div>
 <div class="param">severity (optional)</div><div class="param-desc"><span class="param-type"><a href="#severity_property">severity_property</a></span>  </div>
 <div class="param">tags </div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The words and phrases that help categorize cases. It can be an empty array. </div>
+<div class="param">category (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> Category for the case. It could be a word or a phrase to categorize the case. </div>
 <div class="param">title </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> A title for the case. </div>
     </div>  <!-- field-items -->
   </div>
@@ -4659,12 +4659,6 @@ Any modifications made to this file will be overwritten.
     <div class="field-items">
           </div>  <!-- field-items -->
   </div>
-  <div class="model">
-    <h3><a name="findCasesDefaultSpace_category_parameter"><code>findCasesDefaultSpace_category_parameter</code> - </a> <a class="up" href="#__Models">Up</a></h3>
-    <div class='model-description'></div>
-    <div class="field-items">
-          </div>  <!-- field-items -->
-  </div>
   <div class="model">
     <h3><a name="findCasesDefaultSpace_owner_parameter"><code>findCasesDefaultSpace_owner_parameter</code> - </a> <a class="up" href="#__Models">Up</a></h3>
     <div class='model-description'></div>
@@ -5056,6 +5050,7 @@ Any modifications made to this file will be overwritten.
 <div class="param">severity (optional)</div><div class="param-desc"><span class="param-type"><a href="#severity_property">severity_property</a></span>  </div>
 <div class="param">status (optional)</div><div class="param-desc"><span class="param-type"><a href="#status">status</a></span>  </div>
 <div class="param">tags (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">array[String]</a></span> The words and phrases that help categorize cases. </div>
+<div class="param">category (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> Category for the case. It could be a word or a phrase to categorize the case. </div>
 <div class="param">title (optional)</div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> A title for the case. </div>
 <div class="param">version </div><div class="param-desc"><span class="param-type"><a href="#string">String</a></span> The current version of the case. To determine this value, use the get case or find cases APIs. </div>
     </div>  <!-- field-items -->

diff --git a/x-pack/plugins/cases/common/api/cases/case.ts b/x-pack/plugins/cases/common/api/cases/case.ts
@@ -7,13 +7,17 @@
 
 import * as rt from 'io-ts';
 
-import { NumberFromString } from '../saved_object';
 import { UserRt } from '../user';
 import { CommentRt } from './comment';
 import { CasesStatusResponseRt, CaseStatusRt } from './status';
 import { CaseConnectorRt } from '../connectors/connector';
 import { CaseAssigneesRt } from './assignee';
-import { limitedArraySchema, limitedStringSchema, NonEmptyString } from '../../schema';
+import {
+  limitedArraySchema,
+  limitedStringSchema,
+  NonEmptyString,
+  paginationSchema,
+} from '../../schema';
 import {
   MAX_DELETE_IDS_LENGTH,
   MAX_DESCRIPTION_LENGTH,
@@ -25,6 +29,7 @@ import {
   MAX_REPORTERS_FILTER_LENGTH,
   MAX_TAGS_FILTER_LENGTH,
   MAX_BULK_GET_CASES,
+  MAX_CASES_PER_PAGE,
 } from '../../constants';
 
 export const AttachmentTotalsRt = rt.strict({
@@ -227,110 +232,113 @@ const CasesFindRequestSearchFieldsRt = rt.keyof({
   'updated_by.profile_uid': null,
 });
 
-export const CasesFindRequestRt = rt.exact(
-  rt.partial({
-    /**
-     * Tags to filter by
-     */
-    tags: rt.union([
-      limitedArraySchema({
-        codec: rt.string,
-        fieldName: 'tags',
-        min: 0,
-        max: MAX_TAGS_FILTER_LENGTH,
-      }),
-      rt.string,
-    ]),
-    /**
-     * The status of the case (open, closed, in-progress)
-     */
-    status: CaseStatusRt,
-    /**
-     * The severity of the case
-     */
-    severity: CaseSeverityRt,
-    /**
-     * The uids of the user profiles to filter by
-     */
-    assignees: rt.union([
-      limitedArraySchema({
-        codec: rt.string,
-        fieldName: 'assignees',
-        min: 0,
-        max: MAX_ASSIGNEES_FILTER_LENGTH,
-      }),
-      rt.string,
-    ]),
-    /**
-     * The reporters to filter by
-     */
-    reporters: rt.union([
-      limitedArraySchema({
-        codec: rt.string,
-        fieldName: 'reporters',
-        min: 0,
-        max: MAX_REPORTERS_FILTER_LENGTH,
-      }),
-      rt.string,
-    ]),
-    /**
-     * Operator to use for the `search` field
-     */
-    defaultSearchOperator: rt.union([rt.literal('AND'), rt.literal('OR')]),
-    /**
-     * A KQL date. If used all cases created after (gte) the from date will be returned
-     */
-    from: rt.string,
-    /**
-     * The page of objects to return
-     */
-    page: NumberFromString,
-    /**
-     * The number of objects to include in each page
-     */
-    perPage: NumberFromString,
-    /**
-     * An Elasticsearch simple_query_string
-     */
-    search: rt.string,
-    /**
-     * The fields to perform the simple_query_string parsed query against
-     */
-    searchFields: rt.union([
-      rt.array(CasesFindRequestSearchFieldsRt),
-      CasesFindRequestSearchFieldsRt,
-    ]),
-    /**
-     * The root fields to perform the simple_query_string parsed query against
-     */
-    rootSearchFields: rt.array(rt.string),
-    /**
-     * The field to use for sorting the found objects.
-     *
-     */
-    sortField: rt.string,
-    /**
-     * The order to sort by
-     */
-    sortOrder: rt.union([rt.literal('desc'), rt.literal('asc')]),
+export const CasesFindRequestRt = rt.intersection([
+  rt.exact(
+    rt.partial({
+      /**
+       * Tags to filter by
+       */
+      tags: rt.union([
+        limitedArraySchema({
+          codec: rt.string,
+          fieldName: 'tags',
+          min: 0,
+          max: MAX_TAGS_FILTER_LENGTH,
+        }),
+        rt.string,
+      ]),
+      /**
+       * The status of the case (open, closed, in-progress)
+       */
+      status: CaseStatusRt,
+      /**
+       * The severity of the case
+       */
+      severity: CaseSeverityRt,
+      /**
+       * The uids of the user profiles to filter by
+       */
+      assignees: rt.union([
+        limitedArraySchema({
+          codec: rt.string,
+          fieldName: 'assignees',
+          min: 0,
+          max: MAX_ASSIGNEES_FILTER_LENGTH,
+        }),
+        rt.string,
+      ]),
+      /**
+       * The reporters to filter by
+       */
+      reporters: rt.union([
+        limitedArraySchema({
+          codec: rt.string,
+          fieldName: 'reporters',
+          min: 0,
+          max: MAX_REPORTERS_FILTER_LENGTH,
+        }),
+        rt.string,
+      ]),
+      /**
+       * Operator to use for the `search` field
+       */
+      defaultSearchOperator: rt.union([rt.literal('AND'), rt.literal('OR')]),
+      /**
+       * A KQL date. If used all cases created after (gte) the from date will be returned
+       */
+      from: rt.string,
+      /**
+       * The page of objects to return
+       */
+      // page: rt.union([rt.number, NumberFromString]),
+      /**
+       * The number of objects to include in each page
+       */
+      // perPage: rt.union([rt.number, NumberFromString]),
+      /**
+       * An Elasticsearch simple_query_string
+       */
+      search: rt.string,
+      /**
+       * The fields to perform the simple_query_string parsed query against
+       */
+      searchFields: rt.union([
+        rt.array(CasesFindRequestSearchFieldsRt),
+        CasesFindRequestSearchFieldsRt,
+      ]),
+      /**
+       * The root fields to perform the simple_query_string parsed query against
+       */
+      rootSearchFields: rt.array(rt.string),
+      /**
+       * The field to use for sorting the found objects.
+       *
+       */
+      sortField: rt.string,
+      /**
+       * The order to sort by
+       */
+      sortOrder: rt.union([rt.literal('desc'), rt.literal('asc')]),
 
-    /**
-     * A KQL date. If used all cases created before (lte) the to date will be returned.
-     */
-    to: rt.string,
-    /**
-     * The owner(s) to filter by. The user making the request must have privileges to retrieve cases of that
-     * ownership or they will be ignored. If no owner is included, then all ownership types will be included in the response
-     * that the user has access to.
-     */
+      /**
+       * A KQL date. If used all cases created before (lte) the to date will be returned.
+       */
+      to: rt.string,
+      /**
+       * The owner(s) to filter by. The user making the request must have privileges to retrieve cases of that
+       * ownership or they will be ignored. If no owner is included, then all ownership types will be included in the response
+       * that the user has access to.
+       */
 
-    owner: rt.union([rt.array(rt.string), rt.string]),
-    /**
-     * The category of the case.
-     */
-    category: rt.union([rt.array(rt.string), rt.string]),
-  })
-);
+      owner: rt.union([rt.array(rt.string), rt.string]),
+      /**
+       * The category of the case.
+       */
+      category: rt.union([rt.array(rt.string), rt.string]),
+    })
+  ),
+  paginationSchema({ maxPerPage: MAX_CASES_PER_PAGE }),
+]);
 
 export const CasesDeleteRequestRt = limitedArraySchema({
   codec: NonEmptyString,
@@ -532,8 +540,8 @@ export type Case = rt.TypeOf<typeof CaseRt>;
 export type CaseResolveResponse = rt.TypeOf<typeof CaseResolveResponseRt>;
 export type Cases = rt.TypeOf<typeof CasesRt>;
 export type CasesDeleteRequest = rt.TypeOf<typeof CasesDeleteRequestRt>;
-export type CasesFindRequest = rt.TypeOf<typeof CasesFindRequestRt>;
 export type CasesByAlertIDRequest = rt.TypeOf<typeof CasesByAlertIDRequestRt>;
+export type CasesFindRequest = rt.TypeOf<typeof CasesFindRequestRt>;
 export type CasesFindResponse = rt.TypeOf<typeof CasesFindResponseRt>;
 export type CasePatchRequest = rt.TypeOf<typeof CasePatchRequestRt>;
 export type CasesPatchRequest = rt.TypeOf<typeof CasesPatchRequestRt>;

diff --git a/x-pack/plugins/cases/common/api/cases/comment/index.ts b/x-pack/plugins/cases/common/api/cases/comment/index.ts
@@ -6,10 +6,9 @@
  */
 
 import * as rt from 'io-ts';
-import { MAX_BULK_GET_ATTACHMENTS } from '../../../constants';
-import { limitedArraySchema } from '../../../schema';
+import { MAX_BULK_GET_ATTACHMENTS, MAX_COMMENTS_PER_PAGE } from '../../../constants';
+import { limitedArraySchema, paginationSchema } from '../../../schema';
 import { jsonValueRt } from '../../runtime_types';
-import { NumberFromString } from '../../saved_object';
 
 import { UserRt } from '../../user';
 
@@ -289,22 +288,17 @@ export const CommentsFindResponseRt = rt.strict({
 
 export const CommentsRt = rt.array(CommentRt);
 
-export const FindCommentsQueryParamsRt = rt.exact(
-  rt.partial({
-    /**
-     * The page of objects to return
-     */
-    page: rt.union([rt.number, NumberFromString]),
-    /**
-     * The number of objects to return for a page
-     */
-    perPage: rt.union([rt.number, NumberFromString]),
-    /**
-     * Order to sort the response
-     */
-    sortOrder: rt.union([rt.literal('desc'), rt.literal('asc')]),
-  })
-);
+export const FindCommentsQueryParamsRt = rt.intersection([
+  rt.exact(
+    rt.partial({
+      /**
+       * Order to sort the response
+       */
+      sortOrder: rt.union([rt.literal('desc'), rt.literal('asc')]),
+    })
+  ),
+  paginationSchema({ maxPerPage: MAX_COMMENTS_PER_PAGE }),
+]);
 
 export const BulkCreateCommentRequestRt = rt.array(CommentRequestRt);