[Cases] Guardrails: Total number cases update

x-pack/plugins/cases/common/api/cases/case.ts

@@ -24,6 +24,7 @@ import {
   MAX_ASSIGNEES_FILTER_LENGTH,
   MAX_REPORTERS_FILTER_LENGTH,
   MAX_TAGS_FILTER_LENGTH,
+  MAX_CASES_TO_UPDATE,
 } from '../../constants';
 
 export const AttachmentTotalsRt = rt.strict({
@@ -420,7 +421,10 @@ export const CasePatchRequestRt = rt.intersection([
   rt.strict({ id: rt.string, version: rt.string }),
 ]);
 
-export const CasesPatchRequestRt = rt.strict({ cases: rt.array(CasePatchRequestRt) });
+export const CasesPatchRequestRt = rt.strict({
+  cases: limitedArraySchema(CasePatchRequestRt, 1, MAX_CASES_TO_UPDATE, 'cases'),
+});
+
 export const CasesRt = rt.array(CaseRt);
 
 export const CasePushRequestParamsRt = rt.strict({

x-pack/plugins/cases/common/constants/index.ts

@@ -120,6 +120,7 @@ export const MAX_DESCRIPTION_LENGTH = 30000 as const;
 export const MAX_LENGTH_PER_TAG = 256 as const;
 export const MAX_TAGS_PER_CASE = 200 as const;
 export const MAX_DELETE_IDS_LENGTH = 100 as const;
+export const MAX_CASES_TO_UPDATE = 100 as const;
 
 /**
  * Cases features

x-pack/plugins/cases/docs/openapi/bundled.json

@@ -12,26 +12,18 @@
       "url": "https://www.elastic.co/licensing/elastic-license"
     }
   },
-  "servers": [
-    {
-      "url": "http://localhost:5601",
-      "description": "local"
-    }
-  ],
-  "security": [
-    {
-      "basicAuth": []
-    },
-    {
-      "apiKeyAuth": []
-    }
-  ],
   "tags": [
     {
       "name": "cases",
       "description": "Case APIs enable you to open and track issues."
     }
   ],
+  "servers": [
+    {
+      "url": "http://localhost:5601",
+      "description": "local"
+    }
+  ],
   "paths": {
     "/api/cases": {
       "post": {
@@ -5213,6 +5205,8 @@
           "cases": {
             "type": "array",
             "description": "An array containing one or more case objects.",
+            "maxItems": 100,
+            "minItems": 1,
             "items": {
               "type": "object",
               "required": [
@@ -7161,5 +7155,13 @@
         ]
       }
     }
-  }
+  },
+  "security": [
+    {
+      "basicAuth": []
+    },
+    {
+      "apiKeyAuth": []
+    }
+  ]
 }

x-pack/plugins/cases/docs/openapi/bundled.yaml

@@ -8,15 +8,12 @@ info:
   license:
     name: Elastic License 2.0
     url: https://www.elastic.co/licensing/elastic-license
-servers:
-  - url: http://localhost:5601
-    description: local
-security:
-  - basicAuth: []
-  - apiKeyAuth: []
 tags:
   - name: cases
     description: Case APIs enable you to open and track issues.
+servers:
+  - url: http://localhost:5601
+    description: local
 paths:
   /api/cases:
     post:
@@ -3346,6 +3343,8 @@ components:
         cases:
           type: array
           description: An array containing one or more case objects.
+          maxItems: 100
+          minItems: 1
           items:
             type: object
             required:
@@ -4772,3 +4771,6 @@ components:
           isPreconfigured: false
           isDeprecated: false
           referencedByCount: 0
+security:
+  - basicAuth: []
+  - apiKeyAuth: []

x-pack/plugins/cases/docs/openapi/components/schemas/update_case_request.yaml

@@ -8,6 +8,8 @@ properties:
   cases:
     type: array
     description: An array containing one or more case objects.
+    maxItems: 100
+    minItems: 1
     items:
       type: object
       required:
@@ -35,7 +37,7 @@ properties:
         settings:
           $ref: 'settings.yaml'
         severity:
-          $ref: 'severity_property.yaml' 
+          $ref: 'severity_property.yaml'
         status:
           $ref: 'status.yaml'
         tags:
@@ -55,4 +57,4 @@ properties:
           maxLength: 160
         version:
           description: The current version of the case. To determine this value, use the get case or find cases APIs.
-          type: string
+          type: string

x-pack/plugins/cases/server/client/cases/update.test.ts

@@ -11,6 +11,7 @@ import {
   MAX_TAGS_PER_CASE,
   MAX_LENGTH_PER_TAG,
   MAX_TITLE_LENGTH,
+  MAX_CASES_TO_UPDATE,
 } from '../../../common/constants';
 import { mockCases } from '../../mocks';
 import { createCasesClientMockArgs } from '../mocks';
@@ -701,4 +702,40 @@ describe('update', () => {
       );
     });
   });
+
+  describe('Validation', () => {
+    beforeEach(() => {
+      jest.clearAllMocks();
+    });
+
+    it(`throws an error when trying to update more than ${MAX_CASES_TO_UPDATE} cases`, async () => {
+      await expect(
+        update(
+          {
+            cases: Array(MAX_CASES_TO_UPDATE + 1).fill({
+              id: mockCases[0].id,
+              version: mockCases[0].version ?? '',
+              title: 'This is a test case!!',
+            }),
+          },
+          createCasesClientMockArgs()
+        )
+      ).rejects.toThrow(
+        'Error: The length of the field cases is too long. Array must be of length <= 100.'
+      );
+    });
+
+    it('throws an error when trying to update zero cases', async () => {
+      await expect(
+        update(
+          {
+            cases: [],
+          },
+          createCasesClientMockArgs()
+        )
+      ).rejects.toThrow(
+        'Error: The length of the field cases is too short. Array must be of length >= 1.'
+      );
+    });
+  });
 });