-
Notifications
You must be signed in to change notification settings - Fork 8.2k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Security Solution][Rules] Require all fields to be accounted for in internal schema to response conversion #137628
Merged
marshallmain
merged 6 commits into
elastic:main
from
marshallmain:rules-response-enforce-schema
Aug 4, 2022
Merged
[Security Solution][Rules] Require all fields to be accounted for in internal schema to response conversion #137628
marshallmain
merged 6 commits into
elastic:main
from
marshallmain:rules-response-enforce-schema
Aug 4, 2022
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
marshallmain
added
release_note:skip
Skip the PR/issue when compiling release notes
Team:Detections and Resp
Security Detection Response Team
Team: SecuritySolution
Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.
Team:Detection Alerts
Security Detection Alerts Area Team
v8.5.0
labels
Jul 29, 2022
Pinging @elastic/security-detections-response (Team:Detections and Resp) |
Pinging @elastic/security-solution (Team: SecuritySolution) |
e40pud
reviewed
Aug 3, 2022
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
lgtm
e40pud
approved these changes
Aug 3, 2022
💚 Build Succeeded
Metrics [docs]
History
To update your PR or re-run it, just comment with: |
This was referenced Aug 4, 2022
10 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
backport:skip
This commit does not require backporting
release_note:skip
Skip the PR/issue when compiling release notes
Team:Detection Alerts
Security Detection Alerts Area Team
Team:Detections and Resp
Security Detection Response Team
Team: SecuritySolution
Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.
v8.5.0
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Closes #136910
Related to #136774
A major goal of the security solution rules schema refactor was to catch rule schema mistakes through static typing. Static types now identify many places where new fields need to be added: once a field is added in one place, e.g. the internal rules schema, type errors will appear in other places where the field needs to be handled. However, because the HTTP response schema defined optional fields as truly optional instead of required but possibly undefined, it was still possible to add an optional rule parameter to the rules schema without adding it to the conversion function between internal and response schemas.
This PR solves the issue by implementing a bit of custom logic to replace the use of
t.partial
when building the response schema. Instead, we take each of the optional fields and replace them witht.union([<optionalFieldSchema>, t.undefined])
so the runtime effect is the same - they're optional - but they must be explicitly set toundefined
(or the valid field type) when building a response object.To test this, try removing one of the optional params, e.g.
event_category_override
fromtypeSpecificCamelToSnake
inrule_converters.ts
. Prior to this PR there was no type error, but with this PR TS reportsProperty 'event_category_override' is missing in type ...
.