[Security Solution][Endpoint] Potential improvements in endpoint user artifact packager

x-pack/plugins/fleet/server/services/artifacts/artifacts.test.ts

@@ -29,6 +29,7 @@ import {
 } from './mocks';
 import {
   bulkCreateArtifacts,
+  bulkDeleteArtifacts,
   createArtifact,
   deleteArtifact,
   encodeArtifactContent,
@@ -348,6 +349,54 @@ describe('When using the artifacts services', () => {
     });
   });
 
+  describe('and calling `bulkDeleteArtifacts()`', () => {
+    it('should delete single artifact', async () => {
+      bulkDeleteArtifacts(esClientMock, ['123']);
+
+      expect(esClientMock.bulk).toHaveBeenCalledWith({
+        refresh: 'wait_for',
+        body: [
+          {
+            delete: {
+              _id: '123',
+              _index: FLEET_SERVER_ARTIFACTS_INDEX,
+            },
+          },
+        ],
+      });
+    });
+
+    it('should delete all the artifacts', async () => {
+      bulkDeleteArtifacts(esClientMock, ['123', '231']);
+
+      expect(esClientMock.bulk).toHaveBeenCalledWith({
+        refresh: 'wait_for',
+        body: [
+          {
+            delete: {
+              _id: '123',
+              _index: FLEET_SERVER_ARTIFACTS_INDEX,
+            },
+          },
+          {
+            delete: {
+              _id: '231',
+              _index: FLEET_SERVER_ARTIFACTS_INDEX,
+            },
+          },
+        ],
+      });
+    });
+
+    it('should throw an ArtifactElasticsearchError if one is encountered', async () => {
+      setEsClientMethodResponseToError(esClientMock, 'bulk');
+
+      await expect(bulkDeleteArtifacts(esClientMock, ['123'])).rejects.toBeInstanceOf(
+        ArtifactsElasticsearchError
+      );
+    });
+  });
+
   describe('and calling `listArtifacts()`', () => {
     beforeEach(() => {
       esClientMock.search.mockResponse(generateArtifactEsSearchResultHitsMock());

x-pack/plugins/fleet/server/services/artifacts/artifacts.ts

@@ -197,6 +197,37 @@ export const deleteArtifact = async (esClient: ElasticsearchClient, id: string):
   }
 };
 
+export const bulkDeleteArtifacts = async (
+  esClient: ElasticsearchClient,
+  ids: string[]
+): Promise<Error[]> => {
+  try {
+    const body = ids.map((id) => ({
+      delete: { _index: FLEET_SERVER_ARTIFACTS_INDEX, _id: id },
+    }));
+
+    const res = await withPackageSpan(`Bulk delete fleet artifacts`, () =>
+      esClient.bulk({
+        body,
+        refresh: 'wait_for',
+      })
+    );
+    let errors: Error[] = [];
+    // Track errors of the bulk delete action
+    if (res.errors) {
+      errors = res.items.reduce<Error[]>((acc, item) => {
+        if (item.delete?.error) {
+          acc.push(new Error(item.delete.error.reason));
+        }
+        return acc;
+      }, []);
+    }
+    return errors;
+  } catch (e) {
+    throw new ArtifactsElasticsearchError(e);
+  }
+};
+
 export const listArtifacts = async (
   esClient: ElasticsearchClient,
   options: ListArtifactsProps = {}

x-pack/plugins/fleet/server/services/artifacts/client.test.ts

@@ -7,6 +7,8 @@
 
 import { elasticsearchServiceMock } from '@kbn/core/server/mocks';
 
+import { FLEET_SERVER_ARTIFACTS_INDEX } from '../../../common/constants';
+
 import { ArtifactsClientAccessDeniedError, ArtifactsClientError } from '../../errors';
 
 import { appContextService } from '../app_context';
@@ -155,6 +157,25 @@ describe('When using the Fleet Artifacts Client', () => {
     });
   });
 
+  describe('and calling `bulkDeleteArtifacts()`', () => {
+    it('should bulk delete the artifact', async () => {
+      setEsClientGetMock();
+      await artifactClient.bulkDeleteArtifacts(['123']);
+      expect(esClientMock.bulk).toHaveBeenCalledWith(
+        expect.objectContaining({
+          body: [
+            {
+              delete: {
+                _id: 'endpoint:123',
+                _index: FLEET_SERVER_ARTIFACTS_INDEX,
+              },
+            },
+          ],
+        })
+      );
+    });
+  });
+
   describe('and calling `listArtifacts()`', () => {
     beforeEach(() => {
       esClientMock.search.mockResponse(generateArtifactEsSearchResultHitsMock());

x-pack/plugins/fleet/server/services/artifacts/client.ts

@@ -18,7 +18,7 @@ import type {
   NewArtifact,
   ListArtifactsProps,
 } from './types';
-import { relativeDownloadUrlFromArtifact } from './mappings';
+import { relativeDownloadUrlFromArtifact, uniqueIdFromId } from './mappings';
 
 import {
   createArtifact,
@@ -28,6 +28,7 @@ import {
   getArtifact,
   listArtifacts,
   bulkCreateArtifacts,
+  bulkDeleteArtifacts,
 } from './artifacts';
 
 /**
@@ -112,6 +113,11 @@ export class FleetArtifactsClient implements ArtifactsClientInterface {
     }
   }
 
+  async bulkDeleteArtifacts(ids: string[]): Promise<Error[]> {
+    const idsMappedWithPackageName = ids.map((id) => uniqueIdFromId(id, this.packageName));
+    return await bulkDeleteArtifacts(this.esClient, idsMappedWithPackageName);
+  }
+
   /**
    * Get a list of artifacts.
    * NOTE that when using the `kuery` filtering param, that all filters property names should

x-pack/plugins/fleet/server/services/artifacts/mappings.ts

@@ -82,3 +82,7 @@ export const uniqueIdFromArtifact = <
 }: T): string => {
   return `${packageName}:${identifier}-${decodedSha256}`;
 };
+
+export const uniqueIdFromId = (id: string, packageName: string): string => {
+  return `${packageName}:${id}`;
+};

x-pack/plugins/fleet/server/services/artifacts/mocks.ts

@@ -26,6 +26,7 @@ export const createArtifactsClientMock = (): jest.Mocked<ArtifactsClientInterfac
     createArtifact: jest.fn().mockResolvedValue(generateArtifactMock()),
     bulkCreateArtifacts: jest.fn().mockResolvedValue({ artifacts: generateArtifactMock() }),
     deleteArtifact: jest.fn(),
+    bulkDeleteArtifacts: jest.fn(),
     listArtifacts: jest.fn().mockResolvedValue({
       items: [generateArtifactMock()],
       total: 1,
@@ -172,7 +173,10 @@ export const generateEsApiResponseMock = <TBody extends Record<string, any>>(
 };
 
 type EsClientMock = ReturnType<typeof elasticsearchServiceMock.createInternalClient>;
-type EsClientMockMethods = keyof Pick<EsClientMock, 'get' | 'create' | 'delete' | 'search'>;
+type EsClientMockMethods = keyof Pick<
+  EsClientMock,
+  'get' | 'create' | 'delete' | 'search' | 'bulk'
+>;
 
 export const setEsClientMethodResponseToError = (
   esClientMock: EsClientMock,

x-pack/plugins/fleet/server/services/artifacts/types.ts

@@ -86,6 +86,8 @@ export interface ArtifactsClientInterface {
 
   deleteArtifact(id: string): Promise<void>;
 
+  bulkDeleteArtifacts(ids: string[]): Promise<Error[]>;
+
   listArtifacts(options?: ListArtifactsProps): Promise<ListResult<Artifact>>;
 
   encodeContent(content: ArtifactsClientCreateOptions['content']): Promise<ArtifactEncodedMetadata>;

x-pack/plugins/security_solution/server/config.mock.ts

@@ -21,6 +21,7 @@ export const createMockConfig = (): ConfigType => {
     maxTimelineImportPayloadBytes: 10485760,
     enableExperimental,
     packagerTaskInterval: '60s',
+    packagerTaskPackagePolicyUpdateBatchSize: 10,
     prebuiltRulesPackageVersion: '',
     alertMergeStrategy: 'missingFields',
     alertIgnoreFields: [],

x-pack/plugins/security_solution/server/config.ts

@@ -95,6 +95,11 @@ export const configSchema = schema.object({
    */
   packagerTaskInterval: schema.string({ defaultValue: '60s' }),
 
+  /**
+   * Artifacts Configuration for package policy update concurrency
+   */
+  packagerTaskPackagePolicyUpdateBatchSize: schema.number({ defaultValue: 10, max: 50, min: 1 }),
+
   /**
    * For internal use. Specify which version of the Detection Rules fleet package to install
    * when upgrading rules. If not provided, the latest compatible package will be installed,