Skip to content

[Cases] Restrict the Find Comment API query params#156863

Merged
adcoelho merged 27 commits into
elastic:mainfrom
adcoelho:limit-find-comments-api-params
May 16, 2023
Merged

[Cases] Restrict the Find Comment API query params#156863
adcoelho merged 27 commits into
elastic:mainfrom
adcoelho:limit-find-comments-api-params

Conversation

@adcoelho
Copy link
Copy Markdown
Contributor

@adcoelho adcoelho commented May 5, 2023

Fixes #155983

Summary

This PR changes the accepted params for the Find Comments API to be only perPage, page and sort_order.

@adcoelho adcoelho added release_note:skip Skip the PR/issue when compiling release notes Team:ResponseOps Platform ResponseOps team (formerly the Cases and Alerting teams) t// Feature:Cases Cases feature v8.9.0 labels May 5, 2023
@adcoelho adcoelho self-assigned this May 5, 2023
Comment thread x-pack/plugins/cases/common/api/saved_object.ts
Comment thread x-pack/plugins/cases/server/client/attachments/get.ts
Comment thread x-pack/plugins/cases/server/client/utils.ts Outdated
@adcoelho adcoelho force-pushed the limit-find-comments-api-params branch from e21af7b to 475c731 Compare May 8, 2023 10:58
@adcoelho adcoelho marked this pull request as ready for review May 9, 2023 08:52
@adcoelho adcoelho requested review from a team as code owners May 9, 2023 08:52
@elasticmachine
Copy link
Copy Markdown
Contributor

Pinging @elastic/response-ops (Team:ResponseOps)

@elasticmachine
Copy link
Copy Markdown
Contributor

Pinging @elastic/response-ops-cases (Feature:Cases)

Copy link
Copy Markdown
Member

@cnasikas cnasikas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great job. I left some comments.

Comment thread x-pack/plugins/cases/server/client/attachments/get.ts
Comment thread x-pack/plugins/cases/server/client/attachments/get.ts Outdated
Comment thread x-pack/plugins/cases/server/client/attachments/get.ts
Comment thread x-pack/plugins/cases/server/client/attachments/get.ts
@adcoelho adcoelho enabled auto-merge (squash) May 16, 2023 14:42
@adcoelho
Copy link
Copy Markdown
Contributor Author

@elasticmachine merge upstream

Copy link
Copy Markdown
Contributor

@lcawl lcawl left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Docs LGTM

Copy link
Copy Markdown
Contributor

@jonathan-buttner jonathan-buttner left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looking good, left a few comments. How about we switch the integration tests to use the helper functions that we have?

if (
queryParams?.page &&
queryParams?.perPage &&
queryParams?.page * queryParams?.perPage > MAX_DOCS_PER_PAGE
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

queryParams.page can be 0 right? If it is 0 and perPage is 1 million we'll still want to throw. Also if queryParams.page was 0 it is falsy right?

// post 5 comments of all possible types
await supertest
.post(`${CASES_URL}/${postedCase.id}/comments`)
.post(INTERNAL_BULK_CREATE_ATTACHMENTS_URL.replace('{case_id}', postedCase.id))
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

.expect(200);

const { body: patchedCase } = await supertest
const { body: caseComments } = await supertest
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

});

it('unhappy path - 400s when query is bad', async () => {
it('unhappy path - 400s when total items invalid', async () => {
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we add a test when page is 0?

@kibana-ci
Copy link
Copy Markdown

💛 Build succeeded, but was flaky

Failed CI Steps

Metrics [docs]

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id before after diff
cases 166.2KB 166.0KB -210.0B
Unknown metric groups

ESLint disabled line counts

id before after diff
enterpriseSearch 19 21 +2
securitySolution 400 404 +4
total +6

Total ESLint disabled count

id before after diff
enterpriseSearch 20 22 +2
securitySolution 480 484 +4
total +6

History

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @adcoelho

@adcoelho adcoelho merged commit 927743a into elastic:main May 16, 2023
@kibanamachine kibanamachine added the backport:skip This PR does not require backporting label May 16, 2023
jasonrhodes pushed a commit that referenced this pull request May 17, 2023
Fixes #155983

## Summary

This PR changes the accepted params for the Find Comments API to be only
`perPage`, `page` and `sort_order`.

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Co-authored-by: lcawl <lcawley@elastic.co>
adcoelho added a commit that referenced this pull request May 17, 2023
## Summary

[This PR was merged too
soon](#156863). (my bad, I pressed
merged automatically and some comments showed up afterwards).

I am addressing them now.

Basically:

1. Check for possible 0 as `page` query param in the `findComments` API.
2. Use the test utils in the `findComments` tests.

I also deleted a test that was duplicated and used the same utils in
every test not just the one connected to the PR comment.
christineweng added a commit that referenced this pull request Mar 16, 2026
## Summary

Updated cases API docs to address:

- Removed alert reference in find comment api. Related:
#156863
- Updated response schema and examples - existing response uses full
case response, which is not correct
- Removed `includeComment` param in get case api. [it is always false
for public
api](https://github.com/elastic/kibana/blob/ab858f5d9f3f91104b083c5b6d31363e41804828/x-pack/platform/plugins/shared/cases/server/routes/api/cases/get_case.ts#L40-L42)
but the response example contains comments, related:
#207739
- Included `extractObservables` to case request and response
- Fixed typos

### Checklist


- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This was checked for breaking HTTP API changes, and any breaking
changes have been approved by the breaking-change committee. The
`release_note:breaking` label should be applied in these situations.
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
- [x] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
sorenlouv pushed a commit that referenced this pull request Mar 17, 2026
## Summary

Updated cases API docs to address:

- Removed alert reference in find comment api. Related:
#156863
- Updated response schema and examples - existing response uses full
case response, which is not correct
- Removed `includeComment` param in get case api. [it is always false
for public
api](https://github.com/elastic/kibana/blob/ab858f5d9f3f91104b083c5b6d31363e41804828/x-pack/platform/plugins/shared/cases/server/routes/api/cases/get_case.ts#L40-L42)
but the response example contains comments, related:
#207739
- Included `extractObservables` to case request and response
- Fixed typos

### Checklist


- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This was checked for breaking HTTP API changes, and any breaking
changes have been approved by the breaking-change committee. The
`release_note:breaking` label should be applied in these situations.
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
- [x] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
qn895 pushed a commit to qn895/kibana that referenced this pull request Mar 18, 2026
## Summary

Updated cases API docs to address:

- Removed alert reference in find comment api. Related:
elastic#156863
- Updated response schema and examples - existing response uses full
case response, which is not correct
- Removed `includeComment` param in get case api. [it is always false
for public
api](https://github.com/elastic/kibana/blob/ab858f5d9f3f91104b083c5b6d31363e41804828/x-pack/platform/plugins/shared/cases/server/routes/api/cases/get_case.ts#L40-L42)
but the response example contains comments, related:
elastic#207739
- Included `extractObservables` to case request and response
- Fixed typos

### Checklist


- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This was checked for breaking HTTP API changes, and any breaking
changes have been approved by the breaking-change committee. The
`release_note:breaking` label should be applied in these situations.
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
- [x] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
jeramysoucy pushed a commit to jeramysoucy/kibana that referenced this pull request Mar 26, 2026
## Summary

Updated cases API docs to address:

- Removed alert reference in find comment api. Related:
elastic#156863
- Updated response schema and examples - existing response uses full
case response, which is not correct
- Removed `includeComment` param in get case api. [it is always false
for public
api](https://github.com/elastic/kibana/blob/ab858f5d9f3f91104b083c5b6d31363e41804828/x-pack/platform/plugins/shared/cases/server/routes/api/cases/get_case.ts#L40-L42)
but the response example contains comments, related:
elastic#207739
- Included `extractObservables` to case request and response
- Fixed typos

### Checklist


- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This was checked for breaking HTTP API changes, and any breaking
changes have been approved by the breaking-change committee. The
`release_note:breaking` label should be applied in these situations.
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
- [x] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport:skip This PR does not require backporting Feature:Cases Cases feature release_note:skip Skip the PR/issue when compiling release notes Team:ResponseOps Platform ResponseOps team (formerly the Cases and Alerting teams) t// v8.9.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Cases] Restrict the Find Comment API query params

7 participants