[Security Solution] Replaced the incorrect runtime type used for ruleSource

[xcrzx]

‼️ Part of critical path ‼️
Needed for: #180141 and #180128

Summary

This PR replaces the incorrect Zod schema for the ruleSource rule param.

Previously, the rule source field schema was implemented using a Zod transformation that automatically converted the snake-cased is_customized attribute to its camel-cased version isCustomized.

const RuleSourceCamelCased = RuleSource.transform(convertObjectKeysToCamelCase);

const RuleSource = z.object({
  type: z.literal('external'),
  is_customized: IsExternalRuleCustomized,
});

However, this meant that the expected input type for the schema was snake-cased, as the transformation happened only after validation.

Valid payload before:

{
  "ruleSource": {
    "type": "external",
    "is_customized": false // <- it should be camel cased
  }
}

To overcome this issue, the rule source schema was implemented without using the transformation (revert #180121).

Valid payload after:

{
  "ruleSource": {
    "type": "external",
    "isCustomized": false
  }
}

Important Note

This rule param schema change is considered safe because we do not currently use this field in the code. All values of this field are currently undefined. However, to ensure a Serverless release rollout without breaking changes, we need to release this schema change before we start writing any actual data.

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

[nikitaindik]

Thanks @xcrzx! Changes LGTM.

[banderror]

Should we also do something with this utility? For example:

• Add a comment to convertObjectKeysToCamelCase that it doesn't work as it was originally intended. Explain how it works.
• Create a ticket for reworking it or reopen [Security Solution] Implement a Zod transformation from snake_case to camelCase and vice versa #180121. Add a comment to convertObjectKeysToCamelCase with a link to the ticket.
• Delete the utility.

[xcrzx]

This function works as expected. It accepts any object and converts its keys to camel case. It has nothing to do with Zod and can be used (and is used) in other places, so I believe we can leave it as is.

[kibana-ci]

💚 Build Succeeded

• Buildkite Build
• Commit: fe3c271

Metrics [docs]

✅ unchanged

History

• 💚 Build #211478 succeeded 74b0bfbb96b30332a85467271d7a13777f44b901

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @xcrzx