[Security Solution] Implement normalization of ruleSource for API responses

x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/detection_rules_client/converters/common_params_camel_to_snake.ts

@@ -5,9 +5,9 @@
  * 2.0.
  */
 
-import { convertObjectKeysToSnakeCase } from '../../../../../../utils/object_case_converters';
 import type { BaseRuleParams } from '../../../../rule_schema';
 import { migrateLegacyInvestigationFields } from '../../../utils/utils';
+import { normalizeRuleSource } from './normalize_rule_source';
 
 export const commonParamsCamelToSnake = (params: BaseRuleParams) => {
   return {
@@ -39,7 +39,10 @@ export const commonParamsCamelToSnake = (params: BaseRuleParams) => {
     version: params.version,
     exceptions_list: params.exceptionsList,
     immutable: params.immutable,
-    rule_source: convertObjectKeysToSnakeCase(params.ruleSource),
+    rule_source: normalizeRuleSource({
+      immutable: params.immutable,
+      ruleSource: params.ruleSource,
+    }),
     related_integrations: params.relatedIntegrations ?? [],
     required_fields: params.requiredFields ?? [],
     setup: params.setup ?? '',

x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/detection_rules_client/converters/normalize_rule_source.test.ts

@@ -0,0 +1,55 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { normalizeRuleSource } from './normalize_rule_source';
+import type { BaseRuleParams } from '../../../../rule_schema';
+
+describe('normalizeRuleSource', () => {
+  it('should return rule_source of type `internal` when immutable is false and ruleSource is undefined', () => {
+    const result = normalizeRuleSource({
+      immutable: false,
+      ruleSource: undefined,
+    });
+    expect(result).toEqual({
+      type: 'internal',
+    });
+  });
+
+  it('should return rule_source of type `external` and `isCustomized: false` when immutable is true and ruleSource is undefined', () => {
+    const result = normalizeRuleSource({
+      immutable: true,
+      ruleSource: undefined,
+    });
+    expect(result).toEqual({
+      type: 'external',
+      is_customized: false,
+    });
+  });
+
+  it('should return snake_case version of rule_source when ruleSource is present', () => {
+    const externalRuleSource: BaseRuleParams['ruleSource'] = {
+      type: 'external',
+      isCustomized: true,
+    };
+    const externalResult = normalizeRuleSource({ immutable: true, ruleSource: externalRuleSource });
+    expect(externalResult).toEqual({
+      type: externalRuleSource.type,
+      is_customized: externalRuleSource.isCustomized,
+    });
+
+    const internalRuleSource: BaseRuleParams['ruleSource'] = {
+      type: 'internal',
+    };
+    const internalResult = normalizeRuleSource({
+      immutable: false,
+      ruleSource: internalRuleSource,
+    });
+    expect(internalResult).toEqual({
+      type: internalRuleSource.type,
+    });
+  });
+});

x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/detection_rules_client/converters/normalize_rule_source.ts

@@ -0,0 +1,32 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+import type { RuleSource } from '../../../../../../../common/api/detection_engine';
+import { convertObjectKeysToSnakeCase } from '../../../../../../utils/object_case_converters';
+import type { BaseRuleParams } from '../../../../rule_schema';
+
+interface NormalizeRuleSourceParams {
+  immutable: BaseRuleParams['immutable'];
+  ruleSource: BaseRuleParams['ruleSource'];
+}
+export const normalizeRuleSource = ({
+  immutable,
+  ruleSource,
+}: NormalizeRuleSourceParams): RuleSource => {
+  if (!ruleSource) {
+    const normalizedRuleSource = immutable
+      ? {
+          type: 'external',
+          isCustomized: false,
+        }
+      : {
+          type: 'internal',
+        };
+
+    return convertObjectKeysToSnakeCase(normalizedRuleSource) as RuleSource;
+  }
+  return convertObjectKeysToSnakeCase(ruleSource) as RuleSource;
+};