[Security Solution] Move calculation of rule source outside of applyRuleUpdate

x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/detection_rules_client/mergers/apply_rule_update.ts

@@ -9,18 +9,14 @@ import type {
   RuleResponse,
   RuleUpdateProps,
 } from '../../../../../../../common/api/detection_engine/model/rule_schema';
-import type { IPrebuiltRuleAssetsClient } from '../../../../prebuilt_rules/logic/rule_assets/prebuilt_rule_assets_client';
 import { applyRuleDefaults } from './apply_rule_defaults';
-import { calculateRuleSource } from './rule_source/calculate_rule_source';
 
 interface ApplyRuleUpdateProps {
-  prebuiltRuleAssetClient: IPrebuiltRuleAssetsClient;
   existingRule: RuleResponse;
   ruleUpdate: RuleUpdateProps;
 }
 
 export const applyRuleUpdate = async ({
-  prebuiltRuleAssetClient,
   existingRule,
   ruleUpdate,
 }: ApplyRuleUpdateProps): Promise<RuleResponse> => {
@@ -43,10 +39,5 @@ export const applyRuleUpdate = async ({
     created_by: existingRule.created_by,
   };
 
-  nextRule.rule_source = await calculateRuleSource({
-    rule: nextRule,
-    prebuiltRuleAssetClient,
-  });
-
   return nextRule;
 };

x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/detection_rules_client/methods/import_rule.ts

@@ -19,6 +19,7 @@ import { validateMlAuth, toggleRuleEnabledOnUpdate } from '../utils';
 import { createRule } from './create_rule';
 import { getRuleByRuleId } from './get_rule_by_rule_id';
 import { createRuleImportErrorObject } from '../../import/errors';
+import { calculateRuleSource } from '../mergers/rule_source/calculate_rule_source';
 
 interface ImportRuleOptions {
   actionsClient: ActionsClient;
@@ -57,12 +58,19 @@ export const importRule = async ({
 
   if (existingRule && overwriteRules) {
     let ruleWithUpdates = await applyRuleUpdate({
-      prebuiltRuleAssetClient,
       existingRule,
       ruleUpdate: rule,
     });
-    // applyRuleUpdate prefers the existing rule's values for `rule_source` and `immutable`, but we want to use the importing rule's calculated values
-    ruleWithUpdates = { ...ruleWithUpdates, ...overrideFields };
+
+    // If no override fields are provided, we calculate the rule source
+    if (overrideFields == null) {
+      ruleWithUpdates.rule_source = await calculateRuleSource({
+        rule: ruleWithUpdates,
+        prebuiltRuleAssetClient,
+      });
+    } else {
+      ruleWithUpdates = { ...ruleWithUpdates, ...overrideFields };
+    }
 
     const updatedRule = await rulesClient.update({
       id: existingRule.id,

x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/detection_rules_client/methods/update_rule.ts

@@ -10,6 +10,7 @@ import type { RulesClient } from '@kbn/alerting-plugin/server';
 import type { RuleResponse } from '../../../../../../../common/api/detection_engine/model/rule_schema';
 import type { MlAuthz } from '../../../../../machine_learning/authz';
 import { applyRuleUpdate } from '../mergers/apply_rule_update';
+import { calculateRuleSource } from '../mergers/rule_source/calculate_rule_source';
 import { getIdError } from '../../../utils/utils';
 import { validateNonCustomizableUpdateFields } from '../../../utils/validate';
 import { convertRuleResponseToAlertingRule } from '../converters/convert_rule_response_to_alerting_rule';
@@ -54,10 +55,13 @@ export const updateRule = async ({
   validateNonCustomizableUpdateFields(ruleUpdate, existingRule);
 
   const ruleWithUpdates = await applyRuleUpdate({
-    prebuiltRuleAssetClient,
     existingRule,
     ruleUpdate,
   });
+  ruleWithUpdates.rule_source = await calculateRuleSource({
+    rule: ruleWithUpdates,
+    prebuiltRuleAssetClient,
+  });
 
   const updatedRule = await rulesClient.update({
     id: existingRule.id,

x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/logic/detection_rules_client/methods/upgrade_prebuilt_rule.ts

@@ -15,6 +15,7 @@ import type { IPrebuiltRuleAssetsClient } from '../../../../prebuilt_rules/logic
 import { convertAlertingRuleToRuleResponse } from '../converters/convert_alerting_rule_to_rule_response';
 import { convertRuleResponseToAlertingRule } from '../converters/convert_rule_response_to_alerting_rule';
 import { applyRuleUpdate } from '../mergers/apply_rule_update';
+import { calculateRuleSource } from '../mergers/rule_source/calculate_rule_source';
 import { ClientError, validateMlAuth } from '../utils';
 import { createRule } from './create_rule';
 import { getRuleByRuleId } from './get_rule_by_rule_id';
@@ -70,10 +71,13 @@ export const upgradePrebuiltRule = async ({
 
   // Else, recreate the rule from scratch with the passed payload.
   const updatedRule = await applyRuleUpdate({
-    prebuiltRuleAssetClient,
     existingRule,
     ruleUpdate: ruleAsset,
   });
+  updatedRule.rule_source = await calculateRuleSource({
+    rule: updatedRule,
+    prebuiltRuleAssetClient,
+  });
 
   const updatedInternalRule = await rulesClient.update({
     id: existingRule.id,