[Defend Workflows] Fix endpoint list API to mirror exception list API

oas_docs/output/kibana.serverless.yaml

@@ -15419,9 +15419,7 @@ paths:
           content:
             application/json:
               schema:
-                items:
-                  $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItem'
-                type: array
+                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItem'
           description: Successful response
         '400':
           content:

oas_docs/output/kibana.yaml

@@ -17892,9 +17892,7 @@ paths:
           content:
             application/json:
               schema:
-                items:
-                  $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItem'
-                type: array
+                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItem'
           description: Successful response
         '400':
           content:

x-pack/solutions/security/packages/kbn-securitysolution-endpoint-exceptions-common/api/read_endpoint_list_item/read_endpoint_list_item.gen.ts

@@ -38,4 +38,4 @@ export type ReadEndpointListItemRequestQueryInput = z.input<
 >;
 
 export type ReadEndpointListItemResponse = z.infer<typeof ReadEndpointListItemResponse>;
-export const ReadEndpointListItemResponse = z.array(EndpointListItem);
+export const ReadEndpointListItemResponse = EndpointListItem;

x-pack/solutions/security/packages/kbn-securitysolution-endpoint-exceptions-common/api/read_endpoint_list_item/read_endpoint_list_item.schema.yaml

@@ -29,9 +29,7 @@ paths:
           content:
             application/json:
               schema:
-                type: array
-                items:
-                  $ref: '../model/endpoint_list_common.schema.yaml#/components/schemas/EndpointListItem'
+                $ref: '../model/endpoint_list_common.schema.yaml#/components/schemas/EndpointListItem'
         400:
           description: Invalid input data
           content:

x-pack/solutions/security/packages/kbn-securitysolution-endpoint-exceptions-common/docs/openapi/ess/security_solution_endpoint_exceptions_api_2023_10_31.bundled.schema.yaml

@@ -139,9 +139,7 @@ paths:
           content:
             application/json:
               schema:
-                items:
-                  $ref: '#/components/schemas/EndpointListItem'
-                type: array
+                $ref: '#/components/schemas/EndpointListItem'
           description: Successful response
         '400':
           content:

x-pack/solutions/security/packages/kbn-securitysolution-endpoint-exceptions-common/docs/openapi/serverless/security_solution_endpoint_exceptions_api_2023_10_31.bundled.schema.yaml

@@ -139,9 +139,7 @@ paths:
           content:
             application/json:
               schema:
-                items:
-                  $ref: '#/components/schemas/EndpointListItem'
-                type: array
+                $ref: '#/components/schemas/EndpointListItem'
           description: Successful response
         '400':
           content:

x-pack/solutions/security/plugins/lists/server/routes/create_endpoint_list_item_route.ts

@@ -18,7 +18,8 @@ import { LISTS_API_ALL } from '@kbn/security-solution-features/constants';
 import type { ListsPluginRouter } from '../types';
 
 import { buildSiemResponse, getExceptionListClient } from './utils';
-import { validateExceptionListSize } from './validate';
+import { endpointDisallowedFields } from './endpoint_disallowed_fields';
+import { validateEndpointExceptionItemEntries, validateExceptionListSize } from './validate';
 
 export const createEndpointListItemRoute = (router: ListsPluginRouter): void => {
   router.versioned
@@ -64,37 +65,54 @@ export const createEndpointListItemRoute = (router: ListsPluginRouter): void =>
               body: `exception list item id: "${itemId}" already exists`,
               statusCode: 409,
             });
-          } else {
-            const createdList = await exceptionLists.createEndpointListItem({
-              comments,
-              description,
-              entries,
-              itemId,
-              meta,
-              name,
-              osTypes,
-              tags,
-              type,
-            });
+          }
+
+          const error = validateEndpointExceptionItemEntries(entries);
+          if (error != null) {
+            return siemResponse.error(error);
+          }
+          for (const entry of entries) {
+            if (endpointDisallowedFields.includes(entry.field)) {
+              return siemResponse.error({
+                body: `cannot add endpoint exception item on field ${entry.field}`,
+                statusCode: 400,
+              });
+            }
+          }
 
-            const { success, data, error } = CreateEndpointListItemResponse.safeParse(createdList);
-            if (success === false) {
-              return siemResponse.error({ body: stringifyZodError(error), statusCode: 500 });
-            } else {
-              const listSizeError = await validateExceptionListSize(
-                exceptionLists,
-                ENDPOINT_LIST_ID,
-                'agnostic'
-              );
-              if (listSizeError != null) {
-                await exceptionLists.deleteExceptionListItemById({
-                  id: createdList.id,
-                  namespaceType: 'agnostic',
-                });
-                return siemResponse.error(listSizeError);
-              }
-              return response.ok({ body: data ?? {} });
+          const createdList = await exceptionLists.createEndpointListItem({
+            comments,
+            description,
+            entries,
+            itemId,
+            meta,
+            name,
+            osTypes,
+            tags,
+            type,
+          });
+
+          const {
+            success,
+            data,
+            error: parseError,
+          } = CreateEndpointListItemResponse.safeParse(createdList);
+          if (success === false) {
+            return siemResponse.error({ body: stringifyZodError(parseError), statusCode: 500 });
+          } else {
+            const listSizeError = await validateExceptionListSize(
+              exceptionLists,
+              ENDPOINT_LIST_ID,
+              'agnostic'
+            );
+            if (listSizeError != null) {
+              await exceptionLists.deleteExceptionListItemById({
+                id: createdList.id,
+                namespaceType: 'agnostic',
+              });
+              return siemResponse.error(listSizeError);
             }
+            return response.ok({ body: data ?? {} });
           }
         } catch (err) {
           const error = transformError(err);

x-pack/solutions/security/plugins/lists/server/services/exception_lists/exception_list_client.test.ts

@@ -95,6 +95,50 @@ describe('exception_list_client', () => {
           return extensionPointStorageContext.exceptionPreUpdate.callback;
         },
       ],
+
+      [
+        'createEndpointListItem',
+        (): ReturnType<ExceptionListClient['createEndpointListItem']> => {
+          const mockOptions = getCreateExceptionListItemOptionsMock();
+          return exceptionListClient.createEndpointListItem({
+            comments: mockOptions.comments,
+            description: mockOptions.description,
+            entries: mockOptions.entries,
+            itemId: mockOptions.itemId,
+            meta: mockOptions.meta,
+            name: mockOptions.name,
+            osTypes: mockOptions.osTypes,
+            tags: mockOptions.tags,
+            type: mockOptions.type,
+          });
+        },
+        (): ExtensionPointStorageContextMock['exceptionPreCreate']['callback'] => {
+          return extensionPointStorageContext.exceptionPreCreate.callback;
+        },
+      ],
+
+      [
+        'updateEndpointListItem',
+        (): ReturnType<ExceptionListClient['updateEndpointListItem']> => {
+          const mockOptions = getUpdateExceptionListItemOptionsMock();
+          return exceptionListClient.updateEndpointListItem({
+            _version: mockOptions._version,
+            comments: mockOptions.comments,
+            description: mockOptions.description,
+            entries: mockOptions.entries,
+            id: mockOptions.id,
+            itemId: mockOptions.itemId,
+            meta: mockOptions.meta,
+            name: mockOptions.name,
+            osTypes: mockOptions.osTypes,
+            tags: mockOptions.tags,
+            type: mockOptions.type,
+          });
+        },
+        (): ExtensionPointStorageContextMock['exceptionPreUpdate']['callback'] => {
+          return extensionPointStorageContext.exceptionPreUpdate.callback;
+        },
+      ],
     ])(
       'and calling `ExceptionListClient#%s()`',
       (methodName, callExceptionListClientMethod, getExtensionPointCallback) => {
@@ -294,6 +338,48 @@ describe('exception_list_client', () => {
           return extensionPointStorageContext.exceptionPreDelete.callback;
         },
       ],
+      [
+        'getEndpointListItem',
+        (): ReturnType<ExceptionListClient['getEndpointListItem']> => {
+          return exceptionListClient.getEndpointListItem({
+            id: '1',
+            itemId: '1',
+          });
+        },
+        (): ExtensionPointStorageContextMock['exceptionPreGetOne']['callback'] => {
+          return extensionPointStorageContext.exceptionPreGetOne.callback;
+        },
+      ],
+      [
+        'deleteEndpointListItem',
+        (): ReturnType<ExceptionListClient['deleteEndpointListItem']> => {
+          return exceptionListClient.deleteEndpointListItem({
+            id: '1',
+            itemId: '1',
+          });
+        },
+        (): ExtensionPointStorageContextMock['exceptionPreDelete']['callback'] => {
+          return extensionPointStorageContext.exceptionPreDelete.callback;
+        },
+      ],
+      [
+        'findEndpointListItem',
+        (): ReturnType<ExceptionListClient['findEndpointListItem']> => {
+          return exceptionListClient.findEndpointListItem({
+            filter: undefined,
+            page: 1,
+            perPage: 1,
+            pit: undefined,
+            search: undefined,
+            searchAfter: undefined,
+            sortField: 'name',
+            sortOrder: 'asc',
+          });
+        },
+        (): ExtensionPointStorageContextMock['exceptionPreSingleListFind']['callback'] => {
+          return extensionPointStorageContext.exceptionPreSingleListFind.callback;
+        },
+      ],
       [
         'importExceptionListAndItems',
         (): ReturnType<ExceptionListClient['importExceptionListAndItems']> => {