[SIEM][Exceptions] - Cleaned up and updated exception list item comment structure

[yctercero]

Summary

This PR is a follow up to #68864 . That PR used a partial to differentiate between new and existing comments, this meant that comments could be updated when they shouldn't. It was decided in our discussion of exception list schemas that comments should be append only. This PR assures that's the case, but also leaves it open to editing comments (via API). It checks to make sure that users can only update their own comments.

Created 3 different schemas for comments, during creation, should only accept comments of following schema:

{
  "comment": "This is a comment"
}

Saved comments must be of the following schema:

{
  "comment": "This is a comment",
  "created_at": "timestamp_here",
  "created_by": "user"
}

Much of the added logic deals with updating comments (PUT), the exception list item comments can include a mix of the two above schemas, but the added logic ensures that:

• a user cannot rearrange order of comments
• a user cannot delete comments
• a user cannot update a comment that is not their own
• when comment is updated, it adds updated_at and updated_by
• if user tries to update a comment, they must pass the original created_at, and created_by
• empty comments cannot be added

Looking over the tests is helpful in understanding the logic, and may help you help me find any logic I've missed. 😄

I chose to separate out the different schemas into their own files to maintain readability and maintainability. It looked a little icky when putting everything into one file.

Testing

I added unit tests to confirm the logic, but also used the existing scripts.

To turn on lists plugin - in kibana.dev.yml

# Enable lists feature
xpack.lists.enabled: true
xpack.lists.listIndex: '.lists-yara'
xpack.lists.listItemIndex: '.items-yara'

Use the scripts in x-pack/plugins/lists/server/scripts to create some sample exception lists and items. You can use the following:

• Create exception list ./post_exception_list.sh
• Create exception list items ./post_exception_list_item.sh
• Use update script to add comments ./update_exception_list_item.sh

You can update the scripts to try different edge cases (deleting comments, updating different user comments, etc).

If you want to view the comments in the UI:

• Run ./find_exception_lists.sh to get the id of the two lists you created
• Update the ExceptionsViewer component in x-pack/plugins/security_solution/public/alerts/pages/detection_engine/rules/details/index.tsx to something like the following:

 <ExceptionsViewer
    ruleId={ruleId ?? ''}
    availableListTypes={[
      ExceptionListType.DETECTION_ENGINE,
      ExceptionListType.ENDPOINT,
    ]}
    commentsAccordionId={'ruleDetailsTabExceptions'}
    exceptionListsMeta ={[
       {
         id: [ENDPOINT_LIST_ID],  // `id` not `list_id`
         type: 'endpoint',
         namespaceType: 'single',
       },
    ]}  />

Navigate to the rules details page and click on the 'Exceptions' tab. Voila!

Checklist

Delete any items that are not applicable to this PR.

• Unit or functional tests were updated or added to match the most common scenarios

For maintainers

• This was checked for breaking API changes and was labeled appropriately
  (It is a breaking change, however this API is not yet public and behind feature flag, only devs working on this feature would be affected)

[yctercero]

NOTE: Previously had the different comment schemas all in one doc, but started to feel really messy. Broke out into their own docs, tests, and mocks.

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[peluja1012]

Thanks for this fix!

[yctercero]

@elasticmachine merge upstream

[yctercero]

@elasticmachine merge upstream

[kibanamachine]

💚 Build Succeeded

• continuous-integration/kibana-ci/pull-request
• Commit: 7794514

Build metrics

@kbn/optimizer bundle module count

id	value	diff	baseline
securitySolution	781	+4	777

History

• 💛 Build #56501 was flaky a5e617e
• 💔 Build #56471 failed ad2eab7
• 💚 Build #56313 succeeded 3d8ff56
• 💚 Build #56137 succeeded 0d0a118
• 💚 Build #55707 succeeded f55a236

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)