[Security Solution][Detections] fixes validation issues in rules actions form

[vitaliidm]

Summary

• addresses [Security Solution]: Save button gets disable while selecting overwrite all selected rules actions option under add rules actions flyout. #140593
  • bulk edit of rules actions
  • single rule actions update

Before

Single rule actions update

Screen.Recording.2022-09-26.at.12.36.53.mov

Bulk edit rule actions

rules_actions_form_issues.mp4

After

Single rule actions update and Bulk edit rule actions

Screen.Recording.2022-09-26.at.17.00.16.mov

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[xcrzx]

@vitaliidm Could you, please expand on why form and validation values get out of sync? If there's a race condition, using setTimeout to "win" it doesn't seem like a scalable solution. Maybe there're other options for streamlining those state updates.

[vitaliidm]

@xcrzx

so, setActionIdByIndex within this file fires update of actions(but w/o params properties)
setActionParamsProperty updates params in field actions of form with values displayed if form controls through calling field.setValue. In our case, it is a message form field in slack action form.

These updates trigger form validation:

  actions: {
    validations: [
      {
        validator: validateRuleActionsField(actionTypeRegistry),
      },
    ],
  },

validateRuleActionsField receives in curried function argument field value:

    const [{ value, path }] = data as [{ value: RuleAction[]; path: string }];

which doesn't have updates set in setActionParamsProperty. It happens consistently when you add some action, remove it, add again it.

here is logged values in functions calls

setActionIdByIndex [
  {
    "id": "50a49d70-34d4-11ed-87dc-f3f665e2eedb",
    "actionTypeId": ".slack",
    "group": "default",
    "params": {}
  }
]
validateRuleActionsField [
  {
    "id": "50a49d70-34d4-11ed-87dc-f3f665e2eedb",
    "actionTypeId": ".slack",
    "group": "default",
    "params": {}
  }
]
validateRuleActionsField [
  {
    "id": "50a49d70-34d4-11ed-87dc-f3f665e2eedb",
    "actionTypeId": ".slack",
    "group": "default",
    "params": {}
  }
]
setActionParamsProperty [
  {
    "id": "50a49d70-34d4-11ed-87dc-f3f665e2eedb",
    "actionTypeId": ".slack",
    "group": "default",
    "params": {
      "message": "Rule {{context.rule.name}} generated {{state.signals_count}} alerts"
    }
  }
]

As you can see validateRuleActionsField is not getting called after setActionParamsProperty called, instead validateRuleActionsField called twice on setActionIdByIndex. I would expect validation to be triggered once we set new params values.
But wrapping field.setValue in setTimeout helped to resolve the issue.
If you have any ideas how to resolve this, please share.

[xcrzx]

As you can see validateRuleActionsField is not getting called after setActionParamsProperty called, instead validateRuleActionsField called twice on setActionIdByIndex. I would expect validation to be triggered once we set new params values.

Thanks for the explanation! To me, that looks like a bug on the Actions Form side. Validation should definitely happen after params modification, but it's not the case.

@elastic/response-ops Could you please confirm if the behavior described above is a bug? In which case, I propose fixing it in the getActionForm instead of working it around on the solution side.

[ymao1]

I believe the validateRuleActionsField validation occurs inside the security form, not inside the ActionForm. What triggers this validation?

Looking through the triggers_actions_ui code, when a connector type is specified, the ActionForm calls setActionIdByIndex with empty params and then it loads the Params component for that connector type. When the Params component is loaded, it sets a defaultActionMessage which calls setActionParamsProperty. Based on the logs above, the order that this is happening is correct. What is triggering the validateRuleActionsField call?

[vitaliidm]

What is triggering the validateRuleActionsField call?

I think it's triggered somewhere within eui form hook useForm, where validateRuleActionsField passed inside formSchema

  actions: {
    validations: [
      {
        validator: validateRuleActionsField(actionTypeRegistry),
      },
    ],
  },

  const { form } = useForm({
    schema: formSchema,
    defaultValue: defaultFormData,
  });

@xcrzx
I think it would make sense to merge this fix and investigate further issue with not triggered validation. The root cause seems to be not in Security Solution, so we will depend on other teams in this, but current bug affects customer experience and we already on BC2 of 8.5 release.

cc: @banderror

[xcrzx]

I think it would make sense to merge this fix and investigate further issue with not triggered validation. The root cause seems to be not in Security Solution, so we will depend on other teams in this, but current bug affects customer experience and we already on BC2 of 8.5 release.

I'm fine with that. @vitaliidm, Could you please create a ticker for further investigation and mention it in the code comment for additional context?

[vitaliidm]

@xcrzx

I'm fine with that. @vitaliidm, Could you please create a ticker for further investigation and mention it in the code comment for additional context?

Here is created ticket #142217, also added it to comment

[xcrzx]

LGTM! Thanks for creating a tech debt issue to investigate the problem further

[kibana-ci]

💚 Build Succeeded

• Buildkite Build
• Commit: 40ff98e

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
securitySolution	6.6MB	6.6MB	+4.0B

Unknown metric groups

ESLint disabled line counts

id	before	after	diff
securitySolution	412	410	-2

Total ESLint disabled count

id	before	after	diff
securitySolution	485	483	-2

History

• 💔 Build #76852 failed ac9d2bd
• 💛 Build #75909 was flaky b967c85
• 💔 Build #75778 failed edfd2e4
• 💔 Build #75727 failed a18c4e0

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @vitaliidm

[kibanamachine]

💚 All backports created successfully

Status	Branch	Result
✅	8.5

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation