[Cases] Add to new and existing cases bulk actions in the timelines, security_solution and o11y

x-pack/plugins/cases/public/client/helpers/group_alerts_by_rule.ts

@@ -0,0 +1,44 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { CommentRequestAlertType } from '../../../common/api';
+import { CommentType, Ecs } from '../../../common';
+import { getRuleIdFromEvent } from './get_rule_id_from_event';
+import { CaseAttachments } from '../../types';
+
+type Maybe<T> = T | null;
+interface Event {
+  data: EventNonEcsData[];
+  ecs: Ecs;
+}
+interface EventNonEcsData {
+  field: string;
+  value?: Maybe<string[]>;
+}
+
+export const groupAlertsByRule = (items: Event[], owner: string): CaseAttachments => {
+  const attachmentsByRule = items.reduce<Record<string, CommentRequestAlertType>>((acc, item) => {
+    const rule = getRuleIdFromEvent(item);
+    if (!acc[rule.id]) {
+      acc[rule.id] = {
+        alertId: [],
+        index: [],
+        owner,
+        type: CommentType.alert as const,
+        rule,
+      };
+    }
+    const alerts = acc[rule.id].alertId;
+    const indexes = acc[rule.id].index;
+    if (Array.isArray(alerts) && Array.isArray(indexes)) {
+      alerts.push(item.ecs._id ?? '');
+      indexes.push(item.ecs._index ?? '');
+    }
+    return acc;
+  }, {});
+  return Object.values(attachmentsByRule);
+};

x-pack/plugins/cases/public/common/translations.ts

@@ -265,10 +265,11 @@ export const CASE_SUCCESS_TOAST = (title: string) =>
     defaultMessage: '{title} has been updated',
   });
 
-export const CASE_ALERT_SUCCESS_TOAST = (title: string) =>
+export const CASE_ALERT_SUCCESS_TOAST = (title: string, quantity: number = 1) =>
   i18n.translate('xpack.cases.actions.caseAlertSuccessToast', {
-    values: { title },
-    defaultMessage: 'An alert has been added to "{title}"',
+    values: { quantity, title },
+    defaultMessage:
+      '{quantity, plural, =1 {An alert has} other {Alerts have}} been added to "{title}"',
   });
 
 export const CASE_ALERT_SUCCESS_SYNC_TEXT = i18n.translate(

x-pack/plugins/cases/public/common/use_cases_toast.test.tsx

@@ -72,7 +72,7 @@ describe('Use cases toast hook', () => {
       validateTitle('Custom title');
     });
 
-    it('should display the alert sync title when called with an alert attachment ', () => {
+    it('should display the alert sync title when called with an alert attachment (1 alert)', () => {
       const { result } = renderHook(
         () => {
           return useCasesToast();
@@ -86,6 +86,25 @@ describe('Use cases toast hook', () => {
       validateTitle('An alert has been added to "Another horrible breach!!');
     });
 
+    it('should display the alert sync title when called with an alert attachment (multiple alerts)', () => {
+      const { result } = renderHook(
+        () => {
+          return useCasesToast();
+        },
+        { wrapper: TestProviders }
+      );
+      const alert = {
+        ...alertComment,
+        alertId: ['1234', '54321'],
+      } as SupportedCaseAttachment;
+
+      result.current.showSuccessAttach({
+        theCase: mockCase,
+        attachments: [alert],
+      });
+      validateTitle('Alerts have been added to "Another horrible breach!!');
+    });
+
     it('should display a generic title when called with a non-alert attachament', () => {
       const { result } = renderHook(
         () => {

x-pack/plugins/cases/public/common/use_cases_toast.tsx

@@ -34,6 +34,20 @@ const EuiTextStyled = styled(EuiText)`
   `}
 `;
 
+function getAlertsCount(attachments: CaseAttachments): number {
+  let alertsCount = 0;
+  for (const attachment of attachments) {
+    if (attachment.type === CommentType.alert) {
+      if (Array.isArray(attachment.alertId) && attachment.alertId.length > 1) {
+        alertsCount += attachment.alertId.length;
+      }
+
+      alertsCount++;
+    }
+  }
+  return alertsCount;
+}
+
 function getToastTitle({
   theCase,
   title,
@@ -47,10 +61,9 @@ function getToastTitle({
     return title;
   }
   if (attachments !== undefined) {
-    for (const attachment of attachments) {
-      if (attachment.type === CommentType.alert) {
-        return CASE_ALERT_SUCCESS_TOAST(theCase.title);
-      }
+    const alertsCount = getAlertsCount(attachments);
+    if (alertsCount > 0) {
+      return CASE_ALERT_SUCCESS_TOAST(theCase.title, alertsCount);
     }
   }
   return CASE_SUCCESS_TOAST(theCase.title);

x-pack/plugins/cases/public/components/all_cases/selector_modal/use_cases_add_to_existing_case_modal.test.tsx

@@ -15,7 +15,6 @@ import { AppMockRenderer, createAppMockRenderer } from '../../../common/mock';
 import { useCasesToast } from '../../../common/use_cases_toast';
 import { alertComment } from '../../../containers/mock';
 import { useCreateAttachments } from '../../../containers/use_create_attachments';
-import { SupportedCaseAttachment } from '../../../types';
 import { CasesContext } from '../../cases_context';
 import { CasesContextStoreActionsList } from '../../cases_context/cases_context_reducer';
 import { useCasesAddToExistingCaseModal } from './use_cases_add_to_existing_case_modal';
@@ -35,12 +34,10 @@ const AllCasesSelectorModalMock = AllCasesSelectorModal as unknown as jest.Mock;
 
 // test component to test the hook integration
 const TestComponent: React.FC = () => {
-  const hook = useCasesAddToExistingCaseModal({
-    attachments: [alertComment as SupportedCaseAttachment],
-  });
+  const hook = useCasesAddToExistingCaseModal({});
 
   const onClick = () => {
-    hook.open();
+    hook.open({ attachments: [alertComment] });
   };
 
   return <button type="button" data-test-subj="open-modal" onClick={onClick} />;

x-pack/plugins/cases/public/components/all_cases/selector_modal/use_cases_add_to_existing_case_modal.tsx

@@ -19,12 +19,10 @@ import { useCreateAttachments } from '../../../containers/use_create_attachments
 type AddToExistingFlyoutProps = AllCasesSelectorModalProps & {
   toastTitle?: string;
   toastContent?: string;
-  attachments?: CaseAttachments;
 };
 
-export const useCasesAddToExistingCaseModal = (props: AddToExistingFlyoutProps) => {
+export const useCasesAddToExistingCaseModal = (props: AddToExistingFlyoutProps = {}) => {
   const createNewCaseFlyout = useCasesAddToNewCaseFlyout({
-    attachments: props.attachments,
     onClose: props.onClose,
     // TODO there's no need for onSuccess to be async. This will be fixed
     // in a follow up clean up
@@ -53,18 +51,17 @@ export const useCasesAddToExistingCaseModal = (props: AddToExistingFlyoutProps)
   }, [dispatch]);
 
   const handleOnRowClick = useCallback(
-    async (theCase?: Case) => {
+    async (theCase: Case | undefined, attachments: CaseAttachments) => {
       // when the case is undefined in the modal
       // the user clicked "create new case"
       if (theCase === undefined) {
         closeModal();
-        createNewCaseFlyout.open();
+        createNewCaseFlyout.open({ attachments });
         return;
       }
 
       try {
         // add attachments to the case
-        const attachments = props.attachments;
         if (attachments !== undefined && attachments.length > 0) {
           await createAttachments({
             caseId: theCase.id,
@@ -74,7 +71,7 @@ export const useCasesAddToExistingCaseModal = (props: AddToExistingFlyoutProps)
 
           casesToasts.showSuccessAttach({
             theCase,
-            attachments: props.attachments,
+            attachments,
             title: props.toastTitle,
             content: props.toastContent,
           });
@@ -91,22 +88,28 @@ export const useCasesAddToExistingCaseModal = (props: AddToExistingFlyoutProps)
     [casesToasts, closeModal, createNewCaseFlyout, createAttachments, props]
   );
 
-  const openModal = useCallback(() => {
-    dispatch({
-      type: CasesContextStoreActionsList.OPEN_ADD_TO_CASE_MODAL,
-      payload: {
-        ...props,
-        hiddenStatuses: [CaseStatuses.closed, StatusAll],
-        onRowClick: handleOnRowClick,
-        onClose: () => {
-          closeModal();
-          if (props.onClose) {
-            return props.onClose();
-          }
+  const openModal = useCallback(
+    ({ attachments }: { attachments?: CaseAttachments } = {}) => {
+      dispatch({
+        type: CasesContextStoreActionsList.OPEN_ADD_TO_CASE_MODAL,
+        payload: {
+          ...props,
+          hiddenStatuses: [CaseStatuses.closed, StatusAll],
+          onRowClick: (theCase?: Case) => {
+            const caseAttachments = attachments ?? [];
+            handleOnRowClick(theCase, caseAttachments);
+          },
+          onClose: () => {
+            closeModal();
+            if (props.onClose) {
+              return props.onClose();
+            }
+          },
         },
-      },
-    });
-  }, [closeModal, dispatch, handleOnRowClick, props]);
+      });
+    },
+    [closeModal, dispatch, handleOnRowClick, props]
+  );
   return {
     open: openModal,
     close: closeModal,

x-pack/plugins/cases/public/components/create/flyout/use_cases_add_to_new_case_flyout.test.tsx

@@ -7,6 +7,7 @@
 
 /* eslint-disable react/display-name */
 
+import { alertComment } from '../../../containers/mock';
 import { renderHook } from '@testing-library/react-hooks';
 import React from 'react';
 import { CasesContext } from '../../cases_context';
@@ -48,7 +49,7 @@ describe('use cases add to new case flyout hook', () => {
     );
   });
 
-  it('should dispatch the open action when invoked', () => {
+  it('should dispatch the open action when invoked without attachments', () => {
     const { result } = renderHook(
       () => {
         return useCasesAddToNewCaseFlyout({});
@@ -59,6 +60,45 @@ describe('use cases add to new case flyout hook', () => {
     expect(dispatch).toHaveBeenCalledWith(
       expect.objectContaining({
         type: CasesContextStoreActionsList.OPEN_CREATE_CASE_FLYOUT,
+        payload: expect.objectContaining({
+          attachments: undefined,
+        }),
+      })
+    );
+  });
+
+  it('should dispatch the open action when invoked with attachments', () => {
+    const { result } = renderHook(
+      () => {
+        return useCasesAddToNewCaseFlyout({});
+      },
+      { wrapper }
+    );
+    result.current.open({ attachments: [alertComment] });
+    expect(dispatch).toHaveBeenCalledWith(
+      expect.objectContaining({
+        type: CasesContextStoreActionsList.OPEN_CREATE_CASE_FLYOUT,
+        payload: expect.objectContaining({
+          attachments: [alertComment],
+        }),
+      })
+    );
+  });
+
+  it('should dispatch the open action when invoked, with custom attachments', () => {
+    const { result } = renderHook(
+      () => {
+        return useCasesAddToNewCaseFlyout({});
+      },
+      { wrapper }
+    );
+    result.current.open({ attachments: [alertComment] });
+    expect(dispatch).toHaveBeenCalledWith(
+      expect.objectContaining({
+        type: CasesContextStoreActionsList.OPEN_CREATE_CASE_FLYOUT,
+        payload: expect.objectContaining({
+          attachments: [alertComment],
+        }),
       })
     );
   });