From 9e121ad1d351a092622f1c522b27e4aefb01effd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Antonio=20David=20Guti=C3=A9rrez?=
 <antonio.gutierrez@wazuh.com>
Date: Wed, 9 Aug 2023 15:07:25 +0200
Subject: [PATCH] fix(wql): add whitespace before closing grouping operator )
 when using the suggestions

---
 .../components/search-bar/query-language/wql.test.tsx      | 2 +-
 .../public/components/search-bar/query-language/wql.tsx    | 7 ++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/plugins/main/public/components/search-bar/query-language/wql.test.tsx b/plugins/main/public/components/search-bar/query-language/wql.test.tsx
index 4de5de790b..c911516610 100644
--- a/plugins/main/public/components/search-bar/query-language/wql.test.tsx
+++ b/plugins/main/public/components/search-bar/query-language/wql.test.tsx
@@ -303,7 +303,7 @@ describe('Query language - WQL', () => {
     ${'(field=value or field2>'}       | ${{ type: { iconType: 'kqlOperand', color: 'tint1' }, label: '~' }}            | ${'(field=value or field2~'}
     ${'(field=value or field2>'}       | ${{ type: { iconType: 'kqlValue', color: 'tint0' }, label: 'value2' }}         | ${'(field=value or field2>value2'}
     ${'(field=value or field2>value2'} | ${{ type: { iconType: 'kqlValue', color: 'tint0' }, label: 'value3' }}         | ${'(field=value or field2>value3'}
-    ${'(field=value or field2>value2'} | ${{ type: { iconType: 'tokenDenseVector', color: 'tint3' }, label: ')' }}      | ${'(field=value or field2>value2)'}
+    ${'(field=value or field2>value2'} | ${{ type: { iconType: 'tokenDenseVector', color: 'tint3' }, label: ')' }}      | ${'(field=value or field2>value2 )'}
   `(
     'click suggestion - WQL $WQL => $changedInput',
     async ({ WQL: currentInput, clikedSuggestion, changedInput }) => {
diff --git a/plugins/main/public/components/search-bar/query-language/wql.tsx b/plugins/main/public/components/search-bar/query-language/wql.tsx
index 63216eaeaf..cfdf1c1e58 100644
--- a/plugins/main/public/components/search-bar/query-language/wql.tsx
+++ b/plugins/main/public/components/search-bar/query-language/wql.tsx
@@ -1094,10 +1094,15 @@ export const WQL = {
                   : item.label;
             } else {
               // add a whitespace for conjunction <whitespace><conjunction>
+              // add a whitespace for grouping operator <whitespace>)
               !/\s$/.test(input) &&
                 (item.type.iconType ===
                   suggestionMappingLanguageTokenType.conjunction.iconType ||
-                  lastToken?.type === 'conjunction') &&
+                  lastToken?.type === 'conjunction' ||
+                  (item.type.iconType ===
+                    suggestionMappingLanguageTokenType.operator_group
+                      .iconType &&
+                    item.label === ')')) &&
                 tokens.push({
                   type: 'whitespace',
                   value: ' ',