Repository navigation
fix(rules): keep a rule's condition and preview it before saving - #1169
Merged
Merged
Conversation
The engine stores structured conditions so the console's rule builder can reopen them for editing. - A rule takes either a structured condition or raw SQL. The engine compiles the condition to SQL and stores both. A rule saved as SQL has no condition. - POST /api/v1/rules/preview runs the same checks with the same organisation restrictions as saving, without writing anything. For a condition that saving would reject, it returns 200 with the reasons. - The condition operators are the source form's six plus lt, lte, gt, gte and in. The RuleCondition schema in openapi.json lists them with each operator's value type and the nesting limit. - GET /api/v1/hunts takes rule=<name> to list the hunts that run a rule. - source-detections.md showed a rule as a where_clause file while the API takes a full SELECT. It now documents stored rules and conditions. Every text operand goes through quote_literal. Each field is split into quoted identifier parts. A field uses the matching source-table column, or a path inside _json read as the operand's type. Compilation fails when ClickHouse is configured but cannot be read.
|
Released in v1.22.91 -- https://github.com/hyperi-io/dfe-engine/releases/tag/v1.22.91 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The engine stores builder conditions and previews saves for the console UI Kay and Kaz can build against these endpoints.
conditionor rawuser_sql, not both. The engine compiles the condition to the rule's SQL and stores both, so editing reopens the builder. A rule saved as SQL has no condition.POST /api/v1/rules/previewruns the same checks as saving, with the same organisation boundary. It writes nothing. For a condition that saving would reject, it returns 200 with reasons insql_errorsormatches_everything.lt,lte,gt,gteandin. TheRuleConditionschema inopenapi.jsonpublishes them with each operator's value kind (x-dfe-operand-kinds) and the nesting limit (x-dfe-max-nesting).GET /api/v1/hunts?rule=<name>lists the hunts that run a rule.source-detections.mdshowed a rule as awhere_clausefile while the API takes a full SELECT. It now says what is stored and documents conditions.RuleConditionis its own model with the source form's field names. SharingSourceMatchwould let a source saveltorin, which the receiver has no test for.quote_literal. Fields are split into quoted identifier parts. A field uses the matching source-table column if it exists. Otherwise, it uses a path inside_json, read as its operand's type.Done when the console can create, preview, edit and reopen a rule through these endpoints with no engine change.