From de1064e10363203fbf58ff9c479d40c0cb5b2c23 Mon Sep 17 00:00:00 2001
From: Georgii Gorbachev <georgii.gorbachev@elastic.co>
Date: Mon, 23 Dec 2024 16:27:46 +0100
Subject: [PATCH] [Security Solution] Fix prebuilt rules bootstrap endpoint
 (#205060)

**Fixes: https://github.com/elastic/kibana/issues/203471**

## Summary

The `xpack.securitySolution.prebuiltRulesPackageVersion` config setting
now only affects the version of the prebuilt rules package. The
bootstrap endpoint always installs the latest version of the `endpoint`
package.

```yaml
xpack.securitySolution.prebuiltRulesPackageVersion: 8.16.2-beta.1
```

<img width="2557" alt="Screenshot_2024-12-20_at_20_58_53"
src="https://github.com/user-attachments/assets/a2a1eaad-e842-47d3-9b94-692aabfb97cc"
/>


### Checklist

- [ ] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
---
 .../install_prebuilt_rules_package.ts         | 37 ++++++++++---------
 1 file changed, 19 insertions(+), 18 deletions(-)

diff --git a/x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/api/install_prebuilt_rules_and_timelines/install_prebuilt_rules_package.ts b/x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/api/install_prebuilt_rules_and_timelines/install_prebuilt_rules_package.ts
index 23bcc654eb780..768a0deeeaa2b 100644
--- a/x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/api/install_prebuilt_rules_and_timelines/install_prebuilt_rules_package.ts
+++ b/x-pack/solutions/security/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/api/install_prebuilt_rules_and_timelines/install_prebuilt_rules_package.ts
@@ -22,7 +22,12 @@ export async function installPrebuiltRulesPackage(
   config: ConfigType,
   context: SecuritySolutionApiRequestHandlerContext
 ) {
-  const pkgVersion = await findLatestPackageVersion(config, context, PREBUILT_RULES_PACKAGE_NAME);
+  let pkgVersion = config.prebuiltRulesPackageVersion;
+
+  if (!pkgVersion) {
+    // Find latest package if the version isn't specified in the config
+    pkgVersion = await findLatestPackageVersion(context, PREBUILT_RULES_PACKAGE_NAME);
+  }
 
   return context
     .getInternalFleetServices()
@@ -33,7 +38,7 @@ export async function installEndpointPackage(
   config: ConfigType,
   context: SecuritySolutionApiRequestHandlerContext
 ) {
-  const pkgVersion = await findLatestPackageVersion(config, context, ENDPOINT_PACKAGE_NAME);
+  const pkgVersion = await findLatestPackageVersion(context, ENDPOINT_PACKAGE_NAME);
 
   return context.getInternalFleetServices().packages.ensureInstalledPackage({
     pkgName: ENDPOINT_PACKAGE_NAME,
@@ -42,25 +47,21 @@ export async function installEndpointPackage(
 }
 
 async function findLatestPackageVersion(
-  config: ConfigType,
   context: SecuritySolutionApiRequestHandlerContext,
   packageName: string
 ) {
-  let pkgVersion = config.prebuiltRulesPackageVersion;
+  const securityAppClient = context.getAppClient();
+  const packageClient = context.getInternalFleetServices().packages;
 
-  // Find latest package if the version isn't specified in the config
-  if (!pkgVersion) {
-    const securityAppClient = context.getAppClient();
-    // Use prerelease versions in dev environment
-    const isPrerelease =
-      securityAppClient.getBuildFlavor() === 'traditional' &&
-      (securityAppClient.getKibanaVersion().includes('-SNAPSHOT') ||
-        securityAppClient.getKibanaBranch() === 'main');
+  // Use prerelease versions in dev environment
+  const isPrerelease =
+    securityAppClient.getBuildFlavor() === 'traditional' &&
+    (securityAppClient.getKibanaVersion().includes('-SNAPSHOT') ||
+      securityAppClient.getKibanaBranch() === 'main');
 
-    const result = await context
-      .getInternalFleetServices()
-      .packages.fetchFindLatestPackage(packageName, { prerelease: isPrerelease });
-    pkgVersion = result.version;
-  }
-  return pkgVersion;
+  const result = await packageClient.fetchFindLatestPackage(packageName, {
+    prerelease: isPrerelease,
+  });
+
+  return result.version;
 }