Fixing flaky tests (#199562)

Resolves #196226
Resolves #197352
Resolves #198631
Resolves #199722
Resolves #199351
Resolves #199580

## Summary

* Fixes flaky `find` test that relied on relative dates to use a fixed
offset in the find query params. This closes multiple issues because it
is a security and spaces test that uses the same test for different
user/space scenarios
* Fixes flaky `schedule` test that was checking AAD on an
`ad_hoc_run_param` object after backfill was complete and the SO was
completed. Added artificial delay to rule execution so the backfill
doesn't run as quickly.

Co-authored-by: Elastic Machine <[email protected]>

x-pack/test/alerting_api_integration/common/plugins/alerts/server/rule_types.ts

@@ -750,6 +750,9 @@ function getPatternFiringAutoRecoverFalseRuleType() {
           } else if (scheduleByPattern === 'timeout') {
             // delay longer than the timeout
             await new Promise((r) => setTimeout(r, 12000));
+          } else if (scheduleByPattern === 'run_long') {
+            // delay so rule runs a little longer
+            await new Promise((r) => setTimeout(r, 4000));
           } else {
             services.alertFactory.create(instanceId).scheduleActions('default', scheduleByPattern);
           }

x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/backfill/find.ts

@@ -17,8 +17,7 @@ export default function findBackfillTests({ getService }: FtrProviderContext) {
   const supertest = getService('supertest');
   const supertestWithoutAuth = getService('supertestWithoutAuth');
 
-  // Failing: See https://github.com/elastic/kibana/issues/196226
-  describe.skip('find backfill', () => {
+  describe('find backfill', () => {
     let backfillIds: Array<{ id: string; spaceId: string }> = [];
     const objectRemover = new ObjectRemover(supertest);
     const start1 = moment().utc().startOf('day').subtract(14, 'days').toISOString();
@@ -279,15 +278,12 @@ export default function findBackfillTests({ getService }: FtrProviderContext) {
             .auth(apiOptions.username, apiOptions.password);
 
           // find backfill with end time that is after one backfill ends
+          const findEnd = moment(end2).utc().add(1, 'hour').toISOString();
           const findWithEndOneRuleResponse = await supertestWithoutAuth
             .post(
               `${getUrlPrefix(
                 apiOptions.spaceId
-              )}/internal/alerting/rules/backfill/_find?end=${moment()
-                .utc()
-                .startOf('day')
-                .subtract(9, 'days')
-                .toISOString()}`
+              )}/internal/alerting/rules/backfill/_find?end=${findEnd}`
             )
             .set('kbn-xsrf', 'foo')
             .auth(apiOptions.username, apiOptions.password);

x-pack/test/alerting_api_integration/security_and_spaces/group1/tests/alerting/backfill/schedule.ts

@@ -63,7 +63,7 @@ export default function scheduleBackfillTests({ getService }: FtrProviderContext
         rule_type_id: 'test.patternFiringAutoRecoverFalse',
         params: {
           pattern: {
-            instance: [true, false, true],
+            instance: ['run_long', 'run_long', 'run_long'],
           },
         },
         schedule: { interval: '12h' },
@@ -85,7 +85,7 @@ export default function scheduleBackfillTests({ getService }: FtrProviderContext
         expect(result.rule.tags).to.eql(['foo']);
         expect(result.rule.params).to.eql({
           pattern: {
-            instance: [true, false, true],
+            instance: ['run_long', 'run_long', 'run_long'],
           },
         });
         expect(result.rule.enabled).to.eql(true);
@@ -103,7 +103,7 @@ export default function scheduleBackfillTests({ getService }: FtrProviderContext
         expect(result.rule.tags).to.eql(['foo']);
         expect(result.rule.params).to.eql({
           pattern: {
-            instance: [true, false, true],
+            instance: ['run_long', 'run_long', 'run_long'],
           },
         });
         expect(result.rule.enabled).to.eql(true);