[Security Solution] Adds diff algorithm and unit tests for scalar array values

x-pack/plugins/security_solution/common/api/detection_engine/prebuilt_rules/model/diff/three_way_diff/three_way_diff_outcome.ts

@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { isEqual } from 'lodash';
+import { isEqual, sortBy } from 'lodash';
 import { MissingVersion } from './three_way_diff';
 
 /**
@@ -38,7 +38,55 @@ export const determineDiffOutcome = <TValue>(
   const baseEqlTarget = isEqual(baseVersion, targetVersion);
   const currentEqlTarget = isEqual(currentVersion, targetVersion);
 
-  if (baseVersion === MissingVersion) {
+  return getThreeWayDiffOutcome({
+    baseEqlCurrent,
+    baseEqlTarget,
+    currentEqlTarget,
+    hasBaseVersion: baseVersion !== MissingVersion,
+  });
+};
+
+/**
+ * Determines diff outcomes of array fields that do not care about order (e.g. `[1, 2 , 3] === [3, 2, 1]`)
+ */
+export const determineOrderAgnosticDiffOutcome = <TValue>(
+  baseVersion: TValue[] | MissingVersion,
+  currentVersion: TValue[],
+  targetVersion: TValue[]
+): ThreeWayDiffOutcome => {
+  let baseEqlCurrent: boolean;
+  let baseEqlTarget: boolean;
+  if (baseVersion !== MissingVersion) {
+    baseEqlCurrent = isEqual(sortBy(baseVersion), sortBy(currentVersion));
+    baseEqlTarget = isEqual(sortBy(baseVersion), sortBy(targetVersion));
+  } else {
+    baseEqlCurrent = false;
+    baseEqlTarget = false;
+  }
+  const currentEqlTarget = isEqual(sortBy(currentVersion), sortBy(targetVersion));
+
+  return getThreeWayDiffOutcome({
+    baseEqlCurrent,
+    baseEqlTarget,
+    currentEqlTarget,
+    hasBaseVersion: baseVersion !== MissingVersion,
+  });
+};
+
+interface DetermineDiffOutcomeProps {
+  baseEqlCurrent: boolean;
+  baseEqlTarget: boolean;
+  currentEqlTarget: boolean;
+  hasBaseVersion: boolean;
+}
+
+const getThreeWayDiffOutcome = ({
+  baseEqlCurrent,
+  baseEqlTarget,
+  currentEqlTarget,
+  hasBaseVersion,
+}: DetermineDiffOutcomeProps): ThreeWayDiffOutcome => {
+  if (!hasBaseVersion) {
     /**
      * We couldn't find the base version of the rule in the package so further
      * version comparison is not possible. We assume that the rule is not

x-pack/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/logic/diff/calculation/algorithms/index.ts

@@ -7,4 +7,5 @@
 
 export { numberDiffAlgorithm } from './number_diff_algorithm';
 export { singleLineStringDiffAlgorithm } from './single_line_string_diff_algorithm';
+export { scalarArrayDiffAlgorithm } from './scalar_array_diff_algorithm';
 export { simpleDiffAlgorithm } from './simple_diff_algorithm';

x-pack/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/logic/diff/calculation/algorithms/number_diff_algorithm.test.ts

@@ -14,7 +14,7 @@ import {
 import { numberDiffAlgorithm } from './number_diff_algorithm';
 
 describe('numberDiffAlgorithm', () => {
-  it('returns current_version as merged output if there is no update', () => {
+  it('returns current_version as merged output if there is no update - scenario AAA', () => {
     const mockVersions: ThreeVersionsOf<number> = {
       base_version: 1,
       current_version: 1,
@@ -33,7 +33,7 @@ describe('numberDiffAlgorithm', () => {
     );
   });
 
-  it('returns current_version as merged output if current_version is different and there is no update', () => {
+  it('returns current_version as merged output if current_version is different and there is no update - scenario ABA', () => {
     const mockVersions: ThreeVersionsOf<number> = {
       base_version: 1,
       current_version: 2,
@@ -52,7 +52,7 @@ describe('numberDiffAlgorithm', () => {
     );
   });
 
-  it('returns target_version as merged output if current_version is the same and there is an update', () => {
+  it('returns target_version as merged output if current_version is the same and there is an update - scenario AAB', () => {
     const mockVersions: ThreeVersionsOf<number> = {
       base_version: 1,
       current_version: 1,
@@ -71,7 +71,7 @@ describe('numberDiffAlgorithm', () => {
     );
   });
 
-  it('returns current_version as merged output if current version is different but it matches the update', () => {
+  it('returns current_version as merged output if current version is different but it matches the update - scenario ABB', () => {
     const mockVersions: ThreeVersionsOf<number> = {
       base_version: 1,
       current_version: 2,
@@ -90,7 +90,7 @@ describe('numberDiffAlgorithm', () => {
     );
   });
 
-  it('returns current_version as merged output if all three versions are different', () => {
+  it('returns current_version as merged output if all three versions are different - scenario ABC', () => {
     const mockVersions: ThreeVersionsOf<number> = {
       base_version: 1,
       current_version: 2,
@@ -110,7 +110,7 @@ describe('numberDiffAlgorithm', () => {
   });
 
   describe('if base_version is missing', () => {
-    it('returns current_version as merged output if current_version and target_version are the same', () => {
+    it('returns current_version as merged output if current_version and target_version are the same - scenario -AA', () => {
       const mockVersions: ThreeVersionsOf<number> = {
         base_version: MissingVersion,
         current_version: 1,
@@ -129,7 +129,7 @@ describe('numberDiffAlgorithm', () => {
       );
     });
 
-    it('returns target_version as merged output if current_version and target_version are different', () => {
+    it('returns target_version as merged output if current_version and target_version are different - scenario -AB', () => {
       const mockVersions: ThreeVersionsOf<number> = {
         base_version: MissingVersion,
         current_version: 1,

x-pack/plugins/security_solution/server/lib/detection_engine/prebuilt_rules/logic/diff/calculation/algorithms/scalar_array_diff_algorithm.test.ts

@@ -0,0 +1,152 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { ThreeVersionsOf } from '../../../../../../../../common/api/detection_engine';
+import {
+  ThreeWayDiffOutcome,
+  ThreeWayMergeOutcome,
+  MissingVersion,
+} from '../../../../../../../../common/api/detection_engine';
+import { scalarArrayDiffAlgorithm } from './scalar_array_diff_algorithm';
+
+describe('scalarArrayDiffAlgorithm', () => {
+  it('returns current_version as merged output if there is no update - scenario AAA', () => {
+    const mockVersions: ThreeVersionsOf<string[]> = {
+      base_version: ['A', 'B'],
+      current_version: ['B', 'A'],
+      target_version: ['A', 'B'],
+    };
+
+    const result = scalarArrayDiffAlgorithm(mockVersions);
+
+    expect(result).toEqual(
+      expect.objectContaining({
+        merged_version: mockVersions.current_version,
+        diff_outcome: ThreeWayDiffOutcome.StockValueNoUpdate,
+        merge_outcome: ThreeWayMergeOutcome.Current,
+        has_conflict: false,
+      })
+    );
+  });
+
+  it('returns current_version as merged output if current_version is different and there is no update - scenario ABA', () => {
+    const mockVersions: ThreeVersionsOf<string[]> = {
+      base_version: ['A'],
+      current_version: ['B'],
+      target_version: ['A'],
+    };
+
+    const result = scalarArrayDiffAlgorithm(mockVersions);
+
+    expect(result).toEqual(
+      expect.objectContaining({
+        merged_version: mockVersions.current_version,
+        diff_outcome: ThreeWayDiffOutcome.CustomizedValueNoUpdate,
+        merge_outcome: ThreeWayMergeOutcome.Current,
+        has_conflict: false,
+      })
+    );
+  });
+
+  it('returns target_version as merged output if current_version is the same and there is an update - scenario AAB', () => {
+    const mockVersions: ThreeVersionsOf<string[]> = {
+      base_version: ['A'],
+      current_version: ['A'],
+      target_version: ['B'],
+    };
+
+    const result = scalarArrayDiffAlgorithm(mockVersions);
+
+    expect(result).toEqual(
+      expect.objectContaining({
+        merged_version: mockVersions.target_version,
+        diff_outcome: ThreeWayDiffOutcome.StockValueCanUpdate,
+        merge_outcome: ThreeWayMergeOutcome.Target,
+        has_conflict: false,
+      })
+    );
+  });
+
+  it('returns current_version as merged output if current version is different but it matches the update - scenario ABB', () => {
+    const mockVersions: ThreeVersionsOf<string[]> = {
+      base_version: ['A'],
+      current_version: ['B'],
+      target_version: ['B'],
+    };
+
+    const result = scalarArrayDiffAlgorithm(mockVersions);
+
+    expect(result).toEqual(
+      expect.objectContaining({
+        merged_version: mockVersions.current_version,
+        diff_outcome: ThreeWayDiffOutcome.CustomizedValueSameUpdate,
+        merge_outcome: ThreeWayMergeOutcome.Current,
+        has_conflict: false,
+      })
+    );
+  });
+
+  it('returns custom merged version as merged output if all three versions are different - scenario ABC', () => {
+    const mockVersions: ThreeVersionsOf<string[]> = {
+      base_version: ['A'],
+      current_version: ['B', 'C'],
+      target_version: ['C', 'D'],
+    };
+    const expectedMergedVersion = ['B', 'C', 'D'];
+
+    const result = scalarArrayDiffAlgorithm(mockVersions);
+
+    expect(result).toEqual(
+      expect.objectContaining({
+        merged_version: expectedMergedVersion,
+        diff_outcome: ThreeWayDiffOutcome.CustomizedValueCanUpdate,
+        merge_outcome: ThreeWayMergeOutcome.Merged,
+        has_conflict: false,
+      })
+    );
+  });
+
+  describe('if base_version is missing', () => {
+    it('returns current_version as merged output if current_version and target_version are the same - scenario -AA', () => {
+      const mockVersions: ThreeVersionsOf<string[]> = {
+        base_version: MissingVersion,
+        current_version: ['A'],
+        target_version: ['A'],
+      };
+
+      const result = scalarArrayDiffAlgorithm(mockVersions);
+
+      expect(result).toEqual(
+        expect.objectContaining({
+          merged_version: mockVersions.current_version,
+          diff_outcome: ThreeWayDiffOutcome.StockValueNoUpdate,
+          merge_outcome: ThreeWayMergeOutcome.Current,
+          has_conflict: false,
+        })
+      );
+    });
+
+    it('returns target_version as merged output if current_version and target_version are different - scenario -AB', () => {
+      const mockVersions: ThreeVersionsOf<string[]> = {
+        base_version: MissingVersion,
+        current_version: ['A'],
+        target_version: ['B'],
+      };
+
+      const result = scalarArrayDiffAlgorithm(mockVersions);
+
+      expect(result).toEqual(
+        expect.objectContaining({
+          merged_version: mockVersions.target_version,
+          diff_outcome: ThreeWayDiffOutcome.StockValueCanUpdate,
+          merge_outcome: ThreeWayMergeOutcome.Target,
+          has_conflict: false,
+        })
+      );
+    });
+  });
+});