[backend] added DeleteOperation module

opencti-platform/opencti-front/lang/back/de.json

@@ -626,5 +626,9 @@
   "X_Aliases": "X_Aliases",
   "Samples": "Stichproben",
   "Contains observable": "Enthält beobachtbar",
-  "Artifact content": "Artefaktinhalt"
+  "Artifact content": "Artefaktinhalt",
+  "Deleted entity type": "Gelöschter Entitätstyp",
+  "Deleted entity id": "Gelöschte Entitäts-ID",
+  "Deleted entity name": "Gelöschter Entitätsname",
+  "Deleted elements": "Gelöschte Elemente"
 }

opencti-platform/opencti-front/lang/back/en.json

@@ -626,5 +626,9 @@
   "X_Aliases": "X_Aliases",
   "Samples": "Samples",
   "Contains observable": "Contains observable",
-  "Artifact content": "Artifact content"
+  "Artifact content": "Artifact content",
+  "Deleted entity type": "Deleted entity type",
+  "Deleted entity id": "Deleted entity id",
+  "Deleted entity name": "Deleted entity name",
+  "Deleted elements": "Deleted elements"
 }

opencti-platform/opencti-front/lang/back/es.json

@@ -626,5 +626,9 @@
   "X_Aliases": "X_Aliases",
   "Samples": "Muestras",
   "Contains observable": "Contiene observable",
-  "Artifact content": "Contenido del artefacto"
+  "Artifact content": "Contenido del artefacto",
+  "Deleted entity type": "Tipo de entidad eliminada",
+  "Deleted entity id": "Id de entidad eliminada",
+  "Deleted entity name": "Nombre de la entidad eliminada",
+  "Deleted elements": "Elementos eliminados"
 }

opencti-platform/opencti-front/lang/back/fr.json

@@ -626,5 +626,9 @@
   "X_Aliases": "X_Aliases",
   "Samples": "Échantillons",
   "Contains observable": "Contient des observables",
-  "Artifact content": "Contenu de l'artefact"
+  "Artifact content": "Contenu de l'artefact",
+  "Deleted entity type": "Type de l'entité supprimée",
+  "Deleted entity id": "Id de l'entité supprimée",
+  "Deleted entity name": "Nom de l'entité supprimée",
+  "Deleted elements": "Éléments supprimés"
 }

opencti-platform/opencti-front/lang/back/ja.json

@@ -626,5 +626,9 @@
   "X_Aliases": "X_エイリアス",
   "Samples": "サンプル",
   "Contains observable": "観測値を含む",
-  "Artifact content": "人工物の内容"
+  "Artifact content": "人工物の内容",
+  "Deleted entity type": "削除されたエンティティタイプ",
+  "Deleted entity id": "削除されたエンティティID",
+  "Deleted entity name": "削除されたエンティティ名",
+  "Deleted elements": "削除された要素"
 }

opencti-platform/opencti-front/lang/back/zh.json

@@ -626,5 +626,9 @@
   "X_Aliases": "X_别名",
   "Samples": "样本",
   "Contains observable": "包含观测值",
-  "Artifact content": "工件内容"
-}
+  "Artifact content": "工件内容",
+  "Deleted entity type": "删除的实体类型",
+  "Deleted entity id": "删除的实体 ID",
+  "Deleted entity name": "删除的实体名称",
+  "Deleted elements": "删除的元素"
+}

opencti-platform/opencti-front/src/schema/relay.schema.graphql

@@ -7406,6 +7406,8 @@ type Query {
   publicBookmarks(uriKey: String!, widgetId: String!): StixDomainObjectConnection
   publicStixCoreObjects(uriKey: String!, widgetId: String!, startDate: DateTime, endDate: DateTime): StixCoreObjectConnection
   publicStixRelationships(uriKey: String!, widgetId: String!, startDate: DateTime, endDate: DateTime): StixRelationshipConnection
+  deleteOperation(id: String!): DeleteOperation
+  deleteOperations(first: Int, after: ID, orderBy: DeleteOperationOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): DeleteOperationConnection
 }
 
 type Subscription {
@@ -8173,6 +8175,8 @@ type Mutation {
   aiChangeTone(id: ID!, content: String!, format: Format, tone: Tone): String
   aiSummarize(id: ID!, content: String!, format: Format): String
   aiExplain(id: ID!, content: String!): String
+  deleteOperationRestore(id: ID!): ID
+  deleteOperationConfirm(id: ID!): ID
 }
 
 type Channel implements BasicObject & StixObject & StixCoreObject & StixDomainObject {
@@ -11266,4 +11270,36 @@ enum IndicatorFormat {
 type AIBus {
   bus_id: String!
   content: String!
+}
+
+type DeletedElement {
+  id: String!
+  source_index: String!
+}
+
+type DeleteOperation implements InternalObject & BasicObject {
+  id: ID!
+  entity_type: String!
+  standard_id: String!
+  parent_types: [String!]!
+  timestamp: DateTime!
+  user_id: String!
+  main_entity_type: String!
+  main_entity_id: String!
+  main_entity_name: String!
+  deleted_elements: [DeletedElement!]!
+}
+
+enum DeleteOperationOrdering {
+  timestamp
+}
+
+type DeleteOperationConnection {
+  pageInfo: PageInfo!
+  edges: [DeleteOperationEdge!]!
+}
+
+type DeleteOperationEdge {
+  cursor: String!
+  node: DeleteOperation!
 }

opencti-platform/opencti-graphql/graphql-codegen.yml

@@ -49,6 +49,7 @@ generates:
         CsvMapper: ../modules/internal/csvMapper/csvMapper-types#BasicStoreEntityCsvMapper
         Playbook: ../modules/playbook/playbook-types#BasicStoreEntityPlaybook
         PublicDashboard: ../modules/publicDashboard/publicDashboard-types#BasicStoreEntityPublicDashboard
+        DeleteOperation: ../modules/deleteOperation/deleteOperation-types#BasicStoreEntityDeleteOperation
   ./graphql.schema.json:
     plugins:
       - "introspection"

opencti-platform/opencti-graphql/src/modules/deleteOperation/deleteOperation-converter.ts

@@ -0,0 +1,23 @@
+import { buildStixObject, cleanObject } from '../../database/stix-converter';
+import { STIX_EXT_OCTI } from '../../types/stix-extensions';
+import type { StixDeleteOperation, StoreEntityDeleteOperation } from './deleteOperation-types';
+
+const convertDeleteOperationToStix = (instance: StoreEntityDeleteOperation): StixDeleteOperation => {
+  const stixObject = buildStixObject(instance);
+  return {
+    ...stixObject,
+    timestamp: instance.timestamp,
+    user_id: instance.user_id,
+    main_entity_type: instance.main_entity_type,
+    main_entity_id: instance.main_entity_id,
+    main_entity_name: instance.main_entity_name,
+    extensions: {
+      [STIX_EXT_OCTI]: cleanObject({
+        ...stixObject.extensions[STIX_EXT_OCTI],
+        extension_type: 'new-sdo',
+      })
+    }
+  };
+};
+
+export default convertDeleteOperationToStix;

opencti-platform/opencti-graphql/src/modules/deleteOperation/deleteOperation-domain.ts

@@ -0,0 +1,27 @@
+import type { AuthContext, AuthUser } from '../../types/user';
+import { listEntitiesPaginated, storeLoadById } from '../../database/middleware-loader';
+import type { QueryDeleteOperationsArgs } from '../../generated/graphql';
+import { type BasicStoreEntityDeleteOperation, ENTITY_TYPE_DELETE_OPERATION } from './deleteOperation-types';
+
+export interface DeletedElement {
+  id: string
+  source_index: string
+}
+
+export const findById = (context: AuthContext, user: AuthUser, id: string) => {
+  return storeLoadById<BasicStoreEntityDeleteOperation>(context, user, id, ENTITY_TYPE_DELETE_OPERATION);
+};
+
+export const findAll = (context: AuthContext, user: AuthUser, args: QueryDeleteOperationsArgs) => {
+  return listEntitiesPaginated<BasicStoreEntityDeleteOperation>(context, user, [ENTITY_TYPE_DELETE_OPERATION], args);
+};
+
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+export const restoreDelete = (context: AuthContext, user: AuthUser, id: string) => {
+  throw new Error('Restore delete not implemented');
+};
+
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+export const completeDelete = (context: AuthContext, user: AuthUser, id: string) => {
+  throw new Error('Complete delete not implemented');
+};

opencti-platform/opencti-graphql/src/modules/deleteOperation/deleteOperation-graphql.ts

@@ -0,0 +1,8 @@
+import { registerGraphqlSchema } from '../../graphql/schema';
+import deleteOperationTypeDefs from './deleteOperation.graphql';
+import deleteOperationResolvers from './deleteOperation-resolvers';
+
+registerGraphqlSchema({
+  schema: deleteOperationTypeDefs,
+  resolver: deleteOperationResolvers,
+});

opencti-platform/opencti-graphql/src/modules/deleteOperation/deleteOperation-resolvers.ts

@@ -0,0 +1,19 @@
+import type { Resolvers } from '../../generated/graphql';
+import { completeDelete, findAll, findById, restoreDelete } from './deleteOperation-domain';
+
+const deleteOperationResolvers: Resolvers = {
+  Query: {
+    deleteOperation: (_, { id }, context) => findById(context, context.user, id),
+    deleteOperations: (_, args, context) => findAll(context, context.user, args),
+  },
+  Mutation: {
+    deleteOperationRestore: (_, { id }, context) => {
+      return restoreDelete(context, context.user, id);
+    },
+    deleteOperationConfirm: (_, { id }, context) => {
+      return completeDelete(context, context.user, id);
+    },
+  }
+};
+
+export default deleteOperationResolvers;

opencti-platform/opencti-graphql/src/modules/deleteOperation/deleteOperation-types.ts

@@ -0,0 +1,29 @@
+import type { StixObject, StixOpenctiExtensionSDO } from '../../types/stix-common';
+import { STIX_EXT_OCTI } from '../../types/stix-extensions';
+import type { BasicStoreEntity, StoreEntity } from '../../types/store';
+import type { DeletedElement } from './deleteOperation-domain';
+
+export const ENTITY_TYPE_DELETE_OPERATION = 'DeleteOperation';
+
+export interface BasicStoreEntityDeleteOperation extends BasicStoreEntity {
+  timestamp: Date
+  user_id: string
+  main_entity_type: string
+  main_entity_id: string
+  main_entity_name: string
+  deleted_elements: Array<DeletedElement>
+}
+
+export interface StoreEntityDeleteOperation extends BasicStoreEntityDeleteOperation, StoreEntity {
+}
+
+export interface StixDeleteOperation extends StixObject {
+  timestamp: Date
+  user_id: string
+  main_entity_type: string
+  main_entity_id: string
+  main_entity_name: string
+  extensions: {
+    [STIX_EXT_OCTI]: StixOpenctiExtensionSDO
+  }
+}

opencti-platform/opencti-graphql/src/modules/deleteOperation/deleteOperation.graphql

@@ -0,0 +1,55 @@
+# Type
+type DeletedElement
+{
+    id: String!
+    source_index: String!
+}
+
+type DeleteOperation implements InternalObject & BasicObject {
+    id: ID!
+    entity_type: String!
+    standard_id: String!
+    parent_types: [String!]!
+    # DeleteOperation
+    timestamp: DateTime!
+    user_id: String!
+    main_entity_type: String!
+    main_entity_id: String!
+    main_entity_name: String!
+    deleted_elements: [DeletedElement!]!
+}
+
+# Ordering
+enum DeleteOperationOrdering {
+    timestamp
+}
+
+# Relay connections
+type DeleteOperationConnection {
+    pageInfo: PageInfo!
+    edges: [DeleteOperationEdge!]!
+}
+
+type DeleteOperationEdge {
+    cursor: String!
+    node: DeleteOperation!
+}
+
+# Queries
+type Query {
+    deleteOperation(id: String!): DeleteOperation
+    deleteOperations(
+        first: Int
+        after: ID
+        orderBy: DeleteOperationOrdering
+        orderMode: OrderingMode
+        filters: FilterGroup
+        search: String
+    ): DeleteOperationConnection
+}
+
+# Mutations
+type Mutation {
+    deleteOperationRestore(id: ID!): ID @auth(for: [KNOWLEDGE_KNUPDATE_KNDELETE])
+    deleteOperationConfirm(id: ID!): ID @auth(for: [KNOWLEDGE_KNUPDATE_KNDELETE])
+}

opencti-platform/opencti-graphql/src/modules/deleteOperation/deleteOperation.ts

@@ -0,0 +1,34 @@
+import { v4 as uuidv4 } from 'uuid';
+import { ABSTRACT_INTERNAL_OBJECT } from '../../schema/general';
+import { type ModuleDefinition, registerDefinition } from '../../schema/module';
+import { ENTITY_TYPE_DELETE_OPERATION, type StixDeleteOperation, type StoreEntityDeleteOperation } from './deleteOperation-types';
+import convertDeleteOperationToStix from './deleteOperation-converter';
+
+const DELETE_OPERATION_DEFINITION: ModuleDefinition<StoreEntityDeleteOperation, StixDeleteOperation> = {
+  type: {
+    id: 'deleteOperation',
+    name: ENTITY_TYPE_DELETE_OPERATION,
+    category: ABSTRACT_INTERNAL_OBJECT,
+    aliased: false
+  },
+  identifier: {
+    definition: {
+      [ENTITY_TYPE_DELETE_OPERATION]: () => uuidv4()
+    },
+  },
+  attributes: [
+    { name: 'timestamp', label: 'Timestamp', type: 'date', mandatoryType: 'internal', editDefault: false, multiple: false, upsert: false, isFilterable: true },
+    { name: 'user_id', label: 'User_id', type: 'string', format: 'short', mandatoryType: 'internal', editDefault: false, multiple: false, upsert: false, isFilterable: true },
+    { name: 'main_entity_type', label: 'Deleted entity type', type: 'string', format: 'short', mandatoryType: 'internal', editDefault: false, multiple: false, upsert: false, isFilterable: true },
+    { name: 'main_entity_id', label: 'Deleted entity id', type: 'string', format: 'short', mandatoryType: 'internal', editDefault: false, multiple: false, upsert: false, isFilterable: true },
+    { name: 'main_entity_name', label: 'Deleted entity name', type: 'string', format: 'short', mandatoryType: 'internal', editDefault: false, multiple: false, upsert: false, isFilterable: true },
+    { name: 'deleted_elements', label: 'Deleted elements', type: 'object', format: 'flat', mandatoryType: 'no', editDefault: false, multiple: true, upsert: false, isFilterable: false },
+  ],
+  relations: [],
+  representative: (stix: StixDeleteOperation) => {
+    return stix.main_entity_name;
+  },
+  converter: convertDeleteOperationToStix
+};
+
+registerDefinition(DELETE_OPERATION_DEFINITION);

opencti-platform/opencti-graphql/src/modules/index.ts

@@ -59,6 +59,7 @@ import './organization/organization';
 import './internal/csvMapper/csvMapper';
 import './internal/document/document';
 import './publicDashboard/publicDashboard';
+import './deleteOperation/deleteOperation';
 // endregion
 
 // region graphql registration
@@ -96,5 +97,6 @@ import './organization/organization-graphql';
 import './internal/csvMapper/csvMapper-graphql';
 import './publicDashboard/publicDashboard-graphql';
 import './ai/ai-graphql';
+import './deleteOperation/deleteOperation-graphql';
 // import './internal/document/document-graphql'; # Not needed as document is not fully registered
 // endregion