[backend] Fix import + decay rule add & edit

opencti-platform/opencti-front/src/schema/relay.schema.graphql

@@ -7272,6 +7272,8 @@ type Query {
   indicatorsTimeSeries(objectId: String, field: String!, operation: StatsOperation!, startDate: DateTime!, endDate: DateTime!, interval: String!, filters: FilterGroup): [TimeSeries]
   indicatorsNumber(pattern_type: String, objectId: String, endDate: DateTime): Number
   indicatorsDistribution(objectId: String, field: String!, operation: StatsOperation!, limit: Int, order: String, startDate: DateTime, endDate: DateTime, dateAttribute: String): [Distribution]
+  decayRule(id: String!): DecayRule
+  decayRules(first: Int, after: ID, orderBy: DecayRuleOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String): DecayRuleConnection
   organization(id: String!): Organization
   organizations(first: Int, after: ID, orderBy: OrganizationsOrdering, orderMode: OrderingMode, filters: FilterGroup, search: String, toStix: Boolean): OrganizationConnection
   csvMapper(id: String!): CsvMapper
@@ -8007,6 +8009,9 @@ type Mutation {
   indicatorContextClean(id: ID!): Indicator
   indicatorRelationAdd(id: ID!, input: StixRefRelationshipAddInput!): StixRefRelationship
   indicatorRelationDelete(id: ID!, toId: StixRef!, relationship_type: String!): Indicator
+  decayRuleAdd(input: DecayRuleAddInput!): DecayRule
+  decayRuleDelete(id: ID!): ID
+  decayRuleFieldPatch(id: ID!, input: [EditInput!]!): DecayRule
   organizationAdd(input: OrganizationAddInput!): Organization
   organizationDelete(id: ID!): ID
   organizationFieldPatch(id: ID!, input: [EditInput]!, commitMessage: String, references: [String]): Organization
@@ -10623,6 +10628,53 @@ input IndicatorAddInput {
   basedOn: [String!]
 }
 
+type DecayRule implements InternalObject & BasicObject {
+  id: ID!
+  standard_id: String!
+  entity_type: String!
+  parent_types: [String]!
+  created_at: DateTime!
+  updated_at: DateTime!
+  name: String!
+  description: String
+  order: Int!
+  active: Boolean!
+  activated_at: DateTime
+  built_in: Boolean
+  decay_lifetime: Int!
+  decay_pound: Float!
+  decay_points: [Int!]
+  decay_revoke_score: Int!
+  decay_observable_types: [String!]
+}
+
+enum DecayRuleOrdering {
+  name
+  order
+}
+
+type DecayRuleConnection {
+  pageInfo: PageInfo!
+  edges: [DecayRuleEdge!]!
+}
+
+type DecayRuleEdge {
+  cursor: String!
+  node: DecayRule!
+}
+
+input DecayRuleAddInput {
+  name: name_String_NotNull_minLength_2!
+  description: String
+  order: Int!
+  active: Boolean!
+  decay_lifetime: Int!
+  decay_pound: Float!
+  decay_points: [Int!]
+  decay_revoke_score: Int!
+  decay_observable_types: [String!]
+}
+
 type Organization implements BasicObject & StixObject & StixCoreObject & StixDomainObject & Identity {
   id: ID!
   standard_id: String!

opencti-platform/opencti-graphql/src/modules/decayRule/decayRule-domain.ts

@@ -3,6 +3,7 @@ import { listEntitiesPaginated, storeLoadById } from '../../database/middleware-
 import type { EditInput, QueryDecayRulesArgs, DecayRuleAddInput } from '../../generated/graphql';
 import { type BasicStoreEntityDecayRule, ENTITY_TYPE_DECAY_RULE, type StoreEntityDecayRule } from './decayRule-types';
 import { createInternalObject, deleteInternalObject, editInternalObject } from '../../domain/internalObject';
+import { now } from '../../utils/format';
 
 export const findById = (context: AuthContext, user: AuthUser, id: string) => {
   return storeLoadById<BasicStoreEntityDecayRule>(context, user, id, ENTITY_TYPE_DECAY_RULE);
@@ -13,11 +14,25 @@ export const findAll = (context: AuthContext, user: AuthUser, args: QueryDecayRu
 };
 
 export const addDecayRule = async (context: AuthContext, user: AuthUser, input: DecayRuleAddInput) => {
-  return createInternalObject<StoreEntityDecayRule>(context, user, input, ENTITY_TYPE_DECAY_RULE);
+  const defaultOps = {
+    created_at: now(),
+    updated_at: now(),
+    activated_at: input.active ? now() : undefined,
+    active: input.active || false,
+  };
+  const decayRuleInput = { ...input, ...defaultOps };
+  return createInternalObject<StoreEntityDecayRule>(context, user, decayRuleInput, ENTITY_TYPE_DECAY_RULE);
 };
 
 export const fieldPatchDecayRule = async (context: AuthContext, user: AuthUser, id: string, input: EditInput[]) => {
-  return editInternalObject<StoreEntityDecayRule>(context, user, id, ENTITY_TYPE_DECAY_RULE, input);
+  const finalInput = [...input];
+  // if activate decay rule, we save new date in activated_at
+  const activeInput = input.find((item) => item.key === 'active');
+  const activatedAtInput = input.find((item) => item.key === 'activated_at');
+  if (activeInput && activeInput.value?.length > 0 && activeInput.value[0] === true && !activatedAtInput) {
+    finalInput.push({ key: 'activated_at', value: [now()] });
+  }
+  return editInternalObject<StoreEntityDecayRule>(context, user, id, ENTITY_TYPE_DECAY_RULE, finalInput);
 };
 
 export const deleteDecayRule = async (context: AuthContext, user: AuthUser, id: string) => {

opencti-platform/opencti-graphql/src/modules/decayRule/decayRule-resolver.ts

@@ -6,6 +6,7 @@ const decayRuleResolvers: Resolvers = {
     decayRule: (_, { id }, context) => findById(context, context.user, id),
     decayRules: (_, args, context) => findAll(context, context.user, args),
   },
+  // TODO add appliedIndicatorsCount
   Mutation: {
     decayRuleAdd: (_, { input }, context) => {
       return addDecayRule(context, context.user, input);

opencti-platform/opencti-graphql/src/modules/index.ts

@@ -88,7 +88,7 @@ import './playbook/playbook-graphql';
 import './ingestion/ingestion-rss-graphql';
 import './ingestion/ingestion-taxii-graphql';
 import './indicator/indicator-graphql';
-import './decayRule/decayRule.graphql';
+import './decayRule/decayRule-graphql';
 import './organization/organization-graphql';
 import './internal/csvMapper/csvMapper-graphql';
 // import './internal/document/document-graphql'; # Not needed as document is not fully registered