[backend] added indexing of deleteOperation

opencti-platform/opencti-graphql/src/database/engine.js

@@ -53,6 +53,7 @@ import {
 import {
   ABSTRACT_BASIC_RELATIONSHIP,
   ABSTRACT_STIX_REF_RELATIONSHIP,
+  BASE_TYPE_ENTITY,
   BASE_TYPE_RELATION,
   buildRefRelationKey,
   buildRefRelationSearchKey,
@@ -64,7 +65,7 @@ import {
   INTERNAL_IDS_ALIASES,
   isAbstract,
   REL_INDEX_PREFIX,
-  RULE_PREFIX,
+  RULE_PREFIX
 } from '../schema/general';
 import { isModifiedObject, isUpdatedAtObject, } from '../schema/fieldDataAdapter';
 import { getParentTypes, keepMostRestrictiveTypes } from '../schema/schemaUtils';
@@ -86,7 +87,7 @@ import {
 import { isBasicObject, isStixCoreObject, isStixObject } from '../schema/stixCoreObject';
 import { isBasicRelationship, isStixRelationship } from '../schema/stixRelationship';
 import { isStixCoreRelationship, RELATION_INDICATES, STIX_CORE_RELATIONSHIPS } from '../schema/stixCoreRelationship';
-import { INTERNAL_FROM_FIELD, INTERNAL_TO_FIELD } from '../schema/identifier';
+import { generateInternalId, generateStandardId, INTERNAL_FROM_FIELD, INTERNAL_TO_FIELD } from '../schema/identifier';
 import { BYPASS, computeUserMemberAccessIds, executionContext, INTERNAL_USERS, isBypassUser, MEMBER_ACCESS_ALL, SYSTEM_USER } from '../utils/access';
 import { isSingleRelationsRef, } from '../schema/stixEmbeddedRelationship';
 import { now, runtimeFieldObservableValueScript } from '../utils/format';
@@ -136,6 +137,7 @@ import { INTERNAL_RELATIONSHIPS, isInternalRelationship } from '../schema/intern
 import { isStixSightingRelationship, STIX_SIGHTING_RELATIONSHIP } from '../schema/stixSightingRelationship';
 import { rule_definitions } from '../rules/rules-definition';
 import { buildElasticSortingForAttributeCriteria } from '../utils/sorting';
+import { ENTITY_TYPE_DELETE_OPERATION } from '../modules/deleteOperation/deleteOperation-types';
 
 const ELK_ENGINE = 'elk';
 const OPENSEARCH_ENGINE = 'opensearch';
@@ -3202,11 +3204,12 @@ export const elDeleteElements = async (context, user, elements) => {
   const cleanupRelations = relations.concat(basicCleanup);
   const toBeRemovedIds = elements.map((e) => e.internal_id);
   const elementsImpact = await computeDeleteElementsImpacts(cleanupRelations, toBeRemovedIds, relationsToRemoveMap);
+  const entitiesToDelete = [...elements, ...relations];
   // store deleted objects
-  if (isFeatureEnabled('LOGICAL_DELETION')) {
+  if (isFeatureEnabled('LOGICAL_DELETION') && elements.length === 1) {
     // map of index => ids to save
     const idsByIndex = new Map();
-    [...elements, ...relations].forEach((element) => {
+    entitiesToDelete.forEach((element) => {
       if (!idsByIndex.has(element._index)) {
         idsByIndex.set(element._index, []);
       }
@@ -3219,7 +3222,9 @@ export const elDeleteElements = async (context, user, elements) => {
       logApp.info('==== DEBUG ==== call reindex', { sourceIndex, ids });
       reindexPromises.push(elReindexElements(context, user, ids, sourceIndex));
     });
-    await Promise.all(reindexPromises);
+
+    const indexDeleteOperationPromise = createDeleteOpererationElement(context, user, ...elements, entitiesToDelete);
+    await Promise.all([...reindexPromises, indexDeleteOperationPromise]);
   }
   // 01. Start by clearing connections rel
   await elRemoveRelationConnection(context, user, elementsImpact);
@@ -3231,6 +3236,31 @@ export const elDeleteElements = async (context, user, elements) => {
   await elDeleteInstances(elements);
 };
 
+const createDeleteOpererationElement = async (context, user, mainElement, deletedElements) => {
+  // We currently only handle deleteOperations of 1 element
+  const deleteOperationDeletedElements = deletedElements.map((e) => ({ id: e.internal_id, source_index: e._index }));
+  const deleteOperationInput = {
+    timestamp: new Date().getTime(),
+    user_id: user.id,
+    main_entity_type: mainElement.entity_type,
+    main_entity_id: mainElement.internal_id,
+    main_entity_name: mainElement.internal_id,
+    deleted_elements: deleteOperationDeletedElements,
+  };
+  const internalID = generateInternalId();
+  const standardID = generateStandardId(ENTITY_TYPE_DELETE_OPERATION, deleteOperationInput);
+  const deleteOperationRawElement = {
+    ...deleteOperationInput,
+    _index: INDEX_INTERNAL_OBJECTS,
+    [ID_INTERNAL]: internalID,
+    [ID_STANDARD]: standardID,
+    entity_type: ENTITY_TYPE_DELETE_OPERATION,
+    base_type: BASE_TYPE_ENTITY,
+    parent_types: getParentTypes(ENTITY_TYPE_DELETE_OPERATION),
+  };
+  await elIndexElements(context, user, ENTITY_TYPE_DELETE_OPERATION, [deleteOperationRawElement]);
+};
+
 // TODO: get rid of this function and let elastic fail queries, so we can fix all of them by using the right type of data
 export const prepareElementForIndexing = (element) => {
   const thing = {};