[Cases] [Observability] Disable add-to-case functionality when all selected alerts are already attached (#231877)

## Summary

Resolves #227036.

For o11y alerting, we want to make it so that if a user selects a set of
cases, and the full set of selected alerts is already on the case, the
add to case button will be disabled on the add-to-existing-case modal.

~This functionality is transparent to other consumers of this feature~
This functionality is driven by the `getAttachments` function
implemented by the caller of the _Add to existing case_ modal. The
expectation is that `getAttachments` will provide a list of all the
selected attachments.

This code then queries all of the existing user comments of type `alert`
attached to the cases appearing in the modal. The code diffs the
selected alerts against the existing attachments. If all the selected
alerts intersect with the existing case attachments, that case's button
will be disabled and include copy and an icon to indicate that it
already contains the selected alerts.

**Caveat:** This feature as it is written only works for cases with 100
or fewer attached alerts. In the case where a case has > 100 alerts
attached to it, the functionality will work as it does today and the
user can click the Add button. The code already filters any existing
cases further down the procedure, and I am assuming most cases have
fewer than 100 alerts attached in today's common usage, so this tradeoff
seemed preferable to adding the complexity and querying load of
pagination logic.

<img width="1165" height="391" alt="image"
src="https://github.com/user-attachments/assets/bf0b5daa-4b3c-452b-889b-ccd4a2f9906d"
/>

---------

Co-authored-by: kibanamachine <[email protected]>

Author: justinkambic

x-pack/platform/plugins/shared/cases/common/constants/index.ts

@@ -96,6 +96,8 @@ export const INTERNAL_CASE_FIND_USER_ACTIONS_URL =
   `${CASES_INTERNAL_URL}/{case_id}/user_actions/_find` as const;
 export const INTERNAL_CASE_SUMMARY_URL = `${CASES_INTERNAL_URL}/{case_id}/summary` as const;
 export const INTERNAL_INFERENCE_CONNECTORS_URL = '/internal/inference/connectors' as const;
+export const INTERNAL_CASE_GET_CASES_BY_ATTACHMENT_URL =
+  `${CASES_INTERNAL_URL}/case/alerts/_find_containing_all` as const;
 
 /**
  * Action routes

x-pack/platform/plugins/shared/cases/common/types/api/case/v1.ts

@@ -532,6 +532,23 @@ export const GetRelatedCasesByAlertResponseRt = rt.array(RelatedCaseRt);
 
 export const SimilarCasesSearchRequestRt = paginationSchema({ maxPerPage: MAX_CASES_PER_PAGE });
 
+export const FindCasesContainingAllAlertsRequestRt = rt.exact(
+  rt.type({
+    /**
+     * The IDs of the alerts to find cases for.
+     */
+    alertIds: rt.array(rt.string),
+    // The IDs of the cases to find alerts for.
+    caseIds: rt.array(rt.string),
+  })
+);
+
+export const FindCasesContainingAllAlertsResponseRt = rt.exact(
+  rt.type({
+    casesWithAllAttachments: rt.array(rt.string),
+  })
+);
+
 export type CasePostRequest = rt.TypeOf<typeof CasePostRequestRt>;
 export type CaseResolveResponse = rt.TypeOf<typeof CaseResolveResponseRt>;
 export type CasesDeleteRequest = rt.TypeOf<typeof CasesDeleteRequestRt>;
@@ -557,3 +574,9 @@ export type BulkCreateCasesRequest = rt.TypeOf<typeof BulkCreateCasesRequestRt>;
 export type BulkCreateCasesResponse = rt.TypeOf<typeof BulkCreateCasesResponseRt>;
 export type SimilarCasesSearchRequest = rt.TypeOf<typeof SimilarCasesSearchRequestRt>;
 export type CasesSimilarResponse = rt.TypeOf<typeof CasesSimilarResponseRt>;
+export type FindCasesContainingAllAlertsRequest = rt.TypeOf<
+  typeof FindCasesContainingAllAlertsRequestRt
+>;
+export type FindCasesContainingAllAlertsResponse = rt.TypeOf<
+  typeof FindCasesContainingAllAlertsResponseRt
+>;

x-pack/platform/plugins/shared/cases/public/client/ui/get_all_cases_selector_modal.tsx

@@ -59,12 +59,14 @@ export const getAllCasesSelectorModalNoProviderLazy = ({
   hiddenStatuses,
   onRowClick,
   onClose,
+  getAttachments,
 }: AllCasesSelectorModalProps) => (
   <Suspense fallback={<EuiLoadingSpinner />}>
     <AllCasesSelectorModalLazy
       hiddenStatuses={hiddenStatuses}
       onRowClick={onRowClick}
       onClose={onClose}
+      getAttachments={getAttachments}
     />
   </Suspense>
 );

x-pack/platform/plugins/shared/cases/public/components/all_cases/all_cases_list.tsx

@@ -33,6 +33,8 @@ import { useAvailableCasesOwners } from '../app/use_available_owners';
 import { useCasesColumnsSelection } from './use_cases_columns_selection';
 import { DEFAULT_CASES_TABLE_STATE } from '../../containers/constants';
 import { CasesTableUtilityBar } from './utility_bar';
+import { useCheckAlertAttachments } from '../../containers/use_check_alert_attachments';
+import { type GetAttachments } from './selector_modal/use_cases_add_to_existing_case_modal';
 
 const getSortField = (field: string): SortFieldCase =>
   // @ts-ignore
@@ -42,10 +44,11 @@ export interface AllCasesListProps {
   hiddenStatuses?: CaseStatuses[];
   isSelectorView?: boolean;
   onRowClick?: (theCase?: CaseUI, isCreateCase?: boolean) => void;
+  getAttachments?: GetAttachments;
 }
 
 export const AllCasesList = React.memo<AllCasesListProps>(
-  ({ hiddenStatuses = [], isSelectorView = false, onRowClick }) => {
+  ({ hiddenStatuses = [], isSelectorView = false, onRowClick, getAttachments }) => {
     const { owner, permissions } = useCasesContext();
 
     const availableSolutions = useAvailableCasesOwners(getAllPermissionsExceptFrom('delete'));
@@ -64,6 +67,11 @@ export const AllCasesList = React.memo<AllCasesListProps>(
       queryParams,
     });
 
+    const { disabledCases, isLoading: isLoadingCaseAttachments } = useCheckAlertAttachments({
+      cases: data.cases,
+      getAttachments,
+    });
+
     const assigneesFromCases = useMemo(() => {
       return data.cases.reduce<Set<string>>((acc, caseInfo) => {
         if (!caseInfo) {
@@ -141,6 +149,7 @@ export const AllCasesList = React.memo<AllCasesListProps>(
       onRowClick,
       disableActions: selectedCases.length > 0,
       selectedColumns,
+      disabledCases,
     });
 
     const pagination = useMemo(
@@ -233,7 +242,7 @@ export const AllCasesList = React.memo<AllCasesListProps>(
           data={data}
           goToCreateCase={onRowClick ? onCreateCasePressed : undefined}
           isCasesLoading={isLoadingCases}
-          isLoadingColumns={isLoadingColumns}
+          isLoadingColumns={isLoadingColumns || isLoadingCaseAttachments}
           isCommentUpdating={isLoadingCases}
           isDataEmpty={isDataEmpty}
           isSelectorView={isSelectorView}

x-pack/platform/plugins/shared/cases/public/components/all_cases/selector_modal/all_cases_selector_modal.tsx

@@ -21,16 +21,18 @@ import type { CaseStatuses } from '../../../../common/types/domain';
 import type { CaseUI } from '../../../../common/ui/types';
 import * as i18n from '../../../common/translations';
 import { AllCasesList } from '../all_cases_list';
+import { type GetAttachments } from './use_cases_add_to_existing_case_modal';
 
 export interface AllCasesSelectorModalProps {
   hiddenStatuses?: CaseStatuses[];
   onRowClick?: (theCase?: CaseUI) => void;
   onClose?: (theCase?: CaseUI, isCreateCase?: boolean) => void;
   onCreateCaseClicked?: () => void;
+  getAttachments?: GetAttachments;
 }
 
 export const AllCasesSelectorModal = React.memo<AllCasesSelectorModalProps>(
-  ({ hiddenStatuses, onRowClick, onClose }) => {
+  ({ hiddenStatuses, onRowClick, onClose, getAttachments }) => {
     const [isModalOpen, setIsModalOpen] = useState<boolean>(true);
     const { euiTheme } = useEuiTheme();
     const closeModal = useCallback(() => {
@@ -70,6 +72,7 @@ export const AllCasesSelectorModal = React.memo<AllCasesSelectorModalProps>(
               hiddenStatuses={hiddenStatuses}
               isSelectorView={true}
               onRowClick={onClick}
+              getAttachments={getAttachments}
             />
           </EuiModalBody>
           <EuiModalFooter>

x-pack/platform/plugins/shared/cases/public/components/all_cases/selector_modal/use_cases_add_to_existing_case_modal.tsx

@@ -31,6 +31,8 @@ export type AddToExistingCaseModalProps = Omit<AllCasesSelectorModalProps, 'onRo
   onSuccess?: (theCase: CaseUI) => void;
 };
 
+export type GetAttachments = ({ theCase }: { theCase?: CaseUI }) => CaseAttachmentsWithoutOwner;
+
 export const useCasesAddToExistingCaseModal = ({
   successToaster,
   noAttachmentsToaster,
@@ -135,13 +137,14 @@ export const useCasesAddToExistingCaseModal = ({
     ({
       getAttachments,
     }: {
-      getAttachments?: ({ theCase }: { theCase?: CaseUI }) => CaseAttachmentsWithoutOwner;
+      getAttachments?: GetAttachments;
     } = {}) => {
       dispatch({
         type: CasesContextStoreActionsList.OPEN_ADD_TO_CASE_MODAL,
         payload: {
           hiddenStatuses: [CaseStatuses.closed],
           onCreateCaseClicked,
+          getAttachments,
           onRowClick: (theCase?: CaseUI) => {
             handleOnRowClick(theCase, getAttachments);
           },

x-pack/platform/plugins/shared/cases/public/components/all_cases/translations.ts

@@ -96,6 +96,12 @@ export const SELECT = i18n.translate('xpack.cases.caseTable.select', {
   defaultMessage: 'Select',
 });
 
+export const ALREADY_ATTACHED = i18n.translate('xpack.cases.caseTable.alreadyAttached', {
+  defaultMessage: 'Added',
+  description:
+    'In this context, "Added" is letting the user know that all of their selected alerts were previously added to the case in question, and the "Add to case" button is disabled',
+});
+
 export const REQUIRES_UPDATE = i18n.translate('xpack.cases.caseTable.requiresUpdate', {
   defaultMessage: ' requires update',
 });

x-pack/platform/plugins/shared/cases/public/components/all_cases/use_cases_columns.tsx

@@ -66,6 +66,7 @@ export interface GetCasesColumn {
   connectors?: ActionConnector[];
   onRowClick?: (theCase: CaseUI) => void;
   disableActions?: boolean;
+  disabledCases?: Set<string>;
 }
 
 export interface UseCasesColumnsReturnValue {
@@ -81,6 +82,7 @@ export const useCasesColumns = ({
   onRowClick,
   disableActions = false,
   selectedColumns,
+  disabledCases,
 }: GetCasesColumn): UseCasesColumnsReturnValue => {
   const casesColumnsConfig = useCasesColumnsConfiguration(isSelectorView);
   const { actions } = useActions({ disableActions });
@@ -311,15 +313,16 @@ export const useCasesColumns = ({
         align: RIGHT_ALIGNMENT,
         render: (theCase: CaseUI) => {
           if (theCase.id != null) {
+            const disabled = disabledCases?.has(theCase.id) ?? false;
             return (
               <EuiButton
                 data-test-subj={`cases-table-row-select-${theCase.id}`}
-                onClick={() => {
-                  assignCaseAction(theCase);
-                }}
+                onClick={() => assignCaseAction(theCase)}
                 size="s"
+                iconType={disabled ? 'check' : undefined}
+                disabled={disabled}
               >
-                {i18n.SELECT}
+                {disabled ? i18n.ALREADY_ATTACHED : i18n.SELECT}
               </EuiButton>
             );
           }
@@ -328,7 +331,7 @@ export const useCasesColumns = ({
         width: '120px',
       },
     }),
-    [assignCaseAction, casesColumnsConfig, connectors, isSelectorView, userProfiles]
+    [assignCaseAction, casesColumnsConfig, connectors, isSelectorView, userProfiles, disabledCases]
   );
 
   // we need to extend the columnsDict with the columns of

x-pack/platform/plugins/shared/cases/public/containers/api.ts

@@ -27,6 +27,7 @@ import type {
   UserActionInternalFindResponse,
   CaseSummaryResponse,
   InferenceConnectorsResponse,
+  FindCasesContainingAllAlertsResponse,
 } from '../../common/types/api';
 import type {
   CaseConnectors,
@@ -72,6 +73,7 @@ import {
   INTERNAL_BULK_CREATE_ATTACHMENTS_URL,
   INTERNAL_GET_CASE_CATEGORIES_URL,
   CASES_INTERNAL_URL,
+  INTERNAL_CASE_GET_CASES_BY_ATTACHMENT_URL,
 } from '../../common/constants';
 import { getAllConnectorTypesUrl } from '../../common/utils/connectors_api';
 
@@ -111,6 +113,7 @@ import {
   constructCustomFieldsFilter,
   decodeCaseSummaryResponse,
   decodeInferenceConnectorsResponse,
+  decodeFindAllAttachedAlertsResponse,
 } from './utils';
 import { decodeCasesFindResponse, decodeCasesSimilarResponse } from '../api/decoders';
 
@@ -221,6 +224,20 @@ export const getInferenceConnectors = async (
   return decodeInferenceConnectorsResponse(response);
 };
 
+export const findCasesByAttachmentId = async (alertIds: string[], caseIds: string[]) => {
+  const response = await KibanaServices.get().http.fetch<FindCasesContainingAllAlertsResponse>(
+    `${INTERNAL_CASE_GET_CASES_BY_ATTACHMENT_URL}`,
+    {
+      method: 'POST',
+      body: JSON.stringify({
+        alertIds,
+        caseIds,
+      }),
+    }
+  );
+  return decodeFindAllAttachedAlertsResponse(response);
+};
+
 export const findCaseUserActions = async (
   caseId: string,
   params: {

x-pack/platform/plugins/shared/cases/public/containers/use_check_alert_attachments.ts

@@ -0,0 +1,47 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { useMemo } from 'react';
+import type { CaseUI } from './types';
+import { type GetAttachments } from '../components/all_cases/selector_modal/use_cases_add_to_existing_case_modal';
+import { useFindCasesContainingAllSelectedAlerts } from './use_find_cases_containing_all_selected_alerts';
+
+export interface UseCheckAlertAttachmentsProps {
+  cases: Pick<CaseUI, 'id'>[];
+  getAttachments?: GetAttachments;
+}
+
+function hasAlertId<T>(arg: T): arg is T & { alertId: string[] | string } {
+  const candidate = arg as unknown;
+  return (
+    typeof candidate === 'object' &&
+    candidate !== null &&
+    'alertId' in candidate &&
+    (Array.isArray(candidate.alertId) || typeof candidate.alertId === 'string')
+  );
+}
+
+export const useCheckAlertAttachments = ({
+  cases,
+  getAttachments,
+}: UseCheckAlertAttachmentsProps): { disabledCases: Set<string>; isLoading: boolean } => {
+  const selectedAlerts = (getAttachments?.({ theCase: undefined }) ?? [])
+    .filter(hasAlertId)
+    .map(({ alertId }) => alertId)
+    .flatMap((arrayOrString) => arrayOrString);
+
+  const { data, isFetching } = useFindCasesContainingAllSelectedAlerts(
+    selectedAlerts,
+    cases.map(({ id }) => id)
+  );
+
+  const disabledCases = useMemo(() => new Set(data?.casesWithAllAttachments ?? []), [data]);
+
+  return { disabledCases, isLoading: isFetching };
+};
+
+export type UseCheckAlertAttachments = ReturnType<typeof useCheckAlertAttachments>;