From beb3db9842af8a251ef4493511751b47b977a613 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Alex=20S=C3=A1nchez?= Date: Tue, 1 Sep 2026 22:39:17 -0600 Subject: [PATCH] fix[backend](correlation_rules): fixed correlation rules disappearing after update --- .../eventprocessing/usecase/correlation_rule.go | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/backend/modules/eventprocessing/usecase/correlation_rule.go b/backend/modules/eventprocessing/usecase/correlation_rule.go index 9787a9705..bfd5e6605 100644 --- a/backend/modules/eventprocessing/usecase/correlation_rule.go +++ b/backend/modules/eventprocessing/usecase/correlation_rule.go @@ -133,9 +133,16 @@ func (u *correlationRuleUsecase) Update(ctx context.Context, req dto.UpdateCorre if req.RelPath == "" { return domain.ErrIDRequired } - if err := u.writable(ctx, req.RelPath); err != nil { + sr, err := u.readable(ctx, req.RelPath) + if err != nil { return err } + if sr.System { + return domain.ErrCorrelationRuleSystemOwner + } + if tenant := authz.TenantIDFromContext(ctx); tenant != "" && sr.TenantId != tenant { + return domain.ErrCorrelationRuleNotFound + } if len(req.DataTypes) == 0 { return domain.ErrDataTypesRequired } @@ -149,12 +156,12 @@ func (u *correlationRuleUsecase) Update(ctx context.Context, req dto.UpdateCorre req.RuleAvailability, req.RuleCategory, req.RuleTechnique, req.RuleDescription, req.RuleReferencesDef, req.RuleDefinitionDef, correlate, req.RuleGroupByDef, req.DeduplicateByDef, req.DataTypes) + rule.TenantId = sr.TenantId if _, err := u.store.Update(req.RelPath, rule); err != nil { return err } - // Reconcile the active state (the store keeps it in the filename). - _, err := u.store.SetEnabled(authz.TenantIDFromContext(ctx), req.RelPath, req.RuleActive) + _, err = u.store.SetEnabled(sr.TenantId, req.RelPath, req.RuleActive) return err }