Fixes handling of Custom IOA Rule Group Versioning

[hur]

Fixes handling of Custom IOA Rule Group Versioning

• Enhancement
• Major feature update
• Bug fixes
• Breaking change
• Updated unit tests
• Documentation

Bandit analysis

(caracara-py3.11) redacted@redacted caracara-fork % bandit -r caracara
[main]	INFO	profile include tests: None
[main]	INFO	profile exclude tests: None
[main]	INFO	cli include tests: None
[main]	INFO	cli exclude tests: None
[main]	INFO	running on Python 3.11.9
[manager]	WARNING	Test in comment: The is not a test name or id, ignoring
[manager]	WARNING	Test in comment: password is not a test name or id, ignoring
[manager]	WARNING	Test in comment: infected is not a test name or id, ignoring
[manager]	WARNING	Test in comment: is is not a test name or id, ignoring
[manager]	WARNING	Test in comment: generic is not a test name or id, ignoring
[manager]	WARNING	Test in comment: and is not a test name or id, ignoring
[manager]	WARNING	Test in comment: always is not a test name or id, ignoring
[manager]	WARNING	Test in comment: the is not a test name or id, ignoring
[manager]	WARNING	Test in comment: same is not a test name or id, ignoring
Run started:2024-10-18 10:21:19.988242

Test results:
	No issues identified.

Code scanned:
	Total lines of code: 5522
	Total lines skipped (#nosec): 1

Run metrics:
	Total issues (by severity):
		Undefined: 0
		Low: 0
		Medium: 0
		High: 0
	Total issues (by confidence):
		Undefined: 0
		Low: 0
		Medium: 0
		High: 0

(caracara-py3.11) redacted@redacted tests % bandit -r . --skip=B101
[main]	INFO	Found project level .bandit file: ./.bandit
[utils]	WARNING	Unable to parse config file ./.bandit or missing [bandit] section
[main]	INFO	profile include tests: None
[main]	INFO	profile exclude tests: None
[main]	INFO	cli include tests: None
[main]	INFO	cli exclude tests: B101
[main]	INFO	running on Python 3.11.9
Run started:2024-10-18 10:20:41.486862

Test results:
	No issues identified.

Code scanned:
	Total lines of code: 1446
	Total lines skipped (#nosec): 0

Run metrics:
	Total issues (by severity):
		Undefined: 0
		Low: 0
		Medium: 0
		High: 0
	Total issues (by confidence):
		Undefined: 0
		Low: 0
		Medium: 0
		High: 0
Files skipped (0):

Added features and functionality

Fixed Issue #212.

Issues resolved

• Fixes [ BUG ] 409 Rule group version mismatch error when updating rule group #212. This is achieved by keeping track of rule group versioning changes by rule CRUD operations

Other

• Updated the relevant unit test
• The function _create_update_delete_rules was changed to _update_create_delete_rules after adjusting the order of operations within the function.

[hur]

Adding some details/context on the implemented changes:

Updating a rule group, or a rule within a rule group, requires rulegroup_version to be passed along in the API request. This needs to match the current version of the rule group in Falcon, otherwise a 409 rule group mismatch seems to be returned. I suspect this is required to prevent conflicts from concurrent rule group updates.

When doing update operations on a rule group or its rules, the API returns the rule group with the updated version. However, when creating or deleting rules, the API also increments the rule group version, but as the rule group isn't returned to us, we can't leverage the API response to track the new rule group version, and need to track that locally.

I also changed the ordering of the create, update, and delete operations in _create_update_delete_rules to handle updates first. This feels like the right order to do things.

create->update->read can lead to create operations succeeding but the rest failing due to a concurrent update.
update->create->read will not have such issues with concurrent updated - if the update fails, creation and deletion do not occur, and the request should be safe to try again.

[hur]

I think the linting issues should be fixed @ChristopherHammond13, but seems like the CI workflows need your approval to re-run.

[ChristopherHammond13]

Thank you so much for your fix here, @hur! I'm happy to get this merged. We'll get this fix into 0.9.1.