From eb3462fa4b57f7b3a06be7d4583ea1f81a8a4e96 Mon Sep 17 00:00:00 2001
From: Jeremy Cloarec <159018898+JeremyCloarec@users.noreply.github.com>
Date: Thu, 28 Nov 2024 15:57:01 +0100
Subject: [PATCH] [backend] no longer send x_opencti_files with resolved
 markings to elastic (#9149)

---
 .../opencti-graphql/src/database/middleware.js     |  2 +-
 .../opencti-graphql/src/domain/stixCoreObject.js   | 14 ++++++++++++--
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/opencti-platform/opencti-graphql/src/database/middleware.js b/opencti-platform/opencti-graphql/src/database/middleware.js
index 46af66c23f96..69ac80a9237e 100644
--- a/opencti-platform/opencti-graphql/src/database/middleware.js
+++ b/opencti-platform/opencti-graphql/src/database/middleware.js
@@ -390,7 +390,7 @@ export const loadElementsWithDependencies = async (context, user, elements, opts
         }
       });
     }
-    const deps = depsElementsMap.get(element.id);
+    const deps = depsElementsMap.get(element.id) ?? {};
     if (isNotEmptyField(files)) {
       deps.x_opencti_files = files;
     }
diff --git a/opencti-platform/opencti-graphql/src/domain/stixCoreObject.js b/opencti-platform/opencti-graphql/src/domain/stixCoreObject.js
index a4a1da36dc36..92d10afcd861 100644
--- a/opencti-platform/opencti-graphql/src/domain/stixCoreObject.js
+++ b/opencti-platform/opencti-graphql/src/domain/stixCoreObject.js
@@ -663,12 +663,17 @@ export const stixCoreObjectImportPush = async (context, user, id, file, args = {
     // Patch the updated_at to force live stream evolution
     const eventFile = storeFileConverter(user, up);
     const files = [...(previous.x_opencti_files ?? []).filter((f) => f.id !== up.id), eventFile];
+    const nonResolvedFiles = files.map((f) => {
+      // eslint-disable-next-line @typescript-eslint/no-unused-vars
+      const { [INPUT_MARKINGS]: markingInput, ...nonResolvedFile } = f;
+      return nonResolvedFile;
+    });
     await elUpdateElement(context, user, {
       _index: previous._index,
       internal_id: internalId,
       entity_type: previous.entity_type, // required for schema validation
       updated_at: now(),
-      x_opencti_files: files
+      x_opencti_files: nonResolvedFiles
     });
     // Stream event generation
     const fileMarkings = R.uniq(R.flatten(files.map((f) => f.file_markings)));
@@ -753,11 +758,16 @@ export const stixCoreObjectImportDelete = async (context, user, fileId) => {
     await deleteFile(context, user, fileId);
     // Patch the updated_at to force live stream evolution
     const files = (previous.x_opencti_files ?? []).filter((f) => f.id !== fileId);
+    const nonResolvedFiles = files.map((f) => {
+      // eslint-disable-next-line @typescript-eslint/no-unused-vars
+      const { [INPUT_MARKINGS]: markingInput, ...nonResolvedFile } = f;
+      return nonResolvedFile;
+    });
     await elUpdateElement(context, user, {
       _index: previous._index,
       internal_id: entityId,
       updated_at: now(),
-      x_opencti_files: files,
+      x_opencti_files: nonResolvedFiles,
       entity_type: previous.entity_type, // required for schema validation
     });
     // Stream event generation