Create the alert action pub/sub

Author: cnasikas

x-pack/platform/plugins/shared/alerting_v2/README.md

@@ -46,4 +46,4 @@ If you want implementation detail for one subsystem, continue with:
 - API shape or saved object contracts: inspect `server/routes/` and `server/saved_objects/` together with the relevant subsystem docs
 - Workflow triggers (workflows_extensions registration + runtime emission): see the public and server READMEs
   - [`public/lib/workflow_extensions/README.md`](public/lib/workflow_extensions/README.md)
-  - [`server/lib/services/workflow_extensions_service/README.md`](server/lib/services/workflow_extensions_service/README.md)
+  - [`server/lib/services/workflow_service/README.md`](server/lib/services/workflow_service/README.md)

x-pack/platform/plugins/shared/alerting_v2/public/lib/workflow_extensions/README.md

@@ -9,7 +9,7 @@ This folder owns the **public-side (browser) registration** of `alerting_v2` wor
 - **Public setup contract** (`WorkflowsExtensionsPublicPluginSetup`) — UI metadata for the Workflows builder (title, description, icon, docs, snippets). This is what controls discoverability of a trigger in the Workflows UI.
 - **Server setup contract** (`WorkflowsExtensionsServerPluginSetup`) — runtime validation/execution of triggers and steps.
 
-This README covers the **public** side. For the server side (where runtime emission also lives), see [`server/lib/services/workflow_extensions_service/README.md`](../../../server/lib/services/workflow_extensions_service/README.md).
+This README covers the **public** side. For the server side (where runtime emission also lives), see [`server/lib/services/workflow_service/README.md`](../../../server/lib/services/workflow_service/README.md).
 
 ## Registering a new trigger
 

x-pack/platform/plugins/shared/alerting_v2/server/lib/events/alert_action_event_publisher/alert_action_event_publisher.mock.ts

@@ -7,7 +7,7 @@
 
 import type { EventBus } from '../event_bus';
 import { createEventBusMock } from '../event_bus/event_bus.mock';
-import type { AlertingDomainEvent } from '../domain_events';
+import type { AlertingDomainEvent, AlertingPublisherContext } from '../domain_events';
 import { AlertActionEventPublisher } from './alert_action_event_publisher';
 
 /**
@@ -17,9 +17,9 @@ import { AlertActionEventPublisher } from './alert_action_event_publisher';
  */
 export function createAlertActionEventPublisher(): {
   publisher: AlertActionEventPublisher;
-  eventBus: jest.Mocked<EventBus<AlertingDomainEvent>>;
+  eventBus: jest.Mocked<EventBus<AlertingDomainEvent, AlertingPublisherContext>>;
 } {
-  const eventBus = createEventBusMock<AlertingDomainEvent>();
+  const eventBus = createEventBusMock<AlertingDomainEvent, AlertingPublisherContext>();
 
   return {
     publisher: new AlertActionEventPublisher(eventBus),

x-pack/platform/plugins/shared/alerting_v2/server/lib/events/alert_action_event_publisher/alert_action_event_publisher.test.ts

@@ -5,8 +5,10 @@
  * 2.0.
  */
 
+import type { KibanaRequest } from '@kbn/core/server';
+import { httpServerMock } from '@kbn/core-http-server-mocks';
 import type { EventBus } from '../event_bus';
-import type { AlertingDomainEvent } from '../domain_events';
+import type { AlertingDomainEvent, AlertingPublisherContext } from '../domain_events';
 import { createAlertActionEventPublisher } from './alert_action_event_publisher.mock';
 import type { AlertActionEventPublisher } from './alert_action_event_publisher';
 import { EPISODE_ASSIGNED_EVENT_TYPE } from './events';
@@ -15,10 +17,12 @@ describe('AlertActionEventPublisher', () => {
   jest.useFakeTimers().setSystemTime(new Date('2026-01-01T00:00:00.000Z'));
 
   let publisher: AlertActionEventPublisher;
-  let eventBus: jest.Mocked<EventBus<AlertingDomainEvent>>;
+  let eventBus: jest.Mocked<EventBus<AlertingDomainEvent, AlertingPublisherContext>>;
+  let request: KibanaRequest;
 
   beforeEach(() => {
     ({ publisher, eventBus } = createAlertActionEventPublisher());
+    request = httpServerMock.createKibanaRequest();
   });
 
   afterEach(() => {
@@ -30,8 +34,8 @@ describe('AlertActionEventPublisher', () => {
   });
 
   describe('emitEpisodeAssigned', () => {
-    it('publishes an `episode.assigned` event with the canonical envelope and payload shape', () => {
-      publisher.emitEpisodeAssigned({
+    it('publishes an `episode.assigned` event with the canonical envelope and payload shape, alongside the publishing KibanaRequest as bus context', () => {
+      publisher.emitEpisodeAssigned(request, {
         groupHash: 'group-hash-1',
         episodeId: 'episode-1',
         ruleId: 'rule-1',
@@ -42,22 +46,28 @@ describe('AlertActionEventPublisher', () => {
       });
 
       expect(eventBus.publish).toHaveBeenCalledTimes(1);
-      expect(eventBus.publish).toHaveBeenCalledWith({
-        type: EPISODE_ASSIGNED_EVENT_TYPE,
-        occurredAt: '2025-02-02T12:34:56.000Z',
-        groupHash: 'group-hash-1',
-        episodeId: 'episode-1',
-        ruleId: 'rule-1',
-        spaceId: 'default',
-        actorUid: 'actor-uid-1',
-        payload: {
-          assigneeUid: 'user-uid-1',
+      expect(eventBus.publish).toHaveBeenCalledWith(
+        {
+          type: EPISODE_ASSIGNED_EVENT_TYPE,
+          occurredAt: '2025-02-02T12:34:56.000Z',
+          groupHash: 'group-hash-1',
+          episodeId: 'episode-1',
+          ruleId: 'rule-1',
+          spaceId: 'default',
+          actorUid: 'actor-uid-1',
+          payload: {
+            assigneeUid: 'user-uid-1',
+          },
         },
-      });
+        { request }
+      );
+      // Reference equality: the publisher must not wrap or rebuild the request.
+      expect(eventBus.publish.mock.calls[0][1]).toEqual({ request });
+      expect(eventBus.publish.mock.calls[0][1]?.request).toBe(request);
     });
 
     it('defaults `occurredAt` to the current ISO timestamp when omitted', () => {
-      publisher.emitEpisodeAssigned({
+      publisher.emitEpisodeAssigned(request, {
         groupHash: 'group-hash-1',
         episodeId: 'episode-1',
         ruleId: 'rule-1',
@@ -67,12 +77,13 @@ describe('AlertActionEventPublisher', () => {
       });
 
       expect(eventBus.publish).toHaveBeenCalledWith(
-        expect.objectContaining({ occurredAt: '2026-01-01T00:00:00.000Z' })
+        expect.objectContaining({ occurredAt: '2026-01-01T00:00:00.000Z' }),
+        { request }
       );
     });
 
     it('preserves a null assigneeUid in the payload (unassign case)', () => {
-      publisher.emitEpisodeAssigned({
+      publisher.emitEpisodeAssigned(request, {
         groupHash: 'group-hash-1',
         episodeId: 'episode-1',
         ruleId: 'rule-1',
@@ -82,12 +93,13 @@ describe('AlertActionEventPublisher', () => {
       });
 
       expect(eventBus.publish).toHaveBeenCalledWith(
-        expect.objectContaining({ payload: { assigneeUid: null } })
+        expect.objectContaining({ payload: { assigneeUid: null } }),
+        { request }
       );
     });
 
     it('preserves a null actorUid on the envelope (internal / system actor case)', () => {
-      publisher.emitEpisodeAssigned({
+      publisher.emitEpisodeAssigned(request, {
         groupHash: 'group-hash-1',
         episodeId: 'episode-1',
         ruleId: 'rule-1',
@@ -96,7 +108,35 @@ describe('AlertActionEventPublisher', () => {
         actorUid: null,
       });
 
-      expect(eventBus.publish).toHaveBeenCalledWith(expect.objectContaining({ actorUid: null }));
+      expect(eventBus.publish).toHaveBeenCalledWith(expect.objectContaining({ actorUid: null }), {
+        request,
+      });
+    });
+
+    it('uses the request supplied per emit call (publisher is request-agnostic across invocations)', () => {
+      const otherRequest = httpServerMock.createKibanaRequest();
+
+      publisher.emitEpisodeAssigned(request, {
+        groupHash: 'group-hash-1',
+        episodeId: 'episode-1',
+        ruleId: 'rule-1',
+        spaceId: 'default',
+        assigneeUid: 'user-uid-1',
+        actorUid: 'actor-uid-1',
+      });
+
+      publisher.emitEpisodeAssigned(otherRequest, {
+        groupHash: 'group-hash-2',
+        episodeId: 'episode-2',
+        ruleId: 'rule-2',
+        spaceId: 'default',
+        assigneeUid: 'user-uid-2',
+        actorUid: 'actor-uid-2',
+      });
+
+      expect(eventBus.publish).toHaveBeenCalledTimes(2);
+      expect(eventBus.publish.mock.calls[0][1]?.request).toBe(request);
+      expect(eventBus.publish.mock.calls[1][1]?.request).toBe(otherRequest);
     });
   });
 });

x-pack/platform/plugins/shared/alerting_v2/server/lib/events/alert_action_event_publisher/alert_action_event_publisher.ts

@@ -5,9 +5,14 @@
  * 2.0.
  */
 
+import type { KibanaRequest } from '@kbn/core/server';
 import { inject, injectable } from 'inversify';
 import type { EventBus } from '../event_bus';
-import { AlertingDomainEventBusToken, type AlertingDomainEvent } from '../domain_events';
+import {
+  AlertingDomainEventBusToken,
+  type AlertingDomainEvent,
+  type AlertingPublisherContext,
+} from '../domain_events';
 import {
   EPISODE_ASSIGNED_EVENT_TYPE,
   type AlertActionEventEnvelope,
@@ -46,9 +51,16 @@ export interface EmitEpisodeAssignedParams extends BaseEmitAlertActionParams {
  *
  * One method per concrete event. Additional `emit*` methods will be added
  * as the other alert-action types (ack, snooze, tag, …) start publishing.
+ *
+ * Every method takes the publishing call site's `KibanaRequest` as its
+ * first argument. The request is propagated on the bus as
+ * {@link AlertingPublisherContext} so request-scoped subscribers (e.g.
+ * the workflow subscriber, which needs a user-scoped workflows client)
+ * can operate under the same auth identity that produced the event,
+ * even though the bus dispatches asynchronously.
  */
 export interface AlertActionEventPublisherContract {
-  emitEpisodeAssigned(params: EmitEpisodeAssignedParams): void;
+  emitEpisodeAssigned(request: KibanaRequest, params: EmitEpisodeAssignedParams): void;
 }
 
 /**
@@ -62,20 +74,28 @@ export interface AlertActionEventPublisherContract {
  *     {@link AlertActionEventPublisher#buildEnvelope}, including the
  *     `occurredAt` timestamp default.
  *  2. Builds the event-specific `payload`.
- *  3. Tags the result with the event's `type` discriminator and publishes.
+ *  3. Tags the result with the event's `type` discriminator and
+ *     publishes it alongside the publishing `KibanaRequest` as the bus's
+ *     {@link AlertingPublisherContext}.
  *
  * Publishing is fire-and-forget — `publish` returns synchronously and
  * subscriber work runs on the next event-loop iteration. See
  * {@link EventBus} for the dispatch contract.
+ *
+ * The `request` passed here determines the auth identity under which
+ * downstream subscribers (notably the workflow subscriber) operate.
+ * Background-task callers that have no inbound request must synthesise
+ * a system request at their call site and pass it here. Do not pass
+ * `null`/`undefined` or attempt to forge headers in the publisher.
  */
 @injectable()
 export class AlertActionEventPublisher implements AlertActionEventPublisherContract {
   constructor(
     @inject(AlertingDomainEventBusToken)
-    private readonly eventBus: EventBus<AlertingDomainEvent>
+    private readonly eventBus: EventBus<AlertingDomainEvent, AlertingPublisherContext>
   ) {}
 
-  public emitEpisodeAssigned(params: EmitEpisodeAssignedParams): void {
+  public emitEpisodeAssigned(request: KibanaRequest, params: EmitEpisodeAssignedParams): void {
     const event: EpisodeAssignedEvent = {
       type: EPISODE_ASSIGNED_EVENT_TYPE,
       ...this.buildEnvelope(params),
@@ -84,7 +104,7 @@ export class AlertActionEventPublisher implements AlertActionEventPublisherContr
       },
     };
 
-    this.eventBus.publish(event);
+    this.eventBus.publish(event, { request });
   }
 
   private buildEnvelope(common: BaseEmitAlertActionParams): AlertActionEventEnvelope {