Fix #245936 — shared exception list not refreshed after clearing search input (#270632)

## Summary

Fixes: #245936

Shared exception lists were not refreshed after the user cleared a
search term by backspacing, because `EuiSearchBar` with `incremental:
false` only fires `onChange` on Enter or the built-in clear button — not
on raw backspace keystrokes. This left `handleRefresh` using a stale
`filters.name` value, so clicking Refresh returned filtered results
instead of the full list.

**Root cause**: `EuiSearchBar` with `incremental: false` does not fire
`onChange` on every keystroke. Raw backspace input is invisible to React
state, so `filters.name` could hold a stale search term even after the
input appeared empty.

**Fix**: Added an `onInputChange` prop to `ListsSearchBar` using a
native `onInput` handler on a wrapper `<div>` to capture raw DOM
keystrokes. In `SharedLists`, a `useRef` (`rawSearchInputRef`) tracks
the current raw input value without causing re-renders. `handleRefresh`
now checks: if the raw input is empty but `filters` still has a name, it
calls `setFilters(undefined)` to clear the stale filter and trigger a
clean re-fetch.

**Why this approach**: `onInput` fires on every keystroke (including
backspace), unlike `onChange` which only fires on Enter/clear in
non-incremental mode. Using a `ref` avoids unnecessary re-renders on
every keystroke while still providing `handleRefresh` with an up-to-date
snapshot of the input value.

## Steps to reproduce (before fix)

1. Navigate to Security → Manage → Shared Exception Lists
2. Type a search term in the search bar and press Enter — the list
filters
3. Clear the search term by pressing Backspace (without pressing Enter)
4. Click the Refresh button
5. **Expected**: Full list is shown
6. **Actual**: Filtered results remain (stale filter applied)

## Test plan

- [ ] Bug no longer reproduces: follow the steps above and verify the
full list appears after clearing and refreshing
- [ ] `node scripts/jest
x-pack/solutions/security/plugins/security_solution/public/exceptions/components/list_search_bar/index.test.tsx
--no-coverage` passes
- [ ] `node scripts/jest
x-pack/solutions/security/plugins/security_solution/public/exceptions/pages/shared_lists/shared_lists.test.tsx
--no-coverage` passes
- [ ] No new browser console errors or network failures

## Related

Fixes #245936

🤖 Generated with [Claude Code](https://claude.ai/claude-code)

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>

Author: 3 people

x-pack/solutions/security/plugins/security_solution/public/exceptions/components/list_search_bar/index.test.tsx

@@ -0,0 +1,58 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import React from 'react';
+import { render, fireEvent } from '@testing-library/react';
+import { TestProviders } from '../../../common/mock';
+import { ListsSearchBar } from '.';
+
+describe('ListsSearchBar', () => {
+  it('calls onInputChange with the typed value when user types in the search input', () => {
+    const onInputChange = jest.fn();
+
+    const { getByTestId } = render(
+      <TestProviders>
+        <ListsSearchBar onSearch={jest.fn()} onInputChange={onInputChange} />
+      </TestProviders>
+    );
+
+    const input = getByTestId('exceptionsHeaderSearchInput');
+    fireEvent.input(input, { target: { value: 'foo' } });
+
+    expect(onInputChange).toHaveBeenCalledWith('foo');
+  });
+
+  it('calls onInputChange with empty string when user clears the input', () => {
+    const onInputChange = jest.fn();
+
+    const { getByTestId } = render(
+      <TestProviders>
+        <ListsSearchBar onSearch={jest.fn()} onInputChange={onInputChange} />
+      </TestProviders>
+    );
+
+    const input = getByTestId('exceptionsHeaderSearchInput');
+    fireEvent.input(input, { target: { value: 'foo' } });
+    fireEvent.input(input, { target: { value: '' } });
+
+    expect(onInputChange).toHaveBeenCalledTimes(2);
+    expect(onInputChange).toHaveBeenLastCalledWith('');
+  });
+
+  it('does not throw when onInputChange is not provided', () => {
+    const { getByTestId } = render(
+      <TestProviders>
+        <ListsSearchBar onSearch={jest.fn()} />
+      </TestProviders>
+    );
+
+    const input = getByTestId('exceptionsHeaderSearchInput');
+    expect(() => {
+      fireEvent.input(input, { target: { value: 'foo' } });
+    }).not.toThrow();
+  });
+});

x-pack/solutions/security/plugins/security_solution/public/exceptions/components/list_search_bar/index.tsx

@@ -13,6 +13,7 @@ import * as i18n from '../../translations';
 
 interface ExceptionListsTableSearchProps {
   onSearch: (args: Parameters<NonNullable<EuiSearchBarProps['onChange']>>[0]) => void;
+  onInputChange?: (value: string) => void;
 }
 
 // TODO replace this component with the @Kbn/securitysolution-exception-list-components
@@ -37,20 +38,24 @@ export const EXCEPTIONS_SEARCH_SCHEMA = {
   },
 };
 
-export const ListsSearchBar = React.memo<ExceptionListsTableSearchProps>(({ onSearch }) => {
-  return (
-    <EuiSearchBar
-      data-test-subj="exceptionsHeaderSearch"
-      aria-label={i18n.EXCEPTIONS_LISTS_SEARCH_PLACEHOLDER}
-      onChange={onSearch}
-      box={{
-        [`data-test-subj`]: 'exceptionsHeaderSearchInput',
-        placeholder: i18n.EXCEPTION_LIST_SEARCH_PLACEHOLDER,
-        incremental: false,
-        schema: EXCEPTIONS_SEARCH_SCHEMA,
-      }}
-    />
-  );
-});
+export const ListsSearchBar = React.memo<ExceptionListsTableSearchProps>(
+  ({ onSearch, onInputChange }) => {
+    return (
+      <div onInput={(e) => onInputChange?.((e.target as HTMLInputElement).value)}>
+        <EuiSearchBar
+          data-test-subj="exceptionsHeaderSearch"
+          aria-label={i18n.EXCEPTIONS_LISTS_SEARCH_PLACEHOLDER}
+          onChange={onSearch}
+          box={{
+            [`data-test-subj`]: 'exceptionsHeaderSearchInput',
+            placeholder: i18n.EXCEPTION_LIST_SEARCH_PLACEHOLDER,
+            incremental: false,
+            schema: EXCEPTIONS_SEARCH_SCHEMA,
+          }}
+        />
+      </div>
+    );
+  }
+);
 
 ListsSearchBar.displayName = 'ListsSearchBar';

x-pack/solutions/security/plugins/security_solution/public/exceptions/pages/shared_lists/index.tsx

@@ -116,6 +116,7 @@ export const SharedLists = React.memo(() => {
     exceptionReferenceModalInitialState
   );
   const [filters, setFilters] = useState<ExceptionListFilter | undefined>();
+  const rawSearchInputRef = useRef('');
 
   const [viewerStatus, setViewStatus] = useState<ViewerStatus | null>(ViewerStatus.LOADING);
 
@@ -268,12 +269,20 @@ export const SharedLists = React.memo(() => {
     [exportExceptionList, handleExportError, handleExportSuccess]
   );
 
+  const handleInputChange = useCallback((value: string): void => {
+    rawSearchInputRef.current = value;
+  }, []);
+
   const handleRefresh = useCallback((): void => {
     if (refreshExceptions != null) {
       setLastUpdated(Date.now());
-      refreshExceptions();
+      if (!rawSearchInputRef.current && filters) {
+        setFilters(undefined);
+      } else {
+        refreshExceptions();
+      }
     }
-  }, [refreshExceptions]);
+  }, [refreshExceptions, filters]);
 
   useEffect(() => {
     if (initLoading && !loading && !loadingExceptions && !loadingTableInfo) {
@@ -630,7 +639,9 @@ export const SharedLists = React.memo(() => {
             <EndpointExceptionsMovedCallout id="sharedListsPage" dismissable title="moved" />
           )}
 
-        {!initLoading && <ListsSearchBar onSearch={handleSearch} />}
+        {!initLoading && (
+          <ListsSearchBar onSearch={handleSearch} onInputChange={handleInputChange} />
+        )}
         <EuiSpacer size="m" />
         {viewerStatus != null ? (
           <EmptyViewerState

x-pack/solutions/security/plugins/security_solution/public/exceptions/pages/shared_lists/shared_lists.test.tsx

@@ -455,6 +455,34 @@ describe('SharedLists', () => {
     });
   });
 
+  it('calls refreshExceptions via Refresh button when no stale filter is present', async () => {
+    const mockRefreshExceptions = jest.fn();
+
+    (useExceptionLists as jest.Mock).mockReturnValue([
+      false,
+      [exceptionList1, exceptionList2],
+      { page: 1, perPage: 20, total: 2 },
+      jest.fn(),
+      mockRefreshExceptions,
+      { field: 'created_at', order: 'desc' },
+      jest.fn(),
+    ]);
+
+    const { getByTestId } = render(
+      <TestProviders>
+        <SharedLists />
+      </TestProviders>
+    );
+
+    await waitFor(() => {
+      expect(getByTestId('refreshRulesAction-linkIcon')).toBeInTheDocument();
+    });
+
+    fireEvent.click(getByTestId('refreshRulesAction-linkIcon'));
+
+    expect(mockRefreshExceptions).toHaveBeenCalledTimes(1);
+  });
+
   it('returns focus to the create button when the create shared list flyout is closed', async () => {
     (useUserPrivileges as jest.Mock).mockReturnValue({
       ...initialUserPrivilegesState(),