elastic · lgestc · May 19, 2026 · May 19, 2026 · May 19, 2026 · May 20, 2026
@@ -11,6 +11,11 @@ import { FieldDefinitionSchema } from '../../domain/field_definition/v1';
 
 export const FieldDefinitionsFindRequestSchema = z.object({
   owner: z.union([Owner, Owners]).optional(),
+  // This schema describes the TypeScript/client-side type (boolean).
+  // HTTP query parameters arrive as strings at the route layer; the route handler
+  // coerces "true"/"false" strings manually because the route uses escapeHatch
+  // for query validation rather than applying this Zod schema at runtime.
+  applyToAllCases: z.boolean().optional(),
 });
 
 export type FieldDefinitionsFindRequest = z.infer<typeof FieldDefinitionsFindRequestSchema>;

@@ -33,6 +33,13 @@ export const FieldDefinitionSchema = z.object({
    * Optional human-readable description of the field's purpose
    */
   description: z.string().optional(),
+
+  /**
+   * When true, this field is rendered in every case regardless of which template
+   * (if any) the case uses. Values are stored in extended_fields alongside
+   * template-specific fields.
+   */
+  applyToAllCases: z.boolean().optional(),
 });
 
 export type FieldDefinition = z.infer<typeof FieldDefinitionSchema>;

@@ -117,7 +117,8 @@ const validateField = (field: InlineField, value: string, errors: string[]): voi
 
 export const validateExtendedFields = (
   extendedFields: Record<string, string>,
-  fields: Array<RefField | InlineField>
+  fields: Array<RefField | InlineField>,
+  { partial = false }: { partial?: boolean } = {}
 ): string[] => {
   const errors: string[] = [];
   const inlineFields = fields.filter(isInlineField);
@@ -146,8 +147,10 @@ export const validateExtendedFields = (
       field.display?.show_when != null &&
       !evaluateCondition(field.display.show_when, fieldValues, fieldTypeMap);
 
-    if (!isHidden) {
-      const value = fieldValues[field.name];
+    // In partial-update mode, skip fields not present in the request — the server
+    // merges them so an absent key retains its existing stored value.
+    const value = fieldValues[field.name];
+    if (!isHidden && !(partial && value === undefined)) {
       const isArrayField =
         field.control === FieldType.CHECKBOX_GROUP || field.control === FieldType.USER_PICKER;
       const isEmpty =

@@ -5,7 +5,13 @@
  * 2.0.
  */
 
-import { getFieldCamelKey, getFieldSnakeKey } from './template_fields';
+import yaml from 'js-yaml';
+import {
+  getFieldCamelKey,
+  getFieldSnakeKey,
+  parseFieldDefinitionsToInlineFields,
+} from './template_fields';
+import type { FieldDefinition } from '../types/domain/field_definition/latest';
 
 describe('template field key utils', () => {
   describe('getFieldSnakeKey', () => {
@@ -44,4 +50,49 @@ describe('template field key utils', () => {
       );
     });
   });
+
+  describe('parseFieldDefinitionsToInlineFields', () => {
+    const makeDef = (
+      overrides: Partial<FieldDefinition> & { defYaml?: object } = {}
+    ): FieldDefinition => {
+      const { defYaml, ...rest } = overrides;
+      return {
+        fieldDefinitionId: 'fd-1',
+        name: 'my_field',
+        owner: 'securitySolution',
+        description: '',
+        applyToAllCases: true,
+        definition: yaml.dump(
+          defYaml ?? { name: 'my_field', type: 'keyword', control: 'INPUT_TEXT', label: 'My Field' }
+        ),
+        ...rest,
+      };
+    };
+
+    it('returns inline fields for valid definitions', () => {
+      const fields = parseFieldDefinitionsToInlineFields([makeDef()]);
+      expect(fields).toHaveLength(1);
+      expect(fields[0].name).toBe('my_field');
+    });
+
+    it('returns an empty array for an empty input', () => {
+      expect(parseFieldDefinitionsToInlineFields([])).toEqual([]);
+    });
+
+    it('skips definitions with malformed YAML', () => {
+      const bad = makeDef({ definition: 'not: valid: yaml: [broken' });
+      const good = makeDef({
+        name: 'ok',
+        definition: yaml.dump({ name: 'ok', type: 'keyword', control: 'INPUT_TEXT', label: 'OK' }),
+      });
+      const fields = parseFieldDefinitionsToInlineFields([bad, good]);
+      expect(fields).toHaveLength(1);
+      expect(fields[0].name).toBe('ok');
+    });
+
+    it('skips definitions that fail FieldSchema validation', () => {
+      const invalid = makeDef({ defYaml: { not_a_valid_field: true } });
+      expect(parseFieldDefinitionsToInlineFields([invalid])).toHaveLength(0);
+    });
+  });
 });
@@ -6,8 +6,32 @@
  */
 
 import { camelCase } from 'lodash';
+import { load as parseYaml } from 'js-yaml';
+import { FieldSchema, isInlineField } from '../types/domain/template/fields';
+import type { InlineField } from '../types/domain/template/fields';
+import type { FieldDefinition } from '../types/domain/field_definition/latest';
 
 export const getFieldSnakeKey = (name: string, type: string): string => `${name}_as_${type}`;
 
 export const getFieldCamelKey = (name: string, type: string): string =>
   camelCase(getFieldSnakeKey(name, type));
+
+/**
+ * Parses an array of field definitions into resolved inline fields, skipping any
+ * definitions that are malformed or describe reference (non-inline) fields.
+ */
+export const parseFieldDefinitionsToInlineFields = (defs: FieldDefinition[]): InlineField[] => {
+  const fields: InlineField[] = [];
+  for (const fd of defs) {
+    try {
+      const parsed = parseYaml(fd.definition);
+      const result = FieldSchema.safeParse(parsed);
+      if (result.success && isInlineField(result.data)) {
+        fields.push(result.data as InlineField);
+      }
+    } catch {
+      // Ignore malformed definitions
+    }
+  }
+  return fields;
+};
@@ -47,6 +47,7 @@ import { isLegacyAttachmentRequest } from '../../../../common/utils/attachments'
 
 jest.mock('./template_fields', () => ({
   TemplateFields: () => <div data-test-subj="case-view-template-fields" />,
+  GlobalCaseFields: () => null,
 }));
 
 jest.mock('../../../containers/use_infinite_find_case_user_actions');

@@ -55,7 +55,7 @@ import { parseCaseUsers } from '../../utils';
 import { CustomFields } from './custom_fields';
 import { useReplaceCustomField } from '../../../containers/use_replace_custom_field';
 import { KibanaServices } from '../../../common/lib/kibana';
-import { TemplateFields } from './template_fields';
+import { GlobalCaseFields, TemplateFields } from './template_fields';
 import { useStatusAction } from '../../actions/status/use_status_action';
 import { useRefreshCaseViewPage } from '../use_on_refresh_case_view_page';
 
@@ -353,7 +353,10 @@ export const CaseViewActivity = ({
             onSubmit={onSubmitCustomField}
           />
           {isTemplatesV2Enabled && (
-            <TemplateFields caseData={caseData} onUpdateField={onUpdateField} />
+            <div>
+              <TemplateFields caseData={caseData} onUpdateField={onUpdateField} />
+              <GlobalCaseFields caseData={caseData} onUpdateField={onUpdateField} />
+            </div>
           )}
         </EuiFlexGroup>
       </EuiFlexItem>