[Cases] Add attachment type and author filter (elastic#272759)

## Summary

This PR adds attachment type filter and author (created by) filter in
the attachment tab. Note they are not added to Activity because it is
going through a redesign, but the component is reusable. Also moved a
type conversion from server to common so it can be used for both client
and server.

Attachment types without table (tabViewObject) is excluded from the type
filter, this includes comments, osquery, endpoint etc.
<img width="1293" height="611" alt="image"
src="https://github.com/user-attachments/assets/70b58e0e-adc8-4a24-963e-89ab16cb2f1e"
/>
<img width="1298" height="684" alt="image"
src="https://github.com/user-attachments/assets/55dacff6-0e57-4d55-a21b-2004403c6822"
/>

### Checklist

- [x] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)
- [ ]
[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)
was added for features that require explanation or tutorials
- [x] [Unit or functional
tests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)
were updated or added to match the most common scenarios
- [ ] If a plugin configuration key changed, check if it needs to be
allowlisted in the cloud and added to the [docker
list](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)
- [ ] This was checked for breaking HTTP API changes, and any breaking
changes have been approved by the breaking-change committee. The
`release_note:breaking` label should be applied in these situations.
- [ ] [Flaky Test
Runner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1) was
used on any tests changed
- [x] The PR description includes the appropriate Release Notes section,
and the correct `release_note:*` label is applied per the
[guidelines](https://www.elastic.co/guide/en/kibana/master/contributing.html#kibana-release-notes-process)
- [x] Review the [backport
guidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)
and apply applicable `backport:*` labels.

---------

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

Author: 2 people

x-pack/platform/plugins/shared/cases/common/utils/attachments/migration_utils.test.ts

@@ -16,16 +16,56 @@ import {
   SECURITY_ALERT_ATTACHMENT_TYPE,
   SECURITY_TIMELINE_ATTACHMENT_TYPE,
 } from '../../constants/attachments';
-import { AttachmentType } from '../../types/domain';
+import { AttachmentType, ExternalReferenceStorageType } from '../../types/domain';
 import { SECURITY_SOLUTION_OWNER, OBSERVABILITY_OWNER, GENERAL_CASES_OWNER } from '../../constants';
+import type { AttachmentRequestV2 } from '../../types/api';
 import {
+  getAttachmentTypeFromAttributes,
   isMigratedAttachmentType,
   isPersistableType,
+  resolveUnifiedAttachmentType,
   isUnifiedOnlyAttachmentType,
   toLegacyAttachmentType,
   toUnifiedAttachmentType,
 } from './migration_utils';
 
+const makeExternalReference = (externalReferenceAttachmentTypeId: string): AttachmentRequestV2 => ({
+  type: AttachmentType.externalReference,
+  externalReferenceAttachmentTypeId,
+  externalReferenceId: 'ref-id',
+  externalReferenceStorage: { type: ExternalReferenceStorageType.elasticSearchDoc },
+  externalReferenceMetadata: null,
+  owner,
+});
+
+const makePersistableState = (persistableStateAttachmentTypeId: string): AttachmentRequestV2 => ({
+  type: AttachmentType.persistableState,
+  persistableStateAttachmentTypeId,
+  persistableStateAttachmentState: {},
+  owner,
+});
+
+const makeUnifiedRef = (type: string): AttachmentRequestV2 => ({
+  type,
+  attachmentId: 'att-id',
+  owner,
+});
+
+const makeAlert = (): AttachmentRequestV2 => ({
+  type: AttachmentType.alert,
+  alertId: 'alert-id',
+  index: 'idx',
+  rule: { id: 'rule-id', name: 'rule' },
+  owner,
+});
+
+const makeEvent = (): AttachmentRequestV2 => ({
+  type: AttachmentType.event,
+  eventId: 'evt-id',
+  index: 'idx',
+  owner,
+});
+
 const owner = SECURITY_SOLUTION_OWNER;
 
 describe('migration_utils', () => {
@@ -122,6 +162,126 @@ describe('migration_utils', () => {
     });
   });
 
+  describe('getAttachmentTypeFromAttributes', () => {
+    it('throws for null', () => {
+      expect(() => getAttachmentTypeFromAttributes(null)).toThrow(
+        'Invalid attributes: expected non-null object'
+      );
+    });
+
+    it('throws for non-object', () => {
+      expect(() => getAttachmentTypeFromAttributes('string')).toThrow(
+        'Invalid attributes: expected non-null object'
+      );
+      expect(() => getAttachmentTypeFromAttributes(42)).toThrow(
+        'Invalid attributes: expected non-null object'
+      );
+    });
+
+    it('throws when attributes have no recognizable attachment type', () => {
+      expect(() => getAttachmentTypeFromAttributes({ foo: 'bar' })).toThrow(
+        'Invalid attributes: missing attachment type'
+      );
+    });
+
+    it('throws when type is not a string', () => {
+      expect(() => getAttachmentTypeFromAttributes({ type: 1 })).toThrow(
+        'Invalid attributes: missing attachment type'
+      );
+      expect(() =>
+        getAttachmentTypeFromAttributes({
+          pushed_at: '2020-01-01T00:00:00.000Z',
+          pushed_by: { username: 'elastic', full_name: null, email: null },
+        })
+      ).toThrow('Invalid attributes: missing attachment type');
+    });
+
+    it('returns the top-level type for plain attachments', () => {
+      expect(getAttachmentTypeFromAttributes({ type: 'user' })).toBe('user');
+      expect(getAttachmentTypeFromAttributes({ type: AttachmentType.alert })).toBe(
+        AttachmentType.alert
+      );
+    });
+
+    it('resolves migrated external reference subtypes to unified type names', () => {
+      expect(
+        getAttachmentTypeFromAttributes({
+          type: AttachmentType.externalReference,
+          externalReferenceAttachmentTypeId: 'endpoint',
+        })
+      ).toBe(SECURITY_ENDPOINT_ATTACHMENT_TYPE);
+    });
+
+    it('returns the top-level type for unmigrated external reference subtypes', () => {
+      expect(
+        getAttachmentTypeFromAttributes({
+          type: AttachmentType.externalReference,
+          externalReferenceAttachmentTypeId: 'some-unknown-type',
+        })
+      ).toBe(AttachmentType.externalReference);
+    });
+
+    it('returns the top-level type for external references without externalReferenceAttachmentTypeId', () => {
+      expect(
+        getAttachmentTypeFromAttributes({
+          type: AttachmentType.externalReference,
+        })
+      ).toBe(AttachmentType.externalReference);
+    });
+
+    it('returns persistableStateAttachmentTypeId for persistable state attachments', () => {
+      expect(
+        getAttachmentTypeFromAttributes({
+          type: AttachmentType.persistableState,
+          persistableStateAttachmentTypeId: LEGACY_LENS_ATTACHMENT_TYPE,
+        })
+      ).toBe(LEGACY_LENS_ATTACHMENT_TYPE);
+    });
+  });
+
+  describe('resolveUnifiedAttachmentType', () => {
+    it('passes through unified types unchanged', () => {
+      expect(resolveUnifiedAttachmentType(makeUnifiedRef(LENS_ATTACHMENT_TYPE), owner)).toBe(
+        LENS_ATTACHMENT_TYPE
+      );
+      expect(resolveUnifiedAttachmentType(makeUnifiedRef(FILE_ATTACHMENT_TYPE), owner)).toBe(
+        FILE_ATTACHMENT_TYPE
+      );
+    });
+
+    it('maps legacy alert/event using owner prefix', () => {
+      expect(resolveUnifiedAttachmentType(makeAlert(), owner)).toBe('security.alert');
+      expect(resolveUnifiedAttachmentType(makeEvent(), owner)).toBe('security.event');
+    });
+
+    it('resolves legacy externalReference + typeId to the unified type', () => {
+      expect(resolveUnifiedAttachmentType(makeExternalReference('.files'), owner)).toBe(
+        FILE_ATTACHMENT_TYPE
+      );
+      expect(resolveUnifiedAttachmentType(makeExternalReference('endpoint'), owner)).toBe(
+        SECURITY_ENDPOINT_ATTACHMENT_TYPE
+      );
+      expect(
+        resolveUnifiedAttachmentType(makeExternalReference(OSQUERY_ATTACHMENT_TYPE), owner)
+      ).toBe(OSQUERY_ATTACHMENT_TYPE);
+      expect(resolveUnifiedAttachmentType(makeExternalReference('indicator'), owner)).toBe(
+        INDICATOR_ATTACHMENT_TYPE
+      );
+    });
+
+    it('falls back to the top-level type for unknown externalReference subtypes', () => {
+      expect(resolveUnifiedAttachmentType(makeExternalReference('unknownSubtype'), owner)).toBe(
+        AttachmentType.externalReference
+      );
+    });
+
+    it('resolves legacy persistableState + typeId to the unified persistable type', () => {
+      expect(
+        resolveUnifiedAttachmentType(makePersistableState(LEGACY_LENS_ATTACHMENT_TYPE), owner)
+      ).toBe(LENS_ATTACHMENT_TYPE);
+    });
+  });
+
   describe('isUnifiedOnlyAttachmentType', () => {
     it('is true for unified types with no legacy equivalent', () => {
       expect(isUnifiedOnlyAttachmentType(SECURITY_TIMELINE_ATTACHMENT_TYPE)).toBe(true);

x-pack/platform/plugins/shared/cases/common/utils/attachments/migration_utils.ts

@@ -5,7 +5,9 @@
  * 2.0.
  */
 
+import { isPlainObject } from 'lodash';
 import {
+  EXTERNAL_REFERENCE_TYPE_MAP,
   LEGACY_TO_UNIFIED_MAP,
   MIGRATED_ATTACHMENT_TYPES,
   PERSISTABLE_STATE_LEGACY_TO_UNIFIED_MAP,
@@ -17,6 +19,8 @@ import {
   LEGACY_EVENT_TYPE,
   LEGACY_ALERT_TYPE,
 } from '../../constants/attachments';
+import { AttachmentType } from '../../types/domain';
+import type { AttachmentRequestV2 } from '../../types/api';
 
 export const isMigratedAttachmentType = (type: string, owner: string): boolean => {
   return (
@@ -75,3 +79,49 @@ export const toUnifiedPersistableStateAttachmentType = (type: string): string =>
 export const toLegacyPersistableStateAttachmentType = (type: string): string => {
   return PERSISTABLE_STATE_UNIFIED_TO_LEGACY_MAP[type] ?? type;
 };
+
+/**
+ * Returns a routing key derived from raw attachment attributes — useful when working
+ * with persisted SO data of unknown shape.
+ *
+ * Not a fully-normalized unified type — for that compose with
+ * {@link toUnifiedAttachmentType} / {@link toUnifiedPersistableStateAttachmentType}
+ * (or use {@link resolveUnifiedAttachmentType}).
+ *
+ * @throws Error if attributes is null or not an object, or if `type` is missing.
+ */
+export const getAttachmentTypeFromAttributes = (attributes: unknown): string => {
+  if (!isPlainObject(attributes)) {
+    throw new Error('Invalid attributes: expected non-null object');
+  }
+  const { type, persistableStateAttachmentTypeId, externalReferenceAttachmentTypeId } =
+    attributes as Record<string, unknown>;
+  if (typeof type !== 'string') {
+    throw new Error('Invalid attributes: missing attachment type');
+  }
+  if (
+    type === AttachmentType.persistableState &&
+    typeof persistableStateAttachmentTypeId === 'string'
+  ) {
+    return persistableStateAttachmentTypeId;
+  }
+  if (
+    type === AttachmentType.externalReference &&
+    typeof externalReferenceAttachmentTypeId === 'string'
+  ) {
+    return EXTERNAL_REFERENCE_TYPE_MAP[externalReferenceAttachmentTypeId] ?? type;
+  }
+  return type;
+};
+
+/**
+ * Resolves a typed V2 attachment to its fully-normalized unified type
+ * (`security.alert`, `lens`, `file`, …).
+ */
+export const resolveUnifiedAttachmentType = (
+  attachment: AttachmentRequestV2,
+  owner: string
+): string => {
+  const routingKey = getAttachmentTypeFromAttributes(attachment);
+  return toUnifiedAttachmentType(toUnifiedPersistableStateAttachmentType(routingKey), owner);
+};

x-pack/platform/plugins/shared/cases/public/components/attachments/file/case_view_files.test.tsx

@@ -9,9 +9,12 @@ import React from 'react';
 import { screen, waitFor } from '@testing-library/react';
 import userEvent from '@testing-library/user-event';
 
+import type { FileJSON } from '@kbn/shared-ux-file-types';
 import type { CaseUI } from '../../../../common';
+import { AttachmentType, ExternalReferenceStorageType } from '../../../../common/types/domain';
+import type { AttachmentUIV2 } from '../../../../common/ui/types';
 
-import { alertCommentWithIndices, basicCase } from '../../../containers/mock';
+import { alertCommentWithIndices, basicCase, elasticUser } from '../../../containers/mock';
 import { useGetCaseFiles } from '../../../containers/use_get_case_files';
 import { CaseViewFiles, DEFAULT_CASE_FILES_FILTERING_OPTIONS } from './case_view_files';
 import { renderWithTestingProviders } from '../../../common/mock';
@@ -20,9 +23,45 @@ jest.mock('../../../containers/use_get_case_files');
 
 const useGetCaseFilesMock = useGetCaseFiles as jest.Mock;
 
+export const makeFileComment = (
+  id: string,
+  attachmentId: string | string[],
+  owner: string
+): AttachmentUIV2 =>
+  ({
+    type: AttachmentType.externalReference,
+    id,
+    externalReferenceId: 'ext',
+    externalReferenceStorage: { type: ExternalReferenceStorageType.elasticSearchDoc },
+    externalReferenceAttachmentTypeId: '.files',
+    externalReferenceMetadata: { files: [] },
+    attachmentId,
+    createdAt: '2024-01-01T00:00:00.000Z',
+    createdBy: elasticUser,
+    owner,
+    pushedAt: null,
+    pushedBy: null,
+    updatedAt: null,
+    updatedBy: null,
+    version: 'v',
+  } as unknown as AttachmentUIV2);
+
+const makeFile = (id: string, name = id): Partial<FileJSON> => ({
+  id,
+  name,
+  fileKind: 'cases',
+  mimeType: 'text/plain',
+  status: 'READY',
+  created: '2024-01-01T00:00:00.000Z',
+  updated: '2024-01-01T00:00:00.000Z',
+});
+
+const fileIds = Array.from({ length: 11 }, (_, i) => `file-${i}`);
+const fileComments = fileIds.map((id) => makeFileComment(`c-${id}`, id, basicCase.owner));
+
 const caseData: CaseUI = {
   ...basicCase,
-  comments: [...basicCase.comments, alertCommentWithIndices],
+  comments: [...basicCase.comments, ...fileComments, alertCommentWithIndices],
 };
 
 describe('Case View Page files tab', () => {
@@ -100,4 +139,30 @@ describe('Case View Page files tab', () => {
       })
     );
   });
+
+  describe('intersect with caseData.comments', () => {
+    it('only renders files whose ids are referenced by the (possibly filtered) comments', async () => {
+      // Server returns three files but the (author-filtered) comments only
+      // reference one of them. Only the referenced file should render.
+      useGetCaseFilesMock.mockReturnValue({
+        data: {
+          files: [makeFile('file-a'), makeFile('file-b'), makeFile('file-c')],
+          total: 3,
+        },
+        isLoading: false,
+      });
+
+      const filteredCaseData: CaseUI = {
+        ...basicCase,
+        comments: [makeFileComment('c-a', 'file-a', basicCase.owner)],
+      };
+
+      renderWithTestingProviders(<CaseViewFiles caseData={filteredCaseData} />);
+
+      expect(await screen.findByTestId('cases-files-table')).toBeInTheDocument();
+      expect(await screen.findByTestId('cases-files-table-row-file-a')).toBeInTheDocument();
+      expect(screen.queryByTestId('cases-files-table-row-file-b')).not.toBeInTheDocument();
+      expect(screen.queryByTestId('cases-files-table-row-file-c')).not.toBeInTheDocument();
+    });
+  });
 });