yiannisnikolopoulos
diff --git a/‎x-pack/platform/plugins/shared/cases/common/constants/attachments.ts‎
Lines changed: 23 additions & 0 deletions b/‎x-pack/platform/plugins/shared/cases/common/constants/attachments.ts‎
Lines changed: 23 additions & 0 deletions
diff --git a/‎x-pack/platform/plugins/shared/cases/common/index.ts‎
Lines changed: 1 addition & 0 deletions b/‎x-pack/platform/plugins/shared/cases/common/index.ts‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎x-pack/platform/plugins/shared/cases/server/common/attachments/external_reference.test.ts‎
Lines changed: 218 additions & 0 deletions b/‎x-pack/platform/plugins/shared/cases/server/common/attachments/external_reference.test.ts‎
Lines changed: 218 additions & 0 deletions
@@ -4,11 +4,16 @@
  * 2.0; you may not use this file except in compliance with the Elastic License
  * 2.0.
  */
+// NOTE: Do not import from '../types/domain' here to avoid circular dependencies
+// (types/domain -> constants/index -> constants/attachments -> types/domain).
+// Use string literals for legacy type names instead.
+
 import { SECURITY_SOLUTION_OWNER, OBSERVABILITY_OWNER, GENERAL_CASES_OWNER } from './owners';
 
 // ----------------Unified attachment types-------------------------
 export const COMMENT_ATTACHMENT_TYPE = 'comment';
 export const SECURITY_EVENT_ATTACHMENT_TYPE = 'security.event';
+export const SECURITY_ENDPOINT_ATTACHMENT_TYPE = 'security.endpoint';
 export const LENS_ATTACHMENT_TYPE = 'lens';
 
 export const ML_ANOMALY_SWIMLANE_ATTACHMENT_TYPE = 'ml.anomaly_swimlane';
@@ -34,6 +39,14 @@ export const LEGACY_AIOPS_CHANGE_POINT_CHART_ATTACHMENT_TYPE = 'aiopsChangePoint
 export const LEGACY_AIOPS_PATTERN_ANALYSIS_ATTACHMENT_TYPE = 'aiopsPatternAnalysisEmbeddable';
 export const LEGACY_AIOPS_LOG_RATE_ANALYSIS_ATTACHMENT_TYPE = 'aiopsLogRateAnalysisEmbeddable';
 
+/**
+ * Mapping from legacy externalReferenceAttachmentTypeId to unified type name.
+ * Used by the generic externalReference transformer to resolve the unified type.
+ */
+export const EXTERNAL_REFERENCE_TYPE_MAP: Record<string, string> = {
+  endpoint: SECURITY_ENDPOINT_ATTACHMENT_TYPE,
+} as const;
+
 export const LEGACY_ATTACHMENT_TYPES = new Set([
   LEGACY_ACTIONS_TYPE,
   LEGACY_ALERT_TYPE,
@@ -46,6 +59,7 @@ export const LEGACY_ATTACHMENT_TYPES = new Set([
 export const UNIFIED_ATTACHMENT_TYPES = new Set([
   COMMENT_ATTACHMENT_TYPE,
   SECURITY_EVENT_ATTACHMENT_TYPE,
+  SECURITY_ENDPOINT_ATTACHMENT_TYPE,
 ]);
 
 export const PERSISTABLE_STATE_LEGACY_TO_UNIFIED_MAP: Record<string, string> = {
@@ -84,6 +98,14 @@ export const LEGACY_TO_UNIFIED_MAP: Record<string, string> = {
 export const UNIFIED_TO_LEGACY_MAP: Record<string, string> = {
   [COMMENT_ATTACHMENT_TYPE]: LEGACY_USER_TYPE,
   [SECURITY_EVENT_ATTACHMENT_TYPE]: LEGACY_EVENT_TYPE,
+  [SECURITY_ENDPOINT_ATTACHMENT_TYPE]: LEGACY_EXTERNAL_REFERENCE_TYPE,
+} as const;
+
+/**
+ * Reverse mapping from unified type name back to externalReferenceAttachmentTypeId.
+ */
+export const UNIFIED_TO_EXTERNAL_REFERENCE_TYPE_MAP: Record<string, string> = {
+  [SECURITY_ENDPOINT_ATTACHMENT_TYPE]: 'endpoint',
 } as const;
 
 /**
@@ -92,6 +114,7 @@ export const UNIFIED_TO_LEGACY_MAP: Record<string, string> = {
 export const MIGRATED_ATTACHMENT_TYPES = new Set<string>([
   COMMENT_ATTACHMENT_TYPE,
   SECURITY_EVENT_ATTACHMENT_TYPE,
+  SECURITY_ENDPOINT_ATTACHMENT_TYPE,
   ...PERSISTABLE_ATTACHMENT_TYPES,
 ]);
 
 
@@ -59,6 +59,7 @@ export {
   CASES_REOPEN_CAPABILITY,
   ASSIGN_CASE_CAPABILITY,
   SECURITY_EVENT_ATTACHMENT_TYPE,
+  SECURITY_ENDPOINT_ATTACHMENT_TYPE,
   MANAGE_TEMPLATES_CAPABILITY,
   ML_ANOMALY_SWIMLANE_ATTACHMENT_TYPE,
   ML_ANOMALY_CHARTS_ATTACHMENT_TYPE,
 
@@ -0,0 +1,218 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { AttachmentType, ExternalReferenceStorageType } from '../../../common/types/domain';
+import { externalReferenceAttachmentTransformer } from './external_reference';
+
+const baseLegacyAttributes = {
+  created_at: '2024-01-01T00:00:00.000Z',
+  created_by: {
+    username: 'elastic',
+    full_name: null,
+    email: null,
+    profile_uid: undefined,
+  },
+  pushed_at: null,
+  pushed_by: null,
+  updated_at: null,
+  updated_by: null,
+};
+
+const legacyEndpointAttributes = {
+  ...baseLegacyAttributes,
+  type: AttachmentType.externalReference as const,
+  externalReferenceId: 'action-123',
+  externalReferenceStorage: {
+    type: ExternalReferenceStorageType.elasticSearchDoc as const,
+  },
+  externalReferenceAttachmentTypeId: 'endpoint',
+  externalReferenceMetadata: {
+    command: 'isolate',
+    comment: 'Test comment',
+    targets: [{ endpointId: 'ep-1', hostname: 'host-1', agentType: 'endpoint' }],
+  },
+  owner: 'securitySolution',
+};
+
+const unifiedEndpointAttributes = {
+  ...baseLegacyAttributes,
+  type: 'security.endpoint',
+  attachmentId: 'action-123',
+  metadata: {
+    command: 'isolate',
+    comment: 'Test comment',
+    targets: [{ endpointId: 'ep-1', hostname: 'host-1', agentType: 'endpoint' }],
+  },
+  owner: 'securitySolution',
+};
+
+describe('externalReferenceAttachmentTransformer', () => {
+  describe('toUnifiedSchema', () => {
+    it('converts legacy external reference to unified format', () => {
+      const result =
+        externalReferenceAttachmentTransformer.toUnifiedSchema(legacyEndpointAttributes);
+      expect(result).toEqual(
+        expect.objectContaining({
+          type: 'security.endpoint',
+          attachmentId: 'action-123',
+          metadata: legacyEndpointAttributes.externalReferenceMetadata,
+          owner: 'securitySolution',
+        })
+      );
+    });
+
+    it('passes through already-unified attributes', () => {
+      const result =
+        externalReferenceAttachmentTransformer.toUnifiedSchema(unifiedEndpointAttributes);
+      expect(result).toEqual(unifiedEndpointAttributes);
+    });
+  });
+
+  describe('toLegacySchema', () => {
+    it('converts unified format to legacy external reference', () => {
+      const result =
+        externalReferenceAttachmentTransformer.toLegacySchema(unifiedEndpointAttributes);
+      expect(result).toEqual(
+        expect.objectContaining({
+          type: AttachmentType.externalReference,
+          externalReferenceId: 'action-123',
+          externalReferenceStorage: {
+            type: ExternalReferenceStorageType.elasticSearchDoc,
+          },
+          externalReferenceAttachmentTypeId: 'endpoint',
+          externalReferenceMetadata: unifiedEndpointAttributes.metadata,
+          owner: 'securitySolution',
+        })
+      );
+    });
+
+    it('passes through already-legacy attributes', () => {
+      const result =
+        externalReferenceAttachmentTransformer.toLegacySchema(legacyEndpointAttributes);
+      expect(result).toEqual(legacyEndpointAttributes);
+    });
+  });
+
+  describe('type guards', () => {
+    it('isType detects both legacy and unified', () => {
+      expect(externalReferenceAttachmentTransformer.isType(legacyEndpointAttributes as never)).toBe(
+        true
+      );
+      expect(
+        externalReferenceAttachmentTransformer.isType(unifiedEndpointAttributes as never)
+      ).toBe(true);
+      expect(
+        externalReferenceAttachmentTransformer.isType({ type: AttachmentType.alert } as never)
+      ).toBe(false);
+    });
+
+    it('does not match unmigrated external reference subtypes', () => {
+      const unmigrated = {
+        ...legacyEndpointAttributes,
+        externalReferenceAttachmentTypeId: 'some-unknown-type',
+      };
+      expect(externalReferenceAttachmentTransformer.isType(unmigrated as never)).toBe(false);
+    });
+
+    it('isUnifiedType detects only unified', () => {
+      expect(externalReferenceAttachmentTransformer.isUnifiedType(unifiedEndpointAttributes)).toBe(
+        true
+      );
+      expect(externalReferenceAttachmentTransformer.isUnifiedType(legacyEndpointAttributes)).toBe(
+        false
+      );
+    });
+
+    it('isLegacyType detects only legacy', () => {
+      expect(externalReferenceAttachmentTransformer.isLegacyType(legacyEndpointAttributes)).toBe(
+        true
+      );
+      expect(externalReferenceAttachmentTransformer.isLegacyType(unifiedEndpointAttributes)).toBe(
+        false
+      );
+    });
+
+    it('isUnifiedType rejects payloads where attachmentId is not a single id string', () => {
+      // External-reference unified attachments require `attachmentId: string`. The
+      // shared `AttachmentAttributesV2` union allows `string | string[]` for alert/event
+      // attachments, so the guard explicitly narrows to reject arrays coming via API.
+      expect(
+        externalReferenceAttachmentTransformer.isUnifiedType({
+          ...unifiedEndpointAttributes,
+          attachmentId: ['a', 'b'],
+        })
+      ).toBe(false);
+
+      expect(
+        externalReferenceAttachmentTransformer.isUnifiedType({
+          ...unifiedEndpointAttributes,
+          attachmentId: undefined,
+        })
+      ).toBe(false);
+    });
+  });
+
+  describe('payload transforms', () => {
+    const legacyPayload = {
+      type: AttachmentType.externalReference as const,
+      externalReferenceId: 'action-456',
+      externalReferenceStorage: {
+        type: ExternalReferenceStorageType.elasticSearchDoc as const,
+      },
+      externalReferenceAttachmentTypeId: 'endpoint',
+      externalReferenceMetadata: {
+        command: 'unisolate',
+        comment: '',
+        targets: [{ endpointId: 'ep-2', hostname: 'host-2', agentType: 'endpoint' }],
+      },
+      owner: 'securitySolution',
+    };
+
+    const unifiedPayload = {
+      type: 'security.endpoint',
+      attachmentId: 'action-456',
+      metadata: {
+        command: 'unisolate',
+        comment: '',
+        targets: [{ endpointId: 'ep-2', hostname: 'host-2', agentType: 'endpoint' }],
+      },
+      owner: 'securitySolution',
+    };
+
+    it('toUnifiedPayload converts legacy payload', () => {
+      const result = externalReferenceAttachmentTransformer.toUnifiedPayload(legacyPayload);
+      expect(result).toEqual(unifiedPayload);
+    });
+
+    it('toUnifiedPayload throws for non-legacy payload', () => {
+      expect(() => externalReferenceAttachmentTransformer.toUnifiedPayload(unifiedPayload)).toThrow(
+        'Expected legacy external reference attachment payload'
+      );
+    });
+
+    it('toLegacyPayload converts unified payload', () => {
+      const result = externalReferenceAttachmentTransformer.toLegacyPayload(unifiedPayload);
+      expect(result).toEqual(legacyPayload);
+    });
+
+    it('toLegacyPayload throws for non-unified payload', () => {
+      expect(() => externalReferenceAttachmentTransformer.toLegacyPayload(legacyPayload)).toThrow(
+        'Expected unified external reference attachment payload'
+      );
+    });
+
+    it('isLegacyPayload detects legacy payloads', () => {
+      expect(externalReferenceAttachmentTransformer.isLegacyPayload(legacyPayload)).toBe(true);
+      expect(externalReferenceAttachmentTransformer.isLegacyPayload(unifiedPayload)).toBe(false);
+    });
+
+    it('isUnifiedPayload detects unified payloads', () => {
+      expect(externalReferenceAttachmentTransformer.isUnifiedPayload(unifiedPayload)).toBe(true);
+      expect(externalReferenceAttachmentTransformer.isUnifiedPayload(legacyPayload)).toBe(false);
+    });
+  });
+});