[Alerting v2] Refactor rules list search to use SO client (elastic#265303)

## Summary

- Replaces hand-built KQL search fragments with the SO client's native
`search`/`searchFields` parameters
- Fixes search failures with special characters like consecutive hyphens
(`a--b`) that caused KQL parse errors
- Adds `search` as a separate field in the bulk operations API,
decoupling free-text search from structural KQL filters
- Removes `buildRuleSearchQuery`, `buildApiRulesListCombinedFilter`,
`buildFindRulesSearch`, and associated test files

Closes elastic#261450
Closes elastic/rna-program#415

## Limitations

Search currently matches `metadata.name` and `metadata.description`
only. `metadata.tags` and `grouping.fields` are keyword-mapped and
incompatible with `simple_query_string` phrase-prefix queries.

## Test plan

- [ ] Search by partial rule name returns matching rules
- [ ] Multi-word search applies AND logic across terms
- [ ] Special characters (e.g. `a--b`) do not cause 400 errors
- [ ] Search combined with facet filters works correctly
- [ ] Bulk operations (enable/disable/delete) with select-all + search
scope to search results
- [ ] Bulk operations with select-all + exclusions work correctly

---------

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

Author: yiannisnikolopoulos

x-pack/platform/packages/shared/response-ops/alerting-v2-schemas/src/bulk_operation_schema.ts

@@ -12,9 +12,10 @@ import { BULK_FILTER_MAX_RULES } from './constants';
 /**
  * Schema for bulk operation request bodies.
  *
- * Enforces that exactly one of `ids` or `filter` must be provided:
- * - `ids`: An explicit list of rule IDs to operate on (1–100).
- * - `filter`: A KQL filter string to match rules.
+ * At least one targeting param must be provided:
+ * - `ids` — explicit list (cannot be combined with filter/search/match_all)
+ * - `filter` / `search` — scoped selection
+ * - `match_all` — explicit opt-in to target every rule
  */
 export const bulkOperationParamsSchema = z
   .object({
@@ -30,12 +31,27 @@ export const bulkOperationParamsSchema = z
       .describe(
         `KQL filter string to match rules. At most ${BULK_FILTER_MAX_RULES} matching rules are processed per request.`
       ),
+    search: z
+      .string()
+      .optional()
+      .describe('Free-text search string to match rules by name and description.'),
+    match_all: z
+      .literal(true)
+      .optional()
+      .describe('When true, targets all rules. Cannot be combined with ids.'),
   })
-  .refine((data) => data.ids != null || data.filter != null, {
-    message: 'Either ids or filter must be provided.',
+  .refine(
+    (data) =>
+      data.ids != null || data.filter != null || data.search != null || data.match_all === true,
+    { message: 'At least one of ids, filter, search, or match_all must be provided.' }
+  )
+  .refine((data) => data.ids == null || (data.filter == null && data.search == null), {
+    message: 'ids cannot be combined with filter or search.',
   })
-  .refine((data) => data.ids == null || data.filter == null, {
-    message: 'Only one of ids or filter can be provided.',
-  });
+  .refine(
+    (data) =>
+      data.match_all == null || (data.ids == null && data.filter == null && data.search == null),
+    { message: 'match_all cannot be combined with ids, filter, or search.' }
+  );
 
 export type BulkOperationParams = z.infer<typeof bulkOperationParamsSchema>;

x-pack/platform/plugins/shared/alerting_v2/common/utils/build_rules_list_kql.test.ts

@@ -66,17 +66,17 @@ describe('useBulkSelect', () => {
     expect(result.current.selectedCount).toBe(logical);
   });
 
-  it('returns match-all filter when select-all with no exclusions', () => {
+  it('returns match_all params when select-all with no filter or search', () => {
     const { result } = renderHook(() => useBulkSelect({ totalItemCount: 10, items: pageItems }));
 
     act(() => {
       result.current.onSelectAll();
     });
 
-    expect(result.current.getBulkParams()).toEqual({ filter: '' });
+    expect(result.current.getBulkParams()).toEqual({ match_all: true });
   });
 
-  it('scopes select-all bulk filter to filter', () => {
+  it('scopes select-all bulk params to filter', () => {
     const { result } = renderHook(() =>
       useBulkSelect({
         totalItemCount: 10,
@@ -89,10 +89,10 @@ describe('useBulkSelect', () => {
       result.current.onSelectAll();
     });
 
-    expect(result.current.getBulkParams()).toEqual({ filter: 'enabled: true' });
+    expect(result.current.getBulkParams()).toEqual({ filter: '(enabled: true)' });
   });
 
-  it('scopes select-all bulk filter to search', () => {
+  it('passes search as a separate field in bulk params', () => {
     const { result } = renderHook(() =>
       useBulkSelect({
         totalItemCount: 10,
@@ -105,13 +105,10 @@ describe('useBulkSelect', () => {
       result.current.onSelectAll();
     });
 
-    expect(result.current.getBulkParams()).toEqual({
-      filter:
-        '(metadata.name: prod* OR metadata.description: prod* OR metadata.tags: prod* OR grouping.fields: prod*)',
-    });
+    expect(result.current.getBulkParams()).toEqual({ search: 'prod' });
   });
 
-  it('combines list scope with NOT exclusions when select-all with deselected rows', () => {
+  it('passes filter and search as separate fields with exclusions', () => {
     const { result } = renderHook(() =>
       useBulkSelect({
         totalItemCount: 10,
@@ -129,8 +126,30 @@ describe('useBulkSelect', () => {
     });
 
     expect(result.current.getBulkParams()).toEqual({
-      filter:
-        '((enabled: true) AND ((metadata.name: x* OR metadata.description: x* OR metadata.tags: x* OR grouping.fields: x*))) AND NOT (id: "rule-1")',
+      filter: '(enabled: true) AND NOT (id: "rule-1")',
+      search: 'x',
+    });
+  });
+
+  it('includes only exclusion clauses in filter when no structural filter is set', () => {
+    const { result } = renderHook(() =>
+      useBulkSelect({
+        totalItemCount: 10,
+        items: pageItems,
+        search: 'prod',
+      })
+    );
+
+    act(() => {
+      result.current.onSelectAll();
+    });
+    act(() => {
+      result.current.onSelectRow('rule-1');
+    });
+
+    expect(result.current.getBulkParams()).toEqual({
+      filter: 'NOT (id: "rule-1")',
+      search: 'prod',
     });
   });
 

x-pack/platform/plugins/shared/alerting_v2/common/utils/build_rules_list_kql.ts

@@ -8,7 +8,6 @@
 import { useReducer, useMemo, useCallback } from 'react';
 import { BULK_FILTER_MAX_RULES } from '@kbn/alerting-v2-schemas';
 import { escapeQuotes } from '@kbn/es-query';
-import { buildApiRulesListCombinedFilter } from '../../common/utils/build_rules_list_kql';
 import type { BulkOperationParams } from '../services/rules_api';
 
 interface BulkSelectState {
@@ -176,24 +175,33 @@ export const useBulkSelect = ({ totalItemCount, items, filter, search }: UseBulk
   /**
    * Returns the appropriate `BulkOperationParams` for the current selection state.
    *
-   * When `isAllSelected` is true, sends a filter (or empty filter for "match all")
+   * When `isAllSelected` is true, sends `filter` and/or `search` params
    * with an exclusion clause for deselected IDs. When false, sends explicit IDs.
    *
    * Filters use clean API field names (e.g. `id`), which the server
    * translates to the saved-object KQL format before querying.
    */
   const getBulkParams = useCallback((): BulkOperationParams => {
     if (state.isAllSelected) {
-      const listScope = buildApiRulesListCombinedFilter({ filter, search }) ?? '';
       const excludedIds = [...state.selectedIds];
-      if (excludedIds.length === 0) {
-        return { filter: listScope };
-      }
-      const exclusionClauses = excludedIds.map((id) => `id: "${escapeQuotes(id)}"`).join(' or ');
-      if (listScope) {
-        return { filter: `(${listScope}) AND NOT (${exclusionClauses})` };
-      }
-      return { filter: `NOT (${exclusionClauses})` };
+      const exclusionClauses =
+        excludedIds.length > 0
+          ? excludedIds.map((id) => `id: "${escapeQuotes(id)}"`).join(' or ')
+          : undefined;
+
+      const wrappedFilter = filter ? `(${filter})` : undefined;
+      const combinedFilter = [
+        wrappedFilter,
+        exclusionClauses ? `NOT (${exclusionClauses})` : undefined,
+      ]
+        .filter(Boolean)
+        .join(' AND ');
+
+      return {
+        ...(combinedFilter ? { filter: combinedFilter } : {}),
+        ...(search ? { search } : {}),
+        ...(!combinedFilter && !search ? { match_all: true as const } : {}),
+      };
     }
 
     return { ids: [...state.selectedIds] };

x-pack/platform/plugins/shared/alerting_v2/public/hooks/use_bulk_select.test.ts

@@ -390,7 +390,7 @@ describe('RulesListTableContainer', () => {
       fireEvent.click(screen.getByTestId('bulkEnableRules'));
 
       expect(mockBulkEnableMutate).toHaveBeenCalledWith(
-        { filter: '' },
+        { match_all: true },
         expect.objectContaining({ onSuccess: expect.any(Function) })
       );
     });
@@ -420,7 +420,7 @@ describe('RulesListTableContainer', () => {
       fireEvent.click(screen.getByTestId('bulkEnableRules'));
 
       expect(mockBulkEnableMutate).toHaveBeenCalledWith(
-        { filter: 'kind: alert' },
+        { filter: '(kind: alert)' },
         expect.objectContaining({ onSuccess: expect.any(Function) })
       );
     });