From 4cdea7b6350919207da89d9a368b14ffd27875b4 Mon Sep 17 00:00:00 2001 From: Jonathan Buttner <56361221+jonathan-buttner@users.noreply.github.com> Date: Mon, 10 Aug 2020 11:54:22 -0400 Subject: [PATCH] [Security Solution] Resolver children pagination (#74603) * Handle info and change events for children * Adding sequence * Fixing children pagination * Fixing tests * Adding docs --- .../common/endpoint/generate_data.test.ts | 7 + .../common/endpoint/generate_data.ts | 3 + .../common/endpoint/models/event.ts | 14 ++ .../common/endpoint/types.ts | 3 + .../routes/resolver/queries/children.test.ts | 10 +- .../routes/resolver/queries/children.ts | 9 +- .../routes/resolver/utils/children_helper.ts | 4 +- .../resolver/utils/children_pagination.ts | 129 ++++++++++++++++++ .../utils/children_start_query_handler.ts | 11 +- .../routes/resolver/utils/pagination.ts | 92 +++++++++---- .../apis/resolver/children.ts | 83 ++++++++++- .../apis/resolver/tree.ts | 26 ++-- 12 files changed, 337 insertions(+), 54 deletions(-) create mode 100644 x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_pagination.ts diff --git a/x-pack/plugins/security_solution/common/endpoint/generate_data.test.ts b/x-pack/plugins/security_solution/common/endpoint/generate_data.test.ts index debe4a3da6a6fc..46fc002e76e7ff 100644 --- a/x-pack/plugins/security_solution/common/endpoint/generate_data.test.ts +++ b/x-pack/plugins/security_solution/common/endpoint/generate_data.test.ts @@ -26,6 +26,13 @@ describe('data generator', () => { generator = new EndpointDocGenerator('seed'); }); + it('creates events with a numerically increasing sequence value', () => { + const event1 = generator.generateEvent(); + const event2 = generator.generateEvent(); + + expect(event2.event.sequence).toBe(event1.event.sequence + 1); + }); + it('creates the same documents with same random seed', () => { const generator1 = new EndpointDocGenerator('seed'); const generator2 = new EndpointDocGenerator('seed'); diff --git a/x-pack/plugins/security_solution/common/endpoint/generate_data.ts b/x-pack/plugins/security_solution/common/endpoint/generate_data.ts index aa3f0bf287fcae..09f25fc074effe 100644 --- a/x-pack/plugins/security_solution/common/endpoint/generate_data.ts +++ b/x-pack/plugins/security_solution/common/endpoint/generate_data.ts @@ -333,6 +333,7 @@ export function getTreeOptionsWithDef(options?: TreeOptions): TreeOptionDefaults export class EndpointDocGenerator { commonInfo: HostInfo; random: seedrandom.prng; + sequence: number = 0; constructor(seed: string | seedrandom.prng = Math.random().toString()) { if (typeof seed === 'string') { this.random = seedrandom(seed); @@ -440,6 +441,7 @@ export class EndpointDocGenerator { dataset: 'endpoint', module: 'endpoint', type: 'creation', + sequence: this.sequence++, }, file: { owner: 'SYSTEM', @@ -586,6 +588,7 @@ export class EndpointDocGenerator { kind: 'event', type: options.eventType ? options.eventType : ['start'], id: this.seededUUIDv4(), + sequence: this.sequence++, }, host: this.commonInfo.host, process: { diff --git a/x-pack/plugins/security_solution/common/endpoint/models/event.ts b/x-pack/plugins/security_solution/common/endpoint/models/event.ts index b1a8524a9f9e79..30e11819c02721 100644 --- a/x-pack/plugins/security_solution/common/endpoint/models/event.ts +++ b/x-pack/plugins/security_solution/common/endpoint/models/event.ts @@ -86,6 +86,20 @@ export function eventId(event: ResolverEvent): number | undefined | string { return event.event.id; } +export function eventSequence(event: ResolverEvent): number | undefined { + if (isLegacyEvent(event)) { + return firstNonNullValue(event.endgame.serial_event_id); + } + return firstNonNullValue(event.event?.sequence); +} + +export function eventSequenceSafeVersion(event: SafeResolverEvent): number | undefined { + if (isLegacyEventSafeVersion(event)) { + return firstNonNullValue(event.endgame.serial_event_id); + } + return firstNonNullValue(event.event?.sequence); +} + export function eventIDSafeVersion(event: SafeResolverEvent): number | undefined | string { return firstNonNullValue( isLegacyEventSafeVersion(event) ? event.endgame?.serial_event_id : event.event?.id diff --git a/x-pack/plugins/security_solution/common/endpoint/types.ts b/x-pack/plugins/security_solution/common/endpoint/types.ts index 61ce672405fd58..861e63c7813770 100644 --- a/x-pack/plugins/security_solution/common/endpoint/types.ts +++ b/x-pack/plugins/security_solution/common/endpoint/types.ts @@ -311,6 +311,7 @@ export interface AlertEvent { dataset: string; module: string; type: string; + sequence: number; }; Endpoint: { policy: { @@ -515,6 +516,7 @@ export interface EndpointEvent { type: string | string[]; id: string; kind: string; + sequence: number; }; host: Host; network?: { @@ -591,6 +593,7 @@ export type SafeEndpointEvent = Partial<{ type: ECSField; id: ECSField; kind: ECSField; + sequence: ECSField; }>; host: Partial<{ id: ECSField; diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/children.test.ts b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/children.test.ts index 8175764b3a0a2f..4e210e0237fcd0 100644 --- a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/children.test.ts +++ b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/children.test.ts @@ -4,12 +4,16 @@ * you may not use this file except in compliance with the Elastic License. */ import { ChildrenQuery } from './children'; -import { PaginationBuilder } from '../utils/pagination'; +import { ChildrenPaginationBuilder } from '../utils/children_pagination'; import { legacyEventIndexPattern } from './legacy_event_index_pattern'; describe('Children query', () => { it('constructs a legacy multi search query', () => { - const query = new ChildrenQuery(new PaginationBuilder(1), 'index-pattern', 'endpointID'); + const query = new ChildrenQuery( + new ChildrenPaginationBuilder(1), + 'index-pattern', + 'endpointID' + ); // using any here because otherwise ts complains that it doesn't know what bool and filter are // eslint-disable-next-line @typescript-eslint/no-explicit-any const msearch: any = query.buildMSearch('1234'); @@ -20,7 +24,7 @@ describe('Children query', () => { }); it('constructs a non-legacy multi search query', () => { - const query = new ChildrenQuery(new PaginationBuilder(1), 'index-pattern'); + const query = new ChildrenQuery(new ChildrenPaginationBuilder(1), 'index-pattern'); // using any here because otherwise ts complains that it doesn't know what bool and filter are // eslint-disable-next-line @typescript-eslint/no-explicit-any const msearch: any = query.buildMSearch(['1234', '5678']); diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/children.ts b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/children.ts index 902d287a09e428..6fb38a32f9581a 100644 --- a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/children.ts +++ b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/queries/children.ts @@ -6,7 +6,7 @@ import { SearchResponse } from 'elasticsearch'; import { ResolverEvent } from '../../../../../common/endpoint/types'; import { ResolverQuery } from './base'; -import { PaginationBuilder } from '../utils/pagination'; +import { ChildrenPaginationBuilder } from '../utils/children_pagination'; import { JsonObject } from '../../../../../../../../src/plugins/kibana_utils/common'; /** @@ -14,7 +14,7 @@ import { JsonObject } from '../../../../../../../../src/plugins/kibana_utils/com */ export class ChildrenQuery extends ResolverQuery { constructor( - private readonly pagination: PaginationBuilder, + private readonly pagination: ChildrenPaginationBuilder, indexPattern: string | string[], endpointID?: string ) { @@ -32,6 +32,7 @@ export class ChildrenQuery extends ResolverQuery { query: { bool: { filter: [ + ...paginationFields.filters, { terms: { 'endgame.unique_ppid': uniquePIDs }, }, @@ -63,7 +64,7 @@ export class ChildrenQuery extends ResolverQuery { } protected query(entityIDs: string[]): JsonObject { - const paginationFields = this.pagination.buildQueryFieldsAsInterface('event.id'); + const paginationFields = this.pagination.buildQueryFields('event.id'); return { /** * Using collapse here will only return a single event per occurrence of a process.entity_id. The events are sorted @@ -80,12 +81,12 @@ export class ChildrenQuery extends ResolverQuery { collapse: { field: 'process.entity_id', }, - // do not set the search_after field because collapse does not work with it size: paginationFields.size, sort: paginationFields.sort, query: { bool: { filter: [ + ...paginationFields.filters, { bool: { should: [ diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_helper.ts b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_helper.ts index ef487897e3b4ea..b82b972b887b54 100644 --- a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_helper.ts +++ b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_helper.ts @@ -16,7 +16,7 @@ import { ResolverChildren, } from '../../../../../common/endpoint/types'; import { createChild } from './node'; -import { PaginationBuilder } from './pagination'; +import { ChildrenPaginationBuilder } from './children_pagination'; /** * This class helps construct the children structure when building a resolver tree. @@ -162,7 +162,7 @@ export class ChildrenNodesHelper { for (const nodeEntityID of nodes.values()) { const cachedNode = this.entityToNodeCache.get(nodeEntityID); if (cachedNode) { - cachedNode.nextChild = PaginationBuilder.buildCursor(startEvents); + cachedNode.nextChild = ChildrenPaginationBuilder.buildCursor(startEvents); } } } diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_pagination.ts b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_pagination.ts new file mode 100644 index 00000000000000..1e154caf70c48a --- /dev/null +++ b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_pagination.ts @@ -0,0 +1,129 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License; + * you may not use this file except in compliance with the Elastic License. + */ + +import { ResolverEvent } from '../../../../../common/endpoint/types'; +import { eventSequence } from '../../../../../common/endpoint/models/event'; +import { JsonObject } from '../../../../../../../../src/plugins/kibana_utils/common'; +import { urlEncodeCursor, SortFields, urlDecodeCursor } from './pagination'; + +/** + * Pagination information for the children class. + */ +export interface ChildrenPaginationCursor { + timestamp: number; + sequence: number; +} + +/** + * Interface for defining the returned pagination information. + */ +export interface ChildrenPaginationFields { + sort: SortFields; + size: number; + filters: JsonObject[]; +} + +/** + * This class handles constructing pagination cursors that resolver can use to return additional events in subsequent + * queries. + */ +export class ChildrenPaginationBuilder { + constructor( + /** + * upper limit of how many results should be returned by the parent query. + */ + private readonly size: number, + /** + * timestamp that will be used in the search_after section + */ + private readonly timestamp?: number, + /** + * unique sequence number for the event + */ + private readonly sequence?: number + ) {} + + /** + * This function validates that the parsed cursor is a ChildrenPaginationCursor. + * + * @param parsed an object parsed from an encoded cursor. + */ + static decode( + parsed: ChildrenPaginationCursor | undefined + ): ChildrenPaginationCursor | undefined { + if (parsed && parsed.timestamp && parsed.sequence) { + const { timestamp, sequence } = parsed; + return { timestamp, sequence }; + } + } + + /** + * Construct a cursor to use in subsequent queries. + * + * @param results the events that were returned by the ES query + */ + static buildCursor(results: ResolverEvent[]): string | null { + const lastResult = results[results.length - 1]; + const sequence = eventSequence(lastResult); + const cursor = { + timestamp: lastResult['@timestamp'], + sequence: sequence === undefined ? 0 : sequence, + }; + return urlEncodeCursor(cursor); + } + + /** + * Creates a PaginationBuilder with an upper bound limit of results and a specific cursor to use to retrieve the next + * set of results. + * + * @param limit upper bound for the number of results to return within this query + * @param after a cursor to retrieve the next set of results + */ + static createBuilder(limit: number, after?: string): ChildrenPaginationBuilder { + if (after) { + try { + const cursor = urlDecodeCursor(after, ChildrenPaginationBuilder.decode); + if (cursor && cursor.timestamp && cursor.sequence) { + return new ChildrenPaginationBuilder(limit, cursor.timestamp, cursor.sequence); + } + } catch (err) { + /* tslint:disable:no-empty */ + } // ignore invalid cursor values + } + return new ChildrenPaginationBuilder(limit); + } + + /** + * Helper for creates an object for adding the pagination fields to a query + * + * @param tiebreaker a unique field to use as the tiebreaker for the search_after + * @returns an object containing the pagination information + */ + buildQueryFields(tiebreaker: string): ChildrenPaginationFields { + const sort: SortFields = [{ '@timestamp': 'asc' }, { [tiebreaker]: 'asc' }]; + const filters: JsonObject[] = []; + if (this.timestamp && this.sequence) { + filters.push( + { + range: { + '@timestamp': { + gte: this.timestamp, + }, + }, + }, + { + range: { + 'event.sequence': { + gt: this.sequence, + }, + }, + } + ); + } + + return { sort, size: this.size, filters }; + } +} diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_start_query_handler.ts b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_start_query_handler.ts index 1c741847207931..30d46d12afbe53 100644 --- a/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_start_query_handler.ts +++ b/x-pack/plugins/security_solution/server/endpoint/routes/resolver/utils/children_start_query_handler.ts @@ -11,7 +11,7 @@ import { ChildrenQuery } from '../queries/children'; import { QueryInfo } from '../queries/multi_searcher'; import { QueryHandler } from './fetch'; import { ChildrenNodesHelper } from './children_helper'; -import { PaginationBuilder } from './pagination'; +import { ChildrenPaginationBuilder } from './children_pagination'; /** * Retrieve the start lifecycle events for the children of a resolver tree. @@ -32,7 +32,7 @@ export class ChildrenStartQueryHandler implements QueryHandler = (parsed: T | undefined) => T | undefined; + /** * Interface for defining the returned pagination information. */ @@ -31,10 +41,42 @@ export interface PaginationFields { searchAfter?: SearchAfterFields; } +/** + * A function to encode a cursor from a pagination object. + * + * @param data Transforms a pagination cursor into a base64 encoded string + */ +export function urlEncodeCursor(data: PaginationCursor | ChildrenPaginationCursor): string { + const value = JSON.stringify(data); + return Buffer.from(value, 'utf8') + .toString('base64') + .replace(/\+/g, '-') + .replace(/\//g, '_') + .replace(/=+$/g, ''); +} + +/** + * A function to decode a cursor. + * + * @param cursor a cursor encoded by the `urlEncodeCursor` function + * @param decode a function to transform the parsed data into an actual type + */ +export function urlDecodeCursor(cursor: string, decode: Decoder): T | undefined { + const fixedCursor = cursor.replace(/\-/g, '+').replace(/_/g, '/'); + const data = Buffer.from(fixedCursor, 'base64').toString('utf8'); + let parsed: T; + try { + parsed = JSON.parse(data); + } catch (e) { + return; + } + + return decode(parsed); +} + /** * This class handles constructing pagination cursors that resolver can use to return additional events in subsequent - * queries. It also constructs an aggregation query to determine the totals for other queries. This class should be used - * with a query to build cursors for paginated results. + * queries. */ export class PaginationBuilder { constructor( @@ -52,22 +94,16 @@ export class PaginationBuilder { private readonly eventID?: string ) {} - private static urlEncodeCursor(data: PaginationCursor): string { - const value = JSON.stringify(data); - return Buffer.from(value, 'utf8') - .toString('base64') - .replace(/\+/g, '-') - .replace(/\//g, '_') - .replace(/=+$/g, ''); - } - - private static urlDecodeCursor(cursor: string): PaginationCursor { - const fixedCursor = cursor.replace(/\-/g, '+').replace(/_/g, '/'); - const data = Buffer.from(fixedCursor, 'base64').toString('utf8'); - const { timestamp, eventID } = JSON.parse(data); - // take some extra care to only grab the things we want - // convert the timestamp string to date object - return { timestamp, eventID }; + /** + * Validates that the parsed object is actually a PaginationCursor. + * + * @param parsed an object parsed from an encoded cursor. + */ + static decode(parsed: PaginationCursor | undefined): PaginationCursor | undefined { + if (parsed && parsed.timestamp && parsed.eventID) { + const { timestamp, eventID } = parsed; + return { timestamp, eventID }; + } } /** @@ -81,7 +117,7 @@ export class PaginationBuilder { timestamp: lastResult['@timestamp'], eventID: eventId(lastResult) === undefined ? '' : String(eventId(lastResult)), }; - return PaginationBuilder.urlEncodeCursor(cursor); + return urlEncodeCursor(cursor); } /** @@ -107,8 +143,8 @@ export class PaginationBuilder { static createBuilder(limit: number, after?: string): PaginationBuilder { if (after) { try { - const cursor = PaginationBuilder.urlDecodeCursor(after); - if (cursor.timestamp && cursor.eventID) { + const cursor = urlDecodeCursor(after, PaginationBuilder.decode); + if (cursor && cursor.timestamp && cursor.eventID) { return new PaginationBuilder(limit, cursor.timestamp, cursor.eventID); } } catch (err) { diff --git a/x-pack/test/security_solution_endpoint_api_int/apis/resolver/children.ts b/x-pack/test/security_solution_endpoint_api_int/apis/resolver/children.ts index cde1a3616b620a..2dec3c755a93b2 100644 --- a/x-pack/test/security_solution_endpoint_api_int/apis/resolver/children.ts +++ b/x-pack/test/security_solution_endpoint_api_int/apis/resolver/children.ts @@ -7,11 +7,12 @@ import expect from '@kbn/expect'; import { SearchResponse } from 'elasticsearch'; import { entityId } from '../../../../plugins/security_solution/common/endpoint/models/event'; import { eventsIndexPattern } from '../../../../plugins/security_solution/common/endpoint/constants'; -import { PaginationBuilder } from '../../../../plugins/security_solution/server/endpoint/routes/resolver/utils/pagination'; +import { ChildrenPaginationBuilder } from '../../../../plugins/security_solution/server/endpoint/routes/resolver/utils/children_pagination'; import { ChildrenQuery } from '../../../../plugins/security_solution/server/endpoint/routes/resolver/queries/children'; import { ResolverTree, ResolverEvent, + ResolverChildren, } from '../../../../plugins/security_solution/common/endpoint/types'; import { FtrProviderContext } from '../../ftr_provider_context'; import { @@ -112,7 +113,7 @@ export default function resolverAPIIntegrationTests({ getService }: FtrProviderC it('only retrieves the start event for the child node', async () => { const childrenQuery = new ChildrenQuery( - PaginationBuilder.createBuilder(100), + ChildrenPaginationBuilder.createBuilder(100), eventsIndexPattern ); // [1] here gets the body portion of the array @@ -125,5 +126,83 @@ export default function resolverAPIIntegrationTests({ getService }: FtrProviderC expect(event.event?.type).to.eql(['start']); }); }); + + describe('children api returns same node multiple times', () => { + let origin: Event; + let startEvent: Event; + let infoEvent: Event; + let execEvent: Event; + let genData: InsertedEvents; + + before(async () => { + // Construct the following tree: + // Origin -> (infoEvent, startEvent, execEvent are all for the same node) + origin = generator.generateEvent(); + startEvent = generator.generateEvent({ + parentEntityID: origin.process.entity_id, + ancestry: [origin.process.entity_id], + eventType: ['start'], + }); + + infoEvent = generator.generateEvent({ + timestamp: startEvent['@timestamp'] + 100, + parentEntityID: origin.process.entity_id, + ancestry: [origin.process.entity_id], + entityID: startEvent.process.entity_id, + eventType: ['info'], + }); + + execEvent = generator.generateEvent({ + timestamp: infoEvent['@timestamp'] + 100, + parentEntityID: origin.process.entity_id, + ancestry: [origin.process.entity_id], + eventType: ['change'], + entityID: startEvent.process.entity_id, + }); + genData = await resolver.insertEvents([origin, infoEvent, startEvent, execEvent]); + }); + + after(async () => { + await resolver.deleteData(genData); + }); + + it('retrieves the same node three times', async () => { + let { body }: { body: ResolverChildren } = await supertest + .get(`/api/endpoint/resolver/${origin.process.entity_id}/children?children=1`) + .expect(200); + expect(body.childNodes.length).to.be(1); + expect(body.nextChild).to.not.be(null); + expect(body.childNodes[0].entityID).to.be(startEvent.process.entity_id); + expect(body.childNodes[0].lifecycle[0].event?.type).to.eql(startEvent.event.type); + + ({ body } = await supertest + .get( + `/api/endpoint/resolver/${origin.process.entity_id}/children?children=1&afterChild=${body.nextChild}` + ) + .expect(200)); + expect(body.childNodes.length).to.be(1); + expect(body.nextChild).to.not.be(null); + expect(body.childNodes[0].entityID).to.be(infoEvent.process.entity_id); + expect(body.childNodes[0].lifecycle[1].event?.type).to.eql(infoEvent.event.type); + + ({ body } = await supertest + .get( + `/api/endpoint/resolver/${origin.process.entity_id}/children?children=1&afterChild=${body.nextChild}` + ) + .expect(200)); + expect(body.childNodes.length).to.be(1); + expect(body.nextChild).to.not.be(null); + expect(body.childNodes[0].entityID).to.be(infoEvent.process.entity_id); + expect(body.childNodes[0].lifecycle[2].event?.type).to.eql(execEvent.event.type); + + ({ body } = await supertest + .get( + `/api/endpoint/resolver/${origin.process.entity_id}/children?children=1&afterChild=${body.nextChild}` + ) + .expect(200)); + expect(body.childNodes.length).to.be(0); + expect(body.nextChild).to.be(null); + }); + }); }); } diff --git a/x-pack/test/security_solution_endpoint_api_int/apis/resolver/tree.ts b/x-pack/test/security_solution_endpoint_api_int/apis/resolver/tree.ts index 7b511c3be74b54..f4836379ca273f 100644 --- a/x-pack/test/security_solution_endpoint_api_int/apis/resolver/tree.ts +++ b/x-pack/test/security_solution_endpoint_api_int/apis/resolver/tree.ts @@ -537,7 +537,6 @@ export default function ({ getService }: FtrProviderContext) { describe('legacy events', () => { const endpointID = '5a0c957f-b8e7-4538-965e-57e8bb86ad3a'; const entityID = '94041'; - const cursor = 'eyJ0aW1lc3RhbXAiOjE1ODE0NTYyNTUwMDAsImV2ZW50SUQiOiI5NDA0MiJ9'; it('returns child process lifecycle events', async () => { const { body }: { body: ResolverChildren } = await supertest @@ -566,20 +565,25 @@ export default function ({ getService }: FtrProviderContext) { ).to.eql(93932); }); - // The children api does not support pagination currently - it.skip('returns no values when there is no more data', async () => { - const { body } = await supertest - // after is set to the document id of the last event so there shouldn't be any more after it + it('returns no values when there is no more data', async () => { + let { body }: { body: ResolverChildren } = await supertest .get( - `/api/endpoint/resolver/${entityID}/children?legacyEndpointID=${endpointID}&afterChild=${cursor}` + // there should only be a single child for this node + `/api/endpoint/resolver/94041/children?legacyEndpointID=${endpointID}&children=1` ) .expect(200); + expect(body.nextChild).to.not.be(null); + + ({ body } = await supertest + .get( + `/api/endpoint/resolver/94041/children?legacyEndpointID=${endpointID}&afterChild=${body.nextChild}` + ) + .expect(200)); expect(body.childNodes).be.empty(); expect(body.nextChild).to.eql(null); }); - // The children api does not support pagination currently - it.skip('returns the first page of information when the cursor is invalid', async () => { + it('returns the first page of information when the cursor is invalid', async () => { const { body }: { body: ResolverChildren } = await supertest .get( `/api/endpoint/resolver/${entityID}/children?legacyEndpointID=${endpointID}&afterChild=blah` @@ -641,8 +645,7 @@ export default function ({ getService }: FtrProviderContext) { expect(body.nextChild).to.not.eql(null); }); - // children api does not support pagination currently - it.skip('paginates the children', async () => { + it('paginates the children', async () => { // this gets a node should have 3 children which were created in succession so that the timestamps // are ordered correctly to be retrieved in a single call const distantChildEntityID = Array.from(tree.childrenLevels[0].values())[0].id; @@ -671,8 +674,7 @@ export default function ({ getService }: FtrProviderContext) { expect(body.nextChild).to.be(null); }); - // children api does not support pagination currently - it.skip('gets all children in two queries', async () => { + it('gets all children in two queries', async () => { // should get all the children of the origin let { body }: { body: ResolverChildren } = await supertest .get(`/api/endpoint/resolver/${tree.origin.id}/children?children=3`)