[Security Solution] Implement a Zod transformation from snake_case to camelCase and vice versa

[jpdjere]

Epics: https://github.com/elastic/security-team/issues/1974 (internal), #174168
Needed for: #180124

Summary

We have API schemas where we use snake_casing for object properties, and we have internal BE-side schemas for rule parameters and saved object attributes where we use camelCasing for object properties. Because of that, we manually transform objects between the two schemas, and every time we add a new rule field, we need to write two schemas for it and two transformations between them

kibana/x-pack/plugins/security_solution/common/api/detection_engine/model/rule_schema/common_attributes.gen.ts

Lines 449 to 461 in 7f0701d

	export type AlertSuppression = z.infer<typeof AlertSuppression>;
	export const AlertSuppression = z.object({
	group_by: AlertSuppressionGroupBy,
	duration: AlertSuppressionDuration.optional(),
	missing_fields_strategy: AlertSuppressionMissingFieldsStrategy.optional(),
	});
	export type AlertSuppressionCamel = z.infer<typeof AlertSuppressionCamel>;
	export const AlertSuppressionCamel = z.object({
	groupBy: AlertSuppressionGroupBy,
	duration: AlertSuppressionDuration.optional(),
	missingFieldsStrategy: AlertSuppressionMissingFieldsStrategy.optional(),
	});

kibana/x-pack/plugins/security_solution/server/lib/detection_engine/rule_management/utils/utils.ts

Lines 346 to 366 in 7f0701d

	export const convertAlertSuppressionToCamel = (
	input: AlertSuppression | undefined
	): AlertSuppressionCamel | undefined =>
	input
	? {
	groupBy: input.group_by,
	duration: input.duration,
	missingFieldsStrategy: input.missing_fields_strategy,
	}
	: undefined;
	export const convertAlertSuppressionToSnake = (
	input: AlertSuppressionCamel | undefined
	): AlertSuppression | undefined =>
	input
	? {
	group_by: input.groupBy,
	duration: input.duration,
	missing_fields_strategy: input.missingFieldsStrategy,
	}
	: undefined;

To simplify writing and maintaining schemas, we should try to implement a reusable Zod transformations from snake_case to camelCase, something like that:

export type SnakeCasedObject = z.infer<typeof SnakeCasedObject>;
export const SnakeCasedObject = z.object({
  nested_object: z.object({
    some_property: z.string(),
  }),
});

export type CamelCasedObject = z.infer<typeof CamelCasedObject>;
export const CamelCasedObject = SnakeCasedObject.transform(toCamelCase);

// Should yield:

/*
type CamelCasedObject = {
  nestedObject: {
    someProperty: string;
  };
};
*/

Notes

Some ideas how to do that can be found in a GitHub issue: colinhacks/zod#486 (comment).

This transformation should:

• Support recursion: it should be possible to apply it to deeply nested objects.
• Support arrays of primitives and arrays of deeply nested objects.
• Support type intersection and union, including discriminated union. This will be needed for defining types for the rule_source field:
  • [Security Solution] Add rule_source to the API schema #180122
  • [Security Solution] Make changes in the internal rule schema #180124

During implementation, please evaluate if it would be helpful to have a vice versa toSnakeCase Zod transformation, in addition to toCamelCase.

Note that toCamelCase would be in fact a schema and type transformation that would make it easier to define internal schemas that correspond to API schemas. It wouldn't be a data transformation (something we have in rule_converters.ts). To make it easier to write and maintain functions like convertAlertSuppressionToCamel and convertAlertSuppressionToSnake we might additionally want to write reusable functions for transforming data. Functions from lodash could be useful for that: _.camelCase, _.snakeCase, _.mapKeys.

Background

Context from the RFC:

kibana/x-pack/plugins/security_solution/docs/rfcs/detection_response/prebuilt_rules_customization.md

Lines 313 to 330 in 07706fd

	#### Internal rule schema
	**The internal rule schema** needs to represent that the `immutable` and the new `ruleSource` field may not always exist, so they must be optional.
	_Source: [x-pack/plugins/security_solution/server/lib/detection_engine/rule_schema/model/rule_schemas.ts](https://github.com/elastic/kibana/blob/main/x-pack/plugins/security_solution/server/lib/detection_engine/rule_schema/model/rule_schemas.ts)_
	```ts
	export type BaseRuleParams = z.infer<typeof BaseRuleParams>;
	export const BaseRuleParams = z.object({
	// [...]
	immutable: IsRuleImmutable.optional(),
	ruleSource: RuleSource.transform(camelize).optional(),
	// [...]
	});
	```
	> Notice that in the internal schema we cannot simply reuse the `RuleSource` attribute defined for the API schema, since it should have CamelCase and the API schema uses snake_case. We need to apply a transformation to our Zod type. See this [issue](https://github.com/colinhacks/zod/issues/486#issuecomment-1567296747).

[elasticmachine]

Pinging @elastic/security-detections-response (Team:Detections and Resp)

[elasticmachine]

Pinging @elastic/security-solution (Team: SecuritySolution)

[elasticmachine]

Pinging @elastic/security-detection-rule-management (Team:Detection Rule Management)

[xcrzx]

The approach proposed in the ticket didn't work as expected, see #184004 for more detail. So I am reopening it. We need to investigate other options for automatic case conversation in schemas