import { map , mergeMap } from 'rxjs/operators' ; import { ISearchStrategy , PluginStart , shimHitsTotal , } from '../../../../../../src/plugins/data/server' ; import { ENHANCED_ES_SEARCH_STRATEGY } from '../../../../../../src/plugins/data/common' ; import { FactoryQueryTypes , StrategyResponseType , StrategyRequestType , } from '../../../common/search_strategy/osquery' ; import { osqueryFactory } from './factory' ; import { OsqueryFactory } from './factory/types' ; export const osquerySearchStrategyProvider = < T extends FactoryQueryTypes > ( data ) : ISearchStrategy < StrategyRequestType < T > , StrategyResponseType < T > > => { let es ; return { search : ( request , options , deps ) => { if ( request . factoryQueryType == null ) { throw new Error ( 'factoryQueryType is required' ) ; } const queryFactory = osqueryFactory [ request . factoryQueryType ] ; const dsl = queryFactory . buildDsl ( request ) ; es = dsl . index ?. includes ( 'fleet' ) ? data . search . searchAsInternalUser : data . search . getSearchStrategy ( ENHANCED_ES_SEARCH_STRATEGY ) ; return es . search ( { ... request , params : dsl , } , options , deps ) . pipe ( map ( ( response ) => ( { ... response , ... { rawResponse : shimHitsTotal ( response . rawResponse ) , } , } ) ) , mergeMap ( ( esSearchRes ) => queryFactory . parse ( request , esSearchRes ) ) ) ; } , cancel : async ( id , options , deps ) => { if ( es ?. cancel ) { return es . cancel ( id , options , deps ) ; } } , } ; } ;