unlock prebuilt rules upgrade due to deprecated lastRun.outcomeMsg schema

maximpn · maximpn · commit 0cac49ca75a4 · 2026-02-01T13:30:25.000+01:00
diff --git a/x-pack/platform/plugins/shared/alerting/server/application/rule/methods/update/update_rule.test.ts b/x-pack/platform/plugins/shared/alerting/server/application/rule/methods/update/update_rule.test.ts
@@ -4709,4 +4709,53 @@ describe('update()', () => {
       expect(result.artifacts).toBeDefined();
     });
   });
+
+  describe('rule migration', () => {
+    test('migrates legacy lastRun.outcomeMsg string to string[]', async () => {
+      unsecuredSavedObjectsClient.create.mockResolvedValueOnce({
+        id: '1',
+        type: RULE_SAVED_OBJECT_TYPE,
+        attributes: {
+          enabled: true,
+          schedule: { interval: '1m' },
+          params: {
+            bar: true,
+          },
+          actions: [],
+          lastRun: {
+            outcomeMsg: 'Some message',
+          },
+          revision: 1,
+          scheduledTaskId: 'task-123',
+          createdAt: new Date().toISOString(),
+          updatedAt: new Date().toISOString(),
+        },
+        references: [],
+      });
+
+      const result = await rulesClient.update({
+        id: '1',
+        data: {
+          schedule: { interval: '1m' },
+          name: 'abc',
+          tags: ['foo'],
+          params: {
+            bar: true,
+            risk_score: 40,
+            severity: 'low',
+          },
+          actions: [],
+          alertDelay: {
+            active: 10,
+          },
+        },
+      });
+
+      expect(result).toMatchObject({
+        lastRun: {
+          outcomeMsg: ['Some message'],
+        },
+      });
+    });
+  });
 });
diff --git a/x-pack/platform/plugins/shared/alerting/server/application/rule/methods/update/update_rule.ts b/x-pack/platform/plugins/shared/alerting/server/application/rule/methods/update/update_rule.ts
@@ -316,6 +316,9 @@ async function updateRuleAttributes<Params extends RuleParams = never>({
     updatedBy: username,
     updatedAt: new Date().toISOString(),
     artifacts: artifactsWithRefs,
+    ...(originalRule.lastRun
+      ? { lastRun: migrateLegacyLastRunOutcomeMsg(originalRule.lastRun) }
+      : {}),
   });
 
   const mappedParams = getMappedParams(updatedParams);
@@ -379,3 +382,25 @@ async function updateRuleAttributes<Params extends RuleParams = never>({
   // without fixing all of other solution types
   return rule as SanitizedRule<Params>;
 }
+
+/**
+ * Migrates legacy lastRun.outcomeMsg from string to string[]
+ *
+ * Rule SO schema forces lastRun.outcomeMsg to be string[].
+ * However, some rules may have lastRun.outcomeMsg as string after upgrading from 7.x due to
+ * lack of migration. lastRun.outcomeMsg schema change from string to string[] happened after
+ * classical migrations were deprecated due to Serverless. And quite often it's not an issue
+ * as lastRun is absent.
+ */
+function migrateLegacyLastRunOutcomeMsg<LastRun extends { outcomeMsg?: unknown }>(
+  lastRun: LastRun
+): LastRun {
+  if (typeof lastRun.outcomeMsg === 'string') {
+    return {
+      ...lastRun,
+      outcomeMsg: [lastRun.outcomeMsg],
+    };
+  }
+
+  return lastRun;
+}
