From 4be16d8a99820cd6b9adbbf0e7f5056a670fcb1c Mon Sep 17 00:00:00 2001
From: To-om <toom@thehive-project.org>
Date: Fri, 17 Jul 2020 14:23:42 +0200
Subject: [PATCH] #1410 Fix objectId and objectType in action audits

---
 .../connector/cortex/services/ActionSrv.scala | 58 +++++++++----------
 1 file changed, 26 insertions(+), 32 deletions(-)

diff --git a/cortex/connector/src/main/scala/org/thp/thehive/connector/cortex/services/ActionSrv.scala b/cortex/connector/src/main/scala/org/thp/thehive/connector/cortex/services/ActionSrv.scala
index 62b06c595f..c03d7537b9 100644
--- a/cortex/connector/src/main/scala/org/thp/thehive/connector/cortex/services/ActionSrv.scala
+++ b/cortex/connector/src/main/scala/org/thp/thehive/connector/cortex/services/ActionSrv.scala
@@ -130,43 +130,37 @@ class ActionSrv @Inject() (
     */
   def finished(actionId: String, cortexJob: CortexJob)(implicit authContext: AuthContext): Try[Action with Entity] =
     db.tryTransaction { implicit graph =>
-      val operations = cortexJob
-        .report
-        .fold[Seq[ActionOperation]](Nil)(_.operations.map(_.as[ActionOperation]))
-        .map { operation =>
-          (for {
-            action <- getByIds(actionId).richAction.getOrFail()
-            updatedOperation <- actionOperationSrv.execute(
-              action.context,
-              operation,
-              relatedCase(actionId),
-              relatedTask(actionId)
-            )
-          } yield updatedOperation)
-            .fold(t => ActionOperationStatus(operation, success = false, t.getMessage), identity)
-        }
-
-      for {
-        updated <- getByIds(actionId).updateOne(
-          "status"     -> cortexJob.status.toJobStatus,
-          "report"     -> cortexJob.report.map(r => Json.toJson(r.copy(operations = Nil))),
-          "endDate"    -> Some(new Date()),
-          "operations" -> operations.map(Json.toJsObject(_))
-        )
-      } yield {
-        relatedCase(updated._id)
-          .orElse(get(updated._id).context.headOption()) // FIXME an action context is it an audit context ?
-          .foreach(relatedEntity =>
+      getByIds(actionId).richAction.getOrFail().flatMap { action =>
+        val operations = cortexJob
+          .report
+          .fold[Seq[ActionOperation]](Nil)(_.operations.map(_.as[ActionOperation]))
+          .map { operation =>
+            actionOperationSrv
+              .execute(
+                action.context,
+                operation,
+                relatedCase(actionId),
+                relatedTask(actionId)
+              )
+              .fold(t => ActionOperationStatus(operation, success = false, t.getMessage), identity)
+          }
+        getByIds(actionId)
+          .updateOne(
+            "status"     -> cortexJob.status.toJobStatus,
+            "report"     -> cortexJob.report.map(r => Json.toJson(r.copy(operations = Nil))),
+            "endDate"    -> Some(new Date()),
+            "operations" -> operations.map(Json.toJsObject(_))
+          )
+          .map { updated =>
             auditSrv
               .action
               .update(
                 updated,
-                relatedEntity,
-                Json.obj("status" -> updated.status.toString, "objectId" -> relatedEntity._id, "objectType" -> relatedEntity._model.label)
+                action.context,
+                Json.obj("status" -> updated.status.toString, "objectId" -> action.context._id, "objectType" -> action.context._model.label)
               )
-          )
-
-        updated
+            updated
+          }
       }
     }