Module cases_ops 

Case orchestration: filters, list/get, and the guarded mutation plans.

Structs

AttachGroup

AttachPlan

CaseEditReport

CaseFilter

CaseList

CommentPlan

CreatePlan

DeletePlan

ResolvedCase

StatusPlan

Constants

PAGE_SIZE

The _find route’s per-page cap.

Functions

apply_attach

One comments POST per rule group (the API takes one rule per comment). A failed group must not discard the groups that already attached: a ? on the first error would report only the raw error while leaving earlier groups attached, and a retry would then double-attach them. Accumulate per-group outcomes instead, so a partial failure renders as counts plus per-group detail rather than an opaque error.

apply_comment

apply_create

apply_delete

apply_status

case_row

The compact case row for list output and mutation reports: stable columns in a fixed order (preserve_order makes this the render contract).

export

The --out path: every page, unless limit stops it early.

export_with_page_size

The paging loop with an explicit page size, exposed for tests. Stops paging as soon as limit rows are in hand, mirroring alerts_ops::export’s shape.

find_query

Deterministic query string for GET /api/cases/_find. Key order is fixed so tests and fixtures are stable.

get_one

list

One bounded peek: page until limit + 1 rows are in hand or the server runs out, then truncate.

plan_attach

Resolve the case (for its title) and every alert (id, index, rule), fail-closed on any missing alert, then group by rule — the comments route takes one rule object per comment.

plan_comment

plan_create

plan_delete

The 0.4 area’s only destructive verb: the preview names each title.

plan_status

Fetch each case for its version, mark already-in-state rows, and PATCH only the rest. A no-op set still previews and reports zero updates.