Fix bug when deleting detector with 0 rules. (#1648)

Signed-off-by: Thomas Hurney <hurneyt@amazon.com>

Author: AWSHurneyt

src/main/java/org/opensearch/securityanalytics/transport/TransportDeleteDetectorAction.java

@@ -197,6 +197,13 @@ private void onGetResponse(Detector detector) {
             deleteWorkflow(detector, onDeleteWorkflowStep);
             onDeleteWorkflowStep.whenComplete(acknowledgedResponse -> {
                 List<String> monitorIds = detector.getMonitorIds();
+
+                // A detector with 0 rules will have 0 monitors to delete. Skipping monitor deletion steps.
+                if (monitorIds.isEmpty()) {
+                    deleteDetectorFromConfig(detector.getId(), request.getRefreshPolicy());
+                    return;
+                }
+
                 ActionListener<DeleteMonitorResponse> deletesListener = new GroupedActionListener<>(new ActionListener<>() {
                     @Override
                     public void onResponse(Collection<DeleteMonitorResponse> responses) {

src/test/java/org/opensearch/securityanalytics/resthandler/DetectorRestApiIT.java

@@ -1877,4 +1877,32 @@ public void testCreatingDetectorWithDynamicQueryIndexEnabledAndThenDisabled() th
         Assert.assertEquals("Create detector failed", RestStatus.CREATED, restStatus(createResponse));
         Assert.assertTrue(doesIndexExist(DetectorMonitorConfig.getRuleIndex(randomDetectorType()) + "-000001"));
     }
+
+    public void testDeletingDetectorEditedToHaveZeroRules() throws IOException {
+        String index = createTestIndex(randomIndex(), windowsIndexMapping());
+
+        Request createMappingRequest = new Request("POST", SecurityAnalyticsPlugin.MAPPER_BASE_URI);
+        createMappingRequest.setJsonEntity(
+                "{ \"index_name\":\"" + index + "\"," +
+                        "  \"rule_topic\":\"" + randomDetectorType() + "\", " +
+                        "  \"partial\":true" +
+                        "}"
+        );
+        Response response = client().performRequest(createMappingRequest);
+        assertEquals(HttpStatus.SC_OK, response.getStatusLine().getStatusCode());
+
+        // Create a test detector that has at least 1 rule.
+        Detector detector = randomDetectorWithTriggers(getRandomPrePackagedRules(), List.of(new DetectorTrigger(null, "test-trigger", "1", List.of(randomDetectorType()), List.of(), List.of(), List.of(), List.of(), List.of())));
+        String detectorId = createDetector(detector);
+
+        // Update the detector to have 0 rules. This should update the detector's 'monitor_id' attribute to be an empty array.
+        DetectorInput input = new DetectorInput("detector with no rules", List.of(index), List.of(), List.of());
+        Detector updatedDetector = randomDetectorWithInputs(List.of(input));
+
+        Response updateResponse = makeRequest(client(), "PUT", SecurityAnalyticsPlugin.DETECTOR_BASE_URI + "/" + detectorId, Collections.emptyMap(), toHttpEntity(updatedDetector));
+        Assert.assertEquals("Update detector failed", RestStatus.OK, restStatus(updateResponse));
+
+        Response deleteResponse = makeRequest(client(), "DELETE", SecurityAnalyticsPlugin.DETECTOR_BASE_URI + "/" + detectorId, Collections.emptyMap(), null);
+        Assert.assertEquals("Delete detector failed", RestStatus.OK, restStatus(deleteResponse));
+    }
 }