[WIP] Issue tracker for alignment with recent backend changes

[!NOTE]
This issue description is still a work in progress.

Summary

List of changes needed to align with recent backend changes.

Request body fields that should no longer be explicitly set

The backend will not throw if these fields are provided, but it will generate or set them automatically if they are omitted from the request body.

• id
  If creating a new object.
  Note: creating new object revisions via POST still requires id.
• created
• modified
• spec_version
• x_mitre_attack_spec_version
• external_references[0]
  The reference where source_name="mitre-attack"
• workspace.attack_id
• created_by_ref
• x_mitre_modified_by_ref
• workspace.workflow.created_by_user_account
  This one warrants further discussion; the backend should likely block users from manually setting it.

Group creation requests

• Stop setting ["placeholder"] in aliases for group creation requests.

The group’s own name will automatically be injected into the aliases array as the first value.

Frontend validation needing review

The Technique class’s base_validate method is doing some questionable logic:

if (this.attackID && this.tactics.length == 0) {
  // only check tactics if object is not a draft
  result.errors.push({
    field: 'tactics',
    result: 'error',
    message: 'object has no tactics',
  });
}

Concern

This error only surfaces while editing existing objects. It will never occur when drafting a new object, even if the draft lacks a tactic.

Suggestion

• Remove this validation logic altogether.

Revoking objects

• Use the appropriate endpoint for revoking objects:
  • POST /api/:type/:stixId/revoke

Converting techniques and sub-techniques

• Use the appropriate endpoint for converting a technique to a sub-technique:
  • POST /api/techniques/:stixId/convert-to-subtechnique
• Use the appropriate endpoint for converting a sub-technique to a parent technique:
  • POST /api/techniques/:stixId/convert-to-technique

SRO request validation

• Review whether the frontend is setting x_mitre_version in the req.body of new SRO requests.

x_mitre_version is not permitted on relationships per the ADM.

Setting empty string fields

• In the StixObject base class, description defaults to an empty string. Don't set/post empty string values. Instead, just omit the field.
  e.g.:

  this.description = ''; // TODO do not set/post empty string -- just omit field