fix(backend): add merging user as creator of the merged entity (#17913)

[Gabriele Bonadiman (gabrielebonadiman)]

Proposed changes

• When merging two entities, the acting user is now added to the resulting entity's creator_id list, matching the same convention already used during upsert (upsert-utils.js)
• Internal/system users (INTERNAL_USERS) and users flagged with no_creators are excluded from this, consistent with the upsert behavior

Related issues

• closes [Merge] Merged entity does not set the acting user as creator #17913

How to test this PR

1. Create two entities of the same type as user A
2. Merge them as user B via the platform UI or GraphQL mutation
3. Open the resulting merged entity and check the "Creators" field
4. Confirm user B now appears alongside the original creator(s)

Covered by a new integration test in middleware-test.js ("should merging user be added as creator of the merged entity"), which creates a target and source entity as ADMIN_USER, merges them as a distinct user, and asserts creator_id contains both the original creator and the merging user.

Checklist

• I consider the submitted work as finished
• I tested the code for its functionality
• I wrote test cases for the relevant use cases (coverage and e2e)
• I added/updated the relevant documentation (either on GitHub or on Notion)
• Where necessary, I refactored code to improve the overall quality

Further comments

The fix is scoped to mergeEntitiesRaw in middleware.ts and reuses the existing EditOperation.Add path for multi-valued attributes, so creator_id values are deduplicated automatically. No schema or GraphQL contract changes were needed since creator_id was already declared as a multi-valued, updatable attribute.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 28.14%. Comparing base (2457bc4) to head (2f40051).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #18287      +/-   ##
==========================================
- Coverage   36.37%   28.14%   -8.24%     
==========================================
  Files        3467     3467              
  Lines      141015   141017       +2     
  Branches    38072    38073       +1     
==========================================
- Hits        51295    39687   -11608     
- Misses      89720   101330   +11610     

Flag	Coverage Δ
opencti-client-python	49.85% <ø> (ø)
opencti-front	12.68% <ø> (ø)
opencti-graphql	47.94% <100.00%> (-23.49%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

This PR records the merging user as a creator of the resulting entity when applicable.

Changes:

• Updates merge creator attribution.
• Excludes internal and no_creators users.
• Adds merge and Elasticsearch test coverage.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Review findings
opencti-platform/opencti-graphql/src/database/middleware.ts	Critical (3): duplicate creator_id inputs can overwrite existing creators. Moderate (1): add tests for internal and no_creators users. Critical (1): restore the no-continue lint suppression.
opencti-platform/opencti-graphql/tests/02-dataInjection/01-dataCount/middleware-test.js	Moderate (1): clean up both fixtures in finally. Nit (2): clarify the test title.
opencti-platform/opencti-graphql/tests/03-integration/01-database/elLoadById-rel-payload-test.ts	Nit (1): remove or split this unrelated test. Critical (1): assert the converted indicates property rather than rel_indicates.

Suppressed comments (3)

opencti-platform/opencti-graphql/src/database/middleware.ts:1902

• The negative cases in this guard are part of the stated behavior, but the only merge test uses a normal user and exercises neither INTERNAL_USERS nor no_creators. Add merge tests for an internal actor and a user with no_creators: true, asserting their IDs are not appended; otherwise either exclusion branch can regress unnoticed.

  if (!INTERNAL_USERS[user.id] && !user.no_creators) {
    updateAttributes.push({ key: 'creator_id', value: [user.id], operation: EditOperation.Add });

opencti-platform/opencti-graphql/tests/02-dataInjection/01-dataCount/middleware-test.js:1158

• If the merge or the subsequent load fails before loadedThreat is assigned, this finally block deletes nothing, leaving both newly created fixtures in Elasticsearch. The unique suffix prevents name collisions but does not prevent failed runs from accumulating test data; clean up target and source as well, tolerating the source already being deleted by a partially completed merge.

      if (loadedThreat) {
        await deleteElementById(testContext, ADMIN_USER, loadedThreat.id, ENTITY_TYPE_THREAT_ACTOR_GROUP);

opencti-platform/opencti-graphql/tests/03-integration/01-database/elLoadById-rel-payload-test.ts:18

• This entire test exercises elLoadById relationship-payload sizing and the “SaaS/ES Circuit Breaker,” not merge creator behavior. It adds a 5,000-ID raw ES fixture to the merge PR even though the description says the change is scoped to mergeEntitiesRaw; please remove it from this PR or split it into the dedicated loader/performance change so this fix cannot fail for an unrelated assertion.

describe('elLoadById unbounded rel_* payload vs elFindByIds default exclusion', () => {

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.