Relationship updates at CSV file import don't check confidence

[Archidoit]

Description

Relationship updates at CSV file import don't check confidence

Reproducible Steps

• Log as userA with confidence = 100
• Create entities/relationships that are in a csv file, with confidence = 100
• Log as a userB with confidence = 50
• Import a file in Data > Import
• Launch an import of the file via a CSV mapper
• The entities/relationships are updated with the userB name in 'author'

Expected behavior

The entities/relationsihps shouldn't be update because their confidences are higher than the one of userB

[lndrtrbn]

@Archidoit don t you mean 'creator' instead of 'author' ? That's what I can reproduce locally in any case. If it is the field author you are effectively talking too then I'll need some help to reproduce it

EDIT:

• yes we are talking of the creator field

[lndrtrbn]

Ok so the root cause was found and I fixed it in the draft PR above.
Nonetheless I would like confirmation from @nino-filigran and @richard-julien about it.

Recap of the actual behavior: when upserting entities, we add the user upserting in the array of creators no matter the confidence of the user. Why? In the function upsertElement of the file middleware.js there is an algorithm to determine which fields should be upserted or not and in this algorithm we found this line (l2520):

// Ids and creators consolidation is always granted
const isStructuralUpsert = attributeKey === xOpenctiStixIds.name || attributeKey === creators.name;

This boolean isStructuralUpsert is then used to bypass other checks like the confidence.

// Upsert will be done if upsert is well-defined but also in full synchro mode or if the current value is empty
if (isStructuralUpsert || canBeUpsert || isFullSync || isCurrentlyEmpty) {
  inputs.push(...buildAttributeUpdate(isFullSync, attribute, element[attributeKey], inputData));
}

I'm not sure to understand the purpose of this boolean but if it exists, there should have a reason. But at the end, I think that if there is only the array of creators that has been changed with the upsert, and that user confidence is too low, then we should not taking it into account.

Maybe I'm not right, can you confirm?

[richard-julien]

Creators must always be upserted independently of the confidence level.
This is intended an so not a bug