[Cases] Fix unified event attachments bypassing closed-case check

x-pack/platform/plugins/shared/cases/server/common/models/case_with_comments.test.ts

@@ -435,6 +435,27 @@ describe('CaseCommentModel', () => {
           })
         ).rejects.toThrow();
       });
+
+      it('throws if trying to add a unified (v2) event to a closed case', async () => {
+        clientArgs.services.caseService.getCase.mockResolvedValue(closedCase);
+
+        const modelForClosedCase = await CaseCommentModel.create(closedCase.id, clientArgs);
+
+        const unifiedEventComment = {
+          type: SECURITY_EVENT_ATTACHMENT_TYPE,
+          owner: SECURITY_SOLUTION_OWNER,
+          attachmentId: 'event-id-1',
+          metadata: { index: 'idx-1' },
+        };
+
+        await expect(
+          modelForClosedCase.createComment({
+            id: 'comment-1',
+            commentReq: unifiedEventComment as never,
+            createdDate,
+          })
+        ).rejects.toThrow('Event cannot be attached to a closed case');
+      });
     });
   });
 

x-pack/platform/plugins/shared/cases/server/common/models/case_with_comments.ts

@@ -20,12 +20,7 @@ import {
   isAlertAttachmentType,
   isEventAttachmentType,
 } from '../../../common/utils/attachments';
-import type {
-  AlertAttachmentPayload,
-  AttachmentAttributes,
-  Case,
-  EventAttachmentPayload,
-} from '../../../common/types/domain';
+import type { AttachmentAttributes, Case } from '../../../common/types/domain';
 import {
   CaseRt,
   CaseStatuses,
@@ -519,13 +514,6 @@ export class CaseCommentModel {
     return dedupedAttachments;
   }
 
-  private getAttachmentsByType<
-    T extends AttachmentType,
-    R = T extends AttachmentType.event ? AlertAttachmentPayload[] : EventAttachmentPayload[]
-  >(attachments: AttachmentRequestV2[], attachmentType: T): R {
-    return attachments.filter((attachment) => attachment.type === attachmentType) as R;
-  }
-
   private async validateCreateCommentRequest(req: Array<AttachmentRequestV2>) {
     if (this.caseInfo.attributes.status === CaseStatuses.closed) {
       const hasAlertsInRequest = req.some((a) => isAlertAttachmentType(a.type));
@@ -534,8 +522,9 @@ export class CaseCommentModel {
         throw Boom.badRequest('Alert cannot be attached to a closed case');
       }
 
-      const eventAttachments = this.getAttachmentsByType(req, AttachmentType.event);
-      const hasEventsInRequest = eventAttachments.length > 0;
+      // `isEventAttachmentType` matches both the legacy `event` type and the unified
+      // `security.event` type — a type-only match here would miss unified events.
+      const hasEventsInRequest = req.some((a) => isEventAttachmentType(a.type));
 
       if (hasEventsInRequest) {
         throw Boom.badRequest('Event cannot be attached to a closed case');