[Cases] Fix unified event attachments bypassing closed-case check - #291173

…ck (#291173) (#291204)

# Backport

This will backport the following commits from `main` to `9.5`:
- [[Cases] Fix unified event attachments bypassing closed-case check
(#291173)](#291173)

<!--- Backport version: 12.0.4 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT
[{"author":{"name":"christineweng","email":"18648970+christineweng@users.noreply.github.com"},"sourceCommit":{"committedDate":"2026-09-15T15:55:18Z","message":"[Cases]
Fix unified event attachments bypassing closed-case check
(#291173)\n\n## Summary\n\n`validateCreateCommentRequest` blocks alerts
and events from being\nattached to a closed case. The event check
matched by legacy type only\n(`AttachmentType.event`, i.e. `'event'`),
so unified events\n(`security.event`) never triggered the guard and were
silently accepted\non closed cases.\n\nAlerts already used the
unified-aware `isAlertAttachmentType` predicate.\nThis aligns events to
the same pattern via `isEventAttachmentType`,\nwhich matches both
`'event'` (legacy) and `'security.event'` (unified).\n\nAlso removes the
now-dead `getAttachmentsByType` helper (its only call\nsite was the
buggy event check).\n\n**Found by** @radtke-vale, validated on staging
in [this
review\ncomment](https://github.com/elastic/kibana/pull/290961#discussion_r4014165733)\non
#290961.\n\n## Before / after (validated on
staging)\n\nBefore:\n```\nPOST kbn:/api/cases/{caseId}/comments\n{\n
\"type\": \"security.event\",\n \"owner\": \"securitySolution\",\n
\"attachmentId\": \"...\",\n \"metadata\": { \"index\": \"...\"
}\n}\n```\n→ `200`, attachment created on a closed
case.\n\nAfter:\n```json\n{\n \"statusCode\": 400,\n \"error\": \"Bad
Request\",\n \"message\": \"Event cannot be attached to a closed
case\"\n}\n```\n\n### Checklist\n\n- [ ] Any text added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)\n-
[
]\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\nwas
added for features that require explanation or tutorials\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [ ] If a plugin
configuration key changed, check if it needs to be\nallowlisted in the
cloud and added to the
[docker\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)\n-
[ ] This was checked for breaking HTTP API changes, and any
breaking\nchanges have been approved by the breaking-change committee.
The\n`release_note:breaking` label should be applied in these
situations.\n- [ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n- [x] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/docs/extend/kibana/contributing/workflow/how-we-use-github#release-notes)\n-
[x] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*` labels.\n\nMade with
Cursor","sha":"0b5aba9fe5761d0fd2fc2ce576e6d36146231465","branchLabelMapping":{"^v9.6.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:fix","backport:version","v9.6.0","v9.5.5","Team:Lantern"],"title":"[Cases]
Fix unified event attachments bypassing closed-case
check","number":291173,"url":"https://github.com/elastic/kibana/pull/291173","mergeCommit":{"message":"[Cases]
Fix unified event attachments bypassing closed-case check
(#291173)\n\n## Summary\n\n`validateCreateCommentRequest` blocks alerts
and events from being\nattached to a closed case. The event check
matched by legacy type only\n(`AttachmentType.event`, i.e. `'event'`),
so unified events\n(`security.event`) never triggered the guard and were
silently accepted\non closed cases.\n\nAlerts already used the
unified-aware `isAlertAttachmentType` predicate.\nThis aligns events to
the same pattern via `isEventAttachmentType`,\nwhich matches both
`'event'` (legacy) and `'security.event'` (unified).\n\nAlso removes the
now-dead `getAttachmentsByType` helper (its only call\nsite was the
buggy event check).\n\n**Found by** @radtke-vale, validated on staging
in [this
review\ncomment](https://github.com/elastic/kibana/pull/290961#discussion_r4014165733)\non
#290961.\n\n## Before / after (validated on
staging)\n\nBefore:\n```\nPOST kbn:/api/cases/{caseId}/comments\n{\n
\"type\": \"security.event\",\n \"owner\": \"securitySolution\",\n
\"attachmentId\": \"...\",\n \"metadata\": { \"index\": \"...\"
}\n}\n```\n→ `200`, attachment created on a closed
case.\n\nAfter:\n```json\n{\n \"statusCode\": 400,\n \"error\": \"Bad
Request\",\n \"message\": \"Event cannot be attached to a closed
case\"\n}\n```\n\n### Checklist\n\n- [ ] Any text added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)\n-
[
]\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\nwas
added for features that require explanation or tutorials\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [ ] If a plugin
configuration key changed, check if it needs to be\nallowlisted in the
cloud and added to the
[docker\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)\n-
[ ] This was checked for breaking HTTP API changes, and any
breaking\nchanges have been approved by the breaking-change committee.
The\n`release_note:breaking` label should be applied in these
situations.\n- [ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n- [x] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/docs/extend/kibana/contributing/workflow/how-we-use-github#release-notes)\n-
[x] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*` labels.\n\nMade with
Cursor","sha":"0b5aba9fe5761d0fd2fc2ce576e6d36146231465"}},"sourceBranch":"main","suggestedTargetBranches":["9.5"],"targetPullRequestStates":[{"branch":"main","label":"v9.6.0","branchLabelMappingKey":"^v9.6.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/291173","number":291173,"mergeCommit":{"message":"[Cases]
Fix unified event attachments bypassing closed-case check
(#291173)\n\n## Summary\n\n`validateCreateCommentRequest` blocks alerts
and events from being\nattached to a closed case. The event check
matched by legacy type only\n(`AttachmentType.event`, i.e. `'event'`),
so unified events\n(`security.event`) never triggered the guard and were
silently accepted\non closed cases.\n\nAlerts already used the
unified-aware `isAlertAttachmentType` predicate.\nThis aligns events to
the same pattern via `isEventAttachmentType`,\nwhich matches both
`'event'` (legacy) and `'security.event'` (unified).\n\nAlso removes the
now-dead `getAttachmentsByType` helper (its only call\nsite was the
buggy event check).\n\n**Found by** @radtke-vale, validated on staging
in [this
review\ncomment](https://github.com/elastic/kibana/pull/290961#discussion_r4014165733)\non
#290961.\n\n## Before / after (validated on
staging)\n\nBefore:\n```\nPOST kbn:/api/cases/{caseId}/comments\n{\n
\"type\": \"security.event\",\n \"owner\": \"securitySolution\",\n
\"attachmentId\": \"...\",\n \"metadata\": { \"index\": \"...\"
}\n}\n```\n→ `200`, attachment created on a closed
case.\n\nAfter:\n```json\n{\n \"statusCode\": 400,\n \"error\": \"Bad
Request\",\n \"message\": \"Event cannot be attached to a closed
case\"\n}\n```\n\n### Checklist\n\n- [ ] Any text added follows [EUI's
writing\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\nsentence case text and includes
[i18n\nsupport](https://github.com/elastic/kibana/blob/main/src/platform/packages/shared/kbn-i18n/README.md)\n-
[
]\n[Documentation](https://www.elastic.co/guide/en/kibana/master/development-documentation.html)\nwas
added for features that require explanation or tutorials\n- [x] [Unit or
functional\ntests](https://www.elastic.co/guide/en/kibana/master/development-tests.html)\nwere
updated or added to match the most common scenarios\n- [ ] If a plugin
configuration key changed, check if it needs to be\nallowlisted in the
cloud and added to the
[docker\nlist](https://github.com/elastic/kibana/blob/main/src/dev/build/tasks/os_packages/docker_generator/resources/base/bin/kibana-docker)\n-
[ ] This was checked for breaking HTTP API changes, and any
breaking\nchanges have been approved by the breaking-change committee.
The\n`release_note:breaking` label should be applied in these
situations.\n- [ ] [Flaky
Test\nRunner](https://ci-stats.kibana.dev/trigger_flaky_test_runner/1)
was\nused on any tests changed\n- [x] The PR description includes the
appropriate Release Notes section,\nand the correct `release_note:*`
label is applied per
the\n[guidelines](https://www.elastic.co/docs/extend/kibana/contributing/workflow/how-we-use-github#release-notes)\n-
[x] Review the
[backport\nguidelines](https://docs.google.com/document/d/1VyN5k91e5OVumlc0Gb9RPa3h1ewuPE705nRtioPiTvY/edit?usp=sharing)\nand
apply applicable `backport:*` labels.\n\nMade with
Cursor","sha":"0b5aba9fe5761d0fd2fc2ce576e6d36146231465"}},{"branch":"9.5","label":"v9.5.5","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>