From 5e6395910f7a3562e169490236020eddfd603b21 Mon Sep 17 00:00:00 2001
From: Devin Walters <devwalte@cisco.com>
Date: Wed, 8 Apr 2026 16:06:20 -0500
Subject: [PATCH] Make incident short_id nullable

Add NullableShortString type to common schemas that accepts either a
string (max 1024 chars) or null. Uses f/anything with a registered
nilable spec to work around Flanders lacking native nullable support.

Update incident schema to use NullableShortString for short_id, add
nil short_id example, and add test coverage for the nullable case.
---
 src/ctim/examples/incidents.cljc     | 3 +++
 src/ctim/schemas/common.cljc         | 9 +++++++++
 src/ctim/schemas/incident.cljc       | 4 ++--
 test/ctim/schemas/entities_test.cljc | 1 +
 4 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/src/ctim/examples/incidents.cljc b/src/ctim/examples/incidents.cljc
index c11aac48..99958cf8 100644
--- a/src/ctim/examples/incidents.cljc
+++ b/src/ctim/examples/incidents.cljc
@@ -61,6 +61,9 @@
    :schema_version c/ctim-schema-version
    :confidence "High"})
 
+(def incident-maximal-nil-short-id
+  (assoc incident-maximal :short_id nil))
+
 (def new-incident-maximal
   incident-maximal)
 
diff --git a/src/ctim/schemas/common.cljc b/src/ctim/schemas/common.cljc
index 3ce5669d..9080e4f7 100644
--- a/src/ctim/schemas/common.cljc
+++ b/src/ctim/schemas/common.cljc
@@ -140,6 +140,15 @@
          :name "Markdown"
          :description "Markdown string with at most 5000 characters."))
 
+(cs/def ::nullable-short-string
+  (cs/or :string (cs/and string? (pred/max-len 1024))
+         :nil nil?))
+
+(def NullableShortString
+  (f/anything :spec ::nullable-short-string
+              :description "String with at most 1024 characters, or null."
+              :name "NullableShortString"))
+
 (def OpenVocab
   (f/str :description (str "SHOULD be all lowercase (where lowercase is defined by the "
                            "locality conventions) and SHOULD use hyphens instead of "
diff --git a/src/ctim/schemas/incident.cljc b/src/ctim/schemas/incident.cljc
index 01147741..339a16db 100644
--- a/src/ctim/schemas/incident.cljc
+++ b/src/ctim/schemas/incident.cljc
@@ -173,8 +173,8 @@
    (f/entry :techniques [c/ShortString]
             :description (str "Represents the specific methods or actions used by an attacker "
                               "to carry out an offensive maneuver or achieve their goals."))
-   (f/entry :short_id c/ShortString
-            :description "A human-readable, short identifier for the incident, unique within an organization.")))
+   (f/entry :short_id c/NullableShortString
+            :description "A human-readable, short identifier for the incident, unique within an organization. Can be null.")))
 
 (def-entity-type NewIncident
   "For submitting a new Incident."
diff --git a/test/ctim/schemas/entities_test.cljc b/test/ctim/schemas/entities_test.cljc
index b17cd6d9..971f293b 100644
--- a/test/ctim/schemas/entities_test.cljc
+++ b/test/ctim/schemas/entities_test.cljc
@@ -143,6 +143,7 @@
   (validate-entities
    [ice/incident-maximal ics/Incident]
    [ice/incident-minimal ics/Incident]
+   [ice/incident-maximal-nil-short-id ics/Incident]
    [ice/incident-maximal  (-> ics/Incident
                               fu/replace-either-with-any
                               fu/require-all)]