diff --git a/limacharlie/sdk/cases.py b/limacharlie/sdk/cases.py index 2cfd740..9487aa9 100644 --- a/limacharlie/sdk/cases.py +++ b/limacharlie/sdk/cases.py @@ -59,9 +59,11 @@ def create_case( """ data: dict[str, Any] = {} if detection is not None: - # The extension schema declares detection as type "json", - # which the platform validates as a JSON string (not a dict). - data["detection"] = json.dumps(detection) + # Pass the detection dict directly — the gzdata encoding + # already JSON-serializes the full data dict, so json.dumps + # here would double-encode it into a string that the LC + # backend drops (schema type "json" expects an object). + data["detection"] = detection if severity is not None: data["severity"] = severity if summary is not None: diff --git a/tests/unit/test_sdk_cases.py b/tests/unit/test_sdk_cases.py index b3571a3..425eb2d 100644 --- a/tests/unit/test_sdk_cases.py +++ b/tests/unit/test_sdk_cases.py @@ -84,7 +84,7 @@ def test_calls_extension_request(self, cases, mock_org): MockExt.assert_called_once_with(mock_org) mock_ext.request.assert_called_once_with( "ext-cases", "create_case", - data={"detection": json.dumps(self._SAMPLE_DETECTION)}, + data={"detection": self._SAMPLE_DETECTION}, ) assert result["case_id"] == "tid-new" @@ -100,7 +100,7 @@ def test_all_optional_fields(self, cases, mock_org): ) call_data = mock_ext.request.call_args[1]["data"] assert call_data == { - "detection": json.dumps(self._SAMPLE_DETECTION), + "detection": self._SAMPLE_DETECTION, "severity": "high", "summary": "Test summary", } @@ -144,7 +144,7 @@ def test_with_summary(self, cases, mock_org): ) call_data = mock_ext.request.call_args[1]["data"] assert call_data == { - "detection": json.dumps(self._SAMPLE_DETECTION), + "detection": self._SAMPLE_DETECTION, "severity": "high", "summary": "Lateral movement detected", }