rapid7-insightidr 1.11.1: strip whitespace from comma-separated filter params

"HIGH, CRITICAL" as typed sent " CRITICAL" to the API, which rejects
the whole call — a priority filter written naturally fetched nothing.
Normalize statuses/priorities/sources/tags in list_investigations,
get_investigations_full and search_investigation_alerts before the URL.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L1fWBoEKvAw3k78XDkpRQo

integrations/rapid7-insightidr/scripts/get_investigations_full.py

@@ -477,8 +477,10 @@ def run():
     inv_page = request("GET", "idr/v2/investigations", params={
         "index": inp.get("index") or "0",
         "size": inp.get("page_size") or limit,
-        "statuses": inp.get("statuses"),
-        "priorities": inp.get("priorities"),
+        # ",".join(_list(...)): the API rejects the whole call when a list value
+        # carries whitespace, so "HIGH, CRITICAL" as typed must lose its space.
+        "statuses": ",".join(_list(inp.get("statuses"))) or None,
+        "priorities": ",".join(_list(inp.get("priorities"))) or None,
         "start_time": start_time,
         "end_time": inp.get("end_time"),
         "sort_field": "Created time",

integrations/rapid7-insightidr/scripts/list_investigations.py

@@ -19,6 +19,16 @@ def _inputs():
     return json.loads(os.environ.get("INTEGRATION_INPUTS", "{}"))
 
 
+def _csv(v):
+    # The API rejects the whole call when a list value carries whitespace, so
+    # "HIGH, CRITICAL" as typed must become "HIGH,CRITICAL" before the URL.
+    if isinstance(v, list):
+        parts = [str(x).strip() for x in v]
+    else:
+        parts = [p.strip() for p in str(v or "").split(",")]
+    return ",".join(p for p in parts if p) or None
+
+
 def _api_version(inp, is_v2):
     v = str(inp.get("api_version") or "Default").strip()
     return v if v in ("V1", "V2") else ("V2" if is_v2 else "V1")
@@ -65,18 +75,18 @@ def run():
     params = {
         "index": inp.get("index") or "0",
         "size": inp.get("page_size") or limit,
-        "statuses": inp.get("statuses"),
+        "statuses": _csv(inp.get("statuses")),
         "start_time": start_time,
         "end_time": end_time,
     }
     if api_version == "V2":
         params.update({
-            "sources": inp.get("sources"),
-            "priorities": inp.get("priorities"),
+            "sources": _csv(inp.get("sources")),
+            "priorities": _csv(inp.get("priorities")),
             "assignee_email": inp.get("assignee_email"),
             "sort_field": inp.get("sort_field"),
             "sort_direction": inp.get("sort_direction"),
-            "tags": inp.get("tags"),
+            "tags": _csv(inp.get("tags")),
             "multi-customer": "true" if multi else None,
         })
     endpoint = "idr/" + api_version.lower() + "/investigations"

integrations/rapid7-insightidr/scripts/search_investigation_alerts.py

@@ -121,8 +121,10 @@ def run():
     inv_page = request("GET", "idr/v2/investigations", params={
         "index": inp.get("index") or "0",
         "size": inp.get("page_size") or limit,
-        "statuses": inp.get("statuses"),
-        "priorities": inp.get("priorities"),
+        # ",".join(_list(...)): the API rejects the whole call when a list value
+        # carries whitespace, so "HIGH, CRITICAL" as typed must lose its space.
+        "statuses": ",".join(_list(inp.get("statuses"))) or None,
+        "priorities": ",".join(_list(inp.get("priorities"))) or None,
         "start_time": start_time,
         "end_time": inp.get("end_time"),
         "sort_field": "Created time",