Backlog/v12 rule after events

[AlexSanchez-bit]

No description provided.

[github-actions]

🛑 AI review — Engineer review required

This PR touches critical paths or introduces changes the model cannot judge with sufficient confidence. @Kbayero @osmontero please review.

🛑 architecture (gemini-3-flash-lite) — blocking — must fix before merge

Summary: Renaming database column and API field 'afterEvents' to 'correlation' without a migration plan or backward compatibility for existing persisted data.

• high backend/modules/eventprocessing/domain/correlation_rule.go:33 — Renaming/deprecating a database column without a migration script is a breaking change for existing deployments. Ensure a migration exists to map old data to the new column.
• high backend/modules/eventprocessing/dto/correlation_rule.go:43 — Breaking API contract change. Removing 'AfterEventsDef' from DTOs will break existing clients or integrations expecting this field. Maintain the field as optional/deprecated or provide a versioned endpoint.
• medium backend/modules/eventprocessing/usecase/rule_bootstrap.go:277 — Logic change in bootstrap mapping. Ensure that legacy data stored in 'AfterEventsDef' is correctly migrated to the new 'Correlation' field during runtime initialization.

🛑 bugs (gemini-3-flash-lite) — blocking — must fix before merge

Summary: Renaming 'afterEvents' to 'correlation' in backend/frontend causes a runtime failure because the field name in the database struct (GORM) was not updated, leading to data loss/persistence failure.

• high backend/modules/eventprocessing/domain/correlation_rule.go:33 — The GORM tag gorm:"column:rule_after_events_def" remains, but the field was renamed to AfterEventsDef (or implied removal). If the intention is to map the new CorrelationDef to the database, the GORM column tag must be updated to match the new field name or logic, otherwise, the field will not persist to the database.
• high backend/modules/eventprocessing/usecase/rule_bootstrap.go:277 — The field AfterEventsDef is accessed on the row object, but the corresponding field in domain.UtmCorrelationRules was effectively deprecated/removed in the previous file change. This will cause a compilation error or runtime nil/empty behavior.

🛑 security (gemini-3-flash-lite) — blocking — must fix before merge

Summary: Refactoring of correlation rule handling across backend and frontend; touches core event processing logic.

• medium backend/modules/eventprocessing/domain/correlation_rule.go:33 — Added comment '[deprecated] only kept for compatibility' to a database column field. Ensure that deprecated fields are not exposed in API responses or used in new logic to prevent potential data handling inconsistencies.

[utmstackprapprover]

Changes requested — AI review found blocking issues (high/critical, or engineer review required). See above.

[utmstackprapprover]

Changes requested — AI review found blocking issues (high/critical, or engineer review required). See above.

[utmstackprapprover]

Changes requested — AI review found blocking issues (high/critical, or engineer review required). See above.