[Bug] POST /alerts/update/<alert_id> does not support updating alert IOCs

[sammonsempes]

Describe the bug
POST /alerts/update/<alert_id> silently ignores the alert_iocs field. It is impossible to add or modify IOCs on an existing alert via the API. IOCs are effectively immutable after alert creation.

To Reproduce

1. Create an alert with IOCs via POST /alerts/add
2. Call POST /alerts/update/<alert_id> with an alert_iocs field in the body:

{
    "alert_iocs": [
        {
            "ioc_value": "1.2.3.4",
            "ioc_type_id": 76,
            "ioc_description": "C2 server"
        }
    ]
}

3. Fetch the alert via GET /alerts/<alert_id>
4. Observe that alert_iocs is unchanged

Expected behavior
POST /alerts/update/<alert_id> should accept an alert_iocs field and update the IOC list accordingly, consistent with how POST /alerts/add handles IOCs at creation time.

Screenshots
N/A

Desktop (please complete the following information):

• OS: Linux
• Browser: N/A (API)
• Version: v2.4.27

Smartphone (please complete the following information):
N/A

Additional context
Workaround available until a fix is released. The following Docker entrypoint patch injects the missing logic at container startup without modifying the image, it appends update_alert_iocs() to alerts_db.py and calls it inside alerts_update_route() before db.session.commit(). The patch is idempotent across container restarts.

entrypoint:
  - sh
  - -c
  - |
    grep -q update_alert_iocs app/datamgmt/alerts/alerts_db.py || printf '\n\ndef update_alert_iocs(alert, iocs_data):\n    alert.iocs = []; db.session.flush()\n    for d in iocs_data: i = Ioc(); i.ioc_value = d.get("ioc_value", ""); i.ioc_type_id = d.get("ioc_type_id"); i.ioc_description = d.get("ioc_description", ""); i.ioc_tags = d.get("ioc_tags", ""); i.ioc_tlp_id = d.get("ioc_tlp_id", 2); i.ioc_enrichment = d.get("ioc_enrichment", {}); i.user_id = current_user.id; db.session.add(i); alert.iocs.append(i)\n    return alert\n' >> app/datamgmt/alerts/alerts_db.py
    python3 -c 'import pathlib; f=pathlib.Path("app/blueprints/alerts/alerts_routes.py"); s=f.read_text(); pos=s.find("def alerts_update_route"); cp=s.find("db.session.commit()",pos); ls=s.rfind("\n",0,cp)+1; ind=s[ls:cp]; inj=ind+"from app.datamgmt.alerts.alerts_db import update_alert_iocs\n"+ind+"if data and \"alert_iocs\" in data: update_alert_iocs(alert, data[\"alert_iocs\"])\n"; f.write_text(s[:ls]+inj+s[ls:]) if "update_alert_iocs" not in s and cp>0 else None'
    exec ./iris-entrypoint.sh