fix[backend](socai/mcp): fixed create/update rule schemas

[AlexSanchez-bit]

No description provided.

[github-actions]

🛑 AI review — Sensitive area, extra care recommended

This PR touches critical paths or introduces changes the model cannot judge with sufficient confidence. Review carefully before merging.

⚠️ architecture (gemini-3-flash-lite) — minor findings

Summary: Introduction of manual DTO mapping and input wrappers in MCP module; logic should ideally reside in the eventprocessing DTO layer to avoid duplication.

• medium backend/modules/mcp/tools_eventprocessing.go:23 — Manual DTO mapping and input wrappers (epCorrelationRuleCreateInput) duplicate logic that should be handled by the eventprocessing DTO layer. Consider updating the base DTOs to support proper JSON schema generation instead of creating parallel structures in the MCP module.
• low backend/modules/mcp/tools_eventprocessing.go:78 — Use of reflect.ValueOf(v).IsZero() in mustRaw is inefficient for simple nil checks. Consider type-asserting to specific interfaces or using a more explicit check if performance becomes a concern.

🛑 bugs (gemini-3-flash-lite) — high/critical — please review

Summary: Incorrect JSON marshaling of string fields in mustRaw causes data corruption for rule definitions.

• high backend/modules/mcp/tools_eventprocessing.go:77 — The mustRaw function uses json.Marshal on a string (RuleDefinition). json.Marshal("string") results in the JSON string ""string"" (with escaped quotes). When this is passed to the DTO as a json.RawMessage, the backend will receive a quoted string instead of the raw CEL expression, likely causing syntax errors in the rule engine.

🛑 security (gemini-3-flash-lite) — high/critical — please review

Summary: Introduction of custom input wrappers for correlation rules using reflection and manual JSON marshaling, touching security-critical event processing logic.

• medium backend/modules/mcp/tools_eventprocessing.go:63 — The mustRaw function uses reflection (reflect.ValueOf(v).IsZero()) and json.Marshal to process user-supplied input for CEL expressions and correlation rules. This bypasses standard type-safe validation and could lead to unexpected behavior or injection if the underlying DTOs do not strictly validate the resulting json.RawMessage.

🟢 go-deps — up to date

No pending Go dependency updates.