📑 Description

/close #2292

In _enrich_alert function, you have the following parameter:

dispose_on_new_alert: Optional[bool] = Query(False, description="Dispose on new alert")

Here, you're using Query, which is designed to be used in FastAPI endpoint functions to declare query parameters. When you use Query, FastAPI expects to parse this parameter from the incoming HTTP request.

However, _enrich_alert is not an endpoint function; it's a helper function that's being called directly from another function (enrich_alert). Seems like FastAPI's dependency injection system isn't in play for _enrich_alert, and dispose_on_new_alert is not being set from the HTTP request query parameters. Instead, it's getting assigned the Query object itself as the default value. Since dispose_on_new_alert is set to the Query object, it becomes truthy in a boolean context. Therefore, when execution reach if dispose_on_new_alert condition in _enrich_alert it evaluates as True.

In logs it looks like this:

"Request started: POST /alerts/enrich",  # NO ?dispose_on_new_alert=true here
"Enriching alert", 
"Enriching disposable enrichments",  # yet notes are treated as disposable

✅ Checks

• My pull request adheres to the code style of this project
• My code requires changes to the documentation
• I have updated the documentation as required
• All the tests have passed