[ES|QL] Fix: IN operator inside functions does not display suggestions (elastic#244757)

## Summary

The logic only worked if the left operand was a column.
Also fixed cases with dot like agent.keyword

---------

Co-authored-by: Stratou <[email protected]>

Author: bartoval

src/platform/packages/shared/kbn-esql-ast/src/commands_registry/commands/eval/autocomplete.test.ts

@@ -203,8 +203,8 @@ describe('EVAL Autocomplete', () => {
   });
 
   test('with lists', async () => {
-    await evalExpectSuggestions('from index | EVAL doubleField in ', ['( $0 )']);
-    await evalExpectSuggestions('from index | EVAL doubleField not in /', ['( $0 )']);
+    await evalExpectSuggestions('from index | EVAL doubleField in ', ['($0)']);
+    await evalExpectSuggestions('from index | EVAL doubleField not in /', ['($0)']);
   });
 
   test('after assignment', async () => {

src/platform/packages/shared/kbn-esql-ast/src/commands_registry/commands/where/autocomplete.test.ts

@@ -280,8 +280,8 @@ describe('WHERE Autocomplete', () => {
     });
 
     test('suggestions after IN', async () => {
-      await whereExpectSuggestions('from index | WHERE doubleField in ', ['( $0 )']);
-      await whereExpectSuggestions('from index | WHERE doubleField not in ', ['( $0 )']);
+      await whereExpectSuggestions('from index | WHERE doubleField in ', ['($0)']);
+      await whereExpectSuggestions('from index | WHERE doubleField not in ', ['($0)']);
       const expectedFields = getFieldNamesByType(['double']);
       mockFieldsWithTypes(mockCallbacks, expectedFields);
       await whereExpectSuggestions(

src/platform/packages/shared/kbn-esql-ast/src/commands_registry/complete_items.ts

@@ -206,7 +206,7 @@ export const semiColonCompleteItem = buildCharCompleteItem(
 
 export const listCompleteItem: ISuggestionItem = withAutoSuggest({
   label: '( ... )',
-  text: '( $0 )',
+  text: '($0)',
   asSnippet: true,
   kind: 'Operator',
   detail: i18n.translate('kbn-esql-ast.esql.autocomplete.listDoc', {

src/platform/packages/shared/kbn-esql-ast/src/definitions/utils/autocomplete/expressions/operators/handlers.ts

@@ -20,6 +20,7 @@ import { getLogicalContinuationSuggestions, shouldSuggestOpenListForOperand } fr
 import { shouldSuggestComma } from '../comma_decision_engine';
 import { buildConstantsDefinitions } from '../../../literals';
 import { SuggestionBuilder } from '../suggestion_builder';
+import { withAutoSuggest } from '../../helpers';
 
 // ============================================================================
 // eg. IN / NOT IN Operators
@@ -59,60 +60,53 @@ export async function handleListOperator(ctx: ExpressionContext): Promise<ISugge
       }
     }
 
-    if (columnForType) {
-      // After a value but not after comma: suggest comma
-      if (
-        shouldSuggestComma({
-          position: 'inside_list',
-          innerText,
-          listHasValues: list.values && list.values.length > 0,
-        })
-      ) {
-        return [{ ...commaCompleteItem, text: ', ' }];
-      }
-
-      // After comma or empty list: suggest values
-      // For empty lists, don't ignore the left column - we want to suggest fields of the same type
-      const isEmptyList = !list.values || list.values.length === 0;
-      const ignoredColumns = isEmptyList
-        ? []
-        : [
-            columnForType.parts.join('.'),
-            ...(list.values || []).filter(isColumn).map((col: ESQLColumn) => col.parts.join('.')),
-          ].filter(Boolean);
-
-      return getSuggestionsForColumn(columnForType, ctx, ignoredColumns);
+    // After a value but not after comma: suggest comma
+    if (
+      shouldSuggestComma({
+        position: 'inside_list',
+        innerText,
+        listHasValues: list.values && list.values.length > 0,
+      })
+    ) {
+      return [withAutoSuggest({ ...commaCompleteItem, text: ',' })];
     }
+
+    // After comma or empty list: suggest values
+    const isEmptyList = !list.values || list.values.length === 0;
+    const ignoredColumns = isEmptyList
+      ? []
+      : [
+          ...(columnForType ? [columnForType.parts.join('.')] : []),
+          ...(list.values || []).filter(isColumn).map((col: ESQLColumn) => col.parts.join('.')),
+        ].filter(Boolean);
+
+    return getListValueSuggestions(ctx, columnForType, ignoredColumns);
   }
 
   return [];
 }
 
-async function getSuggestionsForColumn(
-  column: ESQLColumn,
+async function getListValueSuggestions(
   ctx: ExpressionContext,
+  column: ESQLColumn | undefined,
   ignoredColumns: string[]
 ): Promise<ISuggestionItem[]> {
-  const argType = getExpressionType(column, ctx.context?.columns);
-
-  if (!argType) {
-    return [];
-  }
-
-  // Use SuggestionBuilder to eliminate duplicated suggestion patterns
+  const argType = column ? getExpressionType(column, ctx.context?.columns) : undefined;
   const builder = new SuggestionBuilder(ctx);
 
   await builder.addFields({
-    types: [argType],
+    types: argType ? [argType] : undefined,
     ignoredColumns,
+    addSpaceAfterField: true,
+    openSuggestions: true,
   });
 
   builder
     .addFunctions({
-      types: [argType],
+      types: argType ? [argType] : undefined,
     })
     .addLiterals({
-      types: [argType],
+      types: argType ? [argType] : undefined,
       includeDateLiterals: true,
       includeCompatibleLiterals: true,
     });

src/platform/packages/shared/kbn-esql-ast/src/definitions/utils/autocomplete/expressions/operators/partial/handlers.ts

@@ -112,7 +112,8 @@ async function handleInfixOperator(
     return dispatchOperators({ ...context, innerText: text });
   }
 
-  const syntheticNode = createSyntheticNode(operatorName, text, expressionRoot);
+  const leftOperand = expressionRoot?.type === 'column' ? expressionRoot : undefined;
+  const syntheticNode = createSyntheticNode(operatorName, text, leftOperand);
 
   return dispatchOperators({
     ...context,

src/platform/packages/shared/kbn-esql-ast/src/definitions/utils/autocomplete/expressions/operators/partial/utils.ts

@@ -23,8 +23,8 @@ const IS_NOT_REGEX = /\bis\s+not\b/i;
 
 // Regex to extract field name before operator: match[1] = fieldName
 // Matches with or without opening parenthesis
-const FIELD_BEFORE_IN_REGEX = /(\w+)\s+(?:not\s+)?in\s*\(?\s*$/i;
-const FIELD_BEFORE_LIKE_REGEX = /(\w+)\s+(?:not\s+)?(?:r)?like\s*\(?\s*$/i;
+const FIELD_BEFORE_IN_REGEX = /([\w.]+)\s+(?:not\s+)?in\s*\(?\s*$/i;
+const FIELD_BEFORE_LIKE_REGEX = /([\w.]+)\s+(?:not\s+)?(?:r)?like\s*\(?\s*$/i;
 
 /**
  * Creates a synthetic infix operator node (IN, LIKE, RLIKE, etc.).

src/platform/packages/shared/kbn-esql-validation-autocomplete/src/autocomplete/__tests__/functions.test.ts

@@ -444,27 +444,35 @@ describe('functions arg suggestions', () => {
       const suggestions = await suggest('FROM index | EVAL result = CASE(integerField IN /)');
       const texts = suggestions.map(({ text }) => text);
 
-      expect(texts).toContain('( $0 )');
+      expect(texts).toContain('($0)');
     });
 
     it('NOT IN operator: suggests opening parenthesis for list', async () => {
       const { suggest } = await setup();
       const suggestions = await suggest('FROM index | EVAL result = CASE(integerField NOT IN /)');
       const texts = suggestions.map(({ text }) => text);
 
-      expect(texts).toContain('( $0 )');
+      expect(texts).toContain('($0)');
     });
 
-    it('IN operator with empty list: suggests integer fields and functions', async () => {
+    it.each([
+      ['simple field', 'FROM index | WHERE integerField IN (/)'],
+      ['nested field', 'FROM index | WHERE kubernetes.something.something IN (/)'],
+      ['function result', 'FROM index | WHERE CONCAT(textField, keywordField) IN (/)'],
+      ['inside CASE', 'FROM index | EVAL col0 = CASE(keywordField IN (/)'],
+      [
+        'multiple IN - cursor on second',
+        'FROM index | WHERE integerField IN (1) AND keywordField IN (/)',
+      ],
+      ['nested IN inside CASE', 'FROM index | EVAL x = CASE(a IN (1), "yes", keywordField IN (/)'],
+    ])('IN operator with %s: suggests fields and functions', async (_, query) => {
       const { suggest } = await setup();
-      const suggestions = await suggest('FROM index | WHERE integerField IN (/)');
+      const suggestions = await suggest(query);
 
-      const fieldSuggestions = suggestions.filter((s) => s.kind === 'Variable');
-      const functionSuggestions = suggestions.filter((s) => s.kind === 'Function');
+      const fieldSuggestions = suggestions.filter(({ kind }) => kind === 'Variable');
 
       expect(suggestions.length).toBeGreaterThan(0);
       expect(fieldSuggestions.length).toBeGreaterThan(0);
-      expect(functionSuggestions.length).toBeGreaterThan(0);
     });
 
     it('unary NOT operator in WHERE: suggests boolean fields and boolean-returning functions', async () => {

src/platform/packages/shared/kbn-esql-validation-autocomplete/src/autocomplete/autocomplete.test.ts

@@ -1045,7 +1045,7 @@ describe('autocomplete', () => {
   });
 
   describe('IN operator with lists', () => {
-    testSuggestions('FROM a | WHERE integerField IN (doubleField /', [{ text: ', ' }]);
+    testSuggestions('FROM a | WHERE integerField IN (doubleField /', [{ text: ',' }]);
   });
 
   describe('Replacement ranges are attached when needed', () => {