feat(go): advance validation sidecar toward production

go-agent/internal/detectors/persistence_test.go

@@ -0,0 +1,33 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package detectors
+
+import (
+	"testing"
+
+	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/config"
+	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
+)
+
+func TestPersistenceAlertsModifiedWatchedFiles(t *testing.T) {
+	since := 100.0
+	alerts := Persistence(model.State{
+		PersistSince: &since,
+		PersistenceFiles: map[string]float64{
+			"/etc/cron.d/evil": 101,
+			"/tmp/not-watched": 200,
+			"/etc/passwd":      99,
+		},
+	}, config.Default())
+	if len(alerts) != 1 || alerts[0].Key != "persist:/etc/cron.d/evil" {
+		t.Fatalf("got %#v", alerts)
+	}
+}
+
+func TestPersistenceWithoutScanIsSilent(t *testing.T) {
+	if alerts := Persistence(model.State{
+		PersistenceFiles: map[string]float64{"/etc/passwd": 200},
+	}, config.Default()); len(alerts) != 0 {
+		t.Fatalf("got %#v", alerts)
+	}
+}