feat(go): port process access detectors

go-agent/internal/detectors/credential_access_test.go

@@ -0,0 +1,32 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package detectors
+
+import (
+	"strings"
+	"testing"
+
+	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/config"
+	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
+)
+
+func TestCredentialAccessMatchesKindsAndAllowlist(t *testing.T) {
+	cfg := config.Default()
+	cfg.CredentialAccessExtraPaths = []string{"/srv/secrets/"}
+	state := model.State{Processes: []model.Process{
+		{PID: 330, Comm: "hoxha", FDTargets: map[string]string{"4": "/etc/shadow"}},
+		{PID: 331, Comm: "collector", FDTargets: map[string]string{"5": "/home/luna/.ssh/id_ed25519"}},
+		{PID: 332, Comm: "firefox", FDTargets: map[string]string{"8": "/home/luna/.mozilla/firefox/a/key4.db"}},
+		{PID: 333, Comm: "backup", FDTargets: map[string]string{"9": "/srv/secrets/token (deleted)"}},
+	}}
+	alerts := CredentialAccess(state, cfg)
+	if len(alerts) != 3 {
+		t.Fatalf("expected three alerts, got %#v", alerts)
+	}
+	if alerts[0].Key != "cred:330:/etc/shadow" || !strings.Contains(alerts[1].Detail, "private SSH key") {
+		t.Fatalf("unexpected alerts: %#v", alerts)
+	}
+	if !strings.Contains(alerts[2].Detail, "configured credential path") || strings.Contains(alerts[2].Key, "(deleted)") {
+		t.Fatalf("deleted suffix or extra path mismatch: %#v", alerts[2])
+	}
+}