// SPDX-License-Identifier: GPL-3.0-or-later

package enrich

import (
	"testing"

	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
)

func TestBuildAddsBoundedProcessRemotePathAndLineageContext(t *testing.T) {
	result := Build([]model.Alert{{
		SID: 100010, Signature: "reverse_shell", Key: "persist:/etc/cron.d/dropper",
		Detail: "pid=42 peer=[8.8.8.8:4444] wrote /tmp/dropper (deleted)",
	}}, []Process{{PID: 42, Comm: "bash", Exe: "/tmp/dropper (deleted)", PPID: 10, PPIDComm: "nginx"}}, []int{42, 10})
	processes := result["processes"].([]map[string]any)
	if len(processes) != 1 || processes[0]["exe"] != "/tmp/dropper" ||
		processes[0]["package_owner"] != nil || processes[0]["exe_sha256"] != nil {
		t.Fatalf("processes=%#v", processes)
	}
	chain := processes[0]["parent_chain"].([]map[string]any)
	if len(chain) != 1 || chain[0]["pid"] != 10 || chain[0]["comm"] != "nginx" {
		t.Fatalf("chain=%#v", chain)
	}
	remotes := result["remotes"].([]map[string]any)
	if len(remotes) != 1 || remotes[0]["ip"] != "8.8.8.8" || remotes[0]["classification"] != "public" {
		t.Fatalf("remotes=%#v", remotes)
	}
	files := result["files"].([]map[string]any)
	if len(files) != 2 || files[0]["path"] != "/etc/cron.d/dropper" || files[1]["path"] != "/tmp/dropper" {
		t.Fatalf("files=%#v", files)
	}
	lineage := result["lineage"].([]map[string]any)
	if len(lineage) != 2 || lineage[0]["pid"] != 10 || lineage[0]["comm"] != "nginx" {
		t.Fatalf("lineage=%#v", lineage)
	}
}

func TestBuildClassifiesPrivateAndInvalidAddresses(t *testing.T) {
	result := Build([]model.Alert{{Detail: "peers 10.1.2.3 and 999.1.2.3"}}, nil, nil)
	remotes := result["remotes"].([]map[string]any)
	if len(remotes) != 2 || remotes[0]["classification"] != "private" || remotes[1]["classification"] != "invalid" {
		t.Fatalf("remotes=%#v", remotes)
	}
}

func TestBuildCapsAttackerControlledIndicators(t *testing.T) {
	alerts := make([]model.Alert, 300)
	for index := range alerts {
		alerts[index].Detail = "/tmp/path " + "1.2.3.4"
	}
	result := Build(alerts, nil, nil)
	if len(result["remotes"].([]map[string]any)) > maxIndicators || len(result["files"].([]map[string]any)) > maxIndicators {
		t.Fatal("indicator caps were not applied")
	}
}