// SPDX-License-Identifier: GPL-3.0-or-later

package events

import (
	"strings"
	"testing"
)

func TestRuleSetMatchesCompatibilityJSON(t *testing.T) {
	rules := NewRuleSet(DefaultExecRuleEngine())
	tests := []struct {
		raw string
		sid int
	}{
		{`{"type":"execve","pid":"42","ppid":"1","uid":"1000","parent_comm":"nginx","filename":"/bin/sh","argv":["-c","id"]}`, 100003},
		{`{"type":"sys","pid":"43","comm":"loader","syscall":"mprotect","args":["0x1000","0x1000",0],"arg2":"0x6"}`, 100060},
		{`{"type":"listen","pid":"44","comm":"python3","listen_ip":"0.0.0.0","listen_port":"4444"}`, 100068},
	}
	for _, test := range tests {
		alerts, err := rules.MatchJSON([]byte(test.raw))
		if err != nil {
			t.Fatal(err)
		}
		found := false
		for _, alert := range alerts {
			if alert.SID == test.sid {
				found = true
			}
		}
		if !found {
			t.Fatalf("sid %d did not match %s: %#v", test.sid, test.raw, alerts)
		}
	}
}

func TestScanJSONLReportsLine(t *testing.T) {
	err := ScanJSONL(strings.NewReader("\n{}\n"), func(raw []byte) error {
		_, err := NewRuleSet(DefaultExecRuleEngine()).MatchJSON(raw)
		return err
	})
	if err == nil || !strings.Contains(err.Error(), "line 2") {
		t.Fatalf("missing line context: %v", err)
	}
}