# SPDX-License-Identifier: GPL-3.0-or-later
"""The `check --json` flag emits a parseable JSON alert array."""
import io
import json
import unittest
from contextlib import redirect_stdout
from unittest import mock

from enodia_sentinel import cli
from enodia_sentinel.alert import Alert, Severity
from enodia_sentinel.config import Config


class _FakeSentinel:
    def __init__(self, cfg):
        self.start_time = 1.0
        self.listener_baseline = {"x"}

    def load_baselines(self):
        pass

    def build_baselines(self):
        pass

    def sweep(self, force_suid=False):
        return [Alert(Severity.HIGH, "rsh", "rsh:1", "reverse shell", sid=1001)]


class TestCheckJson(unittest.TestCase):
    def test_check_json_emits_alert_array(self):
        cfg = Config()
        with mock.patch.object(cli, "Sentinel", _FakeSentinel):
            buf = io.StringIO()
            with redirect_stdout(buf):
                rc = cli._cmd_check(cfg, True)
        self.assertEqual(rc, 0)
        data = json.loads(buf.getvalue())
        self.assertEqual(len(data), 1)
        self.assertEqual(data[0]["signature"], "rsh")
        self.assertEqual(data[0]["sid"], 1001)