// SPDX-License-Identifier: GPL-3.0-or-later

package detectors

import (
	"testing"

	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/config"
	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
)

func TestFirstSeenAlertsNewDestinationAndListener(t *testing.T) {
	pid := 42
	cfg := config.Default()
	alerts := FirstSeen(model.State{
		FirstSeenInitialized:        true,
		FirstSeenPublicDestinations: map[string][]string{"bash": {"1.1.1.1:443"}},
		FirstSeenListenerPorts:      map[string][]string{"nc": {"22"}},
		Sockets: []model.Socket{
			{State: "ESTAB", Peer: "8.8.8.8:4443", Comm: "bash", PID: &pid},
			{State: "LISTEN", Local: "0.0.0.0:31337", Comm: "nc", PID: &pid, Kind: "tcp"},
		},
	}, cfg)
	if len(alerts) != 2 || alerts[0].SID != 100074 || alerts[1].SID != 100075 {
		t.Fatalf("got %#v", alerts)
	}
}

func TestFirstSeenUninitializedIsSilent(t *testing.T) {
	cfg := config.Default()
	state := model.State{
		FirstSeenPublicDestinations: map[string][]string{},
		FirstSeenListenerPorts:      map[string][]string{},
		Sockets: []model.Socket{
			{State: "ESTAB", Peer: "8.8.8.8:443", Comm: "bash"},
			{State: "ESTAB", Peer: "8.8.8.8:443", Comm: "bash"},
		},
	}
	if alerts := FirstSeen(state, cfg); len(alerts) != 0 {
		t.Fatalf("got %#v", alerts)
	}
	if got := state.FirstSeenPublicDestinations["bash"]; len(got) != 1 || got[0] != "8.8.8.8:443" {
		t.Fatalf("silent learning did not update state once: %#v", got)
	}
}