# SPDX-License-Identifier: GPL-3.0-or-later
"""The SID registry is unique, complete, and matches the engine sources."""
import unittest

from enodia_sentinel import fim, pkgdb, posture, rootcheck, sids
from enodia_sentinel.detectors import (
    credential_access,
    input_snooper,
    memory_obfuscation,
    stealth_network,
)
from enodia_sentinel.events.rules import DEFAULT_EXEC_RULES
from enodia_sentinel.events.host_rules import DEFAULT_HOST_RULES
from enodia_sentinel.events.syscall_rules import DEFAULT_SYSCALL_RULES


class TestRegistry(unittest.TestCase):
    def test_sids_are_unique(self):
        nums = [s.sid for s in sids.BUILTIN_SIDS]
        self.assertEqual(len(nums), len(set(nums)))

    def test_count_and_helpers(self):
        self.assertEqual(len(sids.BUILTIN_SIDS), 55)
        self.assertEqual(
            sids.all_sids(), frozenset(s.sid for s in sids.BUILTIN_SIDS)
        )
        self.assertEqual(
            sids.engine_sids("exec_rule"),
            frozenset({100001, 100002, 100003, 100004}),
        )

    def test_event_rule_sids_match_engines(self):
        self.assertEqual(
            sids.engine_sids("exec_rule"),
            frozenset(r.sid for r in DEFAULT_EXEC_RULES),
        )
        self.assertEqual(
            sids.engine_sids("syscall_rule"),
            frozenset(r.sid for r in DEFAULT_SYSCALL_RULES),
        )
        self.assertEqual(
            sids.engine_sids("host_rule"),
            frozenset(r.sid for r in DEFAULT_HOST_RULES),
        )

    def test_registry_uses_the_source_constants(self):
        by_sid = {s.sid: s for s in sids.BUILTIN_SIDS}
        for const, engine in (
            (fim.SID_MODIFIED, "fim"),
            (pkgdb.SID_PKGDB, "pkgdb"),
            (rootcheck.SID_HIDDEN_PROC, "rootcheck"),
            (posture.SID_SSH_ROOT_LOGIN, "posture"),
            (input_snooper.SID_INPUT_SNOOPER, "detector"),
            (credential_access.SID_CREDENTIAL_ACCESS, "detector"),
            (stealth_network.SID_STEALTH_NETWORK, "detector"),
            (memory_obfuscation.SID_PROCESS_HIDING_LIBRARY, "detector"),
        ):
            self.assertIn(const, by_sid)
            self.assertEqual(by_sid[const].engine, engine)

    def test_every_entry_has_name_and_module(self):
        for entry in sids.BUILTIN_SIDS:
            self.assertTrue(entry.name)
            self.assertTrue(entry.module.startswith("enodia_sentinel"))


if __name__ == "__main__":
    unittest.main()