# SPDX-License-Identifier: GPL-3.0-or-later
import tempfile
import unittest
from pathlib import Path

from enodia_sentinel.config import Config
from enodia_sentinel.detectors import first_seen
from enodia_sentinel.system import Socket, SystemState


class TestFirstSeen(unittest.TestCase):
    def setUp(self):
        self.dir = tempfile.TemporaryDirectory()
        self.cfg = Config()
        self.cfg.log_dir = Path(self.dir.name)

    def tearDown(self):
        self.dir.cleanup()

    def test_first_pass_baselines_without_alerting_then_new_dest_alerts(self):
        first = SystemState(sockets=[
            Socket("ESTAB", "10.0.0.2:5000", "8.8.8.8:443", 1, "curl", 400, "tcp"),
        ])
        self.assertEqual(list(first_seen.detect(first, self.cfg)), [])
        second = SystemState(sockets=[
            Socket("ESTAB", "10.0.0.2:5001", "1.1.1.1:8443", 2, "curl", 400, "tcp"),
        ])
        alerts = list(first_seen.detect(second, self.cfg))
        self.assertEqual(alerts[0].sid, first_seen.SID_FIRST_PUBLIC_DESTINATION)

    def test_new_listener_port_alerts_after_baseline(self):
        list(first_seen.detect(SystemState(sockets=[
            Socket("LISTEN", "0.0.0.0:8000", "*:*", 1, "python3", 401, "tcp"),
        ]), self.cfg))
        alerts = list(first_seen.detect(SystemState(sockets=[
            Socket("LISTEN", "0.0.0.0:9000", "*:*", 2, "python3", 401, "tcp"),
        ]), self.cfg))
        self.assertEqual(alerts[0].sid, first_seen.SID_FIRST_LISTENER_PORT)


if __name__ == "__main__":
    unittest.main()