// SPDX-License-Identifier: GPL-3.0-or-later

package fim

import (
	"context"
	"os"
	"path/filepath"
	"testing"
	"time"

	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/config"
)

func TestManagerBuildsBaselineAndReportsDriftWithoutReplacingIt(t *testing.T) {
	directory := t.TempDir()
	watched := filepath.Join(directory, "watched")
	writeFile(t, watched, "trusted")
	state := filepath.Join(directory, "state")
	cfg := config.Default()
	cfg.LogDir = state
	cfg.FIMPaths = []string{watched}
	manager := New(cfg)
	if err := manager.Initialize(); err != nil {
		t.Fatal(err)
	}
	baselineHash := *manager.baseline[watched].SHA256
	if _, err := os.Stat(filepath.Join(state, baselineFilename)); err != nil {
		t.Fatalf("baseline not persisted: %v", err)
	}

	writeFile(t, watched, "tampered")
	manager.runScan(cloneEntries(manager.baseline), PathList(cfg.FIMPaths))
	alerts := manager.Drain()
	if len(alerts) != 1 || alerts[0].SID != SIDModified || alerts[0].Severity != "HIGH" {
		t.Fatalf("alerts = %+v, want one high modified alert", alerts)
	}
	if got := *manager.baseline[watched].SHA256; got != baselineHash {
		t.Fatalf("scan silently replaced baseline %q with %q", baselineHash, got)
	}
}

func TestManagerPackageVerificationIsBoundedAndDrained(t *testing.T) {
	cfg := config.Default()
	cfg.LogDir = t.TempDir()
	cfg.FIMPaths = []string{filepath.Join(t.TempDir(), "absent")}
	manager := New(cfg)
	manager.Verify = func(ctx context.Context) (string, error) {
		if deadline, ok := ctx.Deadline(); !ok || time.Until(deadline) > pacmanTimeout {
			t.Fatal("package verification did not receive a bounded context")
		}
		return "openssh: /usr/bin/ssh (SHA256 checksum mismatch)", nil
	}
	if err := manager.Initialize(); err != nil {
		t.Fatal(err)
	}
	manager.runVerify()
	alerts := manager.Drain()
	if len(alerts) != 1 || alerts[0].SID != SIDPackage || alerts[0].Severity != "CRITICAL" {
		t.Fatalf("alerts = %+v, want one critical package alert", alerts)
	}
}

func TestDisabledManagerDoesNotCreateAStateDirectory(t *testing.T) {
	cfg := config.Default()
	cfg.FIMEnabled = false
	cfg.LogDir = filepath.Join(t.TempDir(), "state")
	manager := New(cfg)
	if err := manager.Initialize(); err != nil {
		t.Fatal(err)
	}
	if _, err := os.Stat(cfg.LogDir); !os.IsNotExist(err) {
		t.Fatalf("disabled FIM created state directory: %v", err)
	}
}