// SPDX-License-Identifier: GPL-3.0-or-later

package detectors

import (
	"testing"

	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
)

func TestLDPreloadMatchesGlobalAndWritableProcess(t *testing.T) {
	state := model.State{
		LDPreload: "/tmp/global.so\n/opt/second.so",
		Processes: []model.Process{
			{PID: 200, Comm: "sleep", Environ: map[string]string{"LD_PRELOAD": "/tmp/evil.so"}},
			{PID: 201, Comm: "safe", Environ: map[string]string{"LD_PRELOAD": "/usr/lib/libfoo.so"}},
		},
	}
	alerts := LDPreload(state)
	if len(alerts) != 2 {
		t.Fatalf("expected two alerts, got %#v", alerts)
	}
	if alerts[0].Key != "ldp:global" || alerts[0].Detail != "/etc/ld.so.preload is non-empty: [/tmp/global.so /opt/second.so]" {
		t.Fatalf("unexpected global alert: %#v", alerts[0])
	}
	if alerts[1].Key != "ldp:200" || alerts[1].PIDs[0] != 200 {
		t.Fatalf("unexpected process alert: %#v", alerts[1])
	}
}