// SPDX-License-Identifier: GPL-3.0-or-later

package detectors

import (
	"strings"
	"testing"

	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/config"
	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
)

func TestCredentialAccessMatchesKindsAndAllowlist(t *testing.T) {
	cfg := config.Default()
	cfg.CredentialAccessExtraPaths = []string{"/srv/secrets/"}
	state := model.State{Processes: []model.Process{
		{PID: 330, Comm: "hoxha", FDTargets: map[string]string{"4": "/etc/shadow"}},
		{PID: 331, Comm: "collector", FDTargets: map[string]string{"5": "/home/luna/.ssh/id_ed25519"}},
		{PID: 332, Comm: "firefox", FDTargets: map[string]string{"8": "/home/luna/.mozilla/firefox/a/key4.db"}},
		{PID: 333, Comm: "backup", FDTargets: map[string]string{"9": "/srv/secrets/token (deleted)"}},
	}}
	alerts := CredentialAccess(state, cfg)
	if len(alerts) != 3 {
		t.Fatalf("expected three alerts, got %#v", alerts)
	}
	if alerts[0].Key != "cred:330:/etc/shadow" || !strings.Contains(alerts[1].Detail, "private SSH key") {
		t.Fatalf("unexpected alerts: %#v", alerts)
	}
	if !strings.Contains(alerts[2].Detail, "configured credential path") || strings.Contains(alerts[2].Key, "(deleted)") {
		t.Fatalf("deleted suffix or extra path mismatch: %#v", alerts[2])
	}
}