// SPDX-License-Identifier: GPL-3.0-or-later

package detectors

import (
	"testing"

	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/config"
	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
)

func intPointer(value int) *int { return &value }

func TestReverseShellRequiresInterpreterAndNetworkInode(t *testing.T) {
	state := model.State{
		Processes: []model.Process{
			{PID: 100, Comm: "bash", Cmdline: "bash -i", FDTargets: map[string]string{"0": "socket:[999]"}},
			{PID: 101, Comm: "nginx", FDTargets: map[string]string{"0": "socket:[999]"}},
			{PID: 102, Comm: "bash", FDTargets: map[string]string{"0": "socket:[777]"}},
		},
		Sockets: []model.Socket{{
			State: "ESTAB", Local: "127.0.0.1:55", Peer: "9.9.9.9:443",
			Inode: intPointer(999), Comm: "bash", PID: intPointer(100), Kind: "tcp",
		}},
	}
	alerts := ReverseShell(state, config.Default())
	if len(alerts) != 1 || alerts[0].SID != 100010 || alerts[0].Key != "rsh:100" {
		t.Fatalf("unexpected alerts: %#v", alerts)
	}
	want := "pid=100 comm=bash stdio=net-socket peer=[127.0.0.1:55 -> 9.9.9.9:443] cmd=[bash -i]"
	if alerts[0].Detail != want {
		t.Fatalf("unexpected detail: %q", alerts[0].Detail)
	}
}