FeedSOCRadarThreatFeed

import json

import pytest
from CommonServerPython import CommandResults, DemistoException, FeedIndicatorType

SOCRADAR_API_ENDPOINT = "https://platform.socradar.com/api"


def util_load_json(path):
    with open(path, encoding="utf-8") as f:
        return json.loads(f.read())


def test_test_module(requests_mock):
    """Tests the test_module validation command."""
    from FeedSOCRadarThreatFeed import Client, test_module

    mock_socradar_api_key = "APIKey"
    auth_suffix = f"threat/intelligence/check/auth?key={mock_socradar_api_key}"
    mock_response = util_load_json("test_data/check_auth_response.json")
    requests_mock.get(f"{SOCRADAR_API_ENDPOINT}/{auth_suffix}", json=mock_response)

    collection_name_list = ["MockCollectionName"]
    indicator_suffix = (
        f"threat/intelligence/socradar_collections?key={mock_socradar_api_key}"
        f"&collection_names={collection_name_list[0]}"
        f"&limit=1"
        f"&offset=0"
    )
    mock_response = util_load_json("test_data/get_indicators_response.json")
    requests_mock.get(f"{SOCRADAR_API_ENDPOINT}/{indicator_suffix}", json=mock_response)

    client = Client(
        base_url=SOCRADAR_API_ENDPOINT, api_key=mock_socradar_api_key, tlp_color="", tags="", verify=False, proxy=False
    )

    response = test_module(client, collection_name_list)

    assert response == "ok"


def test_test_module_handles_authorization_error(requests_mock):
    """Tests the test_module validation command authorization error."""
    from FeedSOCRadarThreatFeed import MESSAGES, Client, test_module

    mock_socradar_api_key = "WrongAPIKey"
    suffix = f"threat/intelligence/check/auth?key={mock_socradar_api_key}"
    mock_response = util_load_json("test_data/check_auth_response_auth_error.json")
    requests_mock.get(f"{SOCRADAR_API_ENDPOINT}/{suffix}", json=mock_response, status_code=401)
    client = Client(
        base_url=SOCRADAR_API_ENDPOINT, api_key=mock_socradar_api_key, tlp_color="", tags="", verify=False, proxy=False
    )
    with pytest.raises(DemistoException, match=MESSAGES["AUTHORIZATION_ERROR"]):
        test_module(client, [])


def test_fetch_indicators(requests_mock):
    """Tests the fetch-indicators function.

    Configures requests_mock instance to generate the appropriate
    SOCRadar Threat Intelligence Collections API response, loaded from a local JSON file. Checks
    the output of the command function with the expected output.
    """
    from FeedSOCRadarThreatFeed import Client, fetch_indicators

    mock_socradar_api_key = "APIKey"
    mock_response = util_load_json("test_data/fetch_indicators_response.json")
    suffix = f"threat/intelligence/socradar_collections?key={mock_socradar_api_key}&collection_names=MockCollectionName"
    requests_mock.get(f"{SOCRADAR_API_ENDPOINT}/{suffix}", json=mock_response)

    client = Client(
        base_url=SOCRADAR_API_ENDPOINT, api_key=mock_socradar_api_key, tlp_color="GREEN", tags=["TEST"], verify=False, proxy=False
    )

    collections_to_fetch = ["MockCollectionName"]

    indicators = fetch_indicators(client=client, collections_to_fetch=collections_to_fetch, limit=1)

    expected_output = util_load_json("test_data/fetch_indicators_expected_output.json")

    assert indicators == expected_output
    assert len(indicators) == 1


def test_fetch_indicators_handles_error(requests_mock):
    """Tests the fetch_indicators function.

    Configures requests_mock instance to generate the appropriate
    SOCRadar SOCRadar Threat Intelligence Collections API response, loaded from a local JSON file. Checks
    the output of the command function with the expected output.
    """
    from FeedSOCRadarThreatFeed import Client, fetch_indicators

    mock_socradar_api_key = "APIKey"
    mock_response = util_load_json("test_data/fetch_indicators_response_error.json")
    suffix = f"threat/intelligence/socradar_collections?key={mock_socradar_api_key}&collection_names=MockCollectionName"
    requests_mock.get(f"{SOCRADAR_API_ENDPOINT}/{suffix}", json=mock_response)

    client = Client(
        base_url=SOCRADAR_API_ENDPOINT, api_key=mock_socradar_api_key, tlp_color="GREEN", tags=["TEST"], verify=False, proxy=False
    )

    collections_to_fetch = ["MockCollectionName"]
    indicators = fetch_indicators(client=client, collections_to_fetch=collections_to_fetch, limit=1)
    assert len(indicators) == 0


def test_get_indicators_command(requests_mock):
    """Tests the get_indicators_command function.

    Configures requests_mock instance to generate the appropriate
    SOCRadar Threat Intelligence Collections API response, loaded from a local JSON file. Checks
    the output of the command function with the expected output.
    """
    from FeedSOCRadarThreatFeed import Client, get_indicators_command

    mock_socradar_api_key = "APIKey"
    mock_response = util_load_json("test_data/get_indicators_response.json")
    suffix = f"threat/intelligence/socradar_collections?key={mock_socradar_api_key}&collection_names=MockCollectionName"
    requests_mock.get(f"{SOCRADAR_API_ENDPOINT}/{suffix}", json=mock_response)

    client = Client(
        base_url=SOCRADAR_API_ENDPOINT, api_key=mock_socradar_api_key, tlp_color="GREEN", tags=["TEST"], verify=False, proxy=False
    )

    mock_args = {"limit": 1, "collections_to_fetch": "MockCollectionName"}

    result = get_indicators_command(client, mock_args)

    expected_output = util_load_json("test_data/get_indicators_expected_output.json")
    expected_context = util_load_json("test_data/get_indicators_expected_context.json")

    assert isinstance(result, CommandResults)
    assert "Indicators from SOCRadar ThreatFeed Collections (MockCollectionName):" in result.readable_output
    assert result.outputs == expected_context
    assert result.raw_response == expected_output


def test_get_indicators_command_handles_error(requests_mock):
    """Tests the get_indicators_command function.

    Configures requests_mock instance to generate the appropriate
    SOCRadar SOCRadar Threat Intelligence Collections API response, loaded from a local JSON file. Checks
    the output of the command function with the expected output.
    """
    from FeedSOCRadarThreatFeed import Client, get_indicators_command

    mock_socradar_api_key = "APIKey"
    mock_response = util_load_json("test_data/get_indicators_response_error.json")
    suffix = f"threat/intelligence/socradar_collections?key={mock_socradar_api_key}&collection_names=MockCollectionName"
    requests_mock.get(f"{SOCRADAR_API_ENDPOINT}/{suffix}", json=mock_response)

    client = Client(
        base_url=SOCRADAR_API_ENDPOINT, api_key=mock_socradar_api_key, tlp_color="GREEN", tags=["TEST"], verify=False, proxy=False
    )
    mock_args = {"limit": 1, "collections_to_fetch": "MockCollectionName"}
    result = get_indicators_command(client, mock_args)
    assert isinstance(result, CommandResults)
    assert len(result.outputs) == 0


def test_date_string_to_iso_format_parsing():
    """Tests the date_string_to_iso_format_parsing function."""
    from FeedSOCRadarThreatFeed import date_string_to_iso_format_parsing

    mock_date_str = "1111-11-11 11:11:11"
    formatted_date = date_string_to_iso_format_parsing(mock_date_str)

    assert formatted_date


def test_build_entry_context():
    """Tests the build_entry_context function."""
    from FeedSOCRadarThreatFeed import build_entry_context

    mock_indicators = util_load_json("test_data/build_entry_context_input.json")
    context_entry = build_entry_context(mock_indicators)
    expected_context_entry = util_load_json("test_data/build_entry_context_expected_entry.json")

    assert context_entry == expected_context_entry


def test_reset_last_fetch_dict():
    """Tests the reset_last_fetch_dict function."""
    from FeedSOCRadarThreatFeed import reset_last_fetch_dict

    result = reset_last_fetch_dict()

    assert isinstance(result, CommandResults)
    assert "Fetch history has been successfully deleted!" in result.readable_output


CONVERT_DEMISTO_INDICATOR_TYPE_INPUTS = [
    ("hostname", FeedIndicatorType.Domain),
    ("url", FeedIndicatorType.URL),
    ("ip", FeedIndicatorType.IP),
    ("hash", FeedIndicatorType.File),
]


@pytest.mark.parametrize("socradar_indicator_type, demisto_indicator_type", CONVERT_DEMISTO_INDICATOR_TYPE_INPUTS)
def test_convert_to_demisto_indicator_type(socradar_indicator_type, demisto_indicator_type):
    from FeedSOCRadarThreatFeed import convert_to_demisto_indicator_type

    assert convert_to_demisto_indicator_type(socradar_indicator_type) == demisto_indicator_type