RaDark

import json
import os

import RaDark as integration

API_KEY = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
MONITOR_ID = "0000"
CLIENT = integration.Client(
    base_url=integration.BASE_URL, verify=True, headers={}, proxy=False, api_key=API_KEY, monitor_id=MONITOR_ID
)


def load_mock_response(file_name: str) -> dict:
    data_path = os.path.normpath(os.path.join(os.path.dirname(__file__), "test_data", file_name))
    with open(data_path, encoding="utf-8") as mock_file:
        return json.loads(mock_file.read())


def test_fetch_incidents(requests_mock):
    mock_data = load_mock_response("fetch_incidents_info.json")
    fetch_incidents_response = mock_data.get("FETCH_INCIDENTS_RESPONSE", {})
    fetch_incidents_params = mock_data.get("FETCH_INCIDENTS_PARAMS", {})
    fetch_incidents_results = mock_data.get("FETCH_INCIDENTS_RESULTS", {})

    api = integration.FETCH_INCIDENTS_API.format(
        MONITOR_ID=MONITOR_ID, API_KEY=API_KEY, max_results=fetch_incidents_params.get("max_results", 0)
    )

    url = f"{integration.BASE_URL}/{api}"
    requests_mock.post(url, json=fetch_incidents_response)
    next_run, incidents = integration.fetch_incidents(
        CLIENT,
        max_results=fetch_incidents_params.get("max_results", 0),
        last_run=fetch_incidents_params.get("last_run", {}),
        first_fetch_time=fetch_incidents_params.get("first_fetch_time", 0),
        incident_types=fetch_incidents_params.get("incident_types", []),
    )

    assert next_run == fetch_incidents_results.get("next_run")
    assert len(incidents) == len(fetch_incidents_results.get("incidents", [])) == 1
    assert isinstance(incidents, list) == isinstance(fetch_incidents_results.get("incidents", []), list)
    assert incidents[0]["name"] == fetch_incidents_results.get("incidents", [])[0]["name"]
    assert incidents[0]["occurred"] == fetch_incidents_results.get("incidents", [])[0]["occurred"]
    assert json.loads(incidents[0]["rawJSON"]) == fetch_incidents_results.get("incidents", [])[0]["rawJSON"]


def test_incident_get_items_command(requests_mock):
    mock_data = load_mock_response("incident_get_items_info.json")
    incident_get_items_response = mock_data.get("INCIDENT_GET_ITEMS_RESPONSE", {})
    incident_get_items_args = mock_data.get("INCIDENT_GET_ITEMS_ARGS", {})
    incident_get_items_command_results = mock_data.get("INCIDENT_GET_ITEMS_COMMAND_RESULTS", {})

    incident_id = incident_get_items_args.get("incident_id", "")

    api = integration.FETCH_ITEMS_API.format(incident_id=incident_id, MONITOR_ID=MONITOR_ID, API_KEY=API_KEY)
    url = f"{integration.BASE_URL}/{api}"
    requests_mock.get(url, json=incident_get_items_response)
    command_results = integration.incident_get_items_command(CLIENT, incident_get_items_args)

    assert command_results.readable_output == incident_get_items_command_results.get("readable_output", "")
    assert command_results.outputs_prefix == incident_get_items_command_results.get("outputs_prefix", "")
    assert command_results.outputs_key_field == incident_get_items_command_results.get("outputs_key_field", "")
    assert command_results.outputs == incident_get_items_command_results.get("outputs", "")


def test_email_enrich_command(requests_mock):
    mock_data = load_mock_response("email_enrich_info.json")
    email_enrich_response = mock_data.get("EMAIL_ENRICH_RESPONSE", {})
    email_enrich_args = mock_data.get("EMAIL_ENRICH_ARGS", {})
    email_enrich_command_results = mock_data.get("EMAIL_ENRICH_COMMAND_RESULTS", {})
    api = integration.EMAIL_ENRICHMENT_API.format(MONITOR_ID=MONITOR_ID, API_KEY=API_KEY)
    url = f"{integration.BASE_URL}/{api}"
    requests_mock.post(url, json=email_enrich_response)
    command_results = integration.email_enrich_command(CLIENT, email_enrich_args)

    assert command_results.readable_output == email_enrich_command_results.get("readable_output", "")
    assert command_results.outputs_prefix == email_enrich_command_results.get("outputs_prefix", "")
    assert command_results.outputs_key_field == email_enrich_command_results.get("outputs_key_field", "")
    assert command_results.outputs == email_enrich_command_results.get("outputs", "")


def test_item_handle_command(requests_mock):
    mock_data = load_mock_response("item_handle_info.json")
    item_handle_response = mock_data.get("ITEM_HANDLE_RESPONSE", {})
    item_handle_args = mock_data.get("ITEM_HANDLE_ARGS", {})
    item_handle_command_results = mock_data.get("ITEM_HANDLE_COMMAND_RESULTS", {})
    api = integration.INCIDENT_ACTION_API.format(item_id=item_handle_args.get("item_id", ""), action="handled", API_KEY=API_KEY)
    url = f"{integration.BASE_URL}/{api}"
    requests_mock.post(url, json=item_handle_response)
    command_results = integration.item_handle_command(CLIENT, item_handle_args)

    assert command_results.readable_output == item_handle_command_results.get("readable_output", "")


def test_item_purchase_command(requests_mock):
    mock_data = load_mock_response("item_purchase_info.json")
    item_purchase_response = mock_data.get("ITEM_PURCHASE_RESPONSE", [{}, {}, {}, {}, {}])
    item_purchase_args = mock_data.get("ITEM_PURCHASE_ARGS", {})
    item_purchase_runtime_params = mock_data.get("ITEM_PURCHASE_RUNTIME_PARAMS", {})
    item_purchase_command_results = mock_data.get("ITEM_PURCHASE_COMMAND_RESULTS", {})

    item_id = item_purchase_args.get("item_id", "")
    incident_id = item_purchase_runtime_params.get("incident_id", "")

    api0 = integration.MENTIONS_LIST_API.format(API_KEY=API_KEY, MONITOR_ID=MONITOR_ID)
    url0 = f"{integration.BASE_URL}/{api0}"
    requests_mock.get(url0, json=item_purchase_response[0])

    api1 = integration.FETCH_AN_ITEM_API.format(item_id=item_id, API_KEY=API_KEY, MONITOR_ID=MONITOR_ID)
    url1 = f"{integration.BASE_URL}/{api1}"
    requests_mock.get(url1, json=item_purchase_response[1])

    api2 = integration.FETCH_ITEMS_API.format(incident_id=incident_id, API_KEY=API_KEY, MONITOR_ID=MONITOR_ID)
    url2 = f"{integration.BASE_URL}/{api2}"
    requests_mock.get(url2, json=item_purchase_response[2])

    api3 = integration.INCIDENT_ACTION_API.format(item_id=item_id, action="request", API_KEY=API_KEY)
    url3 = f"{integration.BASE_URL}/{api3}"
    requests_mock.post(url3, json=item_purchase_response[3])

    api4 = integration.MESSAGE_API.format(API_KEY=API_KEY)
    url4 = f"{integration.BASE_URL}/{api4}"
    requests_mock.post(url4, json=item_purchase_response[4])

    command_results = integration.item_purchase_command(CLIENT, item_purchase_args)

    assert command_results.readable_output == item_purchase_command_results.get("readable_output", "")


def test_parse_email_enrichment_markdown_table():
    mock_data = load_mock_response("helper_functions_info.json").get("PARSE_EMAIL_ENRICHMENT_MARKDOWN_TABLE", {})
    args = mock_data.get("ARGS", {})
    return_value = mock_data.get("RETURN_VALUE", [])
    results = integration.parse_email_enrichment_markdown_table(args.get("DATA", {}))

    assert results == tuple(return_value)


def test_parse_leaked_credentials_markdown_table():
    mock_data = load_mock_response("helper_functions_info.json").get("PARSE_LEAKED_CREDENTIALS_MARKDOWN_TABLE", {})
    args = mock_data.get("ARGS", {})
    return_value = mock_data.get("RETURN_VALUE", [])
    results = integration.parse_leaked_credentials_markdown_table(args.get("ITEMS", {}), args.get("SUB_TYPE", 0))

    assert results == return_value


def test_parse_botnets_markdown_table():
    mock_data = load_mock_response("helper_functions_info.json").get("PARSE_BOTNETS_MARKDOWN_TABLE", {})
    args = mock_data.get("ARGS", {})
    return_value = mock_data.get("RETURN_VALUE", [])
    results = integration.parse_botnets_markdown_table(args.get("ITEMS", {}), args.get("SUB_TYPE", 0))

    assert results == return_value


def test_parse_network_vulnerabilities_markdown_table():
    mock_data = load_mock_response("helper_functions_info.json").get("PARSE_NETWORK_VULNERABILITIES_MARKDOWN_TABLE", {})
    args = mock_data.get("ARGS", {})
    return_value = mock_data.get("RETURN_VALUE", [])
    results = integration.parse_network_vulnerabilities_markdown_table(args.get("ITEMS", {}), args.get("SUB_TYPE", 0))

    assert results == return_value


def test_parse_credit_cards_markdown_table():
    mock_data = load_mock_response("helper_functions_info.json").get("PARSE_CREDIT_CARDS_MARKDOWN_TABLE", {})
    args = mock_data.get("ARGS", {})
    return_value = mock_data.get("RETURN_VALUE", [])
    results = integration.parse_credit_cards_markdown_table(args.get("ITEMS", {}), args.get("SUB_TYPE", 0))

    assert results == return_value


def test_parse_hacking_discussions_markdown_table():
    mock_data = load_mock_response("helper_functions_info.json").get("PARSE_HACKING_DISCUSSIONS_MARKDOWN_TABLE", {})
    args = mock_data.get("ARGS", {})
    return_value = mock_data.get("RETURN_VALUE", [])
    results = integration.parse_hacking_discussions_markdown_table(args.get("ITEMS", {}), args.get("AGGR", {}))

    assert results == return_value


def test_extract_available_data_from_item():
    mock_data = load_mock_response("helper_functions_info.json").get("EXTRACT_AVAILABLE_DATA_FROM_ITEM", {})
    args = mock_data.get("ARGS", {})
    return_value = mock_data.get("RETURN_VALUE", [])
    results = integration.extract_available_data_from_item(args.get("ITEM", {}))

    assert results == tuple(return_value)