TeamViewer Event Collector

import TeamViewerEventCollector
from freezegun import freeze_time


def test_constructor():
    """
    Given:
    - mocker

    When:
    - Calling the constructor function

    Then:
    - Ensure that the that the function return valid response
    """
    from TeamViewerEventCollector import Client

    base_url = "https://example.com"
    verify = False
    proxy = "http://proxy.example.com"
    headers = {"Authorization": "Bearer token"}
    client = Client(base_url=base_url, verify=verify, proxy=proxy, headers=headers)
    assert client._base_url == base_url
    assert client._verify == verify
    assert client._headers == headers


def test_invalid_request(mocker):
    """
    Given:
    - mocker

    When:
    - Calling the get_events function

    Then:
    - Ensure that the that the get_events method handles an invalid request
    """
    from TeamViewerEventCollector import Client

    # Mocking the get_events method to return an error response
    mocker.patch.object(Client, "get_events", return_value={"error": "Invalid request"})
    # Creating a client instance and calling the get_events method with invalid parameters and body
    client = Client(base_url="https://example.com", verify=False, proxy=False, headers=None)
    response = client.get_events(params="invalid", body="invalid")
    # Asserting that the response contains the expected error message
    assert response == {"error": "Invalid request"}


def test_search_events_retrieves_requested_number_of_events(mocker):
    """
    Given:
    - mocker

    When:
    - Calling the search_events function

    Then:
    - Ensure that the that the function successfully retrieves the requested number of events.
    """
    # Arrange
    client = TeamViewerEventCollector.Client(base_url="https://example.com", verify=False, proxy=False, headers={})
    limit = 3
    expected_results = [{"event_id": i, "Timestamp": f"2022-01-01T00:00:0{i}Z"} for i in range(1, limit + 1)]
    response = {"AuditEvents": expected_results}
    mocker.patch.object(client, "get_events", return_value=response)

    # Act
    results = TeamViewerEventCollector.search_events(client=client, limit=limit)

    # Assert
    assert len(results[0]) == limit
    assert results[0] == expected_results


def test_search_events_retrieves_all_available_events_when_limit_is_higher_than_number_of_available_events(mocker):
    """
    Given:
    - mocker

    When:
    - Calling the search_events function

    Then:
    - Ensure that the that the function retrieves all available events when
      the limit is set to a number higher than the number of available events
    """

    # Arrange
    client = TeamViewerEventCollector.Client(base_url="https://example.com", verify=False, proxy=False, headers={})
    limit = 10
    expected_results = [{"event_id": i, "Timestamp": f"2022-01-01T00:00:0{i}Z"} for i in range(1, 6)]
    response = {"AuditEvents": expected_results, "ContinuationToken": "abc123"}
    mocker.patch.object(client, "get_events", side_effect=[response, {"AuditEvents": []}, {}])

    # Act
    results = TeamViewerEventCollector.search_events(client=client, limit=limit)

    # Assert
    assert len(results[0]) == 5
    assert results[0] == expected_results


def test_search_events_retrieves_when_limit_is_lower_than_results(mocker):
    """
    Given:
    - mocker

    When:
    - Calling the search_events function

    Then:
    - Ensure that the that the function retrieves 1 event when the limit is set to 1.
    """
    # Arrange
    client = TeamViewerEventCollector.Client(base_url="https://example.com", verify=False, proxy=False, headers={})
    limit = 1
    mocker.patch.object(
        client,
        "get_events",
        return_value={
            "AuditEvents": [
                {"event_id": 1, "Timestamp": "2022-01-01T00:00:00Z"},
                {"event_id": 2, "Timestamp": "2022-01-01T00:20:00Z"},
            ]
        },
    )

    # Act
    results = TeamViewerEventCollector.search_events(client=client, limit=limit)

    # Assert
    assert len(results[0]) == limit


def test_search_events_retrieves_no_events_when_time_parameters_have_no_events(mocker):
    """
    Given:
    - A client object
    - A limit parameter
    - A body parameter with time parameters set to a time range with no events

    When:
    - Calling the search_events function

    Then:
    - Ensure that the function retrieves no events when the time parameters
    in the body are set to a time range with no events.
    """
    mock_http_request = mocker.patch.object(
        TeamViewerEventCollector.Client, "get_events", return_value={"AuditEvents": [], "ContinuationToken": None}
    )
    client = TeamViewerEventCollector.Client(base_url="https://test.com", verify=False, proxy=False, headers={})
    results = TeamViewerEventCollector.search_events(
        client=client, limit=10, body={"StartTimeUtc": "2022-01-01T00:00:00Z", "EndTimeUtc": "2022-01-02T00:00:00Z"}
    )
    assert len(results[0]) == 0
    mock_http_request.assert_called_once()


# response or a response with missing fields.
def test_search_events_handles_empty_response_and_missing_fields(mocker):
    """
    Given:
    - A client object
    - A limit parameter
    - An API response with missing fields or an empty response

    When:
    - Calling the search_events function

    Then:
    - Ensure that the function handles the case and returns an empty list
    """
    mock_http_request = mocker.patch.object(TeamViewerEventCollector.Client, "get_events", return_value={})
    client = TeamViewerEventCollector.Client(base_url="https://test.com", verify=False, proxy=False, headers={})
    results = TeamViewerEventCollector.search_events(client=client, limit=10)
    assert len(results[0]) == 0
    mock_http_request.assert_called_once()


@freeze_time("2023-04-16T10:46:49Z")
def test_fetch_events_command(mocker):
    """
    Given:
    - A client object
    - A maximum number of events to fetch
    - A last run dictionary with no last fetch time
    - A first fetch time

    When:
    - Calling the fetch_events_command function

    Then:
    - Ensure the function returns the correct next run dictionary and events list
    """
    from datetime import datetime

    from TeamViewerEventCollector import Client, fetch_events_command

    client = Client(base_url="https://test.com", verify=False, proxy=False, headers={})
    max_fetch = 50
    last_run = {"last_fetch": None}
    first_fetch_time = datetime(2022, 1, 1, 0, 0, 0)
    expected_next_run = {"last_fetch": "2023-04-16T10:46:49Z"}
    expected_events = [{"id": 1, "Timestamp": "2023-01-01T01:00:00Z"}, {"id": 2, "Timestamp": "2023-04-16T10:46:49Z"}]

    mocker.patch("datetime.datetime.utcnow", return_value=datetime(2023, 4, 16, 10, 46, 49))
    http_request_mock = mocker.patch.object(
        TeamViewerEventCollector.Client, "get_events", return_value={"AuditEvents": expected_events}
    )
    next_run, events = fetch_events_command(client, max_fetch, last_run, first_fetch_time)

    assert next_run == expected_next_run
    assert events == expected_events
    http_request_mock.assert_called_once()


def test_add_time_key():
    """
    Given:
    - Valid parameters for the main function.

    When:
    - Calling the add_time_key function.

    Then:
    - Ensure the function executes successfully with valid parameters.
    """
    from TeamViewerEventCollector import add_time_key_to_events

    events = [{"Timestamp": "2022-01-01T00:00:00Z", "data": "example data"}]
    result = add_time_key_to_events(events)
    assert result == [{"Timestamp": "2022-01-01T00:00:00Z", "_time": "2022-01-01T00:00:00Z", "data": "example data"}]


def test_main_function(mocker):
    """
    Given:
    - Valid parameters for the main function.

    When:
    - Calling the main function.

    Then:
    - Ensure the function executes successfully with valid parameters.
    """
    import demistomock as demisto
    from TeamViewerEventCollector import Client, main

    mocker.patch.object(
        demisto,
        "params",
        return_value={
            "url": "https://test.com",
            "credentials": {"Script Token": "test_token"},
            "insecure": False,
            "proxy": False,
            "first_fetch": "3 days",
            "max_fetch": "300",
        },
    )
    mocker.patch.object(demisto, "args", return_value={})
    mocker.patch.object(demisto, "command", return_value="fetch-events")
    mocker.patch.object(demisto, "getLastRun", return_value={"last_fetch": "2023-04-16T10:46:49Z"})
    mocker.patch.object(demisto, "setLastRun")
    demisto_debug_mocker = mocker.patch.object(demisto, "debug")
    demisto_results_mocker = mocker.patch.object(demisto, "results")
    mocker.patch.object(TeamViewerEventCollector, "send_events_to_xsiam")
    mocker.patch.object(Client, "get_events")
    demisto_results_mocker = mocker.patch.object(
        TeamViewerEventCollector,
        "fetch_events_command",
        return_value=(
            {"last_fetch": "2023-04-16T10:46:49Z"},
            [{"id": 1, "Timestamp": "2023-01-01T01:00:00Z"}, {"id": 2, "Timestamp": "2023-04-16T10:46:49Z"}],
        ),
    )
    main()
    assert demisto_debug_mocker.call_count == 3
    demisto_results_mocker.assert_called_once()