GetIndicatorDBotScore

import CommonServerPython
import demistomock as demisto
import pytest

GetIndicatorDBotScoreFunc = "GetIndicatorDBotScore.get_dbot_score_data"


@pytest.fixture(autouse=True)
def handle_calling_context(mocker):
    mocker.patch.object(demisto, "callingContext", {"script": True})


@pytest.mark.parametrize(
    "indicator, indicator_type, expected",
    [
        ("test_indicator", "File SHA-256", "file"),
        ("test_indicator", "File SHA256", "file"),
        ("test_indicator", "File", "file"),
        ("test_indicator", "CVE", "cve"),
        ("test_indicator", "IP", "ip"),
        ("test_indicator", "Email", "email"),
        ("test_indicator", "Url", "url"),
        ("test_indicator", "IPv6", "ip"),
    ],
)
def test_validate_indicator_type(indicator, indicator_type, expected):
    """
    Given:
        - an indicator's data

    When:
        - running the script

    Then:
        - validating the dbotScoreType matches the correct indicator type
    """
    from GetIndicatorDBotScore import INDICATOR_TYPES, get_dbot_score_data

    indicator_type_after_mapping = INDICATOR_TYPES.get(indicator_type, indicator_type).lower()
    res = get_dbot_score_data(indicator, indicator_type_after_mapping, "source", 0)
    assert res.get("Type") == expected


RESPONSE = [
    {
        "Contents": [
            {
                "indicator_type": "IP",
                "manualScore": True,
                "moduleToFeedMap": {
                    "VirusTotal": {"score": 1, "type": "IP", "value": "8.8.8.8"},
                    "ipinfo": {"score": 0, "type": "IP", "value": "8.8.8.8"},
                },
                "score": 2,
                "value": "8.8.8.8",
            }
        ],
        "Type": 1,
    }
]


@pytest.mark.parametrize(
    "indicator_input, expected_count",
    [
        ("test1", 1),
        (["test1", "test2"], 2),
        (["test1", "test2", "test3"], 3),
        ("test1,test2", 1),
        ("https://expired.badssl.com/?q=1,2,3", 1),
        ('["https://expired.badssl.com/?q=1,2,3", "indicator2"]', 2),
    ],
)
def test_multiple_indicators(mocker, indicator_input, expected_count):
    """
    Given:
            - indicator list as input

        When:
            - running the script

        Then:
            - ensures that every indicator in the input returns one valid result (multiple indicators have multiple results)
    """

    from GetIndicatorDBotScore import main

    mocker.patch.object(CommonServerPython, "appendContext")
    execute_command = mocker.patch.object(demisto, "executeCommand", return_value=RESPONSE)
    mocker.patch.object(demisto, "args", return_value={"indicator": indicator_input})
    main()
    assert execute_command.call_count == expected_count


class TestIterateIndicatorEntry:
    @staticmethod
    def set_input(score=2, indicator="8.8.8.8", indicator_type="IP", vendors="ipinfo", set_by=None):
        module_to_feed_map = {}
        vendors = [vendors] if not isinstance(vendors, list) else vendors
        for i, vendor in enumerate(vendors):
            module_to_feed_map[vendor] = {"score": i % 4, "type": indicator_type, "value": indicator}

        res = {"indicator_type": indicator_type, "moduleToFeedMap": module_to_feed_map, "score": score, "value": indicator}
        if set_by:
            res.update({"manualScore": bool(set_by), "setBy": set_by})
        return res

    def test_iterate_indicator_entry_without_vendor(self):
        from GetIndicatorDBotScore import iterate_indicator_entry

        input_data = self.set_input(vendors="")
        output = [x[0] for x in iterate_indicator_entry("8.8.8.8", input_data)]
        assert output == [{"Vendor": "Cortex XSOAR", "Indicator": "8.8.8.8", "Score": 0, "Type": "ip"}]

    def test_iterate_indicator_entry_with_1_vendor(self):
        from GetIndicatorDBotScore import iterate_indicator_entry

        input_data = self.set_input(vendors="test")
        output = [x[0] for x in iterate_indicator_entry("8.8.8.8", input_data)]
        assert output == [{"Vendor": "test", "Indicator": "8.8.8.8", "Score": 0, "Type": "ip"}]

    def test_iterate_indicator_entry_with_corupted_vendor(self):
        from GetIndicatorDBotScore import iterate_indicator_entry

        input_data = self.set_input(vendors=None)
        output = [x[0] for x in iterate_indicator_entry("8.8.8.8", input_data)]
        assert output == [{"Vendor": "Cortex XSOAR", "Indicator": "8.8.8.8", "Score": 0, "Type": "ip"}]

    def test_iterate_indicator_entry_with_1_vendor_and_manual_edit(self):
        from GetIndicatorDBotScore import iterate_indicator_entry

        input_data = self.set_input(vendors="test", set_by="admin")
        output = [x[0] for x in iterate_indicator_entry("8.8.8.8", input_data)]
        assert output == [
            {"Vendor": "test", "Indicator": "8.8.8.8", "Score": 0, "Type": "ip"},
            {"Vendor": "admin", "Indicator": "8.8.8.8", "Score": 2, "Type": "ip"},
        ]

    def test_iterate_indicator_entry_with_2_vendors(self):
        from GetIndicatorDBotScore import iterate_indicator_entry

        input_data = self.set_input(vendors=["test1", "test2"])
        output = [x[0] for x in iterate_indicator_entry("8.8.8.8", input_data)]
        assert output == [
            {"Vendor": "test1", "Indicator": "8.8.8.8", "Score": 0, "Type": "ip"},
            {"Vendor": "test2", "Indicator": "8.8.8.8", "Score": 1, "Type": "ip"},
        ]