InvestigationSummaryToTable

import json
from pathlib import Path

from InvestigationSummaryToTable import Result, findings_to_command_results, get_findings

TEST_DATA_DIR = Path(__file__).parent / "test_data"


def _load_test_file(file_name: str):
    return json.loads((TEST_DATA_DIR / file_name).read_text())


def _dump_test_file(file_name: str, content: dict):
    (TEST_DATA_DIR / file_name).write_text(json.dumps(content))


def test_empty_context():
    context = {}
    findings = get_findings(context)
    result = findings_to_command_results(findings)
    assert not result.outputs
    assert (
        result.readable_output == "### Waiting on entries\n"
        "When `InvestigationSummaryParse` is finished, its results will appear here."
    )


def test_context():
    findings = get_findings(
        {
            "EvidenceOfCommandAndControl": {"Result": "Suspicious", "Tactic": "Command and Control"},
            "EvidenceOfPrivilegeEscalation": [
                {"should be ignored": "should be ignored"},
                {"Result": "Not Detected", "Tactic": "Privilege Escalation"},
            ],
        }
    )
    assert len(findings) == 2
    assert findings[0].result == Result.SUSPICIOUS
    assert findings[0].tactic == "Command and Control"
    assert findings[0].context_name == "EvidenceOfCommandAndControl"
    assert findings[1].result == Result.NOT_DETECTED
    assert findings[1].tactic == "Privilege Escalation"
    assert findings[1].context_name == "EvidenceOfPrivilegeEscalation"
    assert findings_to_command_results(findings).to_context() == _load_test_file("expected_context.json")