import json import pytest from GitGuardianEventCollector import fetch_events, get_events def util_load_json(path): with open(path, encoding="utf-8") as f: return json.loads(f.read()) def http_mock(method: str, url_suffix: str = "", full_url: str = "", params: dict = {}, retries: int = 3): if url_suffix == "/secrets" or full_url.endswith("/secrets"): return util_load_json("test_data/incident_response.json") elif full_url == "next_url": return util_load_json("test_data/audit_log_response_next_link.json") else: return util_load_json("test_data/audit_log_response.json") @pytest.fixture(autouse=True) def client(mocker): from GitGuardianEventCollector import Client headers = {"Authorization": "Token mock"} mocker.patch.object(Client, "_http_request", side_effect=http_mock) return Client( base_url="https://mock.gitguardian.com", verify=False, proxy=False, headers=headers, ) def test_get_events_command_limit(client): """ Given: A mock GitGuardian client. When: Running get_events with a limit of 1, while there are two events. Then: Ensure only one event of each type is returned. """ mock_args = {"limit": "1"} incidents, audit_logs, _ = get_events(client=client, args=mock_args) assert len(incidents) == 1 assert len(audit_logs) == 1 def test_extract_event_ids_with_same_to_fetch_time(client): """ Given: A mock GitGuardian client. When: Running extract_incident_ids_with_same_last_occurrence_date. Then: Ensure the indicators returned have the same last_occurence_date as the one provided """ incidents = [ {"id": 1, "last_occurrence_date": "2024-01-03T21:05:38Z"}, {"id": 2, "last_occurrence_date": "2024-02-03T21:05:38Z"}, {"id": 3, "last_occurrence_date": "2024-01-03T21:05:38Z"}, ] ids_with_same_occurrence_date = client.extract_event_ids_with_same_to_fetch_time( incidents, "2024-01-03T21:05:38Z", "incident" ) assert ids_with_same_occurrence_date == [1, 3] def test_remove_duplicated_incidents(client): """ Given: A mock GitGuardian client. When: Running remove_duplicated_incidents. Then: Ensure the indicators returned without the incidents that were fetched before """ incidents = [ {"id": 1, "last_occurrence_date": "2024-02-03T21:05:38Z"}, {"id": 2, "last_occurrence_date": "2024-01-03T21:05:38Z"}, {"id": 3, "last_occurrence_date": "2024-03-03T21:05:38Z"}, ] last_fetched_ids = [1] sorted_incidents = client.remove_duplicated_events(incidents, last_fetched_ids) assert sorted_incidents == [ {"id": 2, "last_occurrence_date": "2024-01-03T21:05:38Z"}, {"id": 3, "last_occurrence_date": "2024-03-03T21:05:38Z"}, ] def test_fetch_events_without_nextTrigger(client, mocker): """ Given: A mock GitGuardian client. When: Running fetch_events with a limit of 3 Then: Ensure all of the events are returned, and the next run include the new fetch times. """ max_events_per_fetch = 2 last_run = { "incident": { "from_fetch_time": "2024-01-03T21:10:40Z", "to_fetch_time": "2024-01-03T21:10:40Z", "last_fetched_event_ids": [], "next_url_link": "", }, "audit_log": { "from_fetch_time": "2024-01-03T21:10:40Z", "to_fetch_time": "2024-01-03T21:10:40Z", "last_fetched_event_ids": [], "next_url_link": "", }, } mocker.patch("GitGuardianEventCollector.send_events_to_xsiam") next_run, incidents, audit_logs = fetch_events(client, last_run, max_events_per_fetch) assert len(incidents) == 2 assert len(audit_logs) == 2 assert next_run["incident"].get("from_fetch_time") == "2024-01-03T21:10:40Z" assert next_run["incident"].get("last_fetched_event_ids") == [] assert "nextTrigger" not in next_run # fetched all of the events def test_fetch_events_with_nextTrigger(client, mocker): """ Given: A mock GitGuardian client. When: Running fetch_events with a limit of 1 Then: Ensure next run include the new fetch times, the next_url link, and fetch timing """ max_events_per_fetch = 1 last_run = { "incident": { "from_fetch_time": "2024-01-03T21:10:40Z", "to_fetch_time": "2024-01-03T21:10:42Z", "last_fetched_event_ids": [], "next_url_link": "", }, "audit_log": { "from_fetch_time": "2024-01-03T21:10:40Z", "to_fetch_time": "2024-01-03T21:10:42Z", "last_fetched_event_ids": [], "next_url_link": "", }, } mocker.patch("GitGuardianEventCollector.send_events_to_xsiam") next_run, _, _ = fetch_events(client, last_run, max_events_per_fetch) assert "nextTrigger" in next_run # did not fetch all of the events assert next_run["audit_log"].get("next_url_link") == "next_url" # Did not update the time window due to next url assert next_run["audit_log"].get("from_fetch_time") == "2024-01-03T21:10:40Z" assert next_run["audit_log"]["is_pagination_in_progress"] assert next_run["incident"].get("next_url_link") == "" assert not next_run["incident"]["is_pagination_in_progress"] assert next_run["incident"].get("from_fetch_time") == "2024-01-03T21:10:42Z"