import json
from pathlib import Path

import pytest
from InvestigationDetailedSummaryParse import DemistoException, parse_command

TEST_DATA_DIR = Path(__file__).parent / "test_data"


def _dump_test_file(file_name: str, content: dict | list):
    (TEST_DATA_DIR / file_name).write_text(json.dumps(content))


def _load_test_file(file_name: str):
    return json.loads((TEST_DATA_DIR / file_name).read_text())


def test_empty_context():
    assert [_.to_context() for _ in parse_command({})] == _load_test_file("empty_context.json")


def test_parse_command():
    context = {
        "AttackPattern": [
            {"KillChainPhases": ["Lateral Movement", "dummy"], "MITREID": "T1210", "Value": "Exploitation of Remote Services"},
            {"KillChainPhases": ["Execution"], "MITREID": "T1059", "Value": "Command and Scripting Interpreter"},
            {"KillChainPhases": ["dummy"], "MITREID": "T0000", "Value": "dummy value"},
        ]
    }
    assert [_.to_context() for _ in parse_command(context)] == _load_test_file("parse_command.json")


def test_parse_command_value_lower_case():
    """
    The same UT as above just with 'value' key (lower case) instead of 'Value'.
    When 'Value' key is missing, it should retrieve the content from 'value'.
    """
    context = {
        "AttackPattern": [
            {"KillChainPhases": ["Lateral Movement", "dummy"], "MITREID": "T1210", "value": "Exploitation of Remote Services"},
            {"KillChainPhases": ["Execution"], "MITREID": "T1059", "Value": "Command and Scripting Interpreter"},
            {"KillChainPhases": ["dummy"], "MITREID": "T0000", "Value": "dummy value"},
        ]
    }
    assert [_.to_context() for _ in parse_command(context)] == _load_test_file("parse_command.json")


def test_missing_value():
    """
    Given   a context where at least one of the AttackPattern results does not have a `Value` key
    When    running InvestigationDetailedSummaryParse
    Then    make sure an exception is raised.
    """
    context = {
        "AttackPattern": [
            {"KillChainPhases": ["Lateral Movement", "dummy"], "MITREID": "T1210"},  # missing Value key
            {"KillChainPhases": ["Execution"], "MITREID": "T1059", "Value": "Command and Scripting Interpreter"},
        ]
    }
    with pytest.raises(DemistoException) as e:
        parse_command(context)
    assert e.value.message == "please make sure the MITRE ATT&CK v2 pack is up-to-date (v1.1.1 or newer)"