import json
from pathlib import Path

from InvestigationDetailedSummaryToTable import table_command

TEST_DATA_DIR = Path(__file__).parent / "test_data"


def _dump_test_file(file_name: str, content: dict | list):
    (TEST_DATA_DIR / file_name).write_text(json.dumps(content))


def _load_test_file(file_name: str):
    return json.loads((TEST_DATA_DIR / file_name).read_text())


def test_empty_context():
    assert table_command({}).to_context() == _load_test_file("empty_context.json")


def test_table_command():
    context = {
        "Collection": [
            {
                "Automated Collection": True,
                "Data Staged: Local Data Staging": True,
                "Data from Local System": True,
                "Email Collection": True,
                "Input Capture: Keylogging": True,
                "Screen Capture": True,
            }
        ],
        "Command & Control": [
            {
                "Application Layer Protocol": True,
                "Encrypted Channel": True,
                "Encrypted Channel: Asymmetric Cryptography": True,
                "Encrypted Channel: Symmetric Cryptography": True,
                "Ingress Tool Transfer": True,
                "Non-Application Layer Protocol": True,
                "Proxy": True,
            }
        ],
        "Credential Access": [{"Credentials from Password Stores": True, "Input Capture: Keylogging": True}],
        "Defense Evasion": [
            {
                "Abuse Elevation Control Mechanism: Bypass User Account Control": True,
                "Access Token Manipulation": True,
                "Access Token Manipulation: Token Impersonation/Theft": True,
                "Debugger Evasion": True,
                "Deobfuscate/Decode Files or Information": True,
                "Execution Guardrails": True,
                "File and Directory Permissions Modification": True,
                "Hide Artifacts": True,
                "Hijack Execution Flow: Hijack Execution Flow": True,
                "Impair Defenses: Disable or Modify Tools": True,
                "Indicator Removal: Clear Command History": True,
                "Indicator Removal: Indicator Removal": True,
                "Masquerading": True,
                "Modify Registry": True,
                "Obfuscated Files or Information": True,
                "Obfuscated Files or Information: Embedded Payloads": True,
                "Obfuscated Files or Information: Obfuscated Files or Information": True,
                "Process Injection": True,
                "Process Injection: Asynchronous Procedure Call": True,
                "Process Injection: Dynamic-link Library Injection": True,
                "Process Injection: Extra Window Memory Injection": True,
                "Process Injection: Thread Execution Hijacking": True,
                "Reflective Code Loading": True,
                "Virtualization/Sandbox Evasion: System Checks": True,
                "Virtualization/Sandbox Evasion: Time Based Evasion": True,
            }
        ],
        "Discovery": [
            {
                "Account Discovery": True,
                "Application Window Discovery": True,
                "Debugger Evasion": True,
                "File and Directory Discovery": True,
                "Process Discovery": True,
                "Query Registry": True,
                "Remote System Discovery": True,
                "System Information Discovery": True,
                "System Location Discovery": True,
                "System Location Discovery: System Language Discovery": True,
                "System Owner/User Discovery": True,
                "System Service Discovery": True,
                "System Time Discovery": True,
                "Virtualization/Sandbox Evasion: System Checks": True,
                "Virtualization/Sandbox Evasion: Time Based Evasion": True,
            }
        ],
        "Execution": [
            {
                "Command and Scripting Interpreter": False,
                "Command and Scripting Interpreter: PowerShell": True,
                "Inter-Process Communication": True,
                "Native API": True,
                "Shared Modules": True,
                "System Services: System Services": True,
            }
        ],
        "Exfiltration": [{"Scheduled Transfer": True}],
        "Impact": [
            {
                "Data Encrypted for Impact": True,
                "Data Manipulation": True,
                "Service Stop": True,
                "System Shutdown/Reboot": True,
            }
        ],
        "Lateral Movement": [{"Lateral Tool Transfer": True, "Remote Services": False}],
        "Persistence": [
            {
                "Boot or Logon Autostart Execution": True,
                "Create or Modify System Process": True,
                "Create or Modify System Process: Windows Service": True,
                "Event Triggered Execution: Event Triggered Execution": True,
                "Hijack Execution Flow: Hijack Execution Flow": True,
            }
        ],
        "Privilege Escalation": [
            {
                "Abuse Elevation Control Mechanism: Bypass User Account Control": True,
                "Access Token Manipulation": True,
                "Access Token Manipulation: Token Impersonation/Theft": True,
                "Boot or Logon Autostart Execution": True,
                "Create or Modify System Process": True,
                "Create or Modify System Process: Windows Service": True,
                "Event Triggered Execution: Event Triggered Execution": True,
                "Hijack Execution Flow: Hijack Execution Flow": True,
                "Process Injection": True,
                "Process Injection: Asynchronous Procedure Call": True,
                "Process Injection: Dynamic-link Library Injection": True,
                "Process Injection: Extra Window Memory Injection": True,
                "Process Injection: Thread Execution Hijacking": True,
            }
        ],
    }
    assert table_command(context).to_context() == _load_test_file("table_command.json")