<reponame>janheise/zentral
import datetime
from django.test import SimpleTestCase
from zentral.contrib.santa.events import (_build_file_tree_from_santa_event, EventMetadata,
                                          SantaEnrollmentEvent, SantaEventEvent,
                                          SantaRuleSetUpdateEvent, SantaRuleUpdateEvent)


class SantaEventTestCase(SimpleTestCase):
    def test_event_with_signed_bundle(self):
        event_d = {
            'current_sessions': [],
            'decision': 'ALLOW_UNKNOWN',
            'executing_user': 'root',
            'execution_time': 2242783327.585212,
            'file_bundle_id': 'servicecontroller:com.apple.stomp.transcoderx',
            'file_bundle_name': 'CompressorTranscoderX',
            'file_bundle_path': ('/Library/Frameworks/Compressor.framework/'
                                 'Versions/A/Resources/CompressorTranscoderX.bundle'),
            'file_bundle_version': '3.5.3',
            'file_bundle_version_string': '3.5.3',
            'file_name': 'compressord',
            'file_path': ('/Library/Frameworks/Compressor.framework/'
                          'Versions/A/Resources/CompressorTranscoderX.bundle/Contents/MacOS'),
            'file_sha256': '700362aec8dee7df2f17de03df0d0844979b0eca7e878f75248c91ae56b1a7c1',
            'logged_in_users': [],
            'parent_name': 'launchd',
            'pid': 95,
            'ppid': 1,
            'quarantine_timestamp': 0,
            'signing_chain': [{'cn': 'Software Signing',
                               'org': 'Apple Inc.',
                               'sha256': '47e9216d9e90fa2be9c352d40826c9573055f61188942fff25d58da96f8899d4',
                               'valid_from': 1172268176,
                               'valid_until': 1421272976},
                              {'cn': 'Apple Code Signing Certification Authority',
                               'org': 'Apple Inc.',
                               'ou': 'Apple Certification Authority',
                               'sha256': '3afa0bf5027fd0532f436b39363a680aefd6baf7bf6a4f97f17be2937b84b150',
                               'valid_from': 1171487959,
                               'valid_until': 1423948759},
                              {'cn': 'Apple Root CA',
                               'org': 'Apple Inc.',
                               'ou': 'Apple Certification Authority',
                               'sha256': 'b0b1730ecbc7ff4505142c49f1295e6eda6bcaed7e2c68c5be91b5a11001f024',
                               'valid_from': 1146001236,
                               'valid_until': 2054670036}]
        }
        file_d = {
            'source': {'module': 'zentral.contrib.santa', 'name': 'Santa events'},
            'bundle': {'bundle_id': 'servicecontroller:com.apple.stomp.transcoderx',
                       'bundle_name': 'CompressorTranscoderX',
                       'bundle_version': '3.5.3',
                       'bundle_version_str': '3.5.3'},
            'bundle_path': ('/Library/Frameworks/Compressor.framework/'
                            'Versions/A/Resources/CompressorTranscoderX.bundle'),
            'name': 'compressord',
            'path': ('/Library/Frameworks/Compressor.framework/'
                     'Versions/A/Resources/CompressorTranscoderX.bundle/Contents/MacOS'),
            'sha_256': '700362aec8dee7df2f17de03df0d0844979b0eca7e878f75248c91ae56b1a7c1',
            'signed_by': {
                'common_name': '<NAME>',
                'organization': 'Apple Inc.',
                'organizational_unit': None,
                'sha_256': '47e9216d9e90fa2be9c352d40826c9573055f61188942fff25d58da96f8899d4',
                'valid_from': datetime.datetime(2007, 2, 23, 22, 2, 56),
                'valid_until': datetime.datetime(2015, 1, 14, 22, 2, 56),
                'signed_by': {
                    'common_name': 'Apple Code Signing Certification Authority',
                    'organization': 'Apple Inc.',
                    'organizational_unit': 'Apple Certification Authority',
                    'sha_256': '3afa0bf5027fd0532f436b39363a680aefd6baf7bf6a4f97f17be2937b84b150',
                    'valid_from': datetime.datetime(2007, 2, 14, 21, 19, 19),
                    'valid_until': datetime.datetime(2015, 2, 14, 21, 19, 19),
                    'signed_by': {
                        'common_name': '<NAME>',
                        'organization': 'Apple Inc.',
                        'organizational_unit': 'Apple Certification Authority',
                        'sha_256': 'b0b1730ecbc7ff4505142c49f1295e6eda6bcaed7e2c68c5be91b5a11001f024',
                        'valid_from': datetime.datetime(2006, 4, 25, 21, 40, 36),
                        'valid_until': datetime.datetime(2035, 2, 9, 21, 40, 36),
                    },
                },
             }
        }
        self.assertEqual(_build_file_tree_from_santa_event(event_d), file_d)

    def test_event_with_unsigned_bundle(self):
        event_d = {
            'current_sessions': ['std@console',
                                 'std@ttys000',
                                 'std@ttys001',
                                 'std@ttys002',
                                 'std@ttys003'],
            'decision': 'BLOCK_UNKNOWN',
            'executing_user': 'std',
            'execution_time': 1492004439.58063,
            'file_bundle_id': 'com.googlecode.munki.ManagedSoftwareCenter',
            'file_bundle_name': 'Managed Software Center',
            'file_bundle_path': '/Applications/Managed Software Center.app',
            'file_bundle_version': '2842',
            'file_bundle_version_string': '4.2.2842',
            'file_name': 'Managed Software Center',
            'file_path': '/Applications/Managed Software Center.app/Contents/MacOS',
            'file_sha256': '3bccb77072bbc3eac675e2d95f6ef0f23362f015941dd3175bbc7f2d630040f2',
            'logged_in_users': ['std'],
            'parent_name': 'launchd',
            'pid': 1279,
            'ppid': 1,
            'quarantine_timestamp': 0,
            'signing_chain': []
        }
        file_d = {
            'source': {'module': 'zentral.contrib.santa', 'name': 'Santa events'},
            'bundle': {
                'bundle_id': 'com.googlecode.munki.ManagedSoftwareCenter',
                'bundle_name': 'Managed Software Center',
                'bundle_version': '2842',
                'bundle_version_str': '4.2.2842'
            },
            'bundle_path': '/Applications/Managed Software Center.app',
            'name': 'Managed Software Center',
            'path': '/Applications/Managed Software Center.app/Contents/MacOS',
            'sha_256': '3bccb77072bbc3eac675e2d95f6ef0f23362f015941dd3175bbc7f2d630040f2',
            'signed_by': None
        }
        self.assertEqual(_build_file_tree_from_santa_event(event_d), file_d)

    def test_event_without_bundle(self):
        event_d = {
            'current_sessions': ['std@console',
                                 'std@ttys001',
                                 'std@ttys000',
                                 'std@ttys002'],
            'decision': 'BLOCK_UNKNOWN',
            'executing_user': 'root',
            'execution_time': 1491860971.578268,
            'file_name': 'act',
            'file_path': '/var/tmp/act',
            'file_sha256': '13735e5fba4e11988645f0fa02f8dfa0c6caaf13a1e6c1cf06a47f80a7aab236',
            'logged_in_users': ['std'],
            'parent_name': 'bash',
            'pid': 1593,
            'ppid': 1585,
            'quarantine_timestamp': 0,
            'signing_chain': []
        }
        file_d = {
            'source': {'module': 'zentral.contrib.santa', 'name': 'Santa events'},
            'bundle': None,
            'bundle_path': None,
            'name': 'act',
            'path': '/var/tmp/act',
            'sha_256': '13735e5fba4e11988645f0fa02f8dfa0c6caaf13a1e6c1cf06a47f80a7aab236',
            'signed_by': None
        }
        self.assertEqual(_build_file_tree_from_santa_event(event_d), file_d)

    def test_event_linked_objects(self):
        event_d = {
            'current_sessions': ['personne@console', 'flaco@ttys000'],
            'decision': 'ALLOW_UNKNOWN',
            'executing_user': 'personne',
            'execution_time': 1637562907.2363129,
            'file_bundle_id': 'org.mozilla.firefox',
            'file_bundle_name': 'Firefox',
            'file_bundle_path': '/Applications/Firefox.app',
            'file_bundle_version': '9421.11.3',
            'file_bundle_version_string': '94.0.1',
            'file_name': 'firefox',
            'file_path': '/Applications/Firefox.app/Contents/MacOS',
            'file_sha256': '4bc6526e30f2d22d21dd58c60d401454bb6c772733a59cc1c3a21b52b0a23f57',
            'logged_in_users': ['personne'],
            'parent_name': 'launchd',
            'pid': 1280,
            'ppid': 1,
            'quarantine_agent_bundle_id': 'com.apple.Safari',
            'quarantine_data_url': 'https://download-installer.cdn.mozilla.net/pub/firefox/releases'
                                   '/94.0.1/mac/de/Firefox%2094.0.1.dmg',
            'quarantine_timestamp': 1637562799,
            'signing_chain': [
                {'cn': 'Developer ID Application: Mozilla Corporation (43AQ936H96)',
                 'org': 'Mozilla Corporation',
                 'ou': '43AQ936H96',
                 'sha256': '96f18e09d65445985c7df5df74ef152a0bc42e8934175a626180d9700c343e7b',
                 'valid_from': 1494270538,
                 'valid_until': 1652123338},
                {'cn': 'Developer ID Certification Authority',
                 'org': 'Apple Inc.',
                 'ou': 'Apple Certification Authority',
                 'sha256': '7afc9d01a62f03a2de9637936d4afe68090d2de18d03f29c88cfb0b1ba63587f',
                 'valid_from': 1328134335,
                 'valid_until': 1801519935},
                {'cn': 'Apple Root CA',
                 'org': 'Apple Inc.',
                 'ou': 'Apple Certification Authority',
                 'sha256': 'b0b1730ecbc7ff4505142c49f1295e6eda6bcaed7e2c68c5be91b5a11001f024',
                 'valid_from': 1146001236,
                 'valid_until': 2054670036}]
        }
        event = SantaEventEvent(EventMetadata(), event_d)
        self.assertEqual(
            event.get_linked_objects_keys(),
            {"file": [("sha256", "4bc6526e30f2d22d21dd58c60d401454bb6c772733a59cc1c3a21b52b0a23f57")],
             "certificate": [("sha256", "96f18e09d65445985c7df5df74ef152a0bc42e8934175a626180d9700c343e7b"),
                             ("sha256", "7afc9d01a62f03a2de9637936d4afe68090d2de18d03f29c88cfb0b1ba63587f"),
                             ("sha256", "b0b1730ecbc7ff4505142c49f1295e6eda6bcaed7e2c68c5be91b5a11001f024")],
             "apple_team_id": [("43AQ936H96",)]}
        )

    def test_binary_rule_update_linked_objects(self):
        event_d = {
            'result': 'updated',
            'rule': {
                'configuration': {'name': 'Default', 'pk': 1},
                'custom_msg': '123',
                'excluded_tags': [{'name': 'untag', 'pk': 1}],
                'policy': 'BLOCKLIST',
                'serial_numbers': ['2345', '456'],
                'tags': [{'name': 'deuxtag', 'pk': 2}],
                'target': {'sha256': 'e699f8aad9c46505531b174f3868ff05de5dddae5d2eef5c3da65a6bac7d2210',
                           'type': 'BINARY'}
            },
            'updates': {'added': {'excluded_tags': [{'name': 'untag', 'pk': 1}],
                                  'serial_numbers': ['456'],
                                  'tags': [{'name': 'deuxtag', 'pk': 2}]},
                        'removed': {'excluded_tags': [{'name': 'deuxtag', 'pk': 2}],
                                    'tags': [{'name': 'untag', 'pk': 1}]}}
        }
        event = SantaRuleUpdateEvent(EventMetadata(), event_d)
        self.assertEqual(
            event.get_linked_objects_keys(),
            {"santa_configuration": [(1,)],
             "file": [("sha256", "e699f8aad9c46505531b174f3868ff05de5dddae5d2eef5c3da65a6bac7d2210")]}
        )

    def test_certificate_rule_update_linked_objects(self):
        event_d = {
            'result': 'created',
            'rule': {
                'configuration': {'name': 'Default', 'pk': 1},
                'ruleset': {'name': 'Default', 'pk': 42},
                'custom_msg': '123',
                'excluded_tags': [{'name': 'untag', 'pk': 1}],
                'policy': 'BLOCKLIST',
                'serial_numbers': ['2345', '456'],
                'tags': [{'name': 'deuxtag', 'pk': 2}],
                'target': {'sha256': 'e699f8aad9c46505531b174f3868ff05de5dddae5d2eef5c3da65a6bac7d2210',
                           'type': 'CERTIFICATE'}
            }
        }
        event = SantaRuleUpdateEvent(EventMetadata(), event_d)
        self.assertEqual(
            event.get_linked_objects_keys(),
            {"santa_configuration": [(1,)],
             "santa_ruleset": [(42,)],
             "certificate": [("sha256", "e699f8aad9c46505531b174f3868ff05de5dddae5d2eef5c3da65a6bac7d2210")]}
        )

    def test_ruleset_update_linked_objects(self):
        event_d = {
            'configurations': [
                {'name': 'Default',
                 'pk': 1,
                 'rule_results': {'created': 2,
                                  'deleted': 0,
                                  'present': 0,
                                  'updated': 0}},
                {'name': 'Testing',
                 'pk': 2,
                 'rule_results': {'created': 2,
                                  'deleted': 0,
                                  'present': 0,
                                  'updated': 0}}
            ],
            'result': 'created',
            'ruleset': {'name': 'First ruleset test', 'pk': 43}
        }
        event = SantaRuleSetUpdateEvent(EventMetadata(), event_d)
        self.assertEqual(
            event.get_linked_objects_keys(),
            {"santa_configuration": [(1,), (2,)],
             "santa_ruleset": [(43,)]}
        )

    def test_enrollment_linked_objects(self):
        event_d = {
            "configuration": {"pk": 13, "name": "le temps des cerises"},
            "action": "enrollment"
        }
        event = SantaEnrollmentEvent(EventMetadata(), event_d)
        self.assertEqual(
            event.get_linked_objects_keys(),
            {"santa_configuration": [(13,)]}
        )

import datetime
from django.test import SimpleTestCase
from zentral.contrib.santa.events import (_build_file_tree_from_santa_event, EventMetadata,
                                          SantaEnrollmentEvent, SantaEventEvent,
                                          SantaRuleSetUpdateEvent, SantaRuleUpdateEvent)


class SantaEventTestCase(SimpleTestCase):
    def test_event_with_signed_bundle(self):
        event_d = {
            'current_sessions': [],
            'decision': 'ALLOW_UNKNOWN',
            'executing_user': 'root',
            'execution_time': 2242783327.585212,
            'file_bundle_id': 'servicecontroller:com.apple.stomp.transcoderx',
            'file_bundle_name': 'CompressorTranscoderX',
            'file_bundle_path': ('/Library/Frameworks/Compressor.framework/'
                                 'Versions/A/Resources/CompressorTranscoderX.bundle'),
            'file_bundle_version': '3.5.3',
            'file_bundle_version_string': '3.5.3',
            'file_name': 'compressord',
            'file_path': ('/Library/Frameworks/Compressor.framework/'
                          'Versions/A/Resources/CompressorTranscoderX.bundle/Contents/MacOS'),
            'file_sha256': '700362aec8dee7df2f17de03df0d0844979b0eca7e878f75248c91ae56b1a7c1',
            'logged_in_users': [],
            'parent_name': 'launchd',
            'pid': 95,
            'ppid': 1,
            'quarantine_timestamp': 0,
            'signing_chain': [{'cn': 'Software Signing',
                               'org': 'Apple Inc.',
                               'sha256': '47e9216d9e90fa2be9c352d40826c9573055f61188942fff25d58da96f8899d4',
                               'valid_from': 1172268176,
                               'valid_until': 1421272976},
                              {'cn': 'Apple Code Signing Certification Authority',
                               'org': 'Apple Inc.',
                               'ou': 'Apple Certification Authority',
                               'sha256': '3afa0bf5027fd0532f436b39363a680aefd6baf7bf6a4f97f17be2937b84b150',
                               'valid_from': 1171487959,
                               'valid_until': 1423948759},
                              {'cn': 'Apple Root CA',
                               'org': 'Apple Inc.',
                               'ou': 'Apple Certification Authority',
                               'sha256': 'b0b1730ecbc7ff4505142c49f1295e6eda6bcaed7e2c68c5be91b5a11001f024',
                               'valid_from': 1146001236,
                               'valid_until': 2054670036}]
        }
        file_d = {
            'source': {'module': 'zentral.contrib.santa', 'name': 'Santa events'},
            'bundle': {'bundle_id': 'servicecontroller:com.apple.stomp.transcoderx',
                       'bundle_name': 'CompressorTranscoderX',
                       'bundle_version': '3.5.3',
                       'bundle_version_str': '3.5.3'},
            'bundle_path': ('/Library/Frameworks/Compressor.framework/'
                            'Versions/A/Resources/CompressorTranscoderX.bundle'),
            'name': 'compressord',
            'path': ('/Library/Frameworks/Compressor.framework/'
                     'Versions/A/Resources/CompressorTranscoderX.bundle/Contents/MacOS'),
            'sha_256': '700362aec8dee7df2f17de03df0d0844979b0eca7e878f75248c91ae56b1a7c1',
            'signed_by': {
                'common_name': '<NAME>',
                'organization': 'Apple Inc.',
                'organizational_unit': None,
                'sha_256': '47e9216d9e90fa2be9c352d40826c9573055f61188942fff25d58da96f8899d4',
                'valid_from': datetime.datetime(2007, 2, 23, 22, 2, 56),
                'valid_until': datetime.datetime(2015, 1, 14, 22, 2, 56),
                'signed_by': {
                    'common_name': 'Apple Code Signing Certification Authority',
                    'organization': 'Apple Inc.',
                    'organizational_unit': 'Apple Certification Authority',
                    'sha_256': '3afa0bf5027fd0532f436b39363a680aefd6baf7bf6a4f97f17be2937b84b150',
                    'valid_from': datetime.datetime(2007, 2, 14, 21, 19, 19),
                    'valid_until': datetime.datetime(2015, 2, 14, 21, 19, 19),
                    'signed_by': {
                        'common_name': '<NAME>',
                        'organization': 'Apple Inc.',
                        'organizational_unit': 'Apple Certification Authority',
                        'sha_256': 'b0b1730ecbc7ff4505142c49f1295e6eda6bcaed7e2c68c5be91b5a11001f024',
                        'valid_from': datetime.datetime(2006, 4, 25, 21, 40, 36),
                        'valid_until': datetime.datetime(2035, 2, 9, 21, 40, 36),
                    },
                },
             }
        }
        self.assertEqual(_build_file_tree_from_santa_event(event_d), file_d)

    def test_event_with_unsigned_bundle(self):
        event_d = {
            'current_sessions': ['std@console',
                                 'std@ttys000',
                                 'std@ttys001',
                                 'std@ttys002',
                                 'std@ttys003'],
            'decision': 'BLOCK_UNKNOWN',
            'executing_user': 'std',
            'execution_time': 1492004439.58063,
            'file_bundle_id': 'com.googlecode.munki.ManagedSoftwareCenter',
            'file_bundle_name': 'Managed Software Center',
            'file_bundle_path': '/Applications/Managed Software Center.app',
            'file_bundle_version': '2842',
            'file_bundle_version_string': '4.2.2842',
            'file_name': 'Managed Software Center',
            'file_path': '/Applications/Managed Software Center.app/Contents/MacOS',
            'file_sha256': '3bccb77072bbc3eac675e2d95f6ef0f23362f015941dd3175bbc7f2d630040f2',
            'logged_in_users': ['std'],
            'parent_name': 'launchd',
            'pid': 1279,
            'ppid': 1,
            'quarantine_timestamp': 0,
            'signing_chain': []
        }
        file_d = {
            'source': {'module': 'zentral.contrib.santa', 'name': 'Santa events'},
            'bundle': {
                'bundle_id': 'com.googlecode.munki.ManagedSoftwareCenter',
                'bundle_name': 'Managed Software Center',
                'bundle_version': '2842',
                'bundle_version_str': '4.2.2842'
            },
            'bundle_path': '/Applications/Managed Software Center.app',
            'name': 'Managed Software Center',
            'path': '/Applications/Managed Software Center.app/Contents/MacOS',
            'sha_256': '3bccb77072bbc3eac675e2d95f6ef0f23362f015941dd3175bbc7f2d630040f2',
            'signed_by': None
        }
        self.assertEqual(_build_file_tree_from_santa_event(event_d), file_d)

    def test_event_without_bundle(self):
        event_d = {
            'current_sessions': ['std@console',
                                 'std@ttys001',
                                 'std@ttys000',
                                 'std@ttys002'],
            'decision': 'BLOCK_UNKNOWN',
            'executing_user': 'root',
            'execution_time': 1491860971.578268,
            'file_name': 'act',
            'file_path': '/var/tmp/act',
            'file_sha256': '13735e5fba4e11988645f0fa02f8dfa0c6caaf13a1e6c1cf06a47f80a7aab236',
            'logged_in_users': ['std'],
            'parent_name': 'bash',
            'pid': 1593,
            'ppid': 1585,
            'quarantine_timestamp': 0,
            'signing_chain': []
        }
        file_d = {
            'source': {'module': 'zentral.contrib.santa', 'name': 'Santa events'},
            'bundle': None,
            'bundle_path': None,
            'name': 'act',
            'path': '/var/tmp/act',
            'sha_256': '13735e5fba4e11988645f0fa02f8dfa0c6caaf13a1e6c1cf06a47f80a7aab236',
            'signed_by': None
        }
        self.assertEqual(_build_file_tree_from_santa_event(event_d), file_d)

    def test_event_linked_objects(self):
        event_d = {
            'current_sessions': ['personne@console', 'flaco@ttys000'],
            'decision': 'ALLOW_UNKNOWN',
            'executing_user': 'personne',
            'execution_time': 1637562907.2363129,
            'file_bundle_id': 'org.mozilla.firefox',
            'file_bundle_name': 'Firefox',
            'file_bundle_path': '/Applications/Firefox.app',
            'file_bundle_version': '9421.11.3',
            'file_bundle_version_string': '94.0.1',
            'file_name': 'firefox',
            'file_path': '/Applications/Firefox.app/Contents/MacOS',
            'file_sha256': '4bc6526e30f2d22d21dd58c60d401454bb6c772733a59cc1c3a21b52b0a23f57',
            'logged_in_users': ['personne'],
            'parent_name': 'launchd',
            'pid': 1280,
            'ppid': 1,
            'quarantine_agent_bundle_id': 'com.apple.Safari',
            'quarantine_data_url': 'https://download-installer.cdn.mozilla.net/pub/firefox/releases'
                                   '/94.0.1/mac/de/Firefox%2094.0.1.dmg',
            'quarantine_timestamp': 1637562799,
            'signing_chain': [
                {'cn': 'Developer ID Application: Mozilla Corporation (43AQ936H96)',
                 'org': 'Mozilla Corporation',
                 'ou': '43AQ936H96',
                 'sha256': '96f18e09d65445985c7df5df74ef152a0bc42e8934175a626180d9700c343e7b',
                 'valid_from': 1494270538,
                 'valid_until': 1652123338},
                {'cn': 'Developer ID Certification Authority',
                 'org': 'Apple Inc.',
                 'ou': 'Apple Certification Authority',
                 'sha256': '7afc9d01a62f03a2de9637936d4afe68090d2de18d03f29c88cfb0b1ba63587f',
                 'valid_from': 1328134335,
                 'valid_until': 1801519935},
                {'cn': 'Apple Root CA',
                 'org': 'Apple Inc.',
                 'ou': 'Apple Certification Authority',
                 'sha256': 'b0b1730ecbc7ff4505142c49f1295e6eda6bcaed7e2c68c5be91b5a11001f024',
                 'valid_from': 1146001236,
                 'valid_until': 2054670036}]
        }
        event = SantaEventEvent(EventMetadata(), event_d)
        self.assertEqual(
            event.get_linked_objects_keys(),
            {"file": [("sha256", "4bc6526e30f2d22d21dd58c60d401454bb6c772733a59cc1c3a21b52b0a23f57")],
             "certificate": [("sha256", "96f18e09d65445985c7df5df74ef152a0bc42e8934175a626180d9700c343e7b"),
                             ("sha256", "7afc9d01a62f03a2de9637936d4afe68090d2de18d03f29c88cfb0b1ba63587f"),
                             ("sha256", "b0b1730ecbc7ff4505142c49f1295e6eda6bcaed7e2c68c5be91b5a11001f024")],
             "apple_team_id": [("43AQ936H96",)]}
        )

    def test_binary_rule_update_linked_objects(self):
        event_d = {
            'result': 'updated',
            'rule': {
                'configuration': {'name': 'Default', 'pk': 1},
                'custom_msg': '123',
                'excluded_tags': [{'name': 'untag', 'pk': 1}],
                'policy': 'BLOCKLIST',
                'serial_numbers': ['2345', '456'],
                'tags': [{'name': 'deuxtag', 'pk': 2}],
                'target': {'sha256': 'e699f8aad9c46505531b174f3868ff05de5dddae5d2eef5c3da65a6bac7d2210',
                           'type': 'BINARY'}
            },
            'updates': {'added': {'excluded_tags': [{'name': 'untag', 'pk': 1}],
                                  'serial_numbers': ['456'],
                                  'tags': [{'name': 'deuxtag', 'pk': 2}]},
                        'removed': {'excluded_tags': [{'name': 'deuxtag', 'pk': 2}],
                                    'tags': [{'name': 'untag', 'pk': 1}]}}
        }
        event = SantaRuleUpdateEvent(EventMetadata(), event_d)
        self.assertEqual(
            event.get_linked_objects_keys(),
            {"santa_configuration": [(1,)],
             "file": [("sha256", "e699f8aad9c46505531b174f3868ff05de5dddae5d2eef5c3da65a6bac7d2210")]}
        )

    def test_certificate_rule_update_linked_objects(self):
        event_d = {
            'result': 'created',
            'rule': {
                'configuration': {'name': 'Default', 'pk': 1},
                'ruleset': {'name': 'Default', 'pk': 42},
                'custom_msg': '123',
                'excluded_tags': [{'name': 'untag', 'pk': 1}],
                'policy': 'BLOCKLIST',
                'serial_numbers': ['2345', '456'],
                'tags': [{'name': 'deuxtag', 'pk': 2}],
                'target': {'sha256': 'e699f8aad9c46505531b174f3868ff05de5dddae5d2eef5c3da65a6bac7d2210',
                           'type': 'CERTIFICATE'}
            }
        }
        event = SantaRuleUpdateEvent(EventMetadata(), event_d)
        self.assertEqual(
            event.get_linked_objects_keys(),
            {"santa_configuration": [(1,)],
             "santa_ruleset": [(42,)],
             "certificate": [("sha256", "e699f8aad9c46505531b174f3868ff05de5dddae5d2eef5c3da65a6bac7d2210")]}
        )

    def test_ruleset_update_linked_objects(self):
        event_d = {
            'configurations': [
                {'name': 'Default',
                 'pk': 1,
                 'rule_results': {'created': 2,
                                  'deleted': 0,
                                  'present': 0,
                                  'updated': 0}},
                {'name': 'Testing',
                 'pk': 2,
                 'rule_results': {'created': 2,
                                  'deleted': 0,
                                  'present': 0,
                                  'updated': 0}}
            ],
            'result': 'created',
            'ruleset': {'name': 'First ruleset test', 'pk': 43}
        }
        event = SantaRuleSetUpdateEvent(EventMetadata(), event_d)
        self.assertEqual(
            event.get_linked_objects_keys(),
            {"santa_configuration": [(1,), (2,)],
             "santa_ruleset": [(43,)]}
        )

    def test_enrollment_linked_objects(self):
        event_d = {
            "configuration": {"pk": 13, "name": "le temps des cerises"},
            "action": "enrollment"
        }
        event = SantaEnrollmentEvent(EventMetadata(), event_d)
        self.assertEqual(
            event.get_linked_objects_keys(),
            {"santa_configuration": [(13,)]}
        )