import json
from pathlib import Path

import pytest

from CommonServerPython import CommandResults
from InvestigationSummaryParse import parse_command, KillChain, Result, Source

TEST_DATA_DIR = Path(__file__).parent / 'test_data'


def _list_to_context(command_results: list[CommandResults]):
    return [result.to_context() for result in command_results]


def _dump_test_file(file_name: str, content: dict):
    (TEST_DATA_DIR / file_name).write_text(json.dumps(content))


def _load_test_file(file_name: str):
    return json.loads((TEST_DATA_DIR / file_name).read_text())


def test_empty():
    """
    Given   an empty context
    When    calling parse_command
    Then    make sure the result is the default
    """
    assert _list_to_context(parse_command(context={})) == _load_test_file('empty_context.json')


@pytest.mark.parametrize('mocked_context,result,sources,search_value,test_index',
                         [
                             ({}, Result.NOT_DETECTED, set(), '', 0),
                             ({'incident': {'mitretacticname': 'hello'}}, Result.SUSPICIOUS, {Source.EDR}, 'hello', 1),
                             ({'incident': {'mitretacticname': 'hello'},
                               'csfalconx': {'resource': {'sandbox': {'mitre_attacks': {'tactic': 'hello'}}}}},
                              Result.SUSPICIOUS, {Source.SANDBOX, Source.EDR}, 'hello', 2),
                             ({'MITREATTACK': [{'value': 'hello'}]}, Result.SUSPICIOUS, {Source.EDR}, 'hello', 3),
                         ])
def test_kill_chain(mocked_context: dict, result: Result, sources: set[Source], search_value: str, test_index: int):
    """
    Given   a class inheriting from KillChain
    When    instantiating
    Then    check the result of KillChain._parse_context
    """

    class NewKillChain(KillChain):
        def __init__(self, context: dict):
            super().__init__(
                name='dummy',
                tactic='tactic',
                context=context,
                search_value=search_value
            )

    test_object = NewKillChain(mocked_context)

    assert test_object.result == result
    assert test_object.sources == sources
    assert test_object.to_context() == _load_test_file(f'kill_chain_{test_index}.json')

import json
from pathlib import Path

import pytest

from CommonServerPython import CommandResults
from InvestigationSummaryParse import parse_command, KillChain, Result, Source

TEST_DATA_DIR = Path(__file__).parent / 'test_data'


def _list_to_context(command_results: list[CommandResults]):
    return [result.to_context() for result in command_results]


def _dump_test_file(file_name: str, content: dict):
    (TEST_DATA_DIR / file_name).write_text(json.dumps(content))


def _load_test_file(file_name: str):
    return json.loads((TEST_DATA_DIR / file_name).read_text())


def test_empty():
    """
    Given   an empty context
    When    calling parse_command
    Then    make sure the result is the default
    """
    assert _list_to_context(parse_command(context={})) == _load_test_file('empty_context.json')


@pytest.mark.parametrize('mocked_context,result,sources,search_value,test_index',
                         [
                             ({}, Result.NOT_DETECTED, set(), '', 0),
                             ({'incident': {'mitretacticname': 'hello'}}, Result.SUSPICIOUS, {Source.EDR}, 'hello', 1),
                             ({'incident': {'mitretacticname': 'hello'},
                               'csfalconx': {'resource': {'sandbox': {'mitre_attacks': {'tactic': 'hello'}}}}},
                              Result.SUSPICIOUS, {Source.SANDBOX, Source.EDR}, 'hello', 2),
                             ({'MITREATTACK': [{'value': 'hello'}]}, Result.SUSPICIOUS, {Source.EDR}, 'hello', 3),
                         ])
def test_kill_chain(mocked_context: dict, result: Result, sources: set[Source], search_value: str, test_index: int):
    """
    Given   a class inheriting from KillChain
    When    instantiating
    Then    check the result of KillChain._parse_context
    """

    class NewKillChain(KillChain):
        def __init__(self, context: dict):
            super().__init__(
                name='dummy',
                tactic='tactic',
                context=context,
                search_value=search_value
            )

    test_object = NewKillChain(mocked_context)

    assert test_object.result == result
    assert test_object.sources == sources
    assert test_object.to_context() == _load_test_file(f'kill_chain_{test_index}.json')

Given   an empty context     When    calling parse_command     Then    make sure the result is the default Given   a class inheriting from KillChain     When    instantiating     Then    check the result of KillChain._parse_context