/**
 * SIEM Integration Tests
 *
 * Tests for SIEM event formatting and client registry.
 */
import { describe, it, expect, beforeEach, afterEach } from "vitest";
import { formatAsCEF, formatAsJSON, formatForSplunk, formatForSentinel, formatForDatadog, mapSeverity, severityToCEF, createFindingEvent, createScanEvent, createCertificationEvent, getSIEMRegistry, closeSIEMRegistry, createSplunkClient, createDatadogClient, } from "../integrations/siem/index.js";
describe("SIEM Integration", () => {
    describe("Severity Mapping", () => {
        it("maps Vaspera severities to SIEM severities", () => {
            expect(mapSeverity("critical")).toBe("critical");
            expect(mapSeverity("high")).toBe("high");
            expect(mapSeverity("medium")).toBe("medium");
            expect(mapSeverity("low")).toBe("low");
            expect(mapSeverity("info")).toBe("informational");
        });
        it("maps SIEM severity to CEF numeric values", () => {
            expect(severityToCEF("critical")).toBe(10);
            expect(severityToCEF("high")).toBe(8);
            expect(severityToCEF("medium")).toBe(5);
            expect(severityToCEF("low")).toBe(3);
            expect(severityToCEF("informational")).toBe(1);
        });
    });
    describe("Event Creation", () => {
        it("creates finding events", () => {
            const event = createFindingEvent("/test/project", "finding.new", {
                findingId: "finding-001",
                severity: "high",
                category: "sql-injection",
                file: "src/api.ts",
                line: 42,
                scanner: "semgrep",
                ruleId: "sql-injection-001",
                cweIds: ["CWE-89"],
                description: "SQL injection vulnerability",
            }, "cert-001");
            expect(event.eventType).toBe("finding.new");
            expect(event.severity).toBe("high");
            expect(event.project).toBe("/test/project");
            expect(event.certificationId).toBe("cert-001");
            expect(event.source).toBe("vaspera");
            expect(event.message).toContain("sql-injection");
            expect(event.message).toContain("src/api.ts:42");
        });
        it("creates scan events", () => {
            const event = createScanEvent("/test/project", "scan.completed", {
                scanners: ["semgrep", "gitleaks"],
                findingsCount: 5,
                bySeverity: { critical: 1, high: 2, medium: 2, low: 0, info: 0 },
                durationMs: 5000,
            }, "cert-001");
            expect(event.eventType).toBe("scan.completed");
            expect(event.severity).toBe("critical");
            expect(event.message).toContain("5 findings");
            expect(event.message).toContain("1 critical");
        });
        it("creates certification events", () => {
            const event = createCertificationEvent("/test/project", "certification.completed", {
                certificationId: "cert-001",
                level: "GOLD",
                score: 85,
                findingsCount: 5,
                durationMs: 30000,
            });
            expect(event.eventType).toBe("certification.completed");
            expect(event.severity).toBe("informational");
            expect(event.message).toContain("GOLD");
            expect(event.message).toContain("85");
        });
    });
    describe("CEF Formatting", () => {
        it("formats events as CEF", () => {
            const event = {
                timestamp: "2024-01-01T00:00:00.000Z",
                eventType: "finding.new",
                severity: "high",
                project: "/test/project",
                certificationId: "cert-001",
                message: "SQL injection detected",
                source: "vaspera",
                data: {
                    findingId: "finding-001",
                    category: "sql-injection",
                    file: "src/api.ts",
                    line: 42,
                },
            };
            const cef = formatAsCEF(event);
            expect(cef).toContain("CEF:0");
            expect(cef).toContain("Vaspera");
            expect(cef).toContain("Hardening MCP");
            expect(cef).toContain("VASP-001");
            expect(cef).toContain("New Security Finding");
            expect(cef).toContain("|8|");
        });
        it("escapes special characters in CEF", () => {
            const event = {
                timestamp: "2024-01-01T00:00:00.000Z",
                eventType: "finding.new",
                severity: "medium",
                project: "/test/project",
                message: "Message with | pipe and = equals",
                source: "vaspera",
                data: {},
            };
            const cef = formatAsCEF(event);
            expect(cef).toContain("\\|");
            expect(cef).toContain("\\=");
        });
    });
    describe("JSON Formatting", () => {
        it("formats events as JSON", () => {
            const event = {
                timestamp: "2024-01-01T00:00:00.000Z",
                eventType: "finding.new",
                severity: "high",
                project: "/test/project",
                message: "SQL injection detected",
                source: "vaspera",
                data: { findingId: "finding-001" },
            };
            const json = formatAsJSON(event);
            expect(json).toHaveProperty("@timestamp", "2024-01-01T00:00:00.000Z");
            expect(json).toHaveProperty("event");
            expect(json.event.action).toBe("finding.new");
            expect(json.event.severity).toBe(8);
        });
    });
    describe("Splunk Formatting", () => {
        it("formats events for Splunk HEC", () => {
            const event = {
                timestamp: "2024-01-01T00:00:00.000Z",
                eventType: "scan.completed",
                severity: "informational",
                project: "/test/project",
                message: "Scan completed",
                source: "vaspera",
                data: {},
            };
            const splunk = formatForSplunk(event, {
                index: "security",
                source: "vaspera:test",
                host: "test-host",
            });
            expect(splunk).toHaveProperty("time");
            expect(splunk).toHaveProperty("host", "test-host");
            expect(splunk).toHaveProperty("source", "vaspera:test");
            expect(splunk).toHaveProperty("index", "security");
            expect(splunk).toHaveProperty("event");
        });
    });
    describe("Sentinel Formatting", () => {
        it("formats events for Microsoft Sentinel", () => {
            const event = {
                timestamp: "2024-01-01T00:00:00.000Z",
                eventType: "finding.new",
                severity: "critical",
                project: "/test/project",
                certificationId: "cert-001",
                message: "Critical finding",
                source: "vaspera",
                data: { category: "secrets" },
            };
            const sentinel = formatForSentinel(event);
            expect(sentinel).toHaveProperty("TimeGenerated", "2024-01-01T00:00:00.000Z");
            expect(sentinel).toHaveProperty("EventType_s", "finding.new");
            expect(sentinel).toHaveProperty("Severity_s", "critical");
            expect(sentinel).toHaveProperty("Project_s", "/test/project");
            expect(sentinel).toHaveProperty("CertificationId_g", "cert-001");
        });
    });
    describe("Datadog Formatting", () => {
        it("formats events for Datadog", () => {
            const event = {
                timestamp: "2024-01-01T00:00:00.000Z",
                eventType: "finding.new",
                severity: "high",
                project: "/test/project",
                message: "High severity finding",
                source: "vaspera",
                data: {},
            };
            const datadog = formatForDatadog(event, {
                service: "my-service",
                env: "production",
                tags: ["team:security"],
            });
            expect(datadog).toHaveProperty("ddsource", "vaspera");
            expect(datadog).toHaveProperty("service", "my-service");
            expect(datadog).toHaveProperty("status", "error");
            expect(datadog.ddtags).toContain("project:/test/project");
            expect(datadog.ddtags).toContain("env:production");
            expect(datadog.ddtags).toContain("team:security");
        });
        it("maps severity to Datadog status", () => {
            const criticalEvent = {
                timestamp: new Date().toISOString(),
                eventType: "finding.new",
                severity: "critical",
                project: "/test",
                message: "Critical",
                source: "vaspera",
                data: {},
            };
            const lowEvent = {
                timestamp: new Date().toISOString(),
                eventType: "finding.new",
                severity: "low",
                project: "/test",
                message: "Low",
                source: "vaspera",
                data: {},
            };
            const critical = formatForDatadog(criticalEvent);
            const low = formatForDatadog(lowEvent);
            expect(critical.status).toBe("emergency");
            expect(low.status).toBe("info");
        });
    });
    describe("SIEM Registry", () => {
        beforeEach(async () => {
            await closeSIEMRegistry();
        });
        afterEach(async () => {
            await closeSIEMRegistry();
        });
        it("registers and retrieves clients", () => {
            const registry = getSIEMRegistry();
            const client = createSplunkClient({
                endpoint: "https://splunk.example.com:8088",
                token: "test-token",
                index: "security",
            });
            registry.register("test-splunk", client);
            const retrieved = registry.get("test-splunk");
            expect(retrieved).toBeDefined();
            expect(retrieved?.provider).toBe("splunk");
        });
        it("lists all registered clients", () => {
            const registry = getSIEMRegistry();
            registry.register("splunk-1", createSplunkClient({ endpoint: "https://splunk.example.com", token: "t1" }));
            registry.register("datadog-1", createDatadogClient({ apiKey: "api-key-1" }));
            const list = registry.list();
            expect(list).toHaveLength(2);
            expect(list.find((c) => c.name === "splunk-1")?.provider).toBe("splunk");
            expect(list.find((c) => c.name === "datadog-1")?.provider).toBe("datadog");
        });
        it("unregisters clients", async () => {
            const registry = getSIEMRegistry();
            registry.register("test", createSplunkClient({ endpoint: "https://splunk.example.com", token: "t" }));
            expect(registry.get("test")).toBeDefined();
            await registry.unregister("test");
            expect(registry.get("test")).toBeUndefined();
        });
        it("closes all clients", async () => {
            const registry = getSIEMRegistry();
            registry.register("s1", createSplunkClient({ endpoint: "https://splunk.example.com", token: "t1" }));
            registry.register("d1", createDatadogClient({ apiKey: "api-key-1" }));
            expect(registry.list()).toHaveLength(2);
            await registry.closeAll();
            expect(registry.list()).toHaveLength(0);
        });
    });
    describe("Event Type Mapping", () => {
        it("generates correct signature IDs for event types", () => {
            const findingEvent = createFindingEvent("/test", "finding.new", {
                findingId: "f1",
                severity: "high",
                category: "test",
            });
            const cef = formatAsCEF(findingEvent);
            expect(cef).toContain("VASP-001");
            const scanEvent = createScanEvent("/test", "scan.completed", {
                scanners: ["test"],
                findingsCount: 0,
                bySeverity: { critical: 0, high: 0, medium: 0, low: 0, info: 0 },
                durationMs: 100,
            });
            const scanCef = formatAsCEF(scanEvent);
            expect(scanCef).toContain("VASP-011");
        });
    });
});
//# sourceMappingURL=siem-integration.test.js.map