require 'test/unit'
require_relative 'omstestlib'
require_relative ENV['BASE_DIR'] + '/source/code/plugins/antimalware_lib'

class AntimalwareLibTest < Test::Unit::TestCase
    
    def test_antimalware_with_am_detected_no_error

        antimalware_results_str = '{"ProtectionStatusRank":350,"ProtectionStatus":"Action Required","ProtectionStatusDetails":"Both quick scan and full scan are out of 7 days, please run an active scan","DetectionId":"e108ea08-245d-42ec-ae3f-2ffcdb152aab","Threat":"","ThreatStatusRank":470,"ThreatStatus":"Unknown","ThreatStatusDetails":"Threat Status is currently not supported in Linux McAfee","Signature":"9068.0","ScanDate":"10/25/2018 23:44:42","DateCollected":"06/11/2018 22:39","Tool":"McAfee Endpoint Security for Linux Threat Prevention","AMProductVersion":"10.5.1.1582"}'
        antimalware_results_json = JSON.parse(antimalware_results_str)
        
        antimalware = OMS::Antimalware.new(OMS::MockLog.new)
        antimalware_blob, operation_blob = antimalware.transform_and_wrap(antimalware_results_json, "clairetest", 0)    
        
        assert_equal(nil, operation_blob, "No error logs")

        assert_equal("PROTECTION_STATUS_BLOB", antimalware_blob["DataType"], "Incorrect 'DataType' value") 
        assert_equal("Antimalware", antimalware_blob["IPName"], "Incorrect 'IPName' value")
        
        antimalware_item_0 = antimalware_blob["DataItems"][0]
        assert_equal("clairetest", antimalware_item_0["DeviceName"], "Incorrect 'DeviceName' value")
        assert_equal("Linux", antimalware_item_0["OSName"], "Incorrect 'OSName' value")
        assert_equal(350, antimalware_item_0["ProtectionStatusRank"], "Incorrect 'ProtectionStatusRank' value")
        assert_equal("Action Required", antimalware_item_0["ProtectionStatus"], "Incorrect 'ProtectionStatus' value")
        assert_equal("Both quick scan and full scan are out of 7 days, please run an active scan", antimalware_item_0["ProtectionStatusDetails"], "Incorrect 'ProtectionStatusDetails' value")
        assert_equal("e108ea08-245d-42ec-ae3f-2ffcdb152aab", antimalware_item_0["DetectionId"], "Incorrect 'DetectionId' value")
        assert_equal("", antimalware_item_0["Threat"], "Incorrect 'Threat' value")
        assert_equal(470, antimalware_item_0["ThreatStatusRank"], "Incorrect 'ThreatStatusRank' value")
        assert_equal("Unknown", antimalware_item_0["ThreatStatus"], "Incorrect 'ThreatStatus' value")
        assert_equal("Threat Status is currently not supported in Linux McAfee", antimalware_item_0["ThreatStatusDetails"], "Incorrect 'ThreatStatusDetails' value")
        assert_equal("9068.0", antimalware_item_0["Signature"], "Incorrect 'Signature' value")
        assert_equal("10/25/2018 23:44:42", antimalware_item_0["ScanDate"], "Incorrect 'ScanDate' value")
        assert_equal("06/11/2018 22:39", antimalware_item_0["DateCollected"], "Incorrect 'DateCollected' value")
        assert_equal("McAfee Endpoint Security for Linux Threat Prevention", antimalware_item_0["Tool"], "Incorrect 'Tool' value")
        assert_equal("10.5.1.1582", antimalware_item_0["AMProductVersion"], "Incorrect 'AMProductVersion' value")
        
    end

    def test_antimalware_with_empty_input
        antimalware_results_json = nil
      
        antimalware = OMS::Antimalware.new(OMS::MockLog.new)
        antimalware_blob, operation_blob = antimalware.transform_and_wrap(antimalware_results_json, "clairetest", 0)
        
        assert_equal(nil, antimalware_blob, "No antimalware report")
        assert_equal("OPERATION_BLOB", operation_blob["DataType"], "Incorrect 'DataType' value")
        assert_equal("LogManagement", operation_blob["IPName"], "Incorrect 'IPName' value")
        operation_item_0 = operation_blob["DataItems"][0]
        assert_equal("1970-01-01T00:00:00.000Z", operation_item_0["Timestamp"], "Incorrect 'Timestamp' value")#####################
        assert_equal("Error", operation_item_0["OperationStatus"], "Incorrect 'OperationStatus' value")
        assert_equal("clairetest", operation_item_0["Computer"], "Incorrect 'Computer' value")
        assert_equal("Antimalware", operation_item_0["Category"], "Incorrect 'Category' value")
        assert_equal("Antimalware", operation_item_0["Solution"], "Incorrect 'Solution' value")
        assert_equal("Antimalware Assessment failed: Empty output", operation_item_0["Detail"], "Incorrect 'Detail' value")
    end

    def test_antimalware_with_no_am_detected_no_error
        antimalware_results_str = '{"ProtectionStatusRank":470,"ProtectionStatus":"Unknown","ProtectionStatusDetails":"","DetectionId":"e108ea08-245d-42ec-ae3f-2ffcdb152aab","Threat":"","ThreatStatusRank":470,"ThreatStatus":"Unknown","ThreatStatusDetails":"","Signature":"","ScanDate":"25/10/18 23:44:42 UTC","DateCollected":"06/11/2018 22:39","Tool":"No Anti-Malware Tool was detected","AMProductVersion":""}'     
        antimalware_results_json = JSON.parse(antimalware_results_str)
        
        antimalware = OMS::Antimalware.new(OMS::MockLog.new)
        antimalware_blob, operation_blob= antimalware.transform_and_wrap(antimalware_results_json, "clairetest", 0)    
        
        assert_equal(nil, operation_blob, "No error logs")

        assert_equal("PROTECTION_STATUS_BLOB", antimalware_blob["DataType"], "Incorrect 'DataType' value") 
        assert_equal("Antimalware", antimalware_blob["IPName"], "Incorrect 'IPName' value")

        antimalware_item_0 = antimalware_blob["DataItems"][0]
        assert_equal("clairetest", antimalware_item_0["DeviceName"], "Incorrect 'DeviceName' value")
        assert_equal("Linux", antimalware_item_0["OSName"], "Incorrect 'OSName' value")
        assert_equal(470, antimalware_item_0["ProtectionStatusRank"], "Incorrect 'ProtectionStatusRank' value")
        assert_equal("Unknown", antimalware_item_0["ProtectionStatus"], "Incorrect 'ProtectionStatus' value")
        assert_equal("", antimalware_item_0["ProtectionStatusDetails"], "Incorrect 'ProtectionStatusDetails' value")
        assert_equal("e108ea08-245d-42ec-ae3f-2ffcdb152aab", antimalware_item_0["DetectionId"], "Incorrect 'DetectionId' value")
        assert_equal("", antimalware_item_0["Threat"], "Incorrect 'Threat' value")
        assert_equal(470, antimalware_item_0["ThreatStatusRank"], "Incorrect 'ThreatStatusRank' value")
        assert_equal("Unknown", antimalware_item_0["ThreatStatus"], "Incorrect 'ThreatStatus' value")
        assert_equal("", antimalware_item_0["ThreatStatusDetails"], "Incorrect 'ThreatStatusDetails' value")
        assert_equal("", antimalware_item_0["Signature"], "Incorrect 'Signature' value")
        assert_equal("25/10/18 23:44:42 UTC", antimalware_item_0["ScanDate"], "Incorrect 'ScanDate' value")
        assert_equal("06/11/2018 22:39", antimalware_item_0["DateCollected"], "Incorrect 'DateCollected' value")
        assert_equal("No Anti-Malware Tool was detected", antimalware_item_0["Tool"], "Incorrect 'Tool' value")
        assert_equal("", antimalware_item_0["AMProductVersion"], "Incorrect 'AMProductVersion' value")
    end

    def test_antimalware_with_am_detected_error_input
        antimalware_results_str = '{"Error": "test error","ProtectionStatusRank":350,"ProtectionStatus":"Action Required","ProtectionStatusDetails":"Both quick scan and full scan are out of 7 days, please run an active scan","DetectionId":"e108ea08-245d-42ec-ae3f-2ffcdb152aab","Threat":"","ThreatStatusRank":470,"ThreatStatus":"Unknown","ThreatStatusDetails":"Threat Status is currently not supported in Linux McAfee","Signature":"9068.0","ScanDate":"25/10/18 23:44:42 UTC","DateCollected":"06/11/2018 22:39","Tool":"McAfee Endpoint Security for Linux Threat Prevention","AMProductVersion":"10.5.1.1582"}'
        antimalware_results_json = JSON.parse(antimalware_results_str)
        
        antimalware = OMS::Antimalware.new(OMS::MockLog.new)
        antimalware_blob, operation_blob= antimalware.transform_and_wrap(antimalware_results_json, "clairetest", 0)    
        
        assert_equal("OPERATION_BLOB", operation_blob["DataType"], "Incorrect 'DataType' value") 
        assert_equal("LogManagement", operation_blob["IPName"], "Incorrect 'IPName' value")

        operation_item_0 = operation_blob["DataItems"][0]
        assert_equal("1970-01-01T00:00:00.000Z", operation_item_0["Timestamp"], "Incorrect 'Timestamp' value")#####################
        assert_equal("Error", operation_item_0["OperationStatus"], "Incorrect 'OperationStatus' value")
        assert_equal("clairetest", operation_item_0["Computer"], "Incorrect 'Computer' value")
        assert_equal("Antimalware", operation_item_0["Category"], "Incorrect 'Category' value")
        assert_equal("Antimalware", operation_item_0["Solution"], "Incorrect 'Solution' value")
        assert_equal("Antimalware Assessment encountered some errors but still return the result: test error", operation_item_0["Detail"], "Incorrect 'Detail' value")
        
        #######################################
        assert_equal("PROTECTION_STATUS_BLOB", antimalware_blob["DataType"], "Incorrect 'DataType' value") 
        assert_equal("Antimalware", antimalware_blob["IPName"], "Incorrect 'IPName' value")

        antimalware_item_0 = antimalware_blob["DataItems"][0]
        assert_equal("clairetest", antimalware_item_0["DeviceName"], "Incorrect 'DeviceName' value")
        assert_equal("Linux", antimalware_item_0["OSName"], "Incorrect 'OSName' value")
        assert_equal(nil, antimalware_item_0["Error"], "Incorrect 'Error' value in antimalware results, should be null")
        assert_equal(350, antimalware_item_0["ProtectionStatusRank"], "Incorrect 'ProtectionStatusRank' value")
        assert_equal("Action Required", antimalware_item_0["ProtectionStatus"], "Incorrect 'ProtectionStatus' value")
        assert_equal("Both quick scan and full scan are out of 7 days, please run an active scan", antimalware_item_0["ProtectionStatusDetails"], "Incorrect 'ProtectionStatusDetails' value")
        assert_equal("e108ea08-245d-42ec-ae3f-2ffcdb152aab", antimalware_item_0["DetectionId"], "Incorrect 'DetectionId' value")
        assert_equal("", antimalware_item_0["Threat"], "Incorrect 'Threat' value")
        assert_equal(470, antimalware_item_0["ThreatStatusRank"], "Incorrect 'ThreatStatusRank' value")
        assert_equal("Unknown", antimalware_item_0["ThreatStatus"], "Incorrect 'ThreatStatus' value")
        assert_equal("Threat Status is currently not supported in Linux McAfee", antimalware_item_0["ThreatStatusDetails"], "Incorrect 'ThreatStatusDetails' value")
        assert_equal("9068.0", antimalware_item_0["Signature"], "Incorrect 'Signature' value")
        assert_equal("25/10/18 23:44:42 UTC", antimalware_item_0["ScanDate"], "Incorrect 'ScanDate' value")
        assert_equal("06/11/2018 22:39", antimalware_item_0["DateCollected"], "Incorrect 'DateCollected' value")
        assert_equal("McAfee Endpoint Security for Linux Threat Prevention", antimalware_item_0["Tool"], "Incorrect 'Tool' value")
        assert_equal("10.5.1.1582", antimalware_item_0["AMProductVersion"], "Incorrect 'AMProductVersion' value")       
    end
end