tests/test_task6.py

"""Tests for Task 6 — Action Validation Middleware."""

import os
import sys

_PROJECT_ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), os.pardir))
if _PROJECT_ROOT not in sys.path:
    sys.path.insert(0, _PROJECT_ROOT)

from server.action_validation import (
    ActionValidationMiddleware,
    PHASE_VIOLATION,
    INVALID_PARAMS,
    UNGROUNDED_ACTION,
)
from server.threat_graph import ThreatGraph, IOCNode, ProcessNode


def _empty():
    return ThreatGraph()


def _graph_with_ioc(value="1.2.3.4"):
    g = ThreatGraph()
    g.add_ioc(IOCNode(ioc_value=value, ioc_type="ip", confidence=0.9))
    return g


def _graph_with_process(host="H", proc_name="evil.exe"):
    g = ThreatGraph()
    g.add_process(ProcessNode(process_id=f"{host}:{proc_name}", hostname=host, process_name=proc_name))
    return g


def test_gate1_rejects_wrong_phase():
    m = ActionValidationMiddleware()
    err = m.validate("triage", "kill_process", {}, _empty())
    assert err is not None
    assert err["error"] == PHASE_VIOLATION


def test_gate1_passes_correct_phase():
    m = ActionValidationMiddleware()
    err = m.validate("remediation", "kill_process", {"hostname": "H", "process_name": "evil.exe"}, _graph_with_process())
    assert err is None


def test_gate1_error_lists_allowed_tools():
    m = ActionValidationMiddleware()
    err = m.validate("triage", "kill_process", {}, _empty())
    assert err is not None
    msg = err["message"].lower()
    assert any(t in msg for t in ["read_alerts", "read_topology", "correlate_alerts"])


def test_gate2_rejects_missing_ioc_value():
    m = ActionValidationMiddleware()
    err = m.validate("remediation", "block_ioc", {}, _empty())
    assert err is not None and err["error"] == INVALID_PARAMS


def test_gate2_rejects_correlate_with_one_alert():
    m = ActionValidationMiddleware()
    err = m.validate("triage", "correlate_alerts", {"alert_ids": ["A1"]}, _empty())
    assert err is not None and err["error"] == INVALID_PARAMS


def test_gate3_rejects_ungrounded_block():
    m = ActionValidationMiddleware()
    err = m.validate("remediation", "block_ioc", {"ioc_value": "1.2.3.4"}, _empty())
    assert err is not None and err["error"] == UNGROUNDED_ACTION


def test_gate3_passes_grounded_block():
    m = ActionValidationMiddleware()
    err = m.validate("remediation", "block_ioc", {"ioc_value": "1.2.3.4"}, _graph_with_ioc())
    assert err is None


def test_gate3_rejects_ungrounded_kill():
    m = ActionValidationMiddleware()
    err = m.validate("remediation", "kill_process", {"hostname": "H", "process_name": "unknown.exe"}, _empty())
    assert err is not None and err["error"] == UNGROUNDED_ACTION


def test_all_gates_pass_returns_none():
    m = ActionValidationMiddleware()
    err = m.validate("remediation", "block_ioc", {"ioc_value": "1.2.3.4"}, _graph_with_ioc())
    assert err is None


def test_retry_flag_false_for_phase_violation():
    m = ActionValidationMiddleware()
    err = m.validate("triage", "kill_process", {}, _empty())
    assert err["retry"] is False


def test_retry_flag_true_for_invalid_params():
    m = ActionValidationMiddleware()
    err = m.validate("remediation", "block_ioc", {}, _empty())
    assert err["retry"] is True