macos-package-review/internal/security/audit_test.go

package security

import (
	"testing"

	"github.com/user/package-review/internal/inventory"
)

func TestNewAudit(t *testing.T) {
	inv := &inventory.Inventory{}
	audit := NewAudit(inv)

	if audit.Inventory != inv {
		t.Error("NewAudit() did not set inventory")
	}
	if len(audit.Findings) != 0 {
		t.Error("NewAudit() should start with empty findings")
	}
	if len(audit.Mitigations) != 0 {
		t.Error("NewAudit() should start with empty mitigations")
	}
}

func TestFilterByMinSeverity(t *testing.T) {
	audit := &Audit{
		Findings: []Finding{
			{CVE: "CVE-1", CVSS: 3.5, Severity: "LOW"},
			{CVE: "CVE-2", CVSS: 5.5, Severity: "MEDIUM"},
			{CVE: "CVE-3", CVSS: 7.5, Severity: "HIGH"},
			{CVE: "CVE-4", CVSS: 9.5, Severity: "CRITICAL"},
		},
	}

	tests := []struct {
		minCVSS float64
		want    int
	}{
		{0.0, 4},   // All
		{5.0, 3},   // Medium and above
		{7.0, 2},   // High and above
		{9.0, 1},   // Critical only
		{10.0, 0},  // None
	}

	for _, tt := range tests {
		filtered := audit.FilterByMinSeverity(tt.minCVSS)
		if len(filtered) != tt.want {
			t.Errorf("FilterByMinSeverity(%.1f) = %d, want %d", tt.minCVSS, len(filtered), tt.want)
		}
	}
}

func TestCountVulnerable(t *testing.T) {
	audit := &Audit{
		Findings: []Finding{
			{PackageName: "curl", CVE: "CVE-1", CVSS: 7.0},
			{PackageName: "curl", CVE: "CVE-2", CVSS: 5.0},
			{PackageName: "git", CVE: "CVE-3", CVSS: 8.0},
			{PackageName: "python", CVE: "CVE-4", CVSS: 6.0},
			{PackageName: "python", CVE: "CVE-5", CVSS: 4.0},
		},
	}

	count := audit.CountVulnerable()
	if count != 3 {
		t.Errorf("CountVulnerable() = %d, want 3 (curl, git, python)", count)
	}
}

func TestFindingFields(t *testing.T) {
	finding := Finding{
		PackageName:    "curl",
		PackageVersion: "8.0.0",
		CVE:            "CVE-2021-22911",
		CVSS:           7.5,
		Summary:        "Insufficiently random default nonce",
		Link:           "https://nvd.nist.gov/vuln/detail/CVE-2021-22911",
		Severity:       "HIGH",
	}

	// Verify all fields are accessible
	if finding.PackageName != "curl" {
		t.Error("PackageName field not set correctly")
	}
	if finding.CVSS != 7.5 {
		t.Error("CVSS field not set correctly")
	}
	if finding.Severity != "HIGH" {
		t.Error("Severity field not set correctly")
	}
}

func TestMitigationFields(t *testing.T) {
	finding := Finding{
		PackageName:    "curl",
		PackageVersion: "8.0.0",
		CVE:            "CVE-2021-22911",
		CVSS:           7.5,
	}

	mitigation := Mitigation{
		Finding:        finding,
		Recommendation: "update",
		Rationale:      "A patch is available",
		NextSteps:      "Run: brew upgrade curl",
	}

	if mitigation.Recommendation != "update" {
		t.Error("Recommendation field not set correctly")
	}
	if mitigation.NextSteps != "Run: brew upgrade curl" {
		t.Error("NextSteps field not set correctly")
	}
}

func TestAuditAppendFinding(t *testing.T) {
	audit := NewAudit(&inventory.Inventory{})

	finding := Finding{
		PackageName: "curl",
		CVE:         "CVE-2021-22911",
		CVSS:        7.5,
	}

	audit.Findings = append(audit.Findings, finding)

	if len(audit.Findings) != 1 {
		t.Errorf("Expected 1 finding, got %d", len(audit.Findings))
	}
	if audit.Findings[0].CVE != "CVE-2021-22911" {
		t.Error("Finding not appended correctly")
	}
}

func TestAuditAppendMitigation(t *testing.T) {
	audit := NewAudit(&inventory.Inventory{})

	mitigation := Mitigation{
		Recommendation: "update",
		Rationale:      "Patch available",
	}

	audit.Mitigations = append(audit.Mitigations, mitigation)

	if len(audit.Mitigations) != 1 {
		t.Errorf("Expected 1 mitigation, got %d", len(audit.Mitigations))
	}
}

func TestCVSSToSeverity(t *testing.T) {
	tests := []struct {
		cvss     float64
		want     string
	}{
		{9.8, "CRITICAL"},
		{9.0, "CRITICAL"},
		{8.5, "HIGH"},
		{7.0, "HIGH"},
		{5.5, "MEDIUM"},
		{4.0, "MEDIUM"},
		{2.5, "LOW"},
		{0.1, "LOW"},
		{0.0, "UNKNOWN"},
	}

	for _, tt := range tests {
		got := cvssToSeverity(tt.cvss)
		if got != tt.want {
			t.Errorf("cvssToSeverity(%.1f) = %s, want %s", tt.cvss, got, tt.want)
		}
	}
}

func BenchmarkFilterByMinSeverity(b *testing.B) {
	audit := &Audit{
		Findings: make([]Finding, 100),
	}
	for i := 0; i < 100; i++ {
		audit.Findings[i] = Finding{
			CVE:  "CVE-" + string(rune(i)),
			CVSS: float64(i%10) + 0.5,
		}
	}

	b.ResetTimer()
	for i := 0; i < b.N; i++ {
		_ = audit.FilterByMinSeverity(7.0)
	}
}

func BenchmarkCountVulnerable(b *testing.B) {
	audit := &Audit{
		Findings: make([]Finding, 100),
	}
	for i := 0; i < 100; i++ {
		audit.Findings[i] = Finding{
			PackageName: "pkg-" + string(rune(i%10)),
			CVE:         "CVE-" + string(rune(i)),
		}
	}

	b.ResetTimer()
	for i := 0; i < b.N; i++ {
		_ = audit.CountVulnerable()
	}
}