import { describe, expect, it } from 'vitest';
import { baselineTemplateContext } from '../../src/evaluation/baseline-template-context';
import { analyzeMicrosoftSecurityBaselinePackage } from '../../server/gpo/microsoft-security-baseline-parser';
import { syntheticBaselineArchive } from './microsoft-baseline-synthetic-fixture';

describe('Microsoft baseline template metadata', () => {
  it.each([
    ['MSFT Windows 10 RS1 - Computer', 'Windows 10', '1607', 'Client'],
    ['MSFT Windows Server 2016 - Member Server', 'Windows Server', '2016', 'Member Server'],
    ['MSFT Windows Server 2022 - Domain Controller', 'Windows Server', '2022', 'Domain Controller']
  ])('recognizes a complete explicit template name: %s', (name, productFamily, productVersion, role) => {
    expect(baselineTemplateContext([name, name])).toEqual({ productFamily, productVersion, role });
  });
  it.each([[], ['Synthetic Server'], ['Windows Server 2016'],
    ['MSFT Windows Server 2016 - Member Server', 'MSFT Windows Server 2016 - Domain Controller'],
    ['Not MSFT Windows Server 2016 - Member Server']])('does not guess roles from incomplete or contradictory names %j', (...names) => {
    expect(baselineTemplateContext(names as string[])).toBeUndefined();
  });
  it('keeps three template names and source references separate inside one package', () => {
    const names = ['MSFT Windows 10 RS1 - Computer', 'MSFT Windows Server 2016 - Member Server',
      'MSFT Windows Server 2016 - Domain Controller'];
    const entries = names.flatMap((name, index) => {
      const root = `Synthetic/GPOs/template-${index}`;
      return [
        { path: `${root}/Backup.xml`, content: Buffer.from('<GroupPolicyBackupScheme><GroupPolicyObject><GroupPolicyCoreSettings><DisplayName>'
          + name + '</DisplayName></GroupPolicyCoreSettings></GroupPolicyObject></GroupPolicyBackupScheme>') },
        { path: `${root}/bkupInfo.xml`, content: Buffer.from(`<BackupInst><GPODisplayName>${name}</GPODisplayName></BackupInst>`) },
        { path: `${root}/DomainSysvol/GPO/Machine/Microsoft/Windows NT/SecEdit/GptTmpl.inf`,
          content: Buffer.from('[Privilege Rights]\nSeEnableDelegationPrivilege=' + (index === 2 ? '*S-1-5-32-544' : '')) }
      ];
    });
    const analysis = analyzeMicrosoftSecurityBaselinePackage(syntheticBaselineArchive(entries), {
      baselineId: 'synthetic', analyzedAt: '2026-09-09T12:00:00Z'
    });
    expect(analysis.backupCount).toBe(3);
    expect(analysis.settings).toHaveLength(3);
    expect(new Set(analysis.settings.map(item => item.template?.context?.role))).toEqual(new Set(['Client', 'Member Server', 'Domain Controller']));
    for (const setting of analysis.settings) {
      expect(setting.template?.names).toHaveLength(2);
      expect(setting.template?.names.every(name => /^[a-f0-9]{64}$/.test(name.sourceSha256))).toBe(true);
      expect(setting.template?.names.map(name => name.sourcePath)).toEqual(expect.arrayContaining([
        expect.stringContaining('/Backup.xml'), expect.stringContaining('/bkupInfo.xml')
      ]));
    }
    expect(analysis.settings.filter(item => item.observation.values[0].kind === 'principal-set'
      && item.observation.values[0].principals.length === 0)).toHaveLength(2);
  });
});