import { describe, expect, it } from 'vitest';
import { analyzeMicrosoftSecurityBaselinePackage } from '../../server/gpo/microsoft-security-baseline-parser';
import { syntheticMicrosoftBaselineZip } from './microsoft-baseline-synthetic-fixture';
import { syntheticGpoBackupZip } from './gpo-synthetic-fixture';
import { analyzeGpoBackupForPersistence } from '../../server/gpo/gpo-inventory-executor';

describe('Microsoft Security Baseline settings parser', () => {
  it('uses identical native targets for customer and baseline security templates and audit policy', () => {
    const bytes = syntheticGpoBackupZip();
    const customer = analyzeGpoBackupForPersistence({ bytes, options: {
      projectId: 'synthetic', sourceArtifactId: 'synthetic-source', discoveredAt: '2026-09-06T12:00:00Z'
    } });
    const baseline = analyzeMicrosoftSecurityBaselinePackage(bytes, { baselineId: 'synthetic-baseline', analyzedAt: '2026-09-06T12:00:00Z' });
    expect(baseline.settings).toHaveLength(3);
    for (const setting of baseline.settings) {
      expect(setting.identity.status).toBe('resolved');
      if (setting.identity.status !== 'resolved') continue;
      const id = setting.identity.identity.id;
      expect(customer.identityResolutions.some(item => item.resolution.status === 'resolved' && item.resolution.identity.id === id)).toBe(true);
    }
    expect(baseline.settings.map(item => item.observation.deliveryMechanism)).toEqual(expect.arrayContaining(['security-template', 'advanced-audit-policy']));
  });
  it('uses the Registry.pol parser and stable ADMX identity without opening nested documentation', () => {
    const bytes = syntheticMicrosoftBaselineZip();
    const analysis = analyzeMicrosoftSecurityBaselinePackage(bytes, {
      baselineId: 'synthetic-baseline', analyzedAt: '2026-08-04T12:00:00.000Z'
    });
    expect(analysis).toMatchObject({
      status: 'complete',
      backupCount: 1,
      registryPolicyFileCount: 1,
      settings: [{
        observation: {
          parser: { id: 'gpo-registry-policy-binary', version: '1.0.0' },
          reducer: { id: 'gpo-registry-policy-instruction-reducer', version: '1.0.0' },
          values: [{ kind: 'registry-policy', operation: 'set-value', key: 'Software\\Policies\\Synthetic', valueName: 'Mode' }]
        },
        identity: {
          status: 'resolved',
          identity: { admx: { status: 'matched', reference: { technicalId: 'Synthetic.Policies#Mode', settingId: '$policy' } } }
        }
      }]
    });
    expect(analysis.settings[0].observation.sourceRecords).toEqual([{ index: 0, byteOffset: 8 }]);
  });

  it('fails closed through the shared Registry.pol parser on an unknown type', () => {
    const analysis = analyzeMicrosoftSecurityBaselinePackage(syntheticMicrosoftBaselineZip(99), {
      baselineId: 'synthetic-baseline', analyzedAt: '2026-08-04T12:00:00.000Z'
    });
    expect(analysis.status).toBe('partial');
    expect(analysis.settings).toEqual([]);
    expect(analysis.diagnosticCodes).toContain('gpo-registry-policy-type-unsupported');
  });
});