228 lines
12 KiB
TypeScript
228 lines
12 KiB
TypeScript
// @vitest-environment jsdom
|
|
|
|
import { describe, expect, it } from 'vitest';
|
|
import { profileForSheet } from '../../src/app/AppProvider';
|
|
import cisCatFixture from '../../fixtures/cis-cat/assessment.synthetic.html?raw';
|
|
import maesterFixture from '../../fixtures/maester/test-results.synthetic.csv?raw';
|
|
import pingCastleFixture from '../../fixtures/pingcastle/healthcheck.synthetic.html?raw';
|
|
import { importFile } from '../../src/importers/importer';
|
|
import { confirmEntryMappings, previewEntryFromDataset } from '../../src/features/import-workflow/import-workflow';
|
|
import { genericProfile } from '../../src/profiles/generic/generic-profile';
|
|
import { importProfiles } from '../../src/profiles/profile-catalog';
|
|
import { toolProfileDefinitions } from '../../src/profiles/profile-definition-catalog';
|
|
|
|
const options = { profiles: importProfiles };
|
|
|
|
describe('declarative tool profiles', () => {
|
|
it('requires an explicit native-score decision and fallback population for every registered profile', () => {
|
|
for (const { securityScoring: scoring } of toolProfileDefinitions) {
|
|
expect(scoring.version).toMatch(/^\d+\.\d+\.\d+$/);
|
|
expect(['complete', 'findings-only', 'unknown']).toContain(scoring.resultPopulation);
|
|
if (scoring.native.kind === 'mapped') {
|
|
expect(scoring.native.properties.length).toBeGreaterThan(0);
|
|
expect(scoring.native.properties.every(property => property.trim().length > 0)).toBe(true);
|
|
expect(scoring.native.scope).toBe('overall');
|
|
expect(scoring.native.scale).toBe('0-100');
|
|
expect(['higher-is-better', 'lower-is-better']).toContain(scoring.native.direction);
|
|
} else {
|
|
expect(scoring.native.kind).toBe('unavailable');
|
|
expect(scoring.native.reason.trim().length).toBeGreaterThan(0);
|
|
}
|
|
}
|
|
});
|
|
|
|
it('requires an explicit, versioned remediation-comparison decision for every registered profile', () => {
|
|
for (const { timeslotComparison: comparison } of toolProfileDefinitions) {
|
|
expect(comparison.version).toMatch(/^\d+\.\d+\.\d+$/);
|
|
if (comparison.kind === 'unavailable') {
|
|
expect(comparison.reason.trim().length).toBeGreaterThan(0);
|
|
continue;
|
|
}
|
|
expect(['scope', 'asset', 'aggregate']).toContain(comparison.granularity);
|
|
expect(comparison.scope.kind.trim().length).toBeGreaterThan(0);
|
|
expect(comparison.scope.properties.length).toBeGreaterThan(0);
|
|
expect(comparison.scope.properties.every(property => property.trim().length > 0)).toBe(true);
|
|
expect(comparison.observationTimeProperties.length).toBeGreaterThan(0);
|
|
expect(comparison.observationTimeProperties.every(property => property.trim().length > 0)).toBe(true);
|
|
expect(['explicit-results', 'findings-only', 'unknown']).toContain(comparison.resultEvidence);
|
|
expect(['unsupported', 'complete-explicit-negative']).toContain(comparison.negativeEvidence);
|
|
expect(comparison.diagnosticPolicy).toBe('fail-closed-by-impact');
|
|
}
|
|
});
|
|
|
|
it('requires an explicit, versioned priority basis for every registered profile', () => {
|
|
for (const { priorityBasis } of toolProfileDefinitions) {
|
|
expect(priorityBasis.version).toMatch(/^\d+\.\d+\.\d+$/);
|
|
const { basis } = priorityBasis;
|
|
if (basis.kind === 'severity' || basis.kind === 'numeric') {
|
|
expect(basis.properties.length).toBeGreaterThan(0);
|
|
expect(basis.properties.every(property => property.trim().length > 0)).toBe(true);
|
|
}
|
|
if (basis.kind === 'numeric') {
|
|
expect(basis.scale.trim().length).toBeGreaterThan(0);
|
|
expect(['higher-is-worse', 'lower-is-worse']).toContain(basis.direction);
|
|
}
|
|
if (basis.kind === 'unavailable') expect(basis.reason.trim().length).toBeGreaterThan(0);
|
|
for (const excluded of priorityBasis.excludedProperties ?? []) {
|
|
expect(excluded.property.trim().length).toBeGreaterThan(0);
|
|
expect(excluded.reason.trim().length).toBeGreaterThan(0);
|
|
}
|
|
}
|
|
});
|
|
|
|
it('never promotes a CIS profile tier into a criticality', () => {
|
|
const cisCat = toolProfileDefinitions.find(definition => definition.id === 'cis-cat');
|
|
expect(cisCat?.priorityBasis.basis.kind).toBe('unavailable');
|
|
expect(cisCat?.priorityBasis.excludedProperties?.map(entry => entry.property))
|
|
.toContain('recommendation.level');
|
|
});
|
|
|
|
it('declares PingCastle on points because its severity is derived and capped', () => {
|
|
const pingCastle = toolProfileDefinitions.find(definition => definition.id === 'pingcastle');
|
|
expect(pingCastle?.priorityBasis.basis).toMatchObject({
|
|
kind: 'numeric', direction: 'higher-is-worse'
|
|
});
|
|
});
|
|
|
|
it('provides a unique, versioned definition for every runtime profile', () => {
|
|
expect(new Set(toolProfileDefinitions.map(definition => definition.id)).size).toBe(toolProfileDefinitions.length);
|
|
expect(importProfiles.map(profile => profile.id)).toEqual(toolProfileDefinitions.map(definition => definition.id));
|
|
for (const profile of importProfiles) {
|
|
expect(profile.version).toMatch(/^\d+\.\d+\.\d+$/);
|
|
expect(profile.definition).toMatchObject({
|
|
schemaVersion: 1,
|
|
id: profile.id,
|
|
name: profile.name,
|
|
version: profile.version
|
|
});
|
|
expect(profile.definition.fieldRules.length).toBeGreaterThan(0);
|
|
expect(profile.definition.comparisonKeys.length).toBeGreaterThan(0);
|
|
expect(profile.definition.comparisonKeys.every(key => key.includes('rule-id'))).toBe(true);
|
|
expect(profile.defaults(undefined).statusFilter).toBe('deviation');
|
|
expect(profile.presentation.statusFilters.map(filter => filter.value)).toContain('deviation');
|
|
}
|
|
expect(genericProfile.definition.fallback).toBe(true);
|
|
});
|
|
|
|
it.each([
|
|
{
|
|
name: 'PingCastle',
|
|
fileName: 'ad_hc_synthetic.example.html',
|
|
type: 'text/html',
|
|
content: pingCastleFixture,
|
|
profileId: 'pingcastle',
|
|
firstSheet: 'Risk Scores'
|
|
},
|
|
{
|
|
name: 'CIS-CAT',
|
|
fileName: 'CIS-CAT-SYNTHETIC.html',
|
|
type: 'text/html',
|
|
content: cisCatFixture,
|
|
profileId: 'cis-cat',
|
|
firstSheet: 'assessmentResultTable'
|
|
},
|
|
{
|
|
name: 'Maester',
|
|
fileName: 'TestResults-synthetic.csv',
|
|
type: 'text/csv',
|
|
content: maesterFixture,
|
|
profileId: 'maester',
|
|
firstSheet: 'CSV'
|
|
}
|
|
])('selects and applies the $name profile', async ({ fileName, type, content, profileId, firstSheet }) => {
|
|
const imported = await importFile(new File([content], fileName, { type }), options);
|
|
|
|
expect(imported.profileId).toBe(profileId);
|
|
// Gegen den Katalog pruefen statt gegen eine feste Zahl: die Zusage ist,
|
|
// dass die tatsaechliche Profilversion im Importergebnis landet - ein
|
|
// fachlich begruendeter Versionssprung darf diesen Test nicht brechen.
|
|
expect(imported.profileVersion).toBe(importProfiles.find(profile => profile.id === profileId)?.version);
|
|
expect(imported.sheets[0].name).toBe(firstSheet);
|
|
expect(imported.scanTool).toBe(importProfiles.find(profile => profile.id === profileId)?.name);
|
|
});
|
|
|
|
it('uses the sheet tool profile inside a mixed project workspace', async () => {
|
|
const imported = await importFile(new File([cisCatFixture], 'CIS-CAT-SYNTHETIC.html', { type: 'text/html' }), options);
|
|
const sheet = { ...imported.sheets[0], toolId: imported.profileId };
|
|
const mixedDataset = { ...imported, sheets: [sheet], profileId: 'generic', profileVersion: 'gemischt' };
|
|
|
|
expect(sheet.toolId).toBe('cis-cat');
|
|
expect(profileForSheet(mixedDataset, sheet).id).toBe('cis-cat');
|
|
expect(profileForSheet(mixedDataset, sheet).defaults(sheet).titleColumn).toBe('Benchmark Item');
|
|
});
|
|
|
|
it('combines the status filters of every tool in a mixed timeslot aggregate', async () => {
|
|
const imported = await importFile(new File([cisCatFixture], 'CIS-CAT-SYNTHETIC.html', { type: 'text/html' }), options);
|
|
const aggregate = { ...imported.sheets[0], id: 'aggregate', toolId: undefined, isProjectSheet: true };
|
|
const maesterSheet = { ...imported.sheets[0], id: 'maester-sheet', toolId: 'maester' };
|
|
const purpleKnightSheet = { ...imported.sheets[0], id: 'purple-sheet', toolId: 'purple-knight' };
|
|
const mixedDataset = { ...imported, sheets: [aggregate, maesterSheet, purpleKnightSheet], profileId: 'generic', profileVersion: 'gemischt' };
|
|
|
|
const aggregateProfile = profileForSheet(mixedDataset, aggregate);
|
|
const filterValues = aggregateProfile.presentation.statusFilters.map(filter => filter.value);
|
|
expect(aggregateProfile.id).toBe('multiple');
|
|
expect(filterValues).toContain('investigate');
|
|
expect(filterValues).toContain('ioes-found');
|
|
expect(profileForSheet(mixedDataset, maesterSheet).id).toBe('maester');
|
|
expect(profileForSheet(mixedDataset, purpleKnightSheet).id).toBe('purple-knight');
|
|
});
|
|
|
|
it('selects Purple Knight through the same profile factory and keeps status filters', async () => {
|
|
const text = [
|
|
'Name;Short Name;SI Version;Severity;Weight;Category;Result',
|
|
'Synthetic indicator;SYN-001;1;High;10;Identity;IOEs found'
|
|
].join('\n');
|
|
|
|
const imported = await importFile(new File([text], 'PurpleKnight-results.csv', { type: 'text/csv' }), options);
|
|
const profile = importProfiles.find(candidate => candidate.id === imported.profileId);
|
|
|
|
expect(imported.profileId).toBe('purple-knight');
|
|
// 1.4.0 additionally covers the Entra-ID summary and scan scope;
|
|
// canonical status normalization stays at 1.1.0.
|
|
expect(imported.profileVersion).toBe('1.4.0');
|
|
expect(profile?.presentation.statusFilters.map(filter => filter.value)).toContain('ioes-found');
|
|
expect(profile?.matchesStatus(imported.sheets[0].analysis.records[0], 'ioes-found')).toBe(true);
|
|
expect(profile?.matchesStatus(imported.sheets[0].analysis.records[0], 'deviation')).toBe(true);
|
|
});
|
|
|
|
it('uses the canonical missing-status warning for Defender CVEs in Work', () => {
|
|
const profile = importProfiles.find(candidate => candidate.id === 'defender-for-iot-vulnerabilities');
|
|
const fields = [{ label: 'CVE', value: 'CVE-2026-0001', index: 0 }, { label: 'Severity', value: 'Critical', index: 1 }];
|
|
const record = { id: 'defender-record', index: 0, title: 'CVE-2026-0001', fields, filled: fields, meta: [] };
|
|
|
|
expect(profile?.matchesStatus(record, 'deviation')).toBe(true);
|
|
});
|
|
|
|
it('requires confirmation and keeps the generic profile when only the file name identifies a tool', async () => {
|
|
const imported = await importFile(new File(['Alpha;Beta\none;two'], 'CIS-CAT-SYNTHETIC.csv', { type: 'text/csv' }), options);
|
|
|
|
expect(imported.recognition?.source).toMatchObject({
|
|
selected: { toolId: 'cis-cat' },
|
|
requiresConfirmation: true
|
|
});
|
|
expect(imported.profileId).toBe('generic');
|
|
expect(imported.mapping?.mappingProfile.id).toBe('generic');
|
|
|
|
const preview = previewEntryFromDataset(imported, {
|
|
sha256: 'c'.repeat(64), fileName: imported.fileName, sizeBytes: imported.fileSize, lastModified: imported.lastModified
|
|
});
|
|
const confirmed = confirmEntryMappings(preview, importProfiles);
|
|
expect(confirmed.dataset).toMatchObject({ profileId: 'cis-cat', scanTool: 'CIS-CAT Pro' });
|
|
// Die Mappingversion ist die deklarierte Abbildungsversion des Profils und
|
|
// nicht dessen Gesamtversion: ein reiner Kontextzuwachs hebt die
|
|
// Profilversion, laesst die Feldabbildung aber unveraendert.
|
|
expect(confirmed.dataset?.mapping?.mappingProfile).toMatchObject({
|
|
kind: 'mapping-profile', id: 'cis-cat',
|
|
version: importProfiles.find(profile => profile.id === 'cis-cat')?.definition.processing.mappingVersion
|
|
});
|
|
expect(confirmed.dataset?.recognition?.source.decisionSource).toBe('user-confirmed');
|
|
});
|
|
it('keeps an unknown table on the generic fallback profile', async () => {
|
|
const imported = await importFile(new File(['Alpha;Beta\none;two'], 'unknown.csv', { type: 'text/csv' }), options);
|
|
|
|
expect(imported.profileId).toBe('generic');
|
|
expect(imported.profileVersion).toBe('1.0.0');
|
|
expect(imported.sheets[0].rows[1]).toEqual(['one', 'two']);
|
|
});
|
|
});
|