68 lines
4.9 KiB
TypeScript
68 lines
4.9 KiB
TypeScript
import { describe, expect, it } from 'vitest';
|
|
import { cloudInformationFacts, cloudInformationOverview } from '../../src/domain/cloud-information';
|
|
import { selectClientInformation } from '../../src/domain/client-information';
|
|
import { cloudInformationFixture } from '../cloud-information-fixture';
|
|
|
|
describe('source-backed Cloud Information', () => {
|
|
it('projects all four areas with exact source provenance without changing source data', () => {
|
|
const snapshot = cloudInformationFixture(); const before = JSON.stringify(snapshot);
|
|
const facts = cloudInformationFacts(snapshot);
|
|
expect(facts).toHaveLength(5);
|
|
expect(facts.map(fact => fact.value)).toEqual(expect.arrayContaining(['enabled', 1, 2, 'False', '2af84b1e-32c8-42b7-82bc-daa82404023b']));
|
|
expect(cloudInformationOverview(facts, 'cloud-apps')).toEqual(['Admin requests: disabled']);
|
|
expect(cloudInformationOverview(facts, 'cloud-sharing')).toEqual(['Guests: restricted role']);
|
|
expect(facts.find(fact => fact.value === 2)).toMatchObject({ scope: 'reported-subset', observationId: 'CISA.MS.AAD.7.4',
|
|
scanRunId: 'run-1', importFileId: 'file-1', mappingVersion: '1.0.0', source: { rowIndex: 0 } });
|
|
expect(JSON.stringify(snapshot)).toBe(before);
|
|
});
|
|
|
|
it('ignores outcomes, recommendations, unknown IDs, other tools and unassessed evidence', () => {
|
|
const snapshot = cloudInformationFixture();
|
|
snapshot.observations = snapshot.observations.slice(0, 1);
|
|
const obs = snapshot.observations[0];
|
|
for (const value of ['Failed', 'The recommended value is **enabled**.',
|
|
'| Setting | Expected Value |\n| --- | --- |\n| FIDO2 | enabled |', 'Your tenant is configured as **enabled** or **disabled**.']) {
|
|
obs.originalValue = value; expect(cloudInformationFacts(snapshot)).toEqual([]);
|
|
}
|
|
obs.originalValue = 'Your tenant is configured as **disabled**.';
|
|
obs.state = 'not-assessed'; expect(cloudInformationFacts(snapshot)).toEqual([]);
|
|
obs.state = 'observed'; obs.tool = { id: 'other', name: 'Other' }; expect(cloudInformationFacts(snapshot)).toEqual([]);
|
|
obs.tool = { id: 'maester', name: 'Maester' }; obs.attributes.sourceRuleId = 'EIDSCA.AF99'; expect(cloudInformationFacts(snapshot)).toEqual([]);
|
|
});
|
|
|
|
it('keeps explicit zero and unset without inferring defaults or treating missing tables as zero', () => {
|
|
const snapshot = cloudInformationFixture(); snapshot.observations = snapshot.observations.slice(0, 1);
|
|
const obs = snapshot.observations[0];
|
|
obs.originalValue = 'Your tenant is **not configured explicitly**.\n\nThe recommended value is **enabled**.';
|
|
expect(cloudInformationFacts(snapshot)[0].value).toBe('not configured explicitly');
|
|
obs.attributes.sourceRuleId = 'CISA.MS.AAD.7.4';
|
|
obs.originalValue = 'Well done. Your tenant has no active assignments without expiration to privileged roles.';
|
|
expect(cloudInformationFacts(snapshot)[0].value).toBe(0);
|
|
obs.originalValue = 'Your tenant has active assignments without expiration to privileged roles.';
|
|
expect(cloudInformationFacts(snapshot)).toEqual([]);
|
|
obs.attributes.sourceRuleId = 'MT.1032'; obs.originalValue = 'All privileged role assignments are managed by PIM. Well done!';
|
|
expect(cloudInformationFacts(snapshot)).toEqual([]);
|
|
});
|
|
|
|
it('preserves conflicting values and separates runs and tenants instead of adding counts', () => {
|
|
const snapshot = cloudInformationFixture(); snapshot.observations = snapshot.observations.slice(0, 1);
|
|
const obs = snapshot.observations[0];
|
|
snapshot.observations.push({ ...obs, id: 'conflicting', originalValue: 'Your tenant is configured as **disabled**.' });
|
|
expect(cloudInformationOverview(cloudInformationFacts(snapshot), 'cloud-access')).toEqual(['FIDO2: conflicting source values']);
|
|
snapshot.observations[1].scanRunId = 'run-2';
|
|
expect(cloudInformationOverview(cloudInformationFacts(snapshot), 'cloud-access')).toEqual(['Multiple scan scopes — see Results']);
|
|
snapshot.observations[1].scanRunId = obs.scanRunId; snapshot.observations[1].subject = { type: 'entra-tenant', identity: 'tenant-2' };
|
|
expect(cloudInformationOverview(cloudInformationFacts(snapshot), 'cloud-access')).toEqual(['Multiple scan scopes — see Results']);
|
|
});
|
|
|
|
it('publishes full filtered facts through the read contract independently of pagination', () => {
|
|
const snapshot = cloudInformationFixture();
|
|
const result = selectClientInformation(snapshot, { projectId: snapshot.projectId, areas: ['cloud-access'], limit: 1 }, 9);
|
|
expect(result.cloudFacts).toHaveLength(2); expect(result.observations).toHaveLength(1);
|
|
expect(result.cloudFacts.every(fact => fact.area === 'cloud-access')).toBe(true);
|
|
expect(selectClientInformation(snapshot, { projectId: snapshot.projectId, properties: ['missing'] }, 9).cloudFacts).toEqual([]);
|
|
result.cloudFacts[0].source.rowIndex = 999;
|
|
expect(snapshot.observations[0].source.rowIndex).toBe(0);
|
|
});
|
|
});
|