226 lines
13 KiB
TypeScript
226 lines
13 KiB
TypeScript
// @vitest-environment jsdom
|
|
|
|
import { describe, expect, it, vi } from 'vitest';
|
|
import pingCastleXml from '../../fixtures/pingcastle/healthcheck.synthetic.xml?raw';
|
|
import { confirmEntryMappings, previewEntryFromDataset } from '../../src/features/import-workflow/import-workflow';
|
|
import {
|
|
currentPolicyEvaluationsForWork,
|
|
loadCanonicalProjectWorkspace
|
|
} from '../../src/features/project-import/load-canonical-project-workspace';
|
|
import { createCanonicalImportBatch } from '../../src/importers/canonical-import';
|
|
import { importFile } from '../../src/importers/importer';
|
|
import { pingCastleProfile } from '../../src/profiles/pingcastle/pingcastle-profile';
|
|
import { importProfiles } from '../../src/profiles/profile-catalog';
|
|
import type { CanonicalAssessmentModel } from '../../src/domain/canonical-model';
|
|
import { POLICY_EVALUATION_ENGINE, type StoredPolicyEvaluation } from '../../src/domain/policy-evaluation';
|
|
import { selectCurrentPolicyEvaluations } from '../../src/domain/unified-result';
|
|
|
|
describe('canonical project workspace loading', () => {
|
|
it('uses one current evaluation per aggregation even when baseline coverage references more backups', () => {
|
|
const evaluation = (
|
|
id: string,
|
|
version: string,
|
|
baselineCount: number,
|
|
completedAt: string,
|
|
observationId = 'observation-one'
|
|
) => ({
|
|
run: {
|
|
id,
|
|
aggregationRunId: 'aggregation-one',
|
|
completedAt,
|
|
baselineAnalysisIds: Array.from({ length: baselineCount }, (_, index) => `baseline-${index}`),
|
|
evaluator: { ...POLICY_EVALUATION_ENGINE, version }
|
|
},
|
|
results: [{ observationIds: [observationId], backupInstanceIds: ['backup-one'] }]
|
|
}) as unknown as StoredPolicyEvaluation;
|
|
const complete = evaluation('complete', POLICY_EVALUATION_ENGINE.version, 11, '2026-09-06T10:00:00Z');
|
|
complete.results[0].backupInstanceIds = ['backup-one', 'backup-two', 'backup-three'];
|
|
const earlier = evaluation('earlier', POLICY_EVALUATION_ENGINE.version, 11, '2026-09-06T09:00:00Z');
|
|
earlier.results[0].backupInstanceIds = ['backup-one', 'backup-two'];
|
|
const laterPartial = evaluation('later-partial', POLICY_EVALUATION_ENGINE.version, 1, '2026-09-06T11:00:00Z');
|
|
const obsolete = evaluation('obsolete', '1.3.0', 12, '2026-09-06T12:00:00Z');
|
|
const unrelated = evaluation('unrelated', POLICY_EVALUATION_ENGINE.version, 12, '2026-09-06T13:00:00Z', 'other');
|
|
|
|
expect(currentPolicyEvaluationsForWork(
|
|
[laterPartial, obsolete, unrelated, earlier, complete],
|
|
new Set(['observation-one'])
|
|
)).toEqual([complete]);
|
|
const previous = evaluation('previous-version', '1.3.3', 12, '2026-09-06T12:00:00Z');
|
|
expect(currentPolicyEvaluationsForWork([previous], new Set(['observation-one']), new Set([previous.run.id])))
|
|
.toEqual([previous]);
|
|
expect(currentPolicyEvaluationsForWork([previous, complete], new Set(['observation-one']), new Set([previous.run.id])))
|
|
.toEqual([complete]);
|
|
expect(currentPolicyEvaluationsForWork([complete, previous], new Set(['observation-one']), new Set([previous.run.id])))
|
|
.toEqual([complete]);
|
|
expect(currentPolicyEvaluationsForWork([previous], new Set(['observation-one']), new Set())).toEqual([]);
|
|
expect(selectCurrentPolicyEvaluations([previous])).toEqual([]);
|
|
});
|
|
|
|
it('honors authoritative supersession, preserves separate imports and excludes mixed timeslots', () => {
|
|
const evaluation = (id: string, aggregationRunId: string, observationIds: string[]) => ({
|
|
run: { id, aggregationRunId, completedAt: '2026-09-06T10:00:00Z', baselineAnalysisIds: ['baseline'], evaluator: POLICY_EVALUATION_ENGINE },
|
|
results: [{ observationIds, backupInstanceIds: ['same-backup'] }]
|
|
}) as StoredPolicyEvaluation;
|
|
const history = evaluation('history', 'superseded-aggregation', ['one']);
|
|
const current = evaluation('current', 'current-aggregation', ['one']);
|
|
const separateImport = evaluation('separate', 'separate-aggregation', ['two']);
|
|
const otherSlot = evaluation('other-slot', 'other-aggregation', ['elsewhere']);
|
|
const mixed = evaluation('mixed', 'mixed-aggregation', ['one', 'elsewhere']);
|
|
const records = [history, current, separateImport, otherSlot, mixed];
|
|
const before = JSON.stringify(records);
|
|
expect(currentPolicyEvaluationsForWork(records, new Set(['one', 'two']),
|
|
new Set(['current', 'separate', 'other-slot', 'mixed']))).toEqual([current, separateImport]);
|
|
expect(currentPolicyEvaluationsForWork(records, new Set(['one']), new Set())).toEqual([]);
|
|
expect(JSON.stringify(records)).toBe(before);
|
|
});
|
|
|
|
it('opens a GPO-only assessment without loading another timeslot or requiring scanner results', async () => {
|
|
const stamp = '2026-09-06T00:00:00Z';
|
|
const model: CanonicalAssessmentModel = {
|
|
schemaVersion: 1,
|
|
project: { id: 'synthetic-client', name: 'Synthetic', description: '', attributes: {}, createdAt: stamp, updatedAt: stamp },
|
|
assessment: { id: 'gpo-slot', projectId: 'synthetic-client', name: 'Synthetic GPO slot', createdAt: stamp, updatedAt: stamp },
|
|
scanRuns: [], importFiles: [], sourceTables: [], findingDefinitions: [], findingOccurrences: [], evidence: [], reviews: [], diagnostics: []
|
|
};
|
|
const reader = {
|
|
listProjectAssessments: vi.fn().mockResolvedValue([model.assessment, { ...model.assessment, id: 'other-slot' }]),
|
|
loadAssessmentModel: vi.fn().mockResolvedValue(model),
|
|
queryUnifiedResults: vi.fn().mockResolvedValue({ items: [], total: 0, limit: 500, offset: 0 })
|
|
};
|
|
const workspace = await loadCanonicalProjectWorkspace(reader, model.project.id, [], ['gpo-slot']);
|
|
expect(reader.loadAssessmentModel).toHaveBeenCalledTimes(1);
|
|
expect(reader.loadAssessmentModel).toHaveBeenCalledWith('gpo-slot');
|
|
expect(workspace.assessmentIds).toEqual(['gpo-slot']);
|
|
expect(workspace.models).toEqual([model]);
|
|
expect(workspace.dataset).toBeNull();
|
|
expect(reader.queryUnifiedResults).toHaveBeenCalledWith(expect.objectContaining({ assessmentIds: ['gpo-slot'] }));
|
|
});
|
|
|
|
it('retains GPO results from an explicitly selected mixed timeslot when scanner runs live in another assessment', async () => {
|
|
const stamp = '2026-09-06T00:00:00Z';
|
|
const base: CanonicalAssessmentModel = {
|
|
schemaVersion: 1,
|
|
project: { id: 'synthetic-client', name: 'Synthetic', description: '', attributes: {}, createdAt: stamp, updatedAt: stamp },
|
|
assessment: { id: 'scanner-slot', projectId: 'synthetic-client', name: 'Scanner slot', createdAt: stamp, updatedAt: stamp },
|
|
scanRuns: [{ id: 'scanner-run', assessmentId: 'scanner-slot', sequence: 1, label: 'Synthetic scanner',
|
|
tool: { id: 'synthetic', name: 'Synthetic' }, importedAt: stamp }],
|
|
importFiles: [], sourceTables: [], findingDefinitions: [], findingOccurrences: [], evidence: [], reviews: [], diagnostics: []
|
|
};
|
|
const gpoModel = { ...base, assessment: { ...base.assessment, id: 'gpo-slot', name: 'GPO slot' }, scanRuns: [] };
|
|
const observation = {
|
|
sourceKind: 'policy-observation', sourceResultId: 'policy-one', resultProjectionId: 'policy-observation:policy-one',
|
|
projectId: base.project.id, assessmentId: 'gpo-slot', importArtifactId: 'gpo-artifact', title: 'Synthetic policy', importedAt: stamp,
|
|
policyScope: 'computer', policyDeliveryMechanism: 'registry-policy', policyState: 'configured', policyIdentityStatus: 'resolved',
|
|
policyIdentityKey: 'synthetic-policy', policyBackupInstanceId: 'backup-one', policyValues: [{ kind: 'registry-policy',
|
|
key: 'Software\\Policies\\Synthetic', valueName: 'Mode', operation: 'set-value', typeCode: 4,
|
|
data: { kind: 'uint32', value: 1 } }]
|
|
};
|
|
const secondObservation = { ...observation, sourceResultId: 'policy-two',
|
|
resultProjectionId: 'policy-observation:policy-two', policyBackupInstanceId: 'backup-two' };
|
|
const reader = {
|
|
listProjectAssessments: vi.fn().mockResolvedValue([base.assessment, gpoModel.assessment]),
|
|
loadAssessmentModel: vi.fn(async (id: string) => id === 'gpo-slot' ? gpoModel : base),
|
|
queryUnifiedResults: vi.fn().mockResolvedValue({ items: [observation, secondObservation], total: 2, limit: 500, offset: 0 }),
|
|
listPolicyEvaluations: vi.fn().mockResolvedValue({ records: [] })
|
|
};
|
|
|
|
const workspace = await loadCanonicalProjectWorkspace(reader, base.project.id, ['scanner-run'], ['scanner-slot', 'gpo-slot']);
|
|
|
|
expect(reader.queryUnifiedResults).toHaveBeenCalledWith(expect.objectContaining({
|
|
assessmentIds: ['scanner-slot', 'gpo-slot'], sourceKind: ['policy-observation']
|
|
}));
|
|
expect(workspace.assessmentIds).toEqual(['scanner-slot', 'gpo-slot']);
|
|
expect(workspace.dataset?.sheets[0].analysis.records.some(record =>
|
|
record.fields.some(field => field.label === 'Source: Scan' && field.value.startsWith('GPOs')))).toBe(true);
|
|
});
|
|
it('projects persisted PingCastle XML RiskRules instead of generic XML nodes', async () => {
|
|
const imported = await importFile(
|
|
new File([pingCastleXml], 'ad_hc_synthetic.example.xml', { type: 'application/xml' }),
|
|
{ profiles: importProfiles }
|
|
);
|
|
const preview = previewEntryFromDataset(imported, {
|
|
sha256: 'c'.repeat(64),
|
|
fileName: imported.fileName,
|
|
sizeBytes: pingCastleXml.length,
|
|
lastModified: 0
|
|
});
|
|
const entry = confirmEntryMappings(preview, importProfiles);
|
|
const model = createCanonicalImportBatch(
|
|
'pingcastle-workspace',
|
|
[entry],
|
|
'2026-07-22T12:00:00.000Z'
|
|
).model;
|
|
const reader = {
|
|
listProjectAssessments: vi.fn().mockResolvedValue([model.assessment]),
|
|
loadAssessmentModel: vi.fn().mockResolvedValue(model)
|
|
};
|
|
|
|
const workspace = await loadCanonicalProjectWorkspace(reader, model.project.id);
|
|
|
|
expect(reader.listProjectAssessments).toHaveBeenCalledWith(model.project.id);
|
|
expect(reader.loadAssessmentModel).toHaveBeenCalledWith(model.assessment.id);
|
|
expect(workspace.dataset?.profileId).toBe('pingcastle');
|
|
expect(workspace.dataset?.sheets[1].analysis.headers).toEqual(expect.arrayContaining(['Source Rule ID', 'Title', 'Status']));
|
|
expect(workspace.dataset?.sheets[1].analysis.headers).not.toContain('DomainSid');
|
|
expect(workspace.dataset?.sheets[1].analysis.records[0].title).toBe('Synthetic inactive privileged account');
|
|
expect(pingCastleProfile.defaults(workspace.dataset?.sheets[1]).titleColumn).toBe('Title');
|
|
});
|
|
|
|
it('opens a selected PingCastle HTML finding with the Result DB title from its paired XML report', async () => {
|
|
const imported = await importFile(
|
|
new File([pingCastleXml], 'ad_hc_synthetic.example.xml', { type: 'application/xml' }),
|
|
{ profiles: importProfiles }
|
|
);
|
|
const preview = previewEntryFromDataset(imported, {
|
|
sha256: 'd'.repeat(64), fileName: imported.fileName, sizeBytes: pingCastleXml.length, lastModified: 0
|
|
});
|
|
const source = createCanonicalImportBatch('pingcastle-paired-report', [
|
|
confirmEntryMappings(preview, importProfiles)
|
|
], '2026-09-23T12:00:00.000Z').model;
|
|
const resultTitle = 'The synthetic LAN Manager Authentication Level allows NTLMv1 or LM.';
|
|
const checkTitle = 'Ensure that synthetic NTLMv1 and LM protocols are banned';
|
|
const xml = structuredClone(source);
|
|
xml.assessment.id = 'assessment-xml';
|
|
xml.scanRuns[0].assessmentId = 'assessment-xml';
|
|
xml.findingDefinitions[0].title = resultTitle;
|
|
xml.findingOccurrences[0].sourceIdentity.originalRuleId = 'S-oldNtlm';
|
|
xml.findingOccurrences[0].sourceIdentity.canonicalRuleId = 'S-oldNtlm';
|
|
xml.findingOccurrences[0].sourceIdentity.originalTitle = resultTitle;
|
|
|
|
const html = structuredClone(xml);
|
|
html.assessment.id = 'assessment-html';
|
|
html.scanRuns[0].id = 'run-html';
|
|
html.scanRuns[0].assessmentId = 'assessment-html';
|
|
html.importFiles[0].id = 'file-html';
|
|
html.importFiles[0].scanRunId = 'run-html';
|
|
html.importFiles[0].fileName = 'ad_hc_synthetic.example.html';
|
|
html.importFiles[0].format = 'HTML';
|
|
html.findingDefinitions[0].title = checkTitle;
|
|
html.findingOccurrences[0].id = 'occurrence-html';
|
|
html.findingOccurrences[0].scanRunId = 'run-html';
|
|
html.findingOccurrences[0].importFileId = 'file-html';
|
|
html.findingOccurrences[0].sourceIdentity.originalTitle = checkTitle;
|
|
html.findingOccurrences[0].originalFields = [
|
|
{ key: 'risk-id', label: 'Rule ID', value: 'S-oldNtlm' },
|
|
{ key: 'title', label: 'Title', value: checkTitle },
|
|
{ key: 'description', label: 'Description', value: 'Synthetic scanner explanation.' }
|
|
];
|
|
|
|
const models = new Map([[html.assessment.id, html], [xml.assessment.id, xml]]);
|
|
const reader = {
|
|
listProjectAssessments: vi.fn().mockResolvedValue([html.assessment, xml.assessment]),
|
|
loadAssessmentModel: vi.fn(async (id: string) => models.get(id)!)
|
|
};
|
|
const workspace = await loadCanonicalProjectWorkspace(reader, html.project.id,
|
|
['run-html'], ['assessment-html', 'assessment-xml']);
|
|
const records = workspace.dataset?.sheets[0].analysis.records ?? [];
|
|
|
|
expect(workspace.models).toHaveLength(1);
|
|
expect(records).toHaveLength(1);
|
|
expect(records[0].title).toBe(resultTitle);
|
|
expect(records[0].fields.find(field => field.label === 'Source Rule ID')?.value).toBe('S-oldNtlm');
|
|
expect(records[0].fields.find(field => field.label === 'Native source heading')?.value).toBe(checkTitle);
|
|
expect(html.findingOccurrences[0].sourceIdentity.originalTitle).toBe(checkTitle);
|
|
});
|
|
});
|