498 lines
33 KiB
TypeScript
498 lines
33 KiB
TypeScript
import { describe, expect, it } from 'vitest';
|
|
import { buildPolicyEvaluation } from '../../server/gpo/gpo-policy-evaluation-service';
|
|
import { buildPolicyFindingRun } from '../../server/gpo/gpo-policy-finding-service';
|
|
import type { MicrosoftSecurityBaselineRecord } from '../../src/domain/microsoft-security-baseline';
|
|
import type { StoredMicrosoftSecurityBaselineAnalysis } from '../../src/domain/microsoft-security-baseline-analysis';
|
|
import type { GpoPolicyValue, GpoRegistryPolicyValue } from '../../src/domain/gpo-policy';
|
|
import type { GpoTechnicalPolicyIdentity } from '../../src/domain/gpo-policy-identity';
|
|
import type { EnvironmentProfile, StoredPolicySnapshotAggregation } from '../../src/domain/gpo-snapshot-aggregation';
|
|
import type { PolicyEvaluationRuleCatalog } from '../../src/domain/policy-evaluation-rules';
|
|
import { storedPolicyEvaluationValidationErrors, type StoredPolicyEvaluation } from '../../src/domain/policy-evaluation';
|
|
import { createPolicyEvaluationUnifiedResult, type UnifiedResultProjection, selectCurrentPolicyEvaluations } from '../../src/domain/unified-result';
|
|
import { appendPolicyObservationsToDataset } from '../../src/features/project-import/policy-observations-to-dataset';
|
|
import { buildPolicyGuidance } from '../../src/profiles/group-policy/guidance';
|
|
import { filterAndSortRecords } from '../../src/features/search-filter/filter-records';
|
|
import { policyComparisonDisposition } from '../../src/domain/policy-comparison-disposition';
|
|
import { selectWorkFacets } from '../../src/features/search-filter/work-facets';
|
|
import { genericProfile } from '../../src/profiles/generic/generic-profile';
|
|
import { createElement } from 'react';
|
|
import { renderToStaticMarkup } from 'react-dom/server';
|
|
import { ResultRow } from '../../src/features/results-browser/ResultsBrowser';
|
|
|
|
const timestamp = '2026-09-06T10:00:00.000Z';
|
|
const projectId = 'synthetic-policy-project';
|
|
const identity: GpoTechnicalPolicyIdentity = {
|
|
version: 1, id: 'gpo-policy-identity-' + '1'.repeat(32),
|
|
resolver: { id: 'gpo-technical-registry-target', version: '1.0.0' }, scope: 'computer',
|
|
target: { kind: 'registry-value', hive: 'HKEY_LOCAL_MACHINE', key: 'Software\\Policies\\Synthetic', valueName: 'Mode' },
|
|
admx: { status: 'not-found' }
|
|
};
|
|
const profile: EnvironmentProfile = {
|
|
version: 1, id: 'synthetic-profile', projectId, name: 'Synthetic', revision: 1,
|
|
contexts: [{ version: 1, id: 'all', kind: 'operating-system', productFamily: 'Group Policy',
|
|
productVersion: 'All imported baselines', role: 'Any', scope: 'mixed' }], createdAt: timestamp
|
|
};
|
|
const ruleCatalog: PolicyEvaluationRuleCatalog = {
|
|
version: 1, id: 'synthetic-empty-catalog',
|
|
catalog: { id: 'policy-evaluation-rule-catalog', version: '1.0.0' }, status: 'released', rules: []
|
|
};
|
|
|
|
function value(number: number): GpoRegistryPolicyValue {
|
|
return { kind: 'registry-policy', operation: 'set-value', key: 'Software\\Policies\\Synthetic',
|
|
valueName: 'Mode', typeCode: 4, data: { kind: 'uint32', value: number } };
|
|
}
|
|
|
|
function aggregation(actual?: number, options: { partial?: boolean; conflicted?: boolean; unresolvedMember?: boolean } = {}): StoredPolicySnapshotAggregation {
|
|
const configuredValues: GpoPolicyValue[] = actual === undefined ? []
|
|
: options.conflicted ? [value(actual), value(actual + 1)] : [value(actual)];
|
|
if (options.unresolvedMember) configuredValues.push({ kind: 'service-preference', serviceName: 'Synthetic',
|
|
serviceAction: 'start', startupType: 'automatic', passwordAttributePresent: false });
|
|
const states = actual === undefined ? [] : [{
|
|
version: 1 as const, id: 'synthetic-state', aggregationRunId: 'synthetic-aggregation', identity,
|
|
deliveryMechanism: 'registry-policy' as const, status: options.conflicted ? 'conflicted' as const : 'configured' as const,
|
|
values: configuredValues,
|
|
observationIds: ['synthetic-observation'], backupInstanceIds: ['synthetic-backup'], applicableContextIds: ['all'],
|
|
ordering: options.conflicted ? 'cross-gpo-conflict' as const : 'single-gpo' as const,
|
|
targeting: 'none' as const, completeness: 'complete' as const, effectiveState: 'unknown' as const, diagnosticCodes: []
|
|
}];
|
|
return {
|
|
version: 1,
|
|
run: { version: 1, id: 'synthetic-aggregation', projectId, environmentProfileId: profile.id,
|
|
sourceAnalysisRunIds: ['synthetic-analysis'], snapshotId: 'synthetic-snapshot',
|
|
aggregator: { id: 'gpo-policy-snapshot-aggregation', version: '1.1.0' },
|
|
status: options.partial ? 'partial' : 'complete', stateCount: states.length,
|
|
conflictCount: options.conflicted ? 1 : 0, unresolvedIdentityCount: 0, reviewHintCount: 0,
|
|
permitsFindingGeneration: false, diagnosticCodes: options.partial ? ['policy-aggregation-snapshot-incomplete'] : [],
|
|
startedAt: timestamp, completedAt: timestamp },
|
|
snapshot: { version: 1, id: 'synthetic-snapshot', projectId,
|
|
domain: { status: 'resolved', key: 'synthetic.example', evidence: 'backup-metadata' },
|
|
backupSetId: 'synthetic-set', instanceIds: ['synthetic-backup'], status: 'consistent',
|
|
completeness: options.partial ? 'selected-subset' : 'complete', permitsSetAbsenceConclusions: !options.partial,
|
|
diagnosticCodes: [], createdAt: timestamp },
|
|
states,
|
|
reviewHints: []
|
|
};
|
|
}
|
|
|
|
function baseline(name: string, recommended: number): {
|
|
record: MicrosoftSecurityBaselineRecord;
|
|
analysis: StoredMicrosoftSecurityBaselineAnalysis;
|
|
} {
|
|
const baselineId = `baseline-${name}`;
|
|
const analysisId = `baseline-analysis-${name}`;
|
|
const sha256 = name.padEnd(64, 'a').slice(0, 64).replace(/[^a-f0-9]/g, 'a');
|
|
return {
|
|
record: { version: 1, id: baselineId, fileName: `${name}.zip`, sha256, sizeBytes: 100,
|
|
storageKey: `baseline/${name}`, importedAt: timestamp, status: 'eligible',
|
|
metadata: { roles: ['Any'], scopes: ['mixed'], source: 'confirmed' } },
|
|
analysis: { version: 1, analysis: { version: 1, id: analysisId, baselineId, packageSha256: sha256,
|
|
analyzer: { id: 'microsoft-baseline-gpo-settings', version: '1.1.0' }, analyzedAt: timestamp,
|
|
status: 'complete', admxCatalog: { version: 1, id: `catalog-${name}`,
|
|
parser: { id: 'admx-policy-metadata-catalog', version: '1.0.0' },
|
|
source: { kind: 'microsoft-security-baseline', baselineId, packageSha256: sha256 },
|
|
status: 'complete', policies: [], languageResources: [], diagnosticCodes: [] },
|
|
backupCount: 1, registryPolicyFileCount: 1, settings: [{ version: 1, id: `setting-${name}`,
|
|
baselineId, backupId: `backup-${name}`, observation: { sourcePath: 'synthetic/Registry.pol',
|
|
sourceSha256: 'b'.repeat(64), scope: 'computer', deliveryMechanism: 'registry-policy',
|
|
parser: { id: 'registry-policy-preg', version: '1.0.0' },
|
|
reducer: { id: 'registry-policy-reducer', version: '1.0.0' }, state: 'instruction',
|
|
values: [value(recommended)], registryPolicy: { sequence: 0, operation: 'set-value' },
|
|
effectiveState: 'unknown', diagnosticCodes: [] },
|
|
identity: { version: 1, status: 'resolved', identity } }], diagnosticCodes: [] } }
|
|
};
|
|
}
|
|
|
|
function evaluate(actual: number | undefined, sources = [baseline('primary', 1)], options: {
|
|
partial?: boolean; conflicted?: boolean; unresolvedMember?: boolean
|
|
} = {}) {
|
|
return buildPolicyEvaluation({ profile, aggregation: aggregation(actual, options),
|
|
baselineRecords: sources.map(source => source.record), baselineAnalyses: sources.map(source => source.analysis),
|
|
ruleCatalog, startedAt: timestamp, completedAt: timestamp });
|
|
}
|
|
|
|
describe('baseline-driven policy evaluation', () => {
|
|
function templates() {
|
|
const source = baseline('roles', 1);
|
|
const original = source.analysis.analysis.settings[0];
|
|
source.analysis.analysis.settings = ['Client', 'Member Server', 'Domain Controller'].map((role, index) => ({
|
|
...structuredClone(original), id: `role-setting-${index}`, backupId: `role-backup-${index}`,
|
|
observation: { ...structuredClone(original.observation), values: [value(index === 2 ? 1 : 0)] },
|
|
template: { names: [{ value: `Synthetic ${role}`, sourcePath: `Synthetic/${index}/Backup.xml`, sourceSha256: 'a'.repeat(64) }],
|
|
context: { productFamily: index === 0 ? 'Windows 10' : 'Windows Server', productVersion: index === 0 ? '1607' : '2016',
|
|
role: role as 'Client' | 'Member Server' | 'Domain Controller' } }
|
|
}));
|
|
return source;
|
|
}
|
|
function evaluateTemplates(source = templates(), target?: Partial<EnvironmentProfile['contexts'][number]>) {
|
|
const selectedProfile = target ? { ...profile, contexts: [{ ...profile.contexts[0], productFamily: 'Windows Server',
|
|
productVersion: '2016', role: 'Domain Controller', ...target }] } : profile;
|
|
return buildPolicyEvaluation({ profile: selectedProfile, aggregation: aggregation(1),
|
|
baselineRecords: [source.record], baselineAnalyses: [source.analysis], ruleCatalog,
|
|
startedAt: timestamp, completedAt: timestamp });
|
|
}
|
|
it('selects only the explicit comparison role and retains all candidate evidence', () => {
|
|
const source = templates();
|
|
const before = JSON.stringify(source);
|
|
const output = evaluateTemplates(source, {});
|
|
expect(output.results[0]).toMatchObject({ classification: 'configured_match', baselineSettingIds: ['role-setting-2'],
|
|
baselineTemplateSelection: { status: 'selected', candidateSettingIds: ['role-setting-0', 'role-setting-1', 'role-setting-2'] } });
|
|
expect(output.results[0].diagnosticCodes).not.toContain('policy-evaluation-baseline-consensus-conflict');
|
|
expect(output.evidence.filter(item => item.kind === 'baseline-setting')).toHaveLength(3);
|
|
expect(JSON.stringify(source)).toBe(before);
|
|
expect(evaluateTemplates(source, { role: 'Member Server' }).results[0].classification).toBe('confirmed_configured_deviation');
|
|
});
|
|
it('does not use observed inventory or a generic profile to choose the matching variant', () => {
|
|
for (const output of [evaluateTemplates(), evaluateTemplates(templates(), { sourceObservationIds: ['synthetic-os'] })]) {
|
|
expect(output.results[0].classification).toBe('review_required');
|
|
expect(output.results[0].diagnosticCodes).toContain('policy-evaluation-template-context-required');
|
|
expect(output.results[0].baselineSettingIds).toHaveLength(3);
|
|
}
|
|
});
|
|
it('keeps unanimous values comparable without a target-role decision', () => {
|
|
const source = templates();
|
|
source.analysis.analysis.settings.forEach(item => { item.observation.values = [value(1)]; });
|
|
expect(evaluateTemplates(source).results[0].classification).toBe('configured_match');
|
|
});
|
|
it('does not ignore unknown templates or conflicting values in the selected role', () => {
|
|
const unknown = templates();
|
|
unknown.analysis.analysis.settings[0].template = undefined;
|
|
expect(evaluateTemplates(unknown, {}).results[0].classification).toBe('review_required');
|
|
const conflict = templates();
|
|
const copy = structuredClone(conflict.analysis.analysis.settings[2]);
|
|
copy.id = 'role-setting-other'; copy.observation.values = [value(0)];
|
|
conflict.analysis.analysis.settings.push(copy);
|
|
expect(evaluateTemplates(conflict, {}).results[0]).toMatchObject({ classification: 'review_required',
|
|
baselineVariantAssessment: { decision: 'unavailable', diagnosticCodes: ['policy-evaluation-template-values-ambiguous'] } });
|
|
expect(evaluateTemplates(conflict, {}).results[0].diagnosticCodes).not.toContain('policy-evaluation-baseline-consensus-conflict');
|
|
expect(evaluate(2, [conflict]).results[0].classification).toBe('review_required');
|
|
});
|
|
it('does not produce Pass or Fail for a mismatching OS version', () => {
|
|
expect(evaluateTemplates(templates(), { productVersion: '2025' }).results[0]).toMatchObject({
|
|
classification: 'review_required', baselineTemplateSelection: { status: 'no-match' }
|
|
});
|
|
});
|
|
it('reports exact values as Passed and different values as deviations', () => {
|
|
expect(evaluate(1)).toMatchObject({ run: { status: 'complete', matchCount: 1, deviationCount: 0 },
|
|
results: [{ customerState: 'configured', classification: 'configured_match',
|
|
comparator: { relation: 'match' }, findingEligibility: 'ineligible' }] });
|
|
expect(evaluate(2)).toMatchObject({ run: { status: 'complete', matchCount: 0, deviationCount: 1 },
|
|
results: [{ customerState: 'configured', classification: 'confirmed_configured_deviation',
|
|
comparator: { relation: 'different' }, findingEligibility: 'ineligible' }] });
|
|
});
|
|
|
|
it('evaluates Registry.pol absence, key-presence and empty-text requirements in Work', () => {
|
|
const operation = (kind: 'delete-value' | 'delete-all-values' | 'create-key'): GpoRegistryPolicyValue => ({
|
|
kind: 'registry-policy', operation: kind, key: 'Software\\Policies\\Synthetic',
|
|
...(kind === 'delete-value' ? { valueName: 'Mode' } : {}),
|
|
...(kind === 'create-key' ? { typeCode: 0 as const, data: { kind: 'none' as const } } : {})
|
|
});
|
|
const assess = (expected: GpoRegistryPolicyValue, actual?: GpoRegistryPolicyValue) => {
|
|
const source = baseline(`operation-${expected.operation}-${actual?.operation ?? 'missing'}`, 1);
|
|
source.analysis.analysis.settings[0].observation.values = [expected];
|
|
const customer = actual ? aggregation(1) : aggregation(undefined);
|
|
if (actual) customer.states[0].values = [actual];
|
|
return buildPolicyEvaluation({ profile, aggregation: customer, baselineRecords: [source.record],
|
|
baselineAnalyses: [source.analysis], ruleCatalog, startedAt: timestamp, completedAt: timestamp });
|
|
};
|
|
const workStatus = (evaluation: StoredPolicyEvaluation) => {
|
|
const sheet = appendPolicyObservationsToDataset(null, 'Synthetic', [], [evaluation], new Map())!.sheets[0];
|
|
return sheet.rows[1][sheet.rows[0].indexOf('Status')];
|
|
};
|
|
|
|
for (const expected of [operation('delete-value'), operation('delete-all-values')]) {
|
|
const evaluation = assess(expected);
|
|
const absent = evaluation.results[0];
|
|
expect(absent).toMatchObject({ customerState: 'missing', classification: 'configured_match',
|
|
baselineState: 'explicit-recommendation', baselineVariantAssessment: { decision: 'all-pass' },
|
|
comparator: { relation: 'match', actual: { kind: 'registry-state', state: 'absent' } } });
|
|
expect(storedPolicyEvaluationValidationErrors(assess(expected))).toEqual([]);
|
|
expect(workStatus(evaluation)).toBe('Pass');
|
|
}
|
|
|
|
const missingKeyEvaluation = assess(operation('create-key'));
|
|
const missingKey = missingKeyEvaluation.results[0];
|
|
expect(missingKey).toMatchObject({ customerState: 'missing', classification: 'confirmed_configured_deviation',
|
|
baselineVariantAssessment: { decision: 'all-fail' } });
|
|
expect(policyComparisonDisposition(missingKey)).toBe('misconfigured');
|
|
expect(workStatus(missingKeyEvaluation)).toBe('Fail');
|
|
expect(assess(operation('create-key'), operation('create-key')).results[0]).toMatchObject({
|
|
customerState: 'configured', classification: 'configured_match', baselineVariantAssessment: { decision: 'all-pass' }
|
|
});
|
|
expect(assess(operation('delete-value'), value(1)).results[0]).toMatchObject({
|
|
classification: 'confirmed_configured_deviation', baselineVariantAssessment: { decision: 'all-fail' }
|
|
});
|
|
|
|
const assessKeyWithConfiguredChild = (expected: GpoRegistryPolicyValue) => {
|
|
const source = baseline(`key-child-${expected.operation}`, 1);
|
|
const keyIdentity: GpoTechnicalPolicyIdentity = { ...identity,
|
|
id: 'gpo-policy-identity-' + '2'.repeat(32),
|
|
target: { kind: 'registry-key', hive: 'HKEY_LOCAL_MACHINE', key: 'Software\\Policies\\Synthetic' } };
|
|
source.analysis.analysis.settings[0].identity = { version: 1, status: 'resolved', identity: keyIdentity };
|
|
source.analysis.analysis.settings[0].observation.values = [expected];
|
|
return buildPolicyEvaluation({ profile, aggregation: aggregation(1), baselineRecords: [source.record],
|
|
baselineAnalyses: [source.analysis], ruleCatalog, startedAt: timestamp, completedAt: timestamp });
|
|
};
|
|
expect(assessKeyWithConfiguredChild(operation('delete-all-values')).results[0]).toMatchObject({
|
|
customerState: 'configured', classification: 'confirmed_configured_deviation', observationIds: ['synthetic-observation'],
|
|
aggregationStateId: undefined, aggregationStateIds: ['synthetic-state'],
|
|
comparator: { actual: { kind: 'registry-state', state: 'key-present' },
|
|
baseline: { kind: 'registry-state', state: 'key-empty' } }
|
|
});
|
|
expect(assessKeyWithConfiguredChild(operation('create-key')).results[0]).toMatchObject({
|
|
customerState: 'configured', classification: 'configured_match', observationIds: ['synthetic-observation'],
|
|
comparator: { actual: { kind: 'registry-state', state: 'key-present' },
|
|
baseline: { kind: 'registry-state', state: 'key-present' } }
|
|
});
|
|
|
|
const empty = { kind: 'registry-policy', operation: 'set-value', key: 'Software\\Policies\\Synthetic',
|
|
valueName: 'Mode', typeCode: 2, data: { kind: 'string', value: '' } } as const;
|
|
expect(assess(empty, empty).results[0]).toMatchObject({
|
|
classification: 'configured_match', baselineVariantAssessment: { decision: 'all-pass' }
|
|
});
|
|
const missingEmptyEvaluation = assess(empty);
|
|
const missingEmpty = missingEmptyEvaluation.results[0];
|
|
expect(missingEmpty).toMatchObject({ classification: 'confirmed_configured_deviation',
|
|
baselineVariantAssessment: { decision: 'all-fail' }, comparator: { baseline: { kind: 'text', value: '' } } });
|
|
expect(policyComparisonDisposition(missingEmpty)).toBe('misconfigured');
|
|
expect(workStatus(missingEmptyEvaluation)).toBe('Fail');
|
|
expect(buildPolicyGuidance([missingEmptyEvaluation]).get(missingEmpty.id)?.remediation).toContain('Expected: Empty string');
|
|
});
|
|
|
|
it('creates a deviation when a recommended setting is missing from the customer backup', () => {
|
|
expect(evaluate(undefined)).toMatchObject({ run: { status: 'complete', deviationCount: 1 }, results: [{
|
|
aggregationStateId: undefined, customerState: 'missing', observationIds: [],
|
|
classification: 'confirmed_configured_deviation', comparator: { relation: 'different' }
|
|
}] });
|
|
});
|
|
|
|
it('does not emit actual-only settings without a baseline recommendation', () => {
|
|
const source = baseline('empty', 1);
|
|
source.analysis.analysis.settings = [];
|
|
expect(evaluate(2, [source])).toMatchObject({ run: { resultCount: 0, matchCount: 0, deviationCount: 0 }, results: [] });
|
|
});
|
|
|
|
it('does not emit PASS or FAIL for a structurally present baseline row without a Microsoft value', () => {
|
|
const source = baseline('blank', 1);
|
|
source.analysis.analysis.settings[0].observation.values = [];
|
|
expect(evaluate(undefined, [source])).toMatchObject({
|
|
run: { resultCount: 0, matchCount: 0, deviationCount: 0, reviewCount: 0 },
|
|
results: []
|
|
});
|
|
});
|
|
|
|
it('keeps an unsupported baseline value out of PASS and FAIL', () => {
|
|
const source = baseline('unsupported', 1);
|
|
source.analysis.analysis.settings[0].observation.values = [{
|
|
kind: 'service-preference', serviceName: 'Synthetic', serviceAction: 'start',
|
|
startupType: 'automatic', passwordAttributePresent: false
|
|
}];
|
|
expect(evaluate(undefined, [source])).toMatchObject({
|
|
run: { deviationCount: 0, matchCount: 0, reviewCount: 1 },
|
|
results: [{ classification: 'review_required', baselineState: 'unsupported-setting' }]
|
|
});
|
|
});
|
|
|
|
it('compares every baseline independently', () => {
|
|
const record = evaluate(1, [baseline('one', 1), baseline('two', 2)]);
|
|
expect(record.run).toMatchObject({ resultCount: 2, matchCount: 1, deviationCount: 1, reviewCount: 0 });
|
|
expect(new Set(record.results.map(result => result.baselineAnalysisId))).toEqual(
|
|
new Set(['baseline-analysis-one', 'baseline-analysis-two'])
|
|
);
|
|
});
|
|
|
|
it('keeps configured comparison usable for a selected-subset backup', () => {
|
|
expect(evaluate(2, undefined, { partial: true })).toMatchObject({
|
|
run: { status: 'complete', deviationCount: 1, reviewCount: 0 },
|
|
results: [{ classification: 'confirmed_configured_deviation' }]
|
|
});
|
|
});
|
|
|
|
it('rolls a proven failing member up to Fail while retaining the customer conflict', () => {
|
|
expect(evaluate(1, undefined, { conflicted: true })).toMatchObject({
|
|
run: { status: 'complete', deviationCount: 1, reviewCount: 0 }, results: [{ customerState: 'conflicted',
|
|
classification: 'confirmed_configured_deviation', comparator: { relation: 'different' },
|
|
baselineVariantAssessment: { decision: 'all-fail', actualValues: [value(1), value(2)] },
|
|
diagnosticCodes: expect.arrayContaining(['policy-evaluation-customer-conflict']) }]
|
|
});
|
|
expect(evaluate(1, undefined, { conflicted: true, unresolvedMember: true })).toMatchObject({
|
|
run: { deviationCount: 1, reviewCount: 0 }, results: [{ baselineState: 'explicit-recommendation',
|
|
classification: 'confirmed_configured_deviation', baselineVariantAssessment: { decision: 'all-fail' } }]
|
|
});
|
|
});
|
|
|
|
it('does not manufacture security findings from neutral comparison rows', () => {
|
|
const evaluation = evaluate(2);
|
|
const findings = buildPolicyFindingRun({ evaluation, aggregation: aggregation(2), profile,
|
|
startedAt: timestamp, completedAt: timestamp });
|
|
expect(findings).toMatchObject({ run: { status: 'complete', eligibleResultCount: 0, findingCount: 0 },
|
|
definitions: [], occurrences: [], rejections: [] });
|
|
});
|
|
|
|
it('fails every differing variant without inventory, stores individual evidence and never merges recommendations', () => {
|
|
const source = templates();
|
|
const before = JSON.stringify(source);
|
|
const output = evaluate(2, [source]);
|
|
const result = output.results[0];
|
|
expect(output.run).toMatchObject({ evaluator: { version: '1.9.0' }, deviationCount: 1, reviewCount: 0 });
|
|
expect(result).toMatchObject({ classification: 'confirmed_configured_deviation', effectiveState: 'unknown',
|
|
baselineTemplateSelection: { status: 'unresolved' }, comparator: { relation: 'different', baseline: undefined },
|
|
baselineVariantAssessment: { version: 1, scope: 'backup-configuration', decision: 'all-fail',
|
|
variants: [0, 0, 1].map((number, index) => ({ settingId: `role-setting-${index}`,
|
|
baselineValues: [value(number)], comparator: { baseline: { kind: 'integer', value: String(number) }, relation: 'different' } })) } });
|
|
expect(result.diagnosticCodes).not.toContain('policy-evaluation-template-context-required');
|
|
expect(result.diagnosticCodes).not.toContain('policy-evaluation-baseline-consensus-conflict');
|
|
expect(JSON.stringify(source)).toBe(before);
|
|
expect(storedPolicyEvaluationValidationErrors(JSON.parse(JSON.stringify(output)))).toEqual([]);
|
|
const invalid = structuredClone(output);
|
|
invalid.results[0].baselineVariantAssessment!.variants[0].comparator.relation = 'match';
|
|
expect(storedPolicyEvaluationValidationErrors(invalid)).not.toEqual([]);
|
|
});
|
|
|
|
it('does not lose missing, unsupported or ambiguous variants to manufacture unanimity', () => {
|
|
for (const values of [[], [value(0), value(1)], [{ kind: 'service-preference' as const, serviceName: 'Synthetic',
|
|
serviceAction: 'start' as const, startupType: 'automatic' as const, passwordAttributePresent: false }]]) {
|
|
const source = templates();
|
|
source.analysis.analysis.settings[0].observation.values = values;
|
|
const output = evaluate(2, [source]);
|
|
expect(output.results[0]).toMatchObject({ classification: 'review_required',
|
|
baselineVariantAssessment: { decision: 'unavailable' } });
|
|
expect(output.results[0].baselineVariantAssessment?.variants).toHaveLength(3);
|
|
}
|
|
});
|
|
|
|
it('shows absence in the analyzed backup scope as Not configured while retaining its scope limit', () => {
|
|
expect(evaluate(undefined, [templates()], { partial: true }).results[0]).toMatchObject({
|
|
customerState: 'missing', classification: 'confirmed_configured_deviation',
|
|
baselineVariantAssessment: { decision: 'all-fail', diagnosticCodes: [] },
|
|
diagnosticCodes: expect.arrayContaining(['policy-evaluation-customer-absence-scope-limited']) });
|
|
const source = templates();
|
|
source.analysis.analysis.status = 'partial';
|
|
expect(evaluate(2, [source]).results[0]).toMatchObject({ classification: 'review_required',
|
|
baselineVariantAssessment: { decision: 'unavailable' } });
|
|
source.analysis.analysis.diagnosticCodes = ['microsoft-baseline-admx-metadata-not-found', 'gpo-metadata-domain-missing',
|
|
'gpo-metadata-backup-time-missing', 'gpo-metadata-backup-time-zone-missing'];
|
|
source.analysis.analysis.admxCatalog.status = 'partial';
|
|
expect(evaluate(2, [source]).results[0]).toMatchObject({ classification: 'confirmed_configured_deviation',
|
|
baselineVariantAssessment: { decision: 'all-fail' } });
|
|
source.analysis.analysis.diagnosticCodes.push('gpo-metadata-field-shape-invalid');
|
|
expect(evaluate(2, [source]).results[0].classification).toBe('review_required');
|
|
expect(evaluate(undefined, [templates()]).results[0]).toMatchObject({ customerState: 'missing',
|
|
classification: 'confirmed_configured_deviation', baselineVariantAssessment: { decision: 'all-fail' } });
|
|
});
|
|
|
|
it('keeps a resolved registry comparison usable when only unrelated baseline sections are partial', () => {
|
|
const source = baseline('partial-unrelated-sections', 1);
|
|
source.analysis.analysis.status = 'partial';
|
|
source.analysis.analysis.diagnosticCodes = [
|
|
'gpo-metadata-backup-id-missing',
|
|
'gpo-security-template-entry-invalid',
|
|
'gpo-security-template-section-unsupported'
|
|
];
|
|
expect(evaluate(1, [source]).results[0]).toMatchObject({
|
|
classification: 'configured_match',
|
|
baselineVariantAssessment: { decision: 'all-pass', diagnosticCodes: [] }
|
|
});
|
|
expect(evaluate(2, [source]).results[0]).toMatchObject({
|
|
classification: 'confirmed_configured_deviation',
|
|
baselineVariantAssessment: { decision: 'all-fail', diagnosticCodes: [] }
|
|
});
|
|
});
|
|
|
|
it('treats account lists as independent exact sets, never as a union baseline', () => {
|
|
const source = templates();
|
|
const principal = (principals: string[]) => ({ kind: 'principal-set' as const, principals });
|
|
source.analysis.analysis.settings = source.analysis.analysis.settings.slice(0, 2);
|
|
source.analysis.analysis.settings.forEach((setting, index) => {
|
|
setting.observation.values = [principal(index ? ['*S-1-5-32-544', '*S-1-5-9'] : ['*S-1-5-32-544'])];
|
|
});
|
|
const check = (principals: string[]) => {
|
|
const customer = aggregation(1);
|
|
customer.states[0].values = [principal(principals)];
|
|
return buildPolicyEvaluation({ profile, aggregation: customer, baselineRecords: [source.record],
|
|
baselineAnalyses: [source.analysis], ruleCatalog, startedAt: timestamp, completedAt: timestamp });
|
|
};
|
|
expect(check(['*S-1-5-32-544', '*S-1-5-9', '*S-1-1-0']).results[0].baselineVariantAssessment?.decision).toBe('all-fail');
|
|
expect(check(['*S-1-5-9', '*S-1-5-32-544']).results[0].baselineVariantAssessment?.decision).toBe('mixed');
|
|
// Inside the union but equal to neither required set: still Fail for exact comparison.
|
|
expect(check(['*S-1-5-9']).results[0].baselineVariantAssessment?.decision).toBe('all-fail');
|
|
source.analysis.analysis.settings[0].observation.values = [principal(['*S-1-5-32-544', '*S-1-5-9'])];
|
|
expect(check(['*S-1-5-9', '*S-1-5-32-544']).results[0].baselineVariantAssessment?.decision).toBe('all-pass');
|
|
});
|
|
|
|
it('does not treat identical numeric payloads with different registry types as Passed', () => {
|
|
const source = baseline('qword', 1);
|
|
source.analysis.analysis.settings[0].observation.values = [{ ...value(1), typeCode: 11, data: { kind: 'uint64', value: '1' } }];
|
|
expect(evaluate(1, [source]).results[0].baselineVariantAssessment?.decision).toBe('all-fail');
|
|
});
|
|
|
|
it('projects current variant judgments consistently into Work filters, details and Result DB after serialization', () => {
|
|
for (const [actual, expected, decision, filter] of [
|
|
[2, 'Fail', 'all-fail', 'deviation'], [1, 'Review required', 'mixed', 'all'],
|
|
[undefined, 'Not configured', 'all-fail', 'not-configured'], [1, 'Pass', 'all-pass', 'passed']
|
|
] as const) {
|
|
const source = templates();
|
|
if (expected === 'Pass') source.analysis.analysis.settings.forEach(setting => { setting.observation.values = [value(1)]; });
|
|
const saved = JSON.parse(JSON.stringify(evaluate(actual, [source]))) as ReturnType<typeof evaluate>;
|
|
const observations = actual === undefined ? [] : [{ sourceKind: 'policy-observation', sourceResultId: 'synthetic-observation',
|
|
projectId, assessmentId: 'synthetic-slot', title: 'Mode', importedAt: timestamp, policyScope: 'computer',
|
|
policyDeliveryMechanism: 'registry-policy', policyIdentityStatus: 'resolved', policyIdentityKey: identity.id,
|
|
policyValues: [value(actual)], policyBackupInstanceId: 'synthetic-backup' } as unknown as UnifiedResultProjection];
|
|
const guidance = buildPolicyGuidance([saved], [source.analysis]);
|
|
const dataset = appendPolicyObservationsToDataset(null, 'Synthetic', observations, [saved], guidance)!;
|
|
const sheet = dataset.sheets[0];
|
|
const fields = Object.fromEntries(sheet.rows[0].map((header, index) => [header, sheet.rows[1][index]]));
|
|
expect(fields.Status).toBe(expected);
|
|
expect(fields.Comparison).toContain(decision === 'mixed' ? 'Review required' : 'every assessed baseline variant');
|
|
expect(fields.Description).toContain('not effective device security');
|
|
expect(fields.Description.match(/Value comparison:/g)).toHaveLength(3);
|
|
expect(fields.Conflict).toBe('');
|
|
const matching = (status: string) => filterAndSortRecords(sheet, { activeProfile: genericProfile, dataset,
|
|
reviews: {}, search: '', statusFilter: status, sortColumn: '', sortDirection: 'asc', actionOnly: false });
|
|
expect(matching(filter)).toHaveLength(1);
|
|
expect(matching('conflicts')).toHaveLength(0);
|
|
if (expected !== 'Fail') expect(matching('deviation')).toHaveLength(0);
|
|
const facets = selectWorkFacets(sheet, { activeProfile: genericProfile, dataset, reviews: {}, statusFilter: 'all',
|
|
facetFilters: {}, search: '', actionOnly: false });
|
|
expect(facets[0].values.map(item => item.label)).toEqual(['Deviation', 'Passed', 'Not configured', 'No baseline rule', 'Not comparable', 'Conflicts', 'Duplicates']);
|
|
const unified = createPolicyEvaluationUnifiedResult(saved.run, saved.results[0]);
|
|
expect(unified).toMatchObject({
|
|
outcomeNormalized: expected === 'Fail' ? 'fail' : expected === 'Pass' ? 'pass' : expected === 'Not configured' ? 'informational' : 'warning',
|
|
policyClassification: expected === 'Fail' ? 'misconfigured' : expected === 'Pass' ? 'match' : expected === 'Not configured' ? 'not-configured' : 'review-required',
|
|
policyBaselineVariantAssessment: saved.results[0].baselineVariantAssessment
|
|
});
|
|
const html = renderToStaticMarkup(createElement(ResultRow, { item: unified, expanded: true, onToggle() {} }));
|
|
expect(html).toContain('Setting reference:');
|
|
expect(html).toContain('No effective device state');
|
|
expect(html).toContain('Configured Group Policy value compared with the retained baseline recommendation.');
|
|
// The saved per-variant values and verdicts remain available consistently in Work guidance
|
|
// and in the Result DB comparison without claiming effective endpoint state.
|
|
expect(buildPolicyGuidance([saved]).get(saved.results[0].id)?.description).toContain('Value comparison:');
|
|
}
|
|
});
|
|
|
|
it('keeps a setting absent from a selected backup scope filterable as Not configured', () => {
|
|
const source = templates();
|
|
const saved = evaluate(undefined, [source], { partial: true });
|
|
const dataset = appendPolicyObservationsToDataset(null, 'Synthetic', [], [saved], buildPolicyGuidance([saved], [source.analysis]))!;
|
|
const record = dataset.sheets[0].analysis.records[0];
|
|
expect(record.fields.find(field => field.label === 'Status')?.value).toBe('Not configured');
|
|
expect(record.fields.find(field => field.label === 'Diagnostics')?.value)
|
|
.toContain('policy-evaluation-customer-absence-scope-limited');
|
|
expect(genericProfile.matchesStatus(record, 'not-configured')).toBe(true);
|
|
expect(genericProfile.matchesStatus(record, 'deviation')).toBe(false);
|
|
});
|
|
|
|
it('keeps both previous engine versions read-only and prioritizes the new evaluation', () => {
|
|
const current = evaluate(2, [templates()]);
|
|
const older = structuredClone(current);
|
|
older.run.evaluator.version = '1.3.3'; older.run.id = 'older';
|
|
const previous = structuredClone(current);
|
|
previous.run.evaluator.version = '1.4.0'; previous.run.id = 'previous';
|
|
const history = JSON.stringify([previous, older]);
|
|
expect(selectCurrentPolicyEvaluations([previous, older])).toEqual([]);
|
|
expect(selectCurrentPolicyEvaluations([previous, older], { allowPreviousVersionForDisplay: true })).toEqual([previous]);
|
|
expect(selectCurrentPolicyEvaluations([previous, current, older], { allowPreviousVersionForDisplay: true })).toEqual([current]);
|
|
expect(JSON.stringify([previous, older])).toBe(history);
|
|
});
|
|
});
|