111 lines
6.1 KiB
TypeScript
111 lines
6.1 KiB
TypeScript
import { describe, expect, it } from 'vitest';
|
|
import type { UnifiedResultProjection } from '../../src/domain/unified-result';
|
|
import { resultsToPrivacySafeExportJson } from '../../src/exports/result-db-copy';
|
|
|
|
function result(overrides: Partial<UnifiedResultProjection>): UnifiedResultProjection {
|
|
return {
|
|
sourceKind: 'scanner-finding', title: 'Synthetic result', severityNormalized: 'medium',
|
|
outcomeNormalized: 'pass', resultType: 'exposure_finding', isIoe: false, isDeviation: false,
|
|
sourceTool: 'synthetic-tool', ...overrides
|
|
} as UnifiedResultProjection;
|
|
}
|
|
|
|
describe('Result DB compact privacy-safe JSON export', () => {
|
|
it('uses source rule IDs and includes every available actionable narrative', () => {
|
|
const text = resultsToPrivacySafeExportJson([
|
|
result({
|
|
sourceRuleId: 'PK-CRITICAL-1',
|
|
title: 'Critical deviation', description: 'Important evidence', recommendation: 'Urgent remediation',
|
|
severityNormalized: 'critical', outcomeNormalized: 'fail', isIoe: true, isDeviation: true,
|
|
affectedAsset: 'PRIVATE ASSET', reviewOwner: 'PRIVATE OWNER', processingStatus: 'current', reviewStatus: 'open'
|
|
}),
|
|
result({
|
|
sourceRuleId: 'PK-MEDIUM-1', title: 'Medium deviation', description: 'Medium evidence',
|
|
recommendation: 'Medium remediation', outcomeNormalized: 'warning', isDeviation: true
|
|
}),
|
|
result({ title: 'Passed control' }),
|
|
result({
|
|
sourceRuleId: 'PK-NOT-RUN-1', title: 'Unavailable control for alex@example.test',
|
|
outcomeNormalized: 'not_run', severityNormalized: 'unknown'
|
|
})
|
|
]);
|
|
const copied = JSON.parse(text);
|
|
|
|
expect(copied.schemaVersion).toBe(1);
|
|
expect(copied.summary).toMatchObject({
|
|
totalResults: 4, findingResults: 4, environmentResults: 0, actionableFindings: 2, notRunChecks: 1,
|
|
findingOutcomes: { fail: 1, warning: 1, pass: 1, not_run: 1 }
|
|
});
|
|
expect(copied.findings).toEqual([{
|
|
id: 'PK-CRITICAL-1', title: 'Critical deviation', description: 'Important evidence', recommendation: 'Urgent remediation',
|
|
severity: 'critical', outcome: 'fail', resultType: 'exposure_finding', isIoe: true, deviation: true, tool: 'synthetic-tool'
|
|
}, {
|
|
id: 'PK-MEDIUM-1', title: 'Medium deviation', description: 'Medium evidence', recommendation: 'Medium remediation',
|
|
severity: 'medium', outcome: 'warning',
|
|
resultType: 'exposure_finding', isIoe: false, deviation: true, tool: 'synthetic-tool'
|
|
}]);
|
|
expect(copied.notRunChecks).toEqual([{
|
|
id: 'PK-NOT-RUN-1', title: 'Unavailable control for [redacted-email]', severity: 'unknown', resultType: 'exposure_finding', tool: 'synthetic-tool'
|
|
}]);
|
|
expect(text).not.toMatch(/Passed control|PRIVATE|alex@example\.test/);
|
|
});
|
|
|
|
it('uses null when the source has no rule ID instead of inventing one', () => {
|
|
const copied = JSON.parse(resultsToPrivacySafeExportJson([
|
|
result({ title: 'Unidentified deviation', outcomeNormalized: 'fail', isDeviation: true })
|
|
]));
|
|
|
|
expect(copied.findings[0].id).toBeNull();
|
|
});
|
|
|
|
it('adds the GPO comparison to a policy finding without the customer value', () => {
|
|
const copied = JSON.parse(resultsToPrivacySafeExportJson([
|
|
result({
|
|
sourceKind: 'policy-evaluation', sourceTool: 'GPOs', title: 'Synthetic policy mode',
|
|
sourceRuleId: 'registry:machine:software\\policies\\synthetic:mode',
|
|
outcomeNormalized: 'fail', isDeviation: true, policyClassification: 'misconfigured',
|
|
policyBaselineLabel: 'DUMMY Microsoft Security Baseline Windows Server 2022 v1',
|
|
policyBaselineValue: { operation: 'set-value', data: { kind: 'dword', value: 1 } },
|
|
policyActualValue: { operation: 'set-value', data: { kind: 'dword', value: 0 }, principals: ['DUMMY\\named.user'] },
|
|
policyComparisonRelation: 'different', policyCustomerState: 'configured',
|
|
policyScope: 'computer', policyDeliveryMechanism: 'registry-policy',
|
|
policyGpoId: '{A1B2C3D4-1111-2222-3333-444455556666}', policyIdentityKey: 'private-policy-hash'
|
|
}),
|
|
result({ sourceKind: 'policy-evaluation', sourceTool: 'GPOs', title: 'Passed policy', policyClassification: 'match' }),
|
|
result({ sourceKind: 'policy-observation', sourceTool: 'GPOs', title: 'Raw observation', policyValues: ['PRIVATE'] })
|
|
]));
|
|
|
|
expect(copied.summary).toMatchObject({
|
|
totalResults: 3, findingResults: 2, policyObservationResults: 1, actionableFindings: 1,
|
|
policyStatuses: { Deviation: 1, Passed: 1 }
|
|
});
|
|
expect(copied.findings).toHaveLength(1);
|
|
expect(copied.findings[0].policy).toEqual({
|
|
status: 'Deviation', baseline: 'Microsoft Security Baseline - Windows Server',
|
|
expectedValue: { operation: 'set-value', data: { kind: 'dword', value: 1 } },
|
|
comparison: 'different', customerState: 'configured', scope: 'computer', delivery: 'registry-policy'
|
|
});
|
|
expect(JSON.stringify(copied)).not.toMatch(/named\.user|A1B2C3D4|private-policy-hash|PRIVATE|"value":0/);
|
|
});
|
|
|
|
it('groups approved environment facts and excludes identities and arbitrary values', () => {
|
|
const os = result({
|
|
sourceKind: 'environment-observation', title: 'Operating System', environmentState: 'observed',
|
|
environmentProperty: 'operating_system.name', environmentValueType: 'string',
|
|
environmentSubjectIdentity: 'PRIVATE COMPUTER', environmentNormalizedValue: 'Windows Server 2022'
|
|
});
|
|
const privateDomain = result({
|
|
sourceKind: 'environment-observation', title: 'Domain', environmentState: 'observed',
|
|
environmentProperty: 'domain.fqdn', environmentValueType: 'string', environmentNormalizedValue: 'PRIVATE.EXAMPLE'
|
|
});
|
|
const copied = JSON.parse(resultsToPrivacySafeExportJson([os, os, privateDomain]));
|
|
|
|
expect(copied.summary).toMatchObject({ totalResults: 3, findingResults: 0, environmentResults: 3 });
|
|
expect(copied.environmentFacts).toEqual([{
|
|
title: 'Operating System', property: 'operating_system.name', value: 'Windows Server 2022',
|
|
state: 'observed', tool: 'synthetic-tool', count: 2
|
|
}]);
|
|
expect(JSON.stringify(copied)).not.toMatch(/PRIVATE/);
|
|
});
|
|
});
|