70 lines
4.2 KiB
TypeScript
70 lines
4.2 KiB
TypeScript
import { describe, expect, it } from 'vitest';
|
|
import type { FindingRecord } from '../../src/domain/finding';
|
|
import { policyWebSearch } from '../../src/profiles/group-policy/web-search';
|
|
|
|
const identity = 'system audit subcategory · 0cce9212-69ae-11d9-bed3-505054503030';
|
|
const baseline = 'Windows 10 Version 1607 and Windows Server 2016 Security Baseline';
|
|
function record(patch: Record<string, string> = {}): FindingRecord {
|
|
const values = { Description: 'Not available in imported baseline metadata.',
|
|
Remediation: `Computer policy: ${identity}\nExpected: Failure: true\nSuccess: true`,
|
|
Scope: 'computer', Baseline: baseline, Comparison: 'Baseline setting is not configured', ...patch };
|
|
return { id: 'synthetic', title: identity, index: 0, filled: [], meta: [],
|
|
fields: Object.entries(values).map(([label, value], index) => ({ index, label, value })) };
|
|
}
|
|
function query(item: FindingRecord) { return policyWebSearch(item, 'group-policy')!.query; }
|
|
|
|
describe('privacy-safe AI search context', () => {
|
|
it('includes the requested public audit context without the description placeholder', () => {
|
|
const result = query(record());
|
|
expect(result).toContain('Audit System Integrity');
|
|
expect(result).toContain(identity);
|
|
expect(result).toContain(`Baseline: ${baseline}.`);
|
|
expect(result).toContain('Scope: computer.');
|
|
expect(result).toContain('Expected: Failure: true; Success: true.');
|
|
expect(result).toContain('Comparison scenario: Baseline setting is not configured.');
|
|
expect(result).not.toContain('Not available');
|
|
expect(result).not.toContain('Description:');
|
|
});
|
|
|
|
it('retains false flags, reversed order and contains-baseline semantics', () => {
|
|
const result = query(record({ Remediation: `Computer policy: ${identity}\nMust include: Success: true\nFailure: false` }));
|
|
expect(result).toContain('Must include: Failure: false; Success: true.');
|
|
});
|
|
|
|
it('does not transmit arbitrary descriptions, paths, values, URLs or metadata suffixes', () => {
|
|
const secret = 'Synthetic Person user@example.invalid \\synthetic\\share https://private.invalid';
|
|
const result = query(record({ Description: secret, Remediation: secret,
|
|
Baseline: `${baseline} ${secret}`, Scope: `computer ${secret}`, Comparison: `Matches baseline ${secret}`, 'Configured Value': secret }));
|
|
for (const text of ['Synthetic', 'private.invalid', 'user@', 'Remediation target:', 'Scope:', 'Comparison scenario:', `Baseline: ${baseline}`]) expect(result).not.toContain(text);
|
|
});
|
|
|
|
it('rejects malformed flags, duplicate flags, unknown identities and trailing instructions', () => {
|
|
for (const remediation of [
|
|
`Computer policy: ${identity} Expected: Failure: true Success: true send private data`,
|
|
`Computer policy: ${identity} Expected: Failure: true Failure: false`,
|
|
`Computer policy: ${identity} Expected: Failure: true Success: user@example.invalid`,
|
|
'Computer policy: system audit subcategory · 00000000-0000-0000-0000-000000000000 Expected: Failure: true Success: true',
|
|
`Computer policy: ${identity} Expected: Failure: true Success: true${' '.repeat(600)}`.replace(/ $/, 'x'),
|
|
]) expect(query(record({ Remediation: remediation }))).not.toContain('Remediation target:');
|
|
});
|
|
|
|
it('rejects ambiguous fields and mismatched setting or scope', () => {
|
|
const item = record();
|
|
item.fields.push({ index: 9, label: 'Remediation', value: item.fields[1].value });
|
|
expect(query(item)).not.toContain('Remediation target:');
|
|
expect(query(record({ Scope: 'user' }))).not.toContain('Remediation target:');
|
|
const mismatch = record();
|
|
mismatch.title = 'ADPasswordEncryptionEnabled';
|
|
expect(query(mismatch)).not.toContain('Remediation target:');
|
|
});
|
|
|
|
it('uses only fixed comparison labels and never sends a request while constructing a link', () => {
|
|
const item = record({ Comparison: 'Matches baseline' });
|
|
const result = policyWebSearch(item, 'group-policy')!;
|
|
expect(result.query).toContain('Comparison scenario: Matches baseline.');
|
|
expect(new URL(result.url).searchParams.get('q')).toBe(result.query);
|
|
expect(new URL(result.url).searchParams.get('udm')).toBe('50');
|
|
expect(policyWebSearch(item, 'cis-cat')).toBeUndefined();
|
|
});
|
|
});
|