event_forwarder_test.go

package main

import (
	"encoding/json"
	"fmt"
	"io"
	"net/http"
	"net/http/httptest"
	"os"
	"path/filepath"
	"testing"
	"time"
)

// TestForwardEventQueuing tests that events are properly queued
func TestForwardEventQueuing(t *testing.T) {
	StopEventForwarding() // Clean up any existing forwarder

	config := &ForwardingConfig{
		Enabled:    true,
		BufferSize: 10,
		FlushTime:  5,
		HTTP:       HTTPConfig{Enabled: false},
		File:       FileOutputConfig{Enabled: false},
		Filters:    EventFilters{EventTypes: []string{"alert", "error"}},
	}

	err := InitializeEventForwarding(config)
	if err != nil {
		t.Fatalf("Failed to initialize event forwarding: %v", err)
	}
	defer StopEventForwarding()

	// Forward an event
	ForwardEvent("alert", "high", "Test alert", nil)

	// Check if event is queued
	if eventForwarder == nil {
		t.Fatal("Event forwarder not initialized")
	}

	eventForwarder.queueMutex.Lock()
	queueLen := len(eventForwarder.eventQueue)
	eventForwarder.queueMutex.Unlock()

	if queueLen != 1 {
		t.Fatalf("Expected 1 event in queue, got %d", queueLen)
	}
}

// TestEventFilteringByType tests that events are filtered by type
func TestEventFilteringByType(t *testing.T) {
	StopEventForwarding() // Clean up any existing forwarder

	config := &ForwardingConfig{
		Enabled:    true,
		BufferSize: 100,
		FlushTime:  5,
		HTTP:       HTTPConfig{Enabled: false},
		File:       FileOutputConfig{Enabled: false},
		Filters:    EventFilters{EventTypes: []string{"error"}}, // Only forward errors
	}

	err := InitializeEventForwarding(config)
	if err != nil {
		t.Fatalf("Failed to initialize event forwarding: %v", err)
	}
	defer StopEventForwarding()

	// Forward alert (should be filtered)
	ForwardEvent("alert", "high", "Test alert", nil)

	// Forward error (should be queued)
	ForwardEvent("error", "medium", "Test error", nil)

	eventForwarder.queueMutex.Lock()
	queueLen := len(eventForwarder.eventQueue)
	eventForwarder.queueMutex.Unlock()

	if queueLen != 1 {
		t.Fatalf("Expected 1 event in queue (only error), got %d", queueLen)
	}

	// Verify it's the error event
	eventForwarder.queueMutex.Lock()
	if len(eventForwarder.eventQueue) > 0 && eventForwarder.eventQueue[0].EventType != "error" {
		t.Fatal("Queued event should be of type 'error'")
	}
	eventForwarder.queueMutex.Unlock()
}

// TestHTTPForwarding tests HTTP event forwarding with a mock server
func TestHTTPForwarding(t *testing.T) {
	// Create a mock HTTP server
	receivedEvents := []FastFinderEvent{}
	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		body, err := io.ReadAll(r.Body)
		if err != nil {
			t.Fatalf("Failed to read request body: %v", err)
		}

		var events []FastFinderEvent
		if err := json.Unmarshal(body, &events); err != nil {
			t.Fatalf("Failed to unmarshal events: %v", err)
		}

		receivedEvents = append(receivedEvents, events...)
		w.WriteHeader(http.StatusOK)
	}))
	defer server.Close()

	config := &ForwardingConfig{
		Enabled:    true,
		BufferSize: 5,
		FlushTime:  1,
		HTTP: HTTPConfig{
			Enabled:    true,
			URL:        server.URL,
			SSLVerify:  false,
			Timeout:    10,
			Headers:    map[string]string{"X-Custom-Header": "test-value"},
			RetryCount: 2,
		},
		File:    FileOutputConfig{Enabled: false},
		Filters: EventFilters{EventTypes: []string{"alert", "error", "info"}},
	}

	// Need a fresh forwarder for this test - explicitly manage lifecycle
	StopEventForwarding()

	err := InitializeEventForwarding(config)
	if err != nil {
		t.Fatalf("Failed to initialize event forwarding: %v", err)
	}

	// Ensure queue is empty
	if eventForwarder != nil {
		eventForwarder.queueMutex.Lock()
		eventForwarder.eventQueue = []FastFinderEvent{}
		eventForwarder.queueMutex.Unlock()
	}

	// Forward events
	ForwardEvent("alert", "high", "Test alert 1", map[string]string{"key": "value"})
	ForwardEvent("error", "medium", "Test error", nil)

	// Trigger flush immediately
	eventForwarder.flushEvents()

	StopEventForwarding()

	// Verify events were received
	if len(receivedEvents) != 2 {
		t.Fatalf("Expected 2 events to be forwarded, got %d. Events: %v", len(receivedEvents), receivedEvents)
	}

	// Verify event content
	if receivedEvents[0].EventType != "alert" {
		t.Fatalf("Expected first event type to be 'alert', got '%s'", receivedEvents[0].EventType)
	}

	if receivedEvents[0].Message != "Test alert 1" {
		t.Fatalf("Expected message 'Test alert 1', got '%s'", receivedEvents[0].Message)
	}
}

// TestHTTPForwardingWithRetry tests HTTP forwarding with retry logic
func TestHTTPForwardingWithRetry(t *testing.T) {
	StopEventForwarding() // Clean up any existing forwarder

	attemptCount := 0
	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		attemptCount++
		if attemptCount < 2 {
			// Fail on first attempt
			w.WriteHeader(http.StatusInternalServerError)
		} else {
			// Succeed on second attempt
			w.WriteHeader(http.StatusOK)
		}
	}))
	defer server.Close()

	config := &ForwardingConfig{
		Enabled:    true,
		BufferSize: 1,
		FlushTime:  1,
		HTTP: HTTPConfig{
			Enabled:    true,
			URL:        server.URL,
			SSLVerify:  false,
			Timeout:    10,
			RetryCount: 2,
		},
		File:    FileOutputConfig{Enabled: false},
		Filters: EventFilters{EventTypes: []string{"alert"}},
	}

	err := InitializeEventForwarding(config)
	if err != nil {
		t.Fatalf("Failed to initialize event forwarding: %v", err)
	}
	defer StopEventForwarding()

	ForwardEvent("alert", "high", "Test with retry", nil)

	// Trigger flush
	eventForwarder.flushEvents()

	// Should have retried at least once
	if attemptCount < 2 {
		t.Fatalf("Expected at least 2 attempts due to retry, got %d", attemptCount)
	}
}

// TestFileForwarding tests file event forwarding
func TestFileForwarding(t *testing.T) {
	StopEventForwarding() // Clean up any existing forwarder

	// Create a temporary directory
	tmpDir := t.TempDir()

	config := &ForwardingConfig{
		Enabled:    true,
		BufferSize: 5,
		FlushTime:  1,
		HTTP:       HTTPConfig{Enabled: false},
		File: FileOutputConfig{
			Enabled:       true,
			DirectoryPath: tmpDir,
			RotateMinutes: 60,
			MaxFileSize:   100, // 100 MB
			RetainFiles:   5,
		},
		Filters: EventFilters{EventTypes: []string{"alert", "error"}},
	}

	err := InitializeEventForwarding(config)
	if err != nil {
		t.Fatalf("Failed to initialize event forwarding: %v", err)
	}
	defer StopEventForwarding()

	// Forward events
	ForwardEvent("alert", "high", "Test alert for file", nil)
	ForwardEvent("error", "medium", "Test error for file", nil)

	// Trigger flush
	eventForwarder.flushEvents()

	// Check if file was created
	files, err := filepath.Glob(filepath.Join(tmpDir, "*_fastfinder_logs.jsonl"))
	if err != nil {
		t.Fatalf("Failed to glob files: %v", err)
	}

	if len(files) != 1 {
		t.Fatalf("Expected 1 log file, found %d", len(files))
	}

	// Verify file content
	content, err := os.ReadFile(files[0])
	if err != nil {
		t.Fatalf("Failed to read log file: %v", err)
	}

	lines := 0
	var lastEvent FastFinderEvent

	// Count lines and parse last event
	scanner := os.NewFile(0, "")
	for i, b := range content {
		if b == '\n' {
			lines++
		}
		if i == len(content)-1 && b != '\n' {
			lines++
		}
	}

	// Parse each line
	offset := 0
	for {
		newlineIdx := -1
		for i := offset; i < len(content); i++ {
			if content[i] == '\n' {
				newlineIdx = i
				break
			}
		}

		if newlineIdx == -1 {
			if offset < len(content) {
				newlineIdx = len(content)
			} else {
				break
			}
		}

		lineData := content[offset:newlineIdx]
		if len(lineData) > 0 {
			if err := json.Unmarshal(lineData, &lastEvent); err != nil {
				t.Fatalf("Failed to unmarshal event from file: %v", err)
			}
		}

		offset = newlineIdx + 1
		if offset >= len(content) {
			break
		}
	}

	_ = scanner.Close()

	if lines < 2 {
		t.Fatalf("Expected at least 2 events written to file, found %d", lines)
	}
}

// TestFileRotationByTime tests file rotation based on time
func TestFileRotationByTime(t *testing.T) {
	StopEventForwarding() // Clean up any existing forwarder

	// Create a temporary directory
	tmpDir := t.TempDir()

	config := &ForwardingConfig{
		Enabled:    true,
		BufferSize: 100,
		FlushTime:  1,
		HTTP:       HTTPConfig{Enabled: false},
		File: FileOutputConfig{
			Enabled:       true,
			DirectoryPath: tmpDir,
			RotateMinutes: 1, // Rotate every minute
			MaxFileSize:   0, // Disable size-based rotation
			RetainFiles:   10,
		},
		Filters: EventFilters{EventTypes: []string{"alert"}},
	}

	err := InitializeEventForwarding(config)
	if err != nil {
		t.Fatalf("Failed to initialize event forwarding: %v", err)
	}
	defer StopEventForwarding()

	// Write first event
	ForwardEvent("alert", "high", "Event 1", nil)
	eventForwarder.flushEvents()

	// Verify first file was created
	files1, _ := filepath.Glob(filepath.Join(tmpDir, "*_fastfinder_logs.jsonl"))
	if len(files1) < 1 {
		t.Fatal("Expected at least 1 file to be created")
	}

	// Manually set last rotation to past to trigger rotation
	eventForwarder.fileMutex.Lock()
	eventForwarder.lastRotation = time.Now().UTC().Add(-2 * time.Minute)
	eventForwarder.fileMutex.Unlock()

	// Write second event (should trigger rotation)
	ForwardEvent("alert", "high", "Event 2", nil)
	eventForwarder.flushEvents()

	// Check if new file was created
	files2, _ := filepath.Glob(filepath.Join(tmpDir, "*_fastfinder_logs.jsonl"))
	if len(files2) < 2 {
		t.Logf("Note: File rotation test may have created same file due to timing. Files: %v", files2)
		// This is not a critical failure as both events could be in same file
		// if they're written too quickly
	}
}

// TestFileRetention tests that old files are cleaned up
func TestFileRetention(t *testing.T) {
	// Create a temporary directory
	tmpDir := t.TempDir()

	// Create some old log files
	for i := 0; i < 5; i++ {
		filename := fmt.Sprintf("202501010%d_fastfinder_logs.jsonl", i)
		filepath := filepath.Join(tmpDir, filename)
		if err := os.WriteFile(filepath, []byte("old log\n"), 0644); err != nil {
			t.Fatalf("Failed to create old log file: %v", err)
		}
	}

	config := &ForwardingConfig{
		Enabled:    true,
		BufferSize: 100,
		FlushTime:  1,
		HTTP:       HTTPConfig{Enabled: false},
		File: FileOutputConfig{
			Enabled:       true,
			DirectoryPath: tmpDir,
			RotateMinutes: 60,
			MaxFileSize:   0,
			RetainFiles:   3, // Keep only 3 files
		},
		Filters: EventFilters{EventTypes: []string{"alert"}},
	}

	err := InitializeEventForwarding(config)
	if err != nil {
		t.Fatalf("Failed to initialize event forwarding: %v", err)
	}

	// Trigger rotation to cleanup old files
	eventForwarder.fileMutex.Lock()
	eventForwarder.cleanOldFiles()
	eventForwarder.fileMutex.Unlock()

	// Check remaining files
	files, _ := filepath.Glob(filepath.Join(tmpDir, "*_fastfinder_logs.jsonl"))

	// Should have at most 3 old files + 1 new file = 4, but cleanOldFiles was called
	// before opening new file, so should have around 3
	if len(files) > 4 {
		t.Fatalf("Expected at most 4 files (3 retained + 1 new), got %d", len(files))
	}

	StopEventForwarding()
}

// TestYARAMatchForwarding tests forwarding of YARA match events
func TestYARAMatchForwarding(t *testing.T) {
	StopEventForwarding() // Clean up any existing forwarder

	config := &ForwardingConfig{
		Enabled:    true,
		BufferSize: 10,
		FlushTime:  1,
		HTTP:       HTTPConfig{Enabled: false},
		File:       FileOutputConfig{Enabled: false},
		Filters:    EventFilters{EventTypes: []string{"alert"}},
	}

	err := InitializeEventForwarding(config)
	if err != nil {
		t.Fatalf("Failed to initialize event forwarding: %v", err)
	}
	defer StopEventForwarding()

	// Forward a YARA match
	ForwardAlertEvent("TestRule", "/path/to/file.exe", 1024, "abc123hash", nil)

	// Check queue
	eventForwarder.queueMutex.Lock()
	queueLen := len(eventForwarder.eventQueue)
	if queueLen > 0 {
		event := eventForwarder.eventQueue[0]
		if event.EventType != "alert" {
			t.Fatalf("Expected event type 'alert', got '%s'", event.EventType)
		}
		if event.Severity != "high" {
			t.Fatalf("Expected severity 'high', got '%s'", event.Severity)
		}
	}
	eventForwarder.queueMutex.Unlock()

	if queueLen != 1 {
		t.Fatalf("Expected 1 event in queue, got %d", queueLen)
	}
}

// TestScanCompleteForwarding tests forwarding of scan completion events
func TestScanCompleteForwarding(t *testing.T) {
	StopEventForwarding() // Clean up any existing forwarder

	config := &ForwardingConfig{
		Enabled:    true,
		BufferSize: 10,
		FlushTime:  1,
		HTTP:       HTTPConfig{Enabled: false},
		File:       FileOutputConfig{Enabled: false},
		Filters:    EventFilters{EventTypes: []string{"scan_complete"}},
	}

	err := InitializeEventForwarding(config)
	if err != nil {
		t.Fatalf("Failed to initialize event forwarding: %v", err)
	}
	defer StopEventForwarding()

	// Forward scan completion
	ForwardScanCompleteEvent(100, 5, 2, 30*time.Second)

	// Check queue
	eventForwarder.queueMutex.Lock()
	queueLen := len(eventForwarder.eventQueue)
	if queueLen > 0 {
		event := eventForwarder.eventQueue[0]
		if event.EventType != "scan_complete" {
			t.Fatalf("Expected event type 'scan_complete', got '%s'", event.EventType)
		}
		if event.ScanResults == nil {
			t.Fatal("Expected ScanResults to be populated")
		}
		if event.ScanResults.FilesScanned != 100 {
			t.Fatalf("Expected 100 files scanned, got %d", event.ScanResults.FilesScanned)
		}
		if event.ScanResults.MatchesFound != 5 {
			t.Fatalf("Expected 5 matches found, got %d", event.ScanResults.MatchesFound)
		}
	}
	eventForwarder.queueMutex.Unlock()

	if queueLen != 1 {
		t.Fatalf("Expected 1 event in queue, got %d", queueLen)
	}
}

// TestEventForwarderDisabled tests that events are not forwarded when disabled
func TestEventForwarderDisabled(t *testing.T) {
	StopEventForwarding() // Clean up any existing forwarder

	config := &ForwardingConfig{
		Enabled:    false, // Disabled
		BufferSize: 10,
		FlushTime:  1,
		HTTP:       HTTPConfig{Enabled: false},
		File:       FileOutputConfig{Enabled: false},
		Filters:    EventFilters{EventTypes: []string{"alert"}},
	}

	// Initialize with disabled config
	err := InitializeEventForwarding(config)
	if err != nil {
		t.Fatalf("Failed to initialize event forwarding: %v", err)
	}

	// Try to forward an event
	ForwardEvent("alert", "high", "Test", nil)

	// If forwarder is properly disabled, eventForwarder should be nil or event not queued
	if eventForwarder != nil {
		eventForwarder.queueMutex.Lock()
		queueLen := len(eventForwarder.eventQueue)
		eventForwarder.queueMutex.Unlock()

		if queueLen > 0 {
			t.Fatalf("Expected no events in queue when forwarder is disabled, got %d", queueLen)
		}
	}
}

// TestHTTPWithCustomHeaders tests that custom headers are sent in HTTP requests
func TestHTTPWithCustomHeaders(t *testing.T) {
	StopEventForwarding() // Clean up any existing forwarder

	headersReceived := make(map[string]string)
	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		headersReceived["X-Custom-Header"] = r.Header.Get("X-Custom-Header")
		headersReceived["X-API-Key"] = r.Header.Get("X-API-Key")
		headersReceived["Content-Type"] = r.Header.Get("Content-Type")
		w.WriteHeader(http.StatusOK)
	}))
	defer server.Close()

	config := &ForwardingConfig{
		Enabled:    true,
		BufferSize: 1,
		FlushTime:  1,
		HTTP: HTTPConfig{
			Enabled:    true,
			URL:        server.URL,
			SSLVerify:  false,
			Timeout:    10,
			RetryCount: 0,
			Headers: map[string]string{
				"X-Custom-Header": "custom-value",
				"X-API-Key":       "secret-key",
			},
		},
		File:    FileOutputConfig{Enabled: false},
		Filters: EventFilters{EventTypes: []string{"alert"}},
	}

	err := InitializeEventForwarding(config)
	if err != nil {
		t.Fatalf("Failed to initialize event forwarding: %v", err)
	}
	defer StopEventForwarding()

	ForwardEvent("alert", "high", "Test headers", nil)
	eventForwarder.flushEvents()

	if headersReceived["X-Custom-Header"] != "custom-value" {
		t.Fatalf("Expected custom header value 'custom-value', got '%s'", headersReceived["X-Custom-Header"])
	}

	if headersReceived["X-API-Key"] != "secret-key" {
		t.Fatalf("Expected API key 'secret-key', got '%s'", headersReceived["X-API-Key"])
	}

	if headersReceived["Content-Type"] != "application/json" {
		t.Fatalf("Expected Content-Type 'application/json', got '%s'", headersReceived["Content-Type"])
	}
}

// TestBufferFlushOnSize tests that events are flushed when buffer size is reached
func TestBufferFlushOnSize(t *testing.T) {
	StopEventForwarding() // Clean up any existing forwarder

	flushed := false
	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		flushed = true
		w.WriteHeader(http.StatusOK)
	}))
	defer server.Close()

	config := &ForwardingConfig{
		Enabled:    true,
		BufferSize: 2, // Small buffer size
		FlushTime:  30,
		HTTP: HTTPConfig{
			Enabled:    true,
			URL:        server.URL,
			SSLVerify:  false,
			Timeout:    10,
			RetryCount: 0,
		},
		File:    FileOutputConfig{Enabled: false},
		Filters: EventFilters{EventTypes: []string{"alert"}},
	}

	err := InitializeEventForwarding(config)
	if err != nil {
		t.Fatalf("Failed to initialize event forwarding: %v", err)
	}
	defer StopEventForwarding()

	// Add events up to buffer size
	ForwardEvent("alert", "high", "Event 1", nil)
	time.Sleep(100 * time.Millisecond)
	ForwardEvent("alert", "high", "Event 2", nil)

	// Buffer should be full and flushed
	time.Sleep(500 * time.Millisecond) // Give it time to flush

	if !flushed {
		t.Fatal("Expected buffer to be flushed when size reached")
	}
}