poc3

tests/test_rules.py

@@ -170,6 +170,45 @@ Enabled sources:
                 ],
             )
 
+
+    def test_manual_url_source_is_added_and_rules_rebuilt(self):
+        with tempfile.TemporaryDirectory() as td:
+            manager = self.make_manager(td)
+            manager.suricata_available = True
+            calls = []
+            manager._run_suricata_update = lambda args, timeout: (calls.append(list(args)) or subprocess.CompletedProcess(args, 0, stdout="added"))
+            manager._run_vendor_update_unlocked = lambda: RuleActionResult(True, "rebuilt")
+
+            result = manager.add_manual_source("vendor/community", "https://rules.example.invalid/feed.rules")
+            self.assertTrue(result.ok)
+            self.assertEqual(calls, [["add-source", "vendor/community", "https://rules.example.invalid/feed.rules", "--no-checksum"]])
+
+    def test_manual_url_source_rejects_non_http_url(self):
+        with tempfile.TemporaryDirectory() as td:
+            manager = self.make_manager(td)
+            manager.suricata_available = True
+            result = manager.add_manual_source("vendor/community", "file:///tmp/feed.rules")
+            self.assertFalse(result.ok)
+
+    def test_merged_rules_are_searchable_and_paginated(self):
+        with tempfile.TemporaryDirectory() as td:
+            manager = self.make_manager(td)
+            rules = os.path.join(td, "lib", "suricata", "rules")
+            os.makedirs(rules, exist_ok=True)
+            with open(os.path.join(rules, "suricata.rules"), "w", encoding="utf-8") as handle:
+                handle.write('# generated\n')
+                handle.write('alert tcp any any -> any 80 (msg:"one"; sid:1;)\n')
+                handle.write('alert dns any any -> any any (msg:"two"; sid:2;)\n')
+                handle.write('alert tcp any any -> any 443 (msg:"three"; sid:3;)\n')
+
+            result = manager.merged_rules("tcp", offset=0, limit=1)
+            self.assertTrue(result["ok"])
+            self.assertEqual(result["total_rules"], 3)
+            self.assertEqual(result["matched"], 2)
+            self.assertEqual(result["next_offset"], 1)
+            self.assertIn('sid:1', result["content"])
+            self.assertEqual(manager.status()["vendor_rule_count"], 3)
+
     def test_adaptive_threshold_uses_global_limit_and_snapshot_is_persistent(self):
         with tempfile.TemporaryDirectory() as td:
             manager = self.make_manager(td)