from pathlib import Path

ROOT = Path(__file__).resolve().parents[1]


def test_eve_profile_uses_suricata8_logger_names():
    profile = (ROOT / "suricata" / "ids-output.yaml").read_text()
    assert "        - llmnr\n" not in profile
    assert "        - ftp-data\n" not in profile
    assert "        - ftp\n" in profile
    assert "        - ike\n" in profile
    assert "        - ike:\n            extended: yes\n" not in profile


def test_ui_has_no_m_logo_or_llmnr_event_filter():
    dashboard = (ROOT / "app" / "templates" / "index.html").read_text()
    css = (ROOT / "app" / "static" / "css" / "app.css").read_text()
    assert 'class="brand-mark"' not in dashboard
    assert '>M</div>' not in dashboard
    assert '<option>llmnr</option>' not in dashboard
    assert '.brand-mark{' not in css


def test_forensic_pcap_is_bounded_and_alert_conditional():
    profile = (ROOT / "suricata" / "ids-output.yaml").read_text()
    assert "- pcap-log:" in profile
    assert "conditional: alerts" in profile
    assert "limit: 64" in profile
    assert "max-files: 8" in profile


def test_multistage_xbits_rules_are_present():
    rules = (ROOT / "suricata" / "local.rules").read_text()
    assert "xbits:set,ms_ext_scanner" in rules
    assert "xbits:isset,ms_ext_scanner" in rules
    assert "xbits:set,ms_lateral_probe" in rules
    assert "xbits:isset,ms_lateral_probe" in rules
    for sid in range(1000120, 1000124):
        assert f"sid:{sid};" in rules


def test_intelligence_ui_exposes_pcap_and_incident_triage():
    dashboard = (ROOT / "app" / "templates" / "index.html").read_text()
    js = (ROOT / "app" / "static" / "js" / "app.js").read_text()
    assert 'id="pcapRows"' in dashboard
    assert "/api/forensics/pcaps" in js
    assert "/api/admin/ndr/incidents/status" in js


def test_cleartext_ftp_syn_rule_has_explicit_flow_direction():
    rules = (ROOT / "suricata" / "local.rules").read_text()
    line = next(line for line in rules.splitlines() if "sid:1000113;" in line)
    assert "flow:to_server,stateless;" in line
    assert "rev:2;" in line