import os
import tempfile
import unittest
from types import SimpleNamespace

from app.rules import (
    RuleActionResult,
    RuleManager,
    _parse_enabled_sources,
    _parse_source_catalog,
)


class RuleManagerTests(unittest.TestCase):
    def make_manager(self, td):
        custom = os.path.join(td, "custom.rules")
        threshold = os.path.join(td, "threshold.config")
        local = os.path.join(td, "local.rules")
        open(custom, "w").close()
        open(threshold, "w").close()
        open(local, "w").close()
        cfg = SimpleNamespace(
            suricata_custom_rules=custom,
            suricata_threshold_config=threshold,
            suricata_local_rules=local,
            suricata_extra_rules_glob=os.path.join(td, "*.rules"),
            suricata_config="/etc/suricata/suricata.yaml",
            suricata_home_net="[192.168.0.0/16]",
        )
        return RuleManager(cfg, pid_provider=lambda: None, suricata_available=False)

    def test_scoped_suppression_uses_source_ip(self):
        with tempfile.TemporaryDirectory() as td:
            manager = self.make_manager(td)
            captured = {}

            def replace(content):
                captured["content"] = content
                return RuleActionResult(True, "saved")

            manager.replace_threshold_config = replace
            result = manager.suppress_sid(1234567, "by_src", "192.0.2.10")
            self.assertTrue(result.ok)
            self.assertIn(
                "suppress gen_id 1, sig_id 1234567, track by_src, ip 192.0.2.10",
                captured["content"],
            )

    def test_scoped_suppression_rejects_invalid_ip(self):
        with tempfile.TemporaryDirectory() as td:
            manager = self.make_manager(td)
            result = manager.suppress_sid(1234567, "by_src", "not-an-ip")
            self.assertFalse(result.ok)

    def test_parses_official_source_catalog_output(self):
        output = """
Name: et/open
  Vendor: Proofpoint
  Summary: Emerging Threats Open ruleset
  License: MIT
  Tags: free, ids
Name: oisf/trafficid
  Vendor: OISF
  Summary: Traffic identification rules
  License: MIT
  Parameters: code, token
"""
        sources = _parse_source_catalog(output)
        self.assertEqual([item["name"] for item in sources], ["et/open", "oisf/trafficid"])
        self.assertEqual(sources[0]["tags"], ["free", "ids"])
        self.assertEqual(sources[1]["parameters"], ["code", "token"])

    def test_parses_enabled_named_sources_only(self):
        output = """
From /etc/suricata/update.yaml:
 - https://rules.example.invalid/feed.rules
Enabled sources:
 - oisf/trafficid
 - sslbl/ssl-fp-blacklist
"""
        self.assertEqual(
            _parse_enabled_sources(output),
            {"oisf/trafficid", "sslbl/ssl-fp-blacklist"},
        )


if __name__ == "__main__":
    unittest.main()