"""Regression checks for independent review findings; synthetic evidence only."""

import base64
import csv
import tempfile
import unittest
from pathlib import Path

from netscaler_triage.engine import scan
from netscaler_triage.matching import Matcher


class ReviewTests(unittest.TestCase):
    def test_ipv4_with_port_and_embedded_address_boundary(self) -> None:
        matcher = Matcher(
            [{"indicators": [{"type": "ipv4", "value": "192.0.2.1"}]}],
            defaults=False,
        )
        self.assertTrue(matcher.search("http://192.0.2.1:443/a")[1])
        self.assertFalse(matcher.search("192.0.2.10:443")[1])
        self.assertFalse(matcher.search("1192.0.2.1")[1])

    def test_base64_query_without_percent_encoding(self) -> None:
        with tempfile.TemporaryDirectory() as temporary:
            root = Path(temporary).resolve()
            source = root / "logs"
            source.mkdir()
            (source / "access.log").write_text(
                "192.0.2.1 - - [01/Oct/2026:12:00:00 +0000] "
                '"GET /test?x=aWQ= HTTP/1.1" 403 0 "-" "ordinary"\n',
                encoding="utf-8",
            )
            result = scan(
                [("appliance", source)],
                root / "out",
                [{"patterns": [{"id": "decoded_id", "pattern": "^id$"}]}],
                defaults=False,
            )
            self.assertEqual(result["counts"].get("findings", 0), 1)

    def test_authorized_status_survives_ioc_export(self) -> None:
        with tempfile.TemporaryDirectory() as temporary:
            root = Path(temporary).resolve()
            source = root / "logs"
            source.mkdir()
            (source / "access.log").write_text(
                "192.0.2.1 - - [01/Oct/2026:12:00:00 +0000] "
                '"GET /test HTTP/1.1" 403 0 "-" "ordinary"\n',
                encoding="utf-8",
            )
            scan(
                [("appliance", source)],
                root / "out",
                [
                    {
                        "indicators": [
                            {"type": "ipv4", "value": "192.0.2.1", "status": "authorized_test"}
                        ]
                    }
                ],
                defaults=False,
            )
            with (root / "out/IOCS.csv").open(encoding="utf-8", newline="") as handle:
                rows = list(csv.DictReader(handle))
            match = next(row for row in rows if row["value"] == "192.0.2.1")
            self.assertIn("authorized_test", match["status"])

    def test_incomplete_decoding_marks_partial_analysis(self) -> None:
        with tempfile.TemporaryDirectory() as temporary:
            root = Path(temporary).resolve()
            source = root / "logs"
            source.mkdir()
            payload = "x:" + base64.b64encode(b"hostname " * 50).decode() + "%20"
            (source / "payload.log").write_text(payload + "\n", encoding="utf-8")
            result = scan(
                [("appliance", source)],
                root / "out",
                [{"patterns": [{"id": "candidate", "pattern": "^x:"}]}],
                defaults=False,
                max_line_bytes=1024,
            )
            self.assertEqual(result["status"], "partial")


if __name__ == "__main__":
    unittest.main()