safetynet/tests/transfer-facts.test.mjs

import test from 'node:test';
import assert from 'node:assert/strict';
import facts from '../packages/core/transfer-facts.cjs';
import {toECS,toCEF} from '../packages/core/siem.mjs';
test('security file facts carry exact bytes and detected type without arbitrary content',()=>{
 const file=facts.transferFacts({bytes:123,detectedType:'pe',sha256:'a'.repeat(64)});
 const e={id:1,time:new Date().toISOString(),kind:'download.block',metadata:{file}};
 assert.equal(toECS(e).file.size,123);assert.equal(toECS(e).file.type,'pe');assert.match(toCEF(e),/cs6=pe/);
 assert.throws(()=>facts.transferFacts({...file,password:'forbidden'}));
 assert.throws(()=>facts.transferFacts({...file,bytes:-1}));
 e.metadata.file={bytes:123,detectedType:'password=secret',sha256:'a'.repeat(64)};
 assert.equal(toECS(e).file,undefined);assert.equal(toCEF(e).includes('password=secret'),false);
});

test('OLE Office magic facts remain representable in durable SIEM records',()=>{const file=facts.transferFacts({bytes:512,detectedType:'ole',sha256:'b'.repeat(64)});assert.equal(toECS({id:9,time:new Date().toISOString(),kind:'download.scan',metadata:{file}}).file.type,'ole');});