Function TestAnalyzeFirewallPolicy

pkg/cli/firewall_policy_test.go:692–754

(t *testing.T)

}

func TestAnalyzeFirewallPolicy(t *testing.T) {
	t.Run("full enrichment", func(t *testing.T) {
		dir := t.TempDir()
		auditDir := filepath.Join(dir, "sandbox", "firewall", "audit")
		require.NoError(t, os.MkdirAll(auditDir, 0755))

		// Write policy manifest
		manifest := PolicyManifest{
			Version:     1,
			GeneratedAt: "2026-01-01T00:00:00Z",
			Rules: []PolicyRule{
				{ID: "allow-github", Order: 1, Action: "allow", ACLName: "allowed_domains", Protocol: "both", Domains: []string{".github.com"}, Description: "Allow GitHub"},
				{ID: "deny-all", Order: 2, Action: "deny", ACLName: "all", Protocol: "both", Domains: []string{}, Description: "Block all other traffic"},
			},
		}
		manifestData, err := json.Marshal(manifest)
		require.NoError(t, err)
		require.NoError(t, os.WriteFile(filepath.Join(auditDir, "policy-manifest.json"), manifestData, 0644))

		// Write audit JSONL
		jsonl := `{"ts":1.0,"host":"api.github.com:443","method":"CONNECT","status":200,"decision":"TCP_TUNNEL"}
{"ts":2.0,"host":"evil.com:443","method":"CONNECT","status":403,"decision":"NONE_NONE"}
`
		require.NoError(t, os.WriteFile(filepath.Join(auditDir, "audit.jsonl"), []byte(jsonl), 0644))

		analysis, err := analyzeFirewallPolicy(dir, false)
		require.NoError(t, err, "Should analyze without error")
		require.NotNil(t, analysis, "Analysis should not be nil")

		assert.Equal(t, 2, analysis.TotalRequests, "Should have 2 total requests")
		assert.Equal(t, 1, analysis.AllowedCount, "Should have 1 allowed request")
		assert.Equal(t, 1, analysis.DeniedCount, "Should have 1 denied request")
		require.Len(t, analysis.DeniedRequests, 1, "Should have 1 denied request detail")
		assert.Equal(t, "deny-all", analysis.DeniedRequests[0].RuleID, "Denied request should be attributed to deny-all")
	})

	t.Run("manifest only - no audit.jsonl", func(t *testing.T) {
		dir := t.TempDir()
		auditDir := filepath.Join(dir, "sandbox", "firewall", "audit")
		require.NoError(t, os.MkdirAll(auditDir, 0755))

		manifest := PolicyManifest{
			Version:        1,
			Rules:          []PolicyRule{{ID: "r1", Order: 1, Action: "allow", Domains: []string{".example.com"}}},
			SSLBumpEnabled: true,
		}
		manifestData, err := json.Marshal(manifest)
		require.NoError(t, err)
		require.NoError(t, os.WriteFile(filepath.Join(auditDir, "policy-manifest.json"), manifestData, 0644))

		analysis, err := analyzeFirewallPolicy(dir, false)
		require.NoError(t, err, "Should not error with manifest only")
		require.NotNil(t, analysis, "Should return analysis with manifest-only data")
		assert.Contains(t, analysis.PolicySummary, "SSL Bump enabled", "Should reflect SSL Bump enabled")
	})

	t.Run("no artifacts returns nil", func(t *testing.T) {
		dir := t.TempDir()