(t *testing.T)
| 353 | } |
| 354 | |
| 355 | func TestParseAuditJSONL(t *testing.T) { |
| 356 | t.Run("valid JSONL", func(t *testing.T) { |
| 357 | dir := t.TempDir() |
| 358 | jsonlPath := filepath.Join(dir, "audit.jsonl") |
| 359 | |
| 360 | lines := `{"ts":1761074374.646,"client":"172.30.0.20","host":"api.github.com:443","dest":"140.82.114.22:443","method":"CONNECT","status":200,"decision":"TCP_TUNNEL","url":"api.github.com:443"} |
| 361 | {"ts":1761074375.100,"client":"172.30.0.20","host":"evil.com:443","dest":"1.2.3.4:443","method":"CONNECT","status":403,"decision":"NONE_NONE","url":"evil.com:443"} |
| 362 | {"ts":1761074376.200,"client":"172.30.0.20","host":"registry.npmjs.org:443","dest":"104.16.0.1:443","method":"CONNECT","status":200,"decision":"TCP_TUNNEL","url":"registry.npmjs.org:443"} |
| 363 | ` |
| 364 | require.NoError(t, os.WriteFile(jsonlPath, []byte(lines), 0644)) |
| 365 | |
| 366 | entries, err := parseAuditJSONL(jsonlPath) |
| 367 | require.NoError(t, err, "Should parse JSONL without error") |
| 368 | assert.Len(t, entries, 3, "Should parse 3 entries") |
| 369 | |
| 370 | // Check first entry |
| 371 | assert.InDelta(t, 1761074374.646, entries[0].Timestamp, 0.001, "Timestamp should match") |
| 372 | assert.Equal(t, "api.github.com:443", entries[0].Host, "Host should match") |
| 373 | assert.Equal(t, 200, entries[0].Status, "Status should match") |
| 374 | |
| 375 | // Check denied entry |
| 376 | assert.Equal(t, "evil.com:443", entries[1].Host, "Second host should match") |
| 377 | assert.Equal(t, 403, entries[1].Status, "Second status should be 403") |
| 378 | }) |
| 379 | |
| 380 | t.Run("empty lines skipped", func(t *testing.T) { |
| 381 | dir := t.TempDir() |
| 382 | jsonlPath := filepath.Join(dir, "audit.jsonl") |
| 383 | |
| 384 | lines := `{"ts":1.0,"host":"a.com:443","status":200} |
| 385 | |
| 386 | {"ts":2.0,"host":"b.com:443","status":200} |
| 387 | ` |
| 388 | require.NoError(t, os.WriteFile(jsonlPath, []byte(lines), 0644)) |
| 389 | |
| 390 | entries, err := parseAuditJSONL(jsonlPath) |
| 391 | require.NoError(t, err, "Should parse JSONL without error") |
| 392 | assert.Len(t, entries, 2, "Should parse 2 entries, skipping empty line") |
| 393 | }) |
| 394 | |
| 395 | t.Run("malformed lines skipped", func(t *testing.T) { |
| 396 | dir := t.TempDir() |
| 397 | jsonlPath := filepath.Join(dir, "audit.jsonl") |
| 398 | |
| 399 | lines := `{"ts":1.0,"host":"valid.com:443","status":200} |
| 400 | not valid json |
| 401 | {"ts":2.0,"host":"also-valid.com:443","status":200} |
| 402 | ` |
| 403 | require.NoError(t, os.WriteFile(jsonlPath, []byte(lines), 0644)) |
| 404 | |
| 405 | entries, err := parseAuditJSONL(jsonlPath) |
| 406 | require.NoError(t, err, "Should parse JSONL without error despite malformed line") |
| 407 | assert.Len(t, entries, 2, "Should parse 2 valid entries") |
| 408 | }) |
| 409 | |
| 410 | t.Run("missing file", func(t *testing.T) { |
| 411 | _, err := parseAuditJSONL("/nonexistent/path/audit.jsonl") |
| 412 | assert.Error(t, err, "Should return error for missing file") |
nothing calls this directly
no test coverage detected