using System.Runtime.Versioning;
using System.Text.Json;
using Xunit;

namespace OCSentinelCli.Tests;

[SupportedOSPlatform("windows")]
public sealed class RansomwareBetaTests
{
    [Fact]
    public void RansomwareBetaIsEnabledByDefault()
    {
        Assert.True(new ScannerConfiguration().RansomwareBetaEnabled);
        Assert.False(new ScannerConfiguration().RansomwareBetaAlertingEnabled);
    }

    [Fact]
    public void DisabledRansomwareBetaDoesNotReportSensorCoverage()
    {
        var summary = RansomwareBetaDetector.Scan(new ScannerConfiguration { RansomwareBetaEnabled = false }, []);

        Assert.False(summary.Enabled);
        Assert.Empty(summary.Sensors);
    }

    [Fact]
    public void SensorCoverageIsIncludedInTheJsonReport()
    {
        var summary = new RansomwareBetaSummary
        {
            Enabled = true,
            Sensors = [new RansomwareSensorStatus { Name = "security-process-4688", Enabled = true, Available = true, State = "available", EventCount = 4 }]
        };

        string json = JsonSerializer.Serialize(summary, JsonOptions.Default);

        Assert.Contains("\"Sensors\"", json);
        Assert.Contains("security-process-4688", json);
    }

    [Fact]
    public void FileChurnBelowBothThresholdsDoesNotCreateSignal()
    {
        var summary = new RansomwareFileChurnSummary
        {
            Enabled = true,
            DataAvailable = true,
            DeleteOperationCount = 49,
            WriteOperationCount = 500
        };

        RansomwareSignal? signal = RansomwareFileChurnDetector.CreateSignal(summary, new ScannerConfiguration());

        Assert.Null(signal);
    }

    [Fact]
    public void CriticalFileChurnCreatesOnlyMediumConfidenceSignal()
    {
        var summary = new RansomwareFileChurnSummary
        {
            Enabled = true,
            DataAvailable = true,
            WindowMinutes = 15,
            DeleteOperationCount = 200,
            WriteOperationCount = 1000,
            DistinctProcessCount = 1,
            TopProcesses = [new RansomwareFileChurnProcess { Process = "encryptor.exe", DeleteOperationCount = 200, WriteOperationCount = 1000 }]
        };

        RansomwareSignal? signal = RansomwareFileChurnDetector.CreateSignal(summary, new ScannerConfiguration());

        Assert.NotNull(signal);
        Assert.Equal("file-churn-critical", signal.Category);
        Assert.Equal("medium", signal.Confidence);
        Assert.Equal("encryptor.exe", signal.Process);
    }

    [Fact]
    public void PassiveBetaCannotElevateNinjaAlertState()
    {
        var summary = new RansomwareBetaSummary { Enabled = true, State = "critical" };

        Assert.False(RansomwareAlertPolicy.CanElevate(summary, alertingEnabled: false));
        Assert.True(RansomwareAlertPolicy.CanElevate(summary, alertingEnabled: true));
    }
}