up

src/Policy/__Tests/StellaOps.Policy.Engine.Tests/BatchEvaluation/BatchEvaluationMapperTests.cs

@@ -0,0 +1,91 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using StellaOps.Policy;
+using StellaOps.Policy.Engine.BatchEvaluation;
+using StellaOps.Policy.Engine.Services;
+using Xunit;
+
+namespace StellaOps.Policy.Engine.Tests.BatchEvaluation;
+
+public sealed class BatchEvaluationMapperTests
+{
+    [Fact]
+    public void Validate_Fails_WhenTimestampMissing()
+    {
+        var request = new BatchEvaluationRequestDto(
+            TenantId: "acme",
+            Items: new[]
+            {
+                new BatchEvaluationItemDto(
+                    PackId: "pack-1",
+                    Version: 1,
+                    SubjectPurl: "pkg:npm/lodash@4.17.21",
+                    AdvisoryId: "ADV-1",
+                    Severity: new EvaluationSeverityDto("high", 7.5m),
+                    Advisory: new AdvisoryDto(new Dictionary<string, string>(), "nvd"),
+                    Vex: new VexEvidenceDto(Array.Empty<VexStatementDto>()),
+                    Sbom: new SbomDto(Array.Empty<string>()),
+                    Exceptions: new ExceptionsDto(),
+                    Reachability: new ReachabilityDto("unknown"),
+                    EvaluationTimestamp: null)
+            });
+
+        var ok = BatchEvaluationValidator.TryValidate(request, out var error);
+
+        Assert.False(ok);
+        Assert.Contains("evaluationTimestamp", error, StringComparison.OrdinalIgnoreCase);
+    }
+
+    [Fact]
+    public void Mapper_Produces_RuntimeRequest_WithSuppliedValues()
+    {
+        var item = new BatchEvaluationItemDto(
+            PackId: "pack-1",
+            Version: 2,
+            SubjectPurl: "pkg:npm/foo@1.0.0",
+            AdvisoryId: "ADV-1",
+            Severity: new EvaluationSeverityDto("high", 8.0m),
+            Advisory: new AdvisoryDto(new Dictionary<string, string>
+            {
+                ["cve"] = "CVE-2025-0001"
+            }, "nvd"),
+            Vex: new VexEvidenceDto(new[]
+            {
+                new VexStatementDto("not_affected", "vendor_confirmed", "stmt-1", new DateTimeOffset(2025, 1, 1, 0, 0, 0, TimeSpan.Zero))
+            }),
+            Sbom: new SbomDto(
+                Tags: new[] { "runtime", "server" },
+                Components: new[]
+                {
+                    new ComponentDto("foo", "1.0.0", "npm", "pkg:npm/foo@1.0.0")
+                }),
+            Exceptions: new ExceptionsDto(
+                Effects: new Dictionary<string, PolicyExceptionEffect>(),
+                Instances: new[]
+                {
+                    new ExceptionInstanceDto(
+                        Id: "ex-1",
+                        EffectId: "suppress",
+                        Scope: new ExceptionScopeDto(
+                            RuleNames: new[] { "rule-1" },
+                            Severities: new[] { "high" }),
+                        CreatedAt: new DateTimeOffset(2025, 1, 2, 0, 0, 0, TimeSpan.Zero))
+                }),
+            Reachability: new ReachabilityDto("reachable", 0.9m, 0.8m, HasRuntimeEvidence: true, Source: "scanner", Method: "static", EvidenceRef: "evidence-1"),
+            EvaluationTimestamp: new DateTimeOffset(2025, 1, 3, 0, 0, 0, TimeSpan.Zero),
+            BypassCache: false);
+
+        var runtimeRequests = BatchEvaluationMapper.ToRuntimeRequests("acme", new[] { item });
+        var runtime = Assert.Single(runtimeRequests);
+
+        Assert.Equal("acme", runtime.TenantId);
+        Assert.Equal("pack-1", runtime.PackId);
+        Assert.Equal("pkg:npm/foo@1.0.0", runtime.SubjectPurl);
+        Assert.Equal(new DateTimeOffset(2025, 1, 3, 0, 0, 0, TimeSpan.Zero), runtime.EvaluationTimestamp);
+        Assert.Equal("reachable", runtime.Reachability.State);
+        Assert.True(runtime.Reachability.HasRuntimeEvidence);
+        Assert.Equal("scanner", runtime.Reachability.Source);
+        Assert.Equal("high", runtime.Severity.Normalized);
+    }
+}