wulf-pulse/lib/services/remediation-default-params.test.ts

import { describe, it, expect } from 'vitest';
import { deriveDefaultParams, type DefaultParamEvidence } from './remediation-default-params';

const filledEvidence: DefaultParamEvidence = {
  requesterEmail: 'requester@wulfconsulting.test',
  senderEmail: 'attacker@evil.test',
  senderDomain: 'evil.test',
  messageId: 'message-123',
};

const emptyEvidence: DefaultParamEvidence = {
  requesterEmail: null,
  senderEmail: null,
  senderDomain: null,
  messageId: null,
};

describe('deriveDefaultParams', () => {
  it('returns {} for no_action', () => {
    expect(deriveDefaultParams('no_action', filledEvidence)).toEqual({});
  });

  it('returns recipientEmail + empty message for warn_user, using requesterEmail', () => {
    expect(deriveDefaultParams('warn_user', filledEvidence)).toEqual({
      recipientEmail: 'requester@wulfconsulting.test',
      message: '',
    });
  });

  it('returns senderEmail + senderDomain for block_sender', () => {
    expect(deriveDefaultParams('block_sender', filledEvidence)).toEqual({
      senderEmail: 'attacker@evil.test',
      senderDomain: 'evil.test',
    });
  });

  it('returns messageId + empty mailboxes for purge_message', () => {
    expect(deriveDefaultParams('purge_message', filledEvidence)).toEqual({
      messageId: 'message-123',
      mailboxes: [],
    });
  });

  it('returns userPrincipalName (from requesterEmail) for reset_password', () => {
    expect(deriveDefaultParams('reset_password', filledEvidence)).toEqual({
      userPrincipalName: 'requester@wulfconsulting.test',
    });
  });

  it('returns empty deviceId for isolate_endpoint', () => {
    expect(deriveDefaultParams('isolate_endpoint', filledEvidence)).toEqual({ deviceId: '' });
  });

  it('returns userPrincipalName + empty ruleName for disable_forwarding_rule', () => {
    expect(deriveDefaultParams('disable_forwarding_rule', filledEvidence)).toEqual({
      userPrincipalName: 'requester@wulfconsulting.test',
      ruleName: '',
    });
  });

  it('returns {} for an unknown/future action type', () => {
    expect(deriveDefaultParams('unknown_future_type', filledEvidence)).toEqual({});
  });

  it('falls back to empty-string defaults for warn_user/block_sender/reset_password/disable_forwarding_rule when evidence fields are null', () => {
    expect(deriveDefaultParams('warn_user', emptyEvidence)).toEqual({ recipientEmail: '', message: '' });
    expect(deriveDefaultParams('block_sender', emptyEvidence)).toEqual({ senderEmail: '', senderDomain: '' });
    expect(deriveDefaultParams('purge_message', emptyEvidence)).toEqual({ messageId: '', mailboxes: [] });
    expect(deriveDefaultParams('reset_password', emptyEvidence)).toEqual({ userPrincipalName: '' });
    expect(deriveDefaultParams('disable_forwarding_rule', emptyEvidence)).toEqual({
      userPrincipalName: '',
      ruleName: '',
    });
  });
});