wulf-pulse/lib/services/campaign-grouping-service.test.ts

import { describe, it, expect, vi, beforeEach } from 'vitest';

// Mock postgresClient BEFORE importing the module under test.
const queryMock = vi.fn();
const transactionMock = vi.fn();
vi.mock('./postgres-client', () => ({
  postgresClient: {
    query: (...args: unknown[]) => queryMock(...args),
    transaction: (...args: unknown[]) => transactionMock(...args),
  },
}));

// eslint-disable-next-line import/first -- imported after vi.mock hoisting
import { normalizeSubject, extractUrlDomain, groupReportIntoCampaign } from './campaign-grouping-service';

describe('normalizeSubject', () => {
  it('strips a single Re: prefix, lowercases, trims', () => {
    expect(normalizeSubject('Re: Your Invoice ')).toBe('your invoice');
  });

  it('strips repeated Re:/Fwd:/Fw: prefixes case-insensitively', () => {
    expect(normalizeSubject('FW: Re: fwd: Urgent Payment')).toBe('urgent payment');
  });

  it('handles null', () => {
    expect(normalizeSubject(null)).toBe('');
  });

  it('handles empty string', () => {
    expect(normalizeSubject('')).toBe('');
  });

  it('lowercases and trims a subject with no prefix', () => {
    expect(normalizeSubject('  Urgent Payment  ')).toBe('urgent payment');
  });
});

describe('extractUrlDomain', () => {
  it('extracts hostname from a full URL', () => {
    expect(extractUrlDomain('https://evil.example.com/path?x=1')).toBe('evil.example.com');
  });

  it('returns null for a malformed URL instead of throwing', () => {
    expect(extractUrlDomain('not-a-url')).toBeNull();
  });

  it('extracts hostname regardless of scheme', () => {
    expect(extractUrlDomain('http://another.example.net')).toBe('another.example.net');
  });
});

// =============================================================================
// groupReportIntoCampaign — mocked-DB behavior (CAMP-01, CAMP-02, D-08)
//
// `transactionMock` invokes its callback with a fake `client` whose `query`
// method routes to staged rows based on a distinguishing SQL substring for
// each of the implementation's queries (own report / own message / tier 1 /
// own indicators / tier 2 candidates / candidate indicators / tier 3 /
// update campaigns / update reports / insert campaign). This mirrors
// phishing-eml-service.test.ts's `callsContaining()` discipline but resolves
// per-call instead of asserting only after the fact, since groupReportInto
// Campaign's control flow branches on intermediate query results.
// =============================================================================

interface MockRows {
  ownReport?: unknown[];
  ownMessage?: unknown[];
  tier1?: unknown[];
  ownIndicators?: unknown[];
  tier2Candidates?: unknown[];
  candidateIndicators?: unknown[];
  tier3?: unknown[];
  insertCampaign?: unknown[];
}

/** Records every SQL call made through the fake transaction client. */
let clientCalls: Array<{ sql: string; params: unknown[] }> = [];

function makeClient(rows: MockRows) {
  return {
    query: vi.fn(async (sql: string, params?: unknown[]) => {
      clientCalls.push({ sql, params: params ?? [] });

      if (sql.includes('requester_contact_id, company_id, created_at')) {
        return { rows: rows.ownReport ?? [], rowCount: rows.ownReport?.length ?? 0 };
      }
      if (sql.includes('FROM messages') && sql.includes('WHERE report_id = $1')) {
        return { rows: rows.ownMessage ?? [], rowCount: rows.ownMessage?.length ?? 0 };
      }
      if (sql.includes('WHERE m.message_id = $1')) {
        return { rows: rows.tier1 ?? [], rowCount: rows.tier1?.length ?? 0 };
      }
      if (sql.includes('FROM indicators') && sql.includes('WHERE message_id = $1')) {
        return { rows: rows.ownIndicators ?? [], rowCount: rows.ownIndicators?.length ?? 0 };
      }
      if (sql.includes('BETWEEN $2::timestamptz')) {
        return { rows: rows.tier2Candidates ?? [], rowCount: rows.tier2Candidates?.length ?? 0 };
      }
      if (sql.includes('message_id = ANY')) {
        return { rows: rows.candidateIndicators ?? [], rowCount: rows.candidateIndicators?.length ?? 0 };
      }
      if (sql.includes('BETWEEN $4::timestamptz')) {
        return { rows: rows.tier3 ?? [], rowCount: rows.tier3?.length ?? 0 };
      }
      if (sql.includes('UPDATE campaigns')) {
        return { rows: [], rowCount: 1 };
      }
      if (sql.includes('UPDATE reports SET campaign_id')) {
        return { rows: [], rowCount: 1 };
      }
      if (sql.includes('INSERT INTO campaigns')) {
        return { rows: rows.insertCampaign ?? [{ id: 'unstaged-campaign-id' }], rowCount: 1 };
      }
      throw new Error(`Unstaged query in test mock: ${sql}`);
    }),
  };
}

function callsContaining(needle: string) {
  return clientCalls.filter((c) => c.sql.includes(needle));
}

describe('groupReportIntoCampaign', () => {
  beforeEach(() => {
    queryMock.mockReset();
    transactionMock.mockReset();
    clientCalls = [];
  });

  function stage(rows: MockRows) {
    transactionMock.mockImplementation(async (callback: (client: unknown) => Promise<unknown>) =>
      callback(makeClient(rows))
    );
  }

  const REPORT_ROW = {
    title: 'Re: Invoice Alert',
    requester_contact_id: 5,
    company_id: 10,
    created_at: '2026-07-15T10:00:00Z',
  };

  it('Tier 3 match increments existing campaign report_count, updates last_seen_at, links campaign_id, and never creates a second campaign', async () => {
    stage({
      ownReport: [REPORT_ROW],
      ownMessage: [],
      tier3: [{ campaign_id: 'campaign-1', title: 'Invoice Alert' }],
    });

    const result = await groupReportIntoCampaign('report-2');

    expect(result).toEqual({
      campaignId: 'campaign-1',
      groupMethod: 'sender_subject_client',
      created: false,
    });

    const updateCampaignCalls = callsContaining('UPDATE campaigns');
    expect(updateCampaignCalls).toHaveLength(1);
    expect(updateCampaignCalls[0].sql).toContain('report_count = report_count + 1');
    expect(updateCampaignCalls[0].sql).toContain('last_seen_at = NOW()');
    expect(updateCampaignCalls[0].params).toEqual(['campaign-1']);

    const updateReportCalls = callsContaining('UPDATE reports SET campaign_id');
    expect(updateReportCalls).toHaveLength(1);
    expect(updateReportCalls[0].params).toEqual(['campaign-1', 'report-2']);

    expect(callsContaining('INSERT INTO campaigns')).toHaveLength(0);
  });

  it('creates exactly one new campaign when no tier matches anything', async () => {
    stage({
      ownReport: [REPORT_ROW],
      ownMessage: [],
      tier3: [],
      insertCampaign: [{ id: 'new-campaign-id' }],
    });

    const result = await groupReportIntoCampaign('report-3');

    expect(result).toEqual({
      campaignId: 'new-campaign-id',
      groupMethod: 'sender_subject_client',
      created: true,
    });

    const insertCalls = callsContaining('INSERT INTO campaigns');
    expect(insertCalls).toHaveLength(1);
    expect(insertCalls[0].params).toEqual([
      'sender_subject_client:5:invoice alert:10',
      'sender_subject_client',
    ]);
    expect(callsContaining('UPDATE campaigns')).toHaveLength(0);
  });

  it('skipIfAlreadyGrouped:true returns null when the pre-check SELECT reports a non-null campaign_id (D-08)', async () => {
    queryMock.mockResolvedValueOnce({ rows: [{ campaign_id: 'already-grouped' }], rowCount: 1 });

    const result = await groupReportIntoCampaign('report-4', { skipIfAlreadyGrouped: true });

    expect(result).toBeNull();
    expect(transactionMock).not.toHaveBeenCalled();
  });

  it('skipIfAlreadyGrouped:true proceeds to full matching when campaign_id is null', async () => {
    queryMock.mockResolvedValueOnce({ rows: [{ campaign_id: null }], rowCount: 1 });
    stage({
      ownReport: [REPORT_ROW],
      ownMessage: [],
      tier3: [{ campaign_id: 'campaign-9', title: 'Invoice Alert' }],
    });

    const result = await groupReportIntoCampaign('report-5', { skipIfAlreadyGrouped: true });

    expect(result).toEqual({
      campaignId: 'campaign-9',
      groupMethod: 'sender_subject_client',
      created: false,
    });
  });

  it('Tier 1 (Message-ID) matches before Tier 2/3 are ever queried', async () => {
    stage({
      ownReport: [REPORT_ROW],
      ownMessage: [{ id: 'own-msg-id', message_id: 'shared-message-id-123' }],
      tier1: [{ campaign_id: 'campaign-t1' }],
    });

    const result = await groupReportIntoCampaign('report-6');

    expect(result).toEqual({
      campaignId: 'campaign-t1',
      groupMethod: 'message_id',
      created: false,
    });
    expect(callsContaining('FROM indicators')).toHaveLength(0);
    expect(callsContaining('JOIN contacts c')).toHaveLength(0);
  });

  it('Tier 2 (attachment-hash/URL-domain + subject + sender + 24h) matches when Tier 1 finds nothing', async () => {
    stage({
      ownReport: [REPORT_ROW],
      ownMessage: [{ id: 'own-msg-id', message_id: 'unique-message-id-no-other-match' }],
      tier1: [], // own message_id matches no other already-grouped report
      ownIndicators: [
        { indicator_type: 'attachment_hash', value: 'hash123' },
        { indicator_type: 'sender', value: 'attacker@evil.example.com' },
      ],
      tier2Candidates: [
        {
          report_id: 'other-report',
          campaign_id: 'campaign-t2',
          title: 'Invoice Alert',
          message_id: 'other-msg-id',
        },
      ],
      candidateIndicators: [
        { message_id: 'other-msg-id', indicator_type: 'attachment_hash', value: 'hash123' },
        { message_id: 'other-msg-id', indicator_type: 'sender', value: 'attacker@evil.example.com' },
      ],
    });

    const result = await groupReportIntoCampaign('report-7');

    expect(result).toEqual({
      campaignId: 'campaign-t2',
      groupMethod: 'attachment_or_url',
      created: false,
    });
  });

  it('extracts URL-domain (not raw URL string) when matching Tier 2 via url indicators', async () => {
    stage({
      ownReport: [REPORT_ROW],
      ownMessage: [{ id: 'own-msg-id', message_id: 'unique-message-id-no-other-match-2' }],
      tier1: [],
      ownIndicators: [
        { indicator_type: 'url', value: 'https://evil.example.com/phish?x=1' },
        { indicator_type: 'sender', value: 'attacker@evil.example.com' },
      ],
      tier2Candidates: [
        {
          report_id: 'other-report',
          campaign_id: 'campaign-t2-url',
          title: 'Invoice Alert',
          message_id: 'other-msg-id-2',
        },
      ],
      candidateIndicators: [
        // Different raw URL string, same domain — must match via extractUrlDomain, not exact string equality.
        { message_id: 'other-msg-id-2', indicator_type: 'url', value: 'https://evil.example.com/different-path' },
        { message_id: 'other-msg-id-2', indicator_type: 'sender', value: 'attacker@evil.example.com' },
      ],
    });

    const result = await groupReportIntoCampaign('report-8');

    expect(result).toEqual({
      campaignId: 'campaign-t2-url',
      groupMethod: 'attachment_or_url',
      created: false,
    });
  });

  it('re-running on an already-grouped report whose own messages/indicators would otherwise self-match does not increment report_count a second time (self-exclusion)', async () => {
    // Own message_id and own indicators exist (this report has already been
    // through parseAndStoreMessage), but NO other report shares them — the
    // only thing that *could* match is this report's own row, which every
    // tier query excludes via `r.id != <this report's id>`.
    stage({
      ownReport: [REPORT_ROW],
      ownMessage: [{ id: 'own-msg-id', message_id: 'self-message-id' }],
      tier1: [], // self-exclusion means the report's own linked campaign never surfaces here
      ownIndicators: [
        { indicator_type: 'attachment_hash', value: 'self-hash' },
        { indicator_type: 'sender', value: 'attacker@evil.example.com' },
      ],
      tier2Candidates: [], // no other report in the 24h window
      tier3: [], // no other report matches sender+subject+client either
      insertCampaign: [{ id: 'fresh-campaign-id' }],
    });

    const result = await groupReportIntoCampaign('already-grouped-report');

    // Tier 1's own message_id exists, so the new campaign is created with
    // the strongest available key (message_id) — see computeTier1Key.
    expect(result).toEqual({
      campaignId: 'fresh-campaign-id',
      groupMethod: 'message_id',
      created: true,
    });
    // The critical assertion: no existing campaign's report_count is bumped
    // a second time for this report re-run.
    expect(callsContaining('UPDATE campaigns')).toHaveLength(0);
  });
});