acdl/tests/test_checkov_adapter.py

import json
import sys
from pathlib import Path

import jsonschema
import pytest

sys.path.insert(0, str(Path(__file__).resolve().parent.parent))

from adapters.terraform.policy.checkov_adapter import (
    RULE_MAP, _to_pcr, adapt,
)


class TestRuleMap:
    def test_secrets_rules(self):
        assert RULE_MAP["CKV_AWS_41"][0] == "secrets-in-plaintext"
        assert RULE_MAP["CKV_AWS_45"][0] == "secrets-in-plaintext"

    def test_public_ingress_rules(self):
        assert RULE_MAP["CKV_AWS_20"][0] == "public-ingress"
        assert RULE_MAP["CKV_AWS_57"][0] == "public-ingress"

    def test_iam_wildcard(self):
        assert RULE_MAP["CKV_AWS_1"][0] == "iam-wildcard"

    def test_kms(self):
        assert RULE_MAP["CKV_AWS_7"][0] == "kms-key-reference"

    def test_all_have_severities(self):
        for rule_id, (cat, sev) in RULE_MAP.items():
            assert sev in ("high", "medium", "low", "info"), f"{rule_id} has bad severity {sev}"


class TestToPcr:
    def test_passed_result(self):
        rec = {"check_id": "CKV_AWS_20", "check_name": "No public ingress", "file_path": "main.tf"}
        pcr = _to_pcr(rec, "contract-123", "PASSED")
        assert pcr["result"] == "pass"
        assert pcr["contractId"] == "contract-123"
        assert pcr["engine"] == "checkov"
        assert pcr["ruleId"] == "CKV_AWS_20"
        assert pcr["severity"] == "high"

    def test_failed_result(self):
        rec = {"check_id": "CKV_AWS_1", "check_name": "No wildcard IAM"}
        pcr = _to_pcr(rec, "c-1", "FAILED")
        assert pcr["result"] == "fail"
        assert pcr["severity"] == "high"

    def test_skipped_result(self):
        rec = {"check_id": "UNKNOWN_RULE", "check_name": "some check"}
        pcr = _to_pcr(rec, "c-1", "SKIPPED")
        assert pcr["result"] == "skipped"
        assert pcr["severity"] == "info"

    def test_unknown_rule_defaults_to_info(self):
        rec = {"check_id": "UNKNOWN_RULE", "check_name": "unknown"}
        pcr = _to_pcr(rec, "c-1", "FAILED")
        assert pcr["severity"] == "info"

    def test_pcr_validates_against_schema(self, policy_check_result_schema):
        rec = {"check_id": "CKV_AWS_20", "check_name": "test", "file_path": "main.tf",
               "resource": "aws_s3_bucket.s3", "resource_address": "aws_s3_bucket.s3"}
        pcr = _to_pcr(rec, "c-1", "FAILED")
        jsonschema.validate(pcr, policy_check_result_schema)


class TestRuleMapTagging:
    def test_nova_tag_naming_is_real_rule(self):
        # D-054 / D-043 closure, P2 rename (REQ-158): NOVA_TAG_NAMING is now
        # a real custom Checkov rule, not a synthetic SKIPPED record.
        assert RULE_MAP["NOVA_TAG_NAMING"] == ("tagging-standard", "medium")


class TestAdapt:
    def _sample_checkov_json(self):
        return {
            "terraform_plan": {
                "results": {
                    "passed_checks": [
                        {"check_id": "CKV_AWS_20", "check_name": "no public ingress",
                         "file_path": "main.tf", "resource": "aws_vpc.vpc"}
                    ],
                    "failed_checks": [
                        {"check_id": "CKV_AWS_1", "check_name": "no wildcard iam",
                         "file_path": "main.tf", "resource": "aws_iam_role.r"}
                    ],
                    "skipped_checks": []
                }
            }
        }

    def test_adapt_returns_list(self, tmp_path):
        data = self._sample_checkov_json()
        f = tmp_path / "checkov.json"
        f.write_text(json.dumps(data))
        results = adapt(str(f), "c-1")
        assert isinstance(results, list)

    def test_adapt_does_not_emit_synthetic_tag_naming(self, tmp_path):
        # D-043 closure: adapt() no longer appends a synthetic SKIPPED
        # NOVA_TAG_NAMING record. The custom Checkov rule (loaded via
        # --external-checks-dir) produces real PASS/FAIL records instead.
        data = self._sample_checkov_json()
        f = tmp_path / "checkov.json"
        f.write_text(json.dumps(data))
        results = adapt(str(f), "c-1")
        tag = [r for r in results if r["ruleId"] == "NOVA_TAG_NAMING"]
        assert tag == []  # no synthetic record

    def test_adapt_has_passed_and_failed(self, tmp_path):
        data = self._sample_checkov_json()
        f = tmp_path / "checkov.json"
        f.write_text(json.dumps(data))
        results = adapt(str(f), "c-1")
        passed = [r for r in results if r["result"] == "pass"]
        failed = [r for r in results if r["result"] == "fail"]
        assert len(passed) >= 1
        assert len(failed) >= 1

    def test_adapt_empty_input(self, tmp_path):
        data = {"terraform_plan": {"results": {"passed_checks": [], "failed_checks": [], "skipped_checks": []}}}
        f = tmp_path / "checkov.json"
        f.write_text(json.dumps(data))
        results = adapt(str(f), "c-1")
        assert results == []  # no synthetic tag-naming record anymore