security-alert-center/backend/tests/test_telegram_templates.py

"""Telegram HTML templates (notif-30)."""

from datetime import datetime, timezone

from app.models import Event, Host
from app.services.telegram_templates import format_event_telegram_html, format_rdp_login_html, html_escape


def test_html_escape_special_chars():
    assert html_escape("a<b>&") == "a&lt;b&gt;&amp;"


def test_sanitize_telegram_html_keeps_bold():
    from app.services.telegram_templates import sanitize_telegram_html

    assert sanitize_telegram_html("<b>title</b><br>line") == "<b>title</b>\nline"


def test_rdp_failed_template_includes_user_ip_logon():
    host = Host(hostname="K6A-DC3", display_name="UNMS Kalina", os_family="windows")
    event = Event(
        event_id="00000000-0000-4000-8000-000000000501",
        host_id=1,
        host=host,
        occurred_at=datetime(2026, 5, 29, 10, 30, 0, tzinfo=timezone.utc),
        category="auth",
        type="rdp.login.failed",
        severity="warning",
        title="RDP login failed",
        summary="4625 user from 10.0.0.5",
        details={
            "user": "DOMAIN\\admin",
            "ip_address": "10.0.0.5",
            "logon_type": 10,
            "event_id_windows": 4625,
            "workstation_name": "CLIENT01",
        },
        payload={},
    )
    text = format_rdp_login_html(event)
    assert "НЕУДАЧНАЯ" in text
    assert "DOMAIN\\admin" in text or "DOMAIN" in text
    assert "10.0.0.5" in text
    assert "Удаленный интерактивный" in text
    assert "(10)" in text
    assert "UNMS Kalina" in text
    assert "CLIENT01" in text
    assert "4625" in text
    assert "<b>" in text


def test_rdp_success_template():
    event = Event(
        event_id="00000000-0000-4000-8000-000000000502",
        host_id=1,
        occurred_at=datetime(2026, 5, 29, 11, 0, tzinfo=timezone.utc),
        category="auth",
        type="rdp.login.success",
        severity="info",
        title="ok",
        summary="ok",
        details={"user": "u1", "ip_address": "1.2.3.4", "logon_type": 3},
        payload={},
    )
    text = format_event_telegram_html(event)
    assert "УСПЕШНЫЙ" in text
    assert "Сеть/RDP" in text
    assert "📡 Оповещение: агент" in text


def test_event_telegram_includes_sac_source_for_sac_daily_report():
    host = Host(hostname="h1", display_name="H1", os_family="linux", product="ssh-monitor")
    event = Event(
        event_id="00000000-0000-4000-8000-000000000504",
        host_id=1,
        host=host,
        occurred_at=datetime(2026, 5, 29, 9, 0, tzinfo=timezone.utc),
        category="report",
        type="report.daily.ssh",
        severity="info",
        title="Отчёт",
        summary="short",
        details={"generated_by": "sac", "report_body": "📊 ЕЖЕДНЕВНЫЙ ОТЧЕТ SSH МОНИТОРИНГА\nline"},
        payload={},
    )
    text = format_event_telegram_html(event)
    assert "📡 Оповещение: SAC (Security Alert Center)" in text


def test_rdp_shadow_control_template():
    host = Host(hostname="RDS01", display_name="RDS Farm", ipv4="10.0.0.5", os_family="windows")
    event = Event(
        event_id="00000000-0000-4000-8000-000000000701",
        host_id=1,
        host=host,
        occurred_at=datetime(2026, 5, 30, 10, 0, 0, tzinfo=timezone.utc),
        category="session",
        type="rdp.shadow.control.started",
        severity="warning",
        title="RDS Shadow Control 20506",
        summary="Shadow admin -> user",
        details={
            "event_id_windows": 20506,
            "shadower_user": "DOMAIN\\admin",
            "target_user": "DOMAIN\\user",
            "session_id": "3",
            "shadow_action": "control_started",
        },
        payload={},
    )
    text = format_event_telegram_html(event)
    assert "SHADOW CONTROL" in text
    assert "DOMAIN" in text
    assert "20506" in text
    assert "RDS Farm" in text


def test_winrm_session_template():
    host = Host(hostname="SRV01", display_name="App Server", os_family="windows")
    event = Event(
        event_id="00000000-0000-4000-8000-000000000702",
        host_id=1,
        host=host,
        occurred_at=datetime(2026, 5, 30, 11, 0, 0, tzinfo=timezone.utc),
        category="session",
        type="winrm.session.started",
        severity="warning",
        title="WinRM shell",
        summary="WinRM 91",
        details={
            "event_id_windows": 91,
            "user": "DOMAIN\\admin",
            "source_ip": "192.168.160.3",
            "resource_uri": "http://schemas.microsoft.com/powershell/Microsoft.PowerShell",
        },
        payload={},
    )
    text = format_event_telegram_html(event)
    assert "Enter-PSSession" in text or "WinRM" in text
    assert "192.168.160.3" in text
    assert "91" in text


def test_ssh_failed_template():
    event = Event(
        event_id="00000000-0000-4000-8000-000000000503",
        host_id=1,
        occurred_at=datetime(2026, 5, 29, 12, 0, tzinfo=timezone.utc),
        category="auth",
        type="ssh.login.failed",
        severity="warning",
        title="ssh fail",
        summary="fail",
        details={"user": "root", "source_ip": "10.10.36.9", "port": 22, "attempt_number": 3, "max_attempts": 5},
        payload={},
    )
    text = format_event_telegram_html(event)
    assert "SSH" in text
    assert "root" in text
    assert "10.10.36.9" in text
    assert "3 / 5" in text