test: add assertions to deserialization tests

Add field-level assertions to test_l9event_json_from_reference_repository
covering event metadata, HTTP, SSL, service, leak, network, tags, and
transport fields. Add structural assertions to test_l9events_from_ip4scout
verifying event_source, event_type, ip, and port.

Closes #26

Author: dannywillems

tests/test_l9format.py

@@ -16,14 +16,56 @@ def test_l9event_json_from_reference_repository():
     path = TESTS_DIR / "l9event.json"
     with open(path) as f:
         c = json.load(f)
-    L9Event.from_dict(c)
+    event = L9Event.from_dict(c)
+    assert event.event_type == "leak"
+    assert event.event_source == "DotEnvConfigPlugin"
+    assert event.ip == "127.0.0.1"
+    assert event.port == "8080"
+    assert event.host == "site1.example.com"
+    assert event.reverse == "ptr1.example.com"
+    assert event.protocol == "https"
+    assert event.summary == "GET /... qwerqwer"
+    assert event.http.root == "/site1"
+    assert event.http.url == "/site1/.env"
+    assert event.http.status == 200
+    assert event.http.length == 12423
+    assert event.http.title == "Apache welcome page"
+    assert event.ssl.detected is True
+    assert event.ssl.enabled is True
+    assert event.ssl.version == "TLSv1.3"
+    assert event.ssl.certificate.cn == "example.com"
+    assert event.ssl.certificate.key_algo == "RSA"
+    assert event.ssl.certificate.key_size == 2048
+    assert event.service.software.name == "Apache"
+    assert event.service.software.version == "2.2.4"
+    assert event.service.credentials.noauth is True
+    assert event.leak.stage == "open"
+    assert event.leak.type == "configuration"
+    assert event.leak.severity == "medium"
+    assert event.leak.dataset.rows == 4
+    assert event.leak.dataset.files == 1
+    assert event.network.asn == 0
+    assert event.tags == ["plc"]
+    assert event.transport == ["tcp", "tls", "http"]
+    assert event.event_pipeline == [
+        "ip4scout",
+        "l9tcpid",
+        "l9explore",
+        "DotEnvConfigPlugin",
+    ]
 
 
 def test_l9events_from_ip4scout():
     for path in IP4SCOUT_FILES:
         with open(path) as f:
             c = json.load(f)
-        L9Event.from_dict(c)
+        event = L9Event.from_dict(c)
+        assert event.event_source == "ip4scout"
+        assert event.event_type == "synack"
+        assert isinstance(event.ip, str)
+        assert len(event.ip) > 0
+        assert isinstance(event.port, str)
+        assert len(event.port) > 0
 
 
 def test_iso8601_nanosecond_parsing():