test(config): lock sample config contract

Author: stacknil

tests/test_cli.cpp

@@ -225,6 +225,12 @@ int main(int argc, char* argv[]) {
         + " " + quote_argument(config_run_out))
                                                 .c_str());
     expect(config_run_exit == 0, "expected sample config run to succeed");
+    expect_report_core_fields(
+        read_file(config_run_out / "report.md"),
+        read_file(config_run_out / "report.json"),
+        "syslog_legacy",
+        true,
+        false);
 
     const auto journalctl_out = output_dir / "journalctl_cli";
     std::filesystem::create_directories(journalctl_out);

tests/test_detector.cpp

@@ -10,6 +10,7 @@
 #include <stdexcept>
 #include <string>
 #include <string_view>
+#include <vector>
 
 namespace {
 
@@ -49,6 +50,31 @@ std::vector<loglens::Event> parse_events(loglens::ParserConfig config, std::stri
     return parser.parse_stream(input).events;
 }
 
+std::filesystem::path repo_root() {
+    const std::filesystem::path source_path{__FILE__};
+    std::vector<std::filesystem::path> candidates;
+
+    if (source_path.is_absolute()) {
+        candidates.push_back(source_path);
+    } else {
+        const auto cwd = std::filesystem::current_path();
+        candidates.push_back(cwd / source_path);
+        candidates.push_back(cwd.parent_path() / source_path);
+    }
+
+    for (const auto& candidate : candidates) {
+        if (std::filesystem::exists(candidate)) {
+            return candidate.parent_path().parent_path();
+        }
+    }
+
+    throw std::runtime_error("unable to resolve repository root from test source path");
+}
+
+std::filesystem::path asset_path(std::string_view filename) {
+    return repo_root() / "assets" / std::string(filename);
+}
+
 loglens::ParserConfig make_syslog_config() {
     return loglens::ParserConfig{
         loglens::InputMode::SyslogLegacy,
@@ -121,6 +147,54 @@ std::vector<loglens::Event> build_sudo_burst_preservation_events() {
         "Mar 10 08:24:15 example-host sudo:    alice : TTY=pts/0 ; PWD=/home/alice ; USER=root ; COMMAND=/usr/bin/vi /etc/ssh/sshd_config\n");
 }
 
+void expect_same_rule_threshold(const loglens::RuleThreshold& actual,
+                                const loglens::RuleThreshold& expected,
+                                const std::string& rule_name) {
+    expect(actual.threshold == expected.threshold, "expected " + rule_name + " threshold to match default");
+    expect(actual.window == expected.window, "expected " + rule_name + " window to match default");
+}
+
+void expect_same_auth_signal_behavior(const loglens::AuthSignalBehavior& actual,
+                                      const loglens::AuthSignalBehavior& expected,
+                                      const std::string& signal_name) {
+    expect(actual.counts_as_attempt_evidence == expected.counts_as_attempt_evidence,
+           "expected " + signal_name + " attempt-evidence mapping to match default");
+    expect(actual.counts_as_terminal_auth_failure == expected.counts_as_terminal_auth_failure,
+           "expected " + signal_name + " terminal-failure mapping to match default");
+}
+
+void expect_same_detector_config(const loglens::DetectorConfig& actual,
+                                 const loglens::DetectorConfig& expected) {
+    expect_same_rule_threshold(actual.brute_force, expected.brute_force, "brute_force");
+    expect_same_rule_threshold(actual.multi_user_probing, expected.multi_user_probing, "multi_user_probing");
+    expect_same_rule_threshold(actual.sudo_burst, expected.sudo_burst, "sudo_burst");
+
+    expect_same_auth_signal_behavior(
+        actual.auth_signal_mappings.ssh_failed_password,
+        expected.auth_signal_mappings.ssh_failed_password,
+        "ssh_failed_password");
+    expect_same_auth_signal_behavior(
+        actual.auth_signal_mappings.ssh_invalid_user,
+        expected.auth_signal_mappings.ssh_invalid_user,
+        "ssh_invalid_user");
+    expect_same_auth_signal_behavior(
+        actual.auth_signal_mappings.ssh_failed_publickey,
+        expected.auth_signal_mappings.ssh_failed_publickey,
+        "ssh_failed_publickey");
+    expect_same_auth_signal_behavior(
+        actual.auth_signal_mappings.ssh_failed_keyboard_interactive,
+        expected.auth_signal_mappings.ssh_failed_keyboard_interactive,
+        "ssh_failed_keyboard_interactive");
+    expect_same_auth_signal_behavior(
+        actual.auth_signal_mappings.ssh_max_auth_tries,
+        expected.auth_signal_mappings.ssh_max_auth_tries,
+        "ssh_max_auth_tries");
+    expect_same_auth_signal_behavior(
+        actual.auth_signal_mappings.pam_auth_failure,
+        expected.auth_signal_mappings.pam_auth_failure,
+        "pam_auth_failure");
+}
+
 void test_default_thresholds() {
     const auto events = build_events();
     const loglens::Detector detector;
@@ -341,6 +415,30 @@ void test_load_valid_config() {
     expect(findings.size() == 3, "expected loaded config to preserve default findings");
 }
 
+void test_sample_config_matches_default_detector_contract() {
+    const auto config = loglens::load_app_config(asset_path("sample_config.json"));
+    expect(config.input_mode == loglens::InputMode::SyslogLegacy,
+           "expected sample config to use syslog legacy input");
+    expect(config.timestamp.assume_year == 2026,
+           "expected sample config to provide the sample syslog year");
+    expect_same_detector_config(config.detector, loglens::DetectorConfig{});
+
+    const auto events = build_events();
+    const loglens::Detector default_detector;
+    const loglens::Detector sample_config_detector(config.detector);
+    const auto default_findings = default_detector.analyze(events);
+    const auto sample_config_findings = sample_config_detector.analyze(events);
+
+    expect(sample_config_findings.size() == default_findings.size(),
+           "expected sample config to preserve default finding count");
+    expect(find_finding(sample_config_findings, loglens::FindingType::BruteForce, "203.0.113.10") != nullptr,
+           "expected sample config to preserve brute-force finding");
+    expect(find_finding(sample_config_findings, loglens::FindingType::MultiUserProbing, "203.0.113.10") != nullptr,
+           "expected sample config to preserve multi-user finding");
+    expect(find_finding(sample_config_findings, loglens::FindingType::SudoBurst, "alice") != nullptr,
+           "expected sample config to preserve sudo-burst finding");
+}
+
 void test_reject_invalid_config() {
     const auto temp_path = std::filesystem::current_path() / "invalid_config_test.json";
     {
@@ -389,6 +487,7 @@ int main() {
     test_pam_auth_failure_does_not_trigger_bruteforce_by_default();
     test_equivalent_attack_scenario_yields_same_finding_count_across_modes();
     test_load_valid_config();
+    test_sample_config_matches_default_detector_contract();
     test_reject_invalid_config();
     return 0;
 }