anti
b5ce236cab
Three producer-side regression guards. Each drives the worker's run loop with a fake bus + stubbed repo and asserts the documented topic fires when the producer has data: - reuse correlator → credential.reuse.detected (one finding row) - clusterer → identity.formed + identity.merged (one ClusterResult) - intel worker → attacker.intel.enriched (one unenriched attacker + a fake provider returning a "malicious" verdict) These complement commit 1's attacker.session.ended producer test — together the four cover every TTP-relevant publisher in the tree (modulo email.received, which has no producer yet; tracked in DEBT.md).
98 lines
2.8 KiB
Python
98 lines
2.8 KiB
Python
"""Intel worker publishes ``attacker.intel.enriched`` per enriched row.
|
|
|
|
Pins the producer wiring. The worker drains
|
|
``repo.get_unenriched_attackers``, calls the providers' ``lookup``,
|
|
upserts via ``repo.upsert_attacker_intel``, and publishes
|
|
``attacker.intel.enriched`` per row.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import asyncio
|
|
import os
|
|
from typing import Any
|
|
|
|
import pytest
|
|
|
|
from decnet.bus import topics as _topics
|
|
from decnet.bus.fake import FakeBus
|
|
from decnet.intel import worker as _iw
|
|
from decnet.intel.base import IntelProvider, IntelResult
|
|
|
|
|
|
class _FakeProvider(IntelProvider):
|
|
name = "fake"
|
|
|
|
async def lookup(self, ip: str) -> IntelResult:
|
|
return IntelResult(
|
|
provider="fake",
|
|
column_updates={"fake_classification": "malicious"},
|
|
verdict="malicious",
|
|
)
|
|
|
|
|
|
class _RepoStub:
|
|
def __init__(self, pending: list[dict[str, Any]]) -> None:
|
|
self._pending = pending
|
|
self._yielded = False
|
|
self.upserts: list[dict[str, Any]] = []
|
|
|
|
async def get_unenriched_attackers(
|
|
self, *, limit: int = 100,
|
|
) -> list[dict[str, Any]]:
|
|
if not self._yielded:
|
|
self._yielded = True
|
|
return list(self._pending)
|
|
return []
|
|
|
|
async def upsert_attacker_intel(self, row: dict[str, Any]) -> None:
|
|
self.upserts.append(row)
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_intel_worker_publishes_intel_enriched(
|
|
monkeypatch: pytest.MonkeyPatch,
|
|
) -> None:
|
|
bus = FakeBus()
|
|
await bus.connect()
|
|
monkeypatch.setattr(_iw, "get_bus", lambda *_a, **_kw: bus)
|
|
|
|
captured: list[tuple[str, dict[str, Any]]] = []
|
|
sub = bus.subscribe(_topics.attacker(_topics.ATTACKER_INTEL_ENRICHED))
|
|
|
|
async def drain() -> None:
|
|
try:
|
|
async with sub:
|
|
async for ev in sub:
|
|
captured.append((ev.topic, ev.payload))
|
|
except Exception:
|
|
pass
|
|
|
|
drain_task = asyncio.create_task(drain())
|
|
await asyncio.sleep(0)
|
|
|
|
repo = _RepoStub([
|
|
{"uuid": "att-1", "ip": "192.168.1.5"},
|
|
])
|
|
shutdown = asyncio.Event()
|
|
|
|
loop_task = asyncio.create_task(_iw.run_intel_loop(
|
|
repo, # type: ignore[arg-type]
|
|
poll_interval_secs=0.05, ttl_hours=24,
|
|
providers=[_FakeProvider()],
|
|
shutdown=shutdown,
|
|
))
|
|
await asyncio.sleep(0.2)
|
|
shutdown.set()
|
|
await asyncio.wait_for(loop_task, timeout=2.0)
|
|
drain_task.cancel()
|
|
await bus.close()
|
|
|
|
assert len(repo.upserts) == 1
|
|
assert len(captured) == 1
|
|
topic, payload = captured[0]
|
|
assert topic == _topics.attacker(_topics.ATTACKER_INTEL_ENRICHED)
|
|
assert payload["attacker_uuid"] == "att-1"
|
|
assert payload["attacker_ip"] == "192.168.1.5"
|
|
assert payload["aggregate_verdict"] == "malicious"
|
|
assert "fake" in payload["providers"]
|