test_case_integration.py

"""Integration tests for the SecOps CLI case commands.

These tests require valid credentials and API access.
They interact with real Chronicle API endpoints via CLI.
"""

import json
import subprocess

import pytest


@pytest.mark.integration
def test_cli_list_and_get_cases_workflow(cli_env, common_args):
    """Test CLI case list and get workflow.

    TODO: Remove 401 skip logic once SOAR IAM role issue is fixed.
    """
    # Test basic list
    list_cmd = ["secops"] + common_args + ["case", "list", "--page-size", "3"]
    list_result = subprocess.run(
        list_cmd, env=cli_env, capture_output=True, text=True
    )

    # Check for 401/Unauthorized or auth errors in stderr or stdout
    if list_result.returncode != 0:
        error_output = list_result.stderr + list_result.stdout
        auth_errors = [
            "401",
            "Unauthorized",
            "AuthenticationError",
            "Failed to get credentials",
            "DefaultCredentialsError",
        ]
        if any(err in error_output for err in auth_errors):
            pytest.skip(
                f"Skipping due to SOAR IAM/auth issue: {error_output[:200]}"
            )

    assert list_result.returncode == 0

    try:
        list_output = json.loads(list_result.stdout)
        assert "cases" in list_output
        assert isinstance(list_output["cases"], list)
        assert "totalSize" in list_output
    except json.JSONDecodeError:
        assert "Error:" not in list_result.stdout

    # Test list with --as-list flag
    as_list_cmd = (
        ["secops"]
        + common_args
        + ["case", "list", "--page-size", "3", "--as-list"]
    )
    as_list_result = subprocess.run(
        as_list_cmd, env=cli_env, capture_output=True, text=True
    )
    assert as_list_result.returncode == 0

    try:
        as_list_output = json.loads(as_list_result.stdout)
        assert isinstance(as_list_output, list)
        if as_list_output:
            assert "name" in as_list_output[0]
    except json.JSONDecodeError:
        assert "Error:" not in as_list_result.stdout

    # Test list with filter
    filter_cmd = (
        ["secops"]
        + common_args
        + ["case", "list", "--page-size", "5", "--filter", 'status = "OPENED"']
    )
    filter_result = subprocess.run(
        filter_cmd, env=cli_env, capture_output=True, text=True
    )
    assert filter_result.returncode == 0

    try:
        filter_output = json.loads(filter_result.stdout)
        assert "cases" in filter_output
    except json.JSONDecodeError:
        assert "Error:" not in filter_result.stdout

    # Test get case by ID
    try:
        if list_output.get("cases"):
            case_name = list_output["cases"][0].get("name", "")
            case_id = case_name.split("/")[-1]

            if case_id:
                get_cmd = (
                    ["secops"] + common_args + ["case", "get", "--id", case_id]
                )
                get_result = subprocess.run(
                    get_cmd, env=cli_env, capture_output=True, text=True
                )

                assert get_result.returncode == 0

                get_output = json.loads(get_result.stdout)
                assert "id" in get_output or "display_name" in get_output
                assert "priority" in get_output
                assert "status" in get_output
    except (json.JSONDecodeError, KeyError):
        pass


@pytest.mark.integration
def test_cli_case_update(cli_env, common_args):
    """Test the case update command.

    TODO: Remove 401 skip logic once SOAR IAM role issue is fixed.
    """
    # Use dedicated test case ID
    case_id = "7418669"

    # Get original case state
    get_cmd = ["secops"] + common_args + ["case", "get", "--id", case_id]
    get_result = subprocess.run(
        get_cmd, env=cli_env, capture_output=True, text=True
    )

    if get_result.returncode != 0:
        error_output = get_result.stderr + get_result.stdout
        auth_errors = [
            "401",
            "Unauthorized",
            "AuthenticationError",
            "Failed to get credentials",
            "DefaultCredentialsError",
        ]
        if any(err in error_output for err in auth_errors):
            pytest.skip(
                f"Skipping due to SOAR IAM/auth issue: {error_output[:200]}"
            )
        pytest.skip("Unable to get test case")

    try:
        get_output = json.loads(get_result.stdout)
        original_priority = get_output.get("priority", "PRIORITY_MEDIUM")

        # Determine new priority
        new_priority = (
            "PRIORITY_MEDIUM"
            if original_priority == "PRIORITY_HIGH"
            else "PRIORITY_HIGH"
        )

        # Update the case
        update_cmd = (
            ["secops"]
            + common_args
            + [
                "case",
                "update",
                "--id",
                case_id,
                "--data",
                f'{{"priority": "{new_priority}"}}',
                "--update-mask",
                "priority",
            ]
        )

        update_result = subprocess.run(
            update_cmd, env=cli_env, capture_output=True, text=True
        )

        # Check for 401/Unauthorized or auth errors
        if update_result.returncode != 0:
            error_output = update_result.stderr + update_result.stdout
            auth_errors = [
                "401",
                "Unauthorized",
                "AuthenticationError",
                "Failed to get credentials",
                "DefaultCredentialsError",
            ]
            if any(err in error_output for err in auth_errors):
                pytest.skip(
                    f"Skipping due to SOAR IAM/auth issue: "
                    f"{error_output[:200]}"
                )

        assert update_result.returncode == 0

        update_output = json.loads(update_result.stdout)
        assert update_output.get("priority") == new_priority

        # Cleanup: Restore original priority
        restore_cmd = (
            ["secops"]
            + common_args
            + [
                "case",
                "update",
                "--id",
                case_id,
                "--data",
                f'{{"priority": "{original_priority}"}}',
                "--update-mask",
                "priority",
            ]
        )
        subprocess.run(restore_cmd, env=cli_env, capture_output=True)

    except (json.JSONDecodeError, KeyError):
        pytest.skip("Unable to parse JSON output or extract data")


@pytest.mark.integration
def test_cli_case_bulk_add_tag(cli_env, common_args):
    """Test the case bulk-add-tag command.

    TODO: Remove 401 skip logic once SOAR IAM role issue is fixed.
    """
    # Use dedicated test case ID
    case_ids = ["7418669"]

    # Test bulk add tag
    bulk_cmd = (
        ["secops"]
        + common_args
        + [
            "case",
            "bulk-add-tag",
            "--ids",
            ",".join(case_ids),
            "--tags",
            "cli-integration-test",
        ]
    )

    bulk_result = subprocess.run(
        bulk_cmd, env=cli_env, capture_output=True, text=True
    )

    # Check for 401/Unauthorized or auth errors
    if bulk_result.returncode != 0:
        error_output = bulk_result.stderr + bulk_result.stdout
        auth_errors = [
            "401",
            "Unauthorized",
            "AuthenticationError",
            "Failed to get credentials",
            "DefaultCredentialsError",
        ]
        if any(err in error_output for err in auth_errors):
            pytest.skip(
                f"Skipping due to SOAR IAM/auth issue: " f"{error_output[:200]}"
            )

    assert bulk_result.returncode == 0


@pytest.mark.integration
def test_cli_case_bulk_assign(cli_env, common_args):
    """Test the case bulk-assign command.

    TODO: Remove 401 skip logic once SOAR IAM role issue is fixed.
    """
    # Use dedicated test case ID
    case_ids = ["7418669"]

    bulk_cmd = (
        ["secops"]
        + common_args
        + [
            "case",
            "bulk-assign",
            "--ids",
            ",".join(case_ids),
            "--username",
            "'@Administrator'",
        ]
    )

    bulk_result = subprocess.run(
        bulk_cmd, env=cli_env, capture_output=True, text=True
    )

    # Skip if API returns auth or INTERNAL/500 error
    if bulk_result.returncode != 0:
        error_output = bulk_result.stderr + bulk_result.stdout
        auth_errors = [
            "401",
            "Unauthorized",
            "AuthenticationError",
            "Failed to get credentials",
            "DefaultCredentialsError",
        ]
        if any(err in error_output for err in auth_errors):
            pytest.skip(
                f"Skipping due to SOAR IAM/auth issue: " f"{error_output[:200]}"
            )
        if "INTERNAL" in error_output or "500" in error_output:
            pytest.skip(
                f"Bulk assign API returned INTERNAL error: "
                f"{error_output[:200]}"
            )

    assert bulk_result.returncode == 0


@pytest.mark.integration
def test_cli_case_bulk_change_priority(cli_env, common_args):
    """Test the case bulk-change-priority command.

    TODO: Remove 401 skip logic once SOAR IAM role issue is fixed.
    """
    # Use dedicated test case ID
    case_ids = ["7418669"]

    bulk_cmd = (
        ["secops"]
        + common_args
        + [
            "case",
            "bulk-change-priority",
            "--ids",
            ",".join(case_ids),
            "--priority",
            "MEDIUM",
        ]
    )

    bulk_result = subprocess.run(
        bulk_cmd, env=cli_env, capture_output=True, text=True
    )

    # Check for 401/Unauthorized or auth errors
    if bulk_result.returncode != 0:
        error_output = bulk_result.stderr + bulk_result.stdout
        auth_errors = [
            "401",
            "Unauthorized",
            "AuthenticationError",
            "Failed to get credentials",
            "DefaultCredentialsError",
        ]
        if any(err in error_output for err in auth_errors):
            pytest.skip(
                f"Skipping due to SOAR IAM/auth issue: " f"{error_output[:200]}"
            )

    assert bulk_result.returncode == 0


@pytest.mark.integration
def test_cli_case_bulk_change_stage(cli_env, common_args):
    """Test the case bulk-change-stage command.

    TODO: Remove 401 skip logic once SOAR IAM role issue is fixed.
    """
    # Use dedicated test case ID
    case_ids = ["7418669"]

    bulk_cmd = (
        ["secops"]
        + common_args
        + [
            "case",
            "bulk-change-stage",
            "--ids",
            ",".join(case_ids),
            "--stage",
            "Triage",
        ]
    )

    bulk_result = subprocess.run(
        bulk_cmd, env=cli_env, capture_output=True, text=True
    )

    # Check for 401/Unauthorized or auth errors
    if bulk_result.returncode != 0:
        error_output = bulk_result.stderr + bulk_result.stdout
        auth_errors = [
            "401",
            "Unauthorized",
            "AuthenticationError",
            "Failed to get credentials",
            "DefaultCredentialsError",
        ]
        if any(err in error_output for err in auth_errors):
            pytest.skip(
                f"Skipping due to SOAR IAM/auth issue: " f"{error_output[:200]}"
            )

    assert bulk_result.returncode == 0


@pytest.mark.integration
def test_cli_case_bulk_close_reopen_workflow(cli_env, common_args):
    """Test the case bulk-close and bulk-reopen commands in workflow.

    TODO: Remove 401 skip logic once SOAR IAM role issue is fixed.
    """
    # Use dedicated test case ID
    case_ids = ["7418669"]
    auth_errors = [
        "401",
        "Unauthorized",
        "AuthenticationError",
        "Failed to get credentials",
        "DefaultCredentialsError",
    ]

    try:
        # Test bulk close
        close_cmd = (
            ["secops"]
            + common_args
            + [
                "case",
                "bulk-close",
                "--ids",
                ",".join(case_ids),
                "--close-reason",
                "MAINTENANCE",
                "--root-cause",
                "CLI integration test",
            ]
        )

        close_result = subprocess.run(
            close_cmd, env=cli_env, capture_output=True, text=True
        )

        # Check for 401/Unauthorized or auth errors
        if close_result.returncode != 0:
            error_output = close_result.stderr + close_result.stdout

            if any(err in error_output for err in auth_errors):
                pytest.skip(
                    f"Skipping due to SOAR IAM/auth issue: "
                    f"{error_output[:200]}"
                )

        assert close_result.returncode == 0

    finally:
        # Cleanup: Test bulk reopen
        reopen_cmd = (
            ["secops"]
            + common_args
            + [
                "case",
                "bulk-reopen",
                "--ids",
                ",".join(case_ids),
                "--reopen-comment",
                "CLI integration test cleanup",
            ]
        )

        reopen_result = subprocess.run(
            reopen_cmd, env=cli_env, capture_output=True, text=True
        )
        # Check for 401/Unauthorized or auth errors
        if reopen_result.returncode != 0:
            reopen_error_output = reopen_result.stderr + reopen_result.stdout

            if any(err in reopen_error_output for err in auth_errors):
                pytest.skip(
                    f"Skipping due to SOAR IAM/auth issue: "
                    f"{reopen_error_output[:200]}"
                )

        assert reopen_result.returncode == 0