breakpilot-compliance/ai-compliance-sdk/internal/ucca/tom_mapper_test.go

package ucca

import (
	"testing"
)

func TestTOMControlLoader(t *testing.T) {
	index, err := LoadTOMControls()
	if err != nil {
		t.Skipf("TOM controls not found: %v", err)
	}

	if len(index.ByID) == 0 {
		t.Error("expected controls indexed by ID")
	}
	if len(index.ByDomain) == 0 {
		t.Error("expected controls indexed by domain")
	}
	t.Logf("Loaded %d TOM controls across %d domains", len(index.ByID), len(index.ByDomain))

	// Check known control
	ctrl, ok := index.GetControl("TOM.GOV.01")
	if !ok || ctrl == nil {
		t.Error("expected TOM.GOV.01 to exist")
	} else if ctrl.Title == "" {
		t.Error("expected TOM.GOV.01 to have a title")
	}

	// Check domain
	govCtrls := index.GetControlsByDomain("GOV")
	if len(govCtrls) == 0 {
		t.Error("expected GOV domain to have controls")
	}

	// Validate known ID
	if !index.ValidateControlID("TOM.GOV.01") {
		t.Error("TOM.GOV.01 should be valid")
	}
	if index.ValidateControlID("TOM.FAKE.99") {
		t.Error("TOM.FAKE.99 should be invalid")
	}
}

func TestTOMObligationMapper_FromObligations(t *testing.T) {
	index, err := LoadTOMControls()
	if err != nil {
		t.Skipf("TOM controls not found: %v", err)
	}

	// Create test obligations with tom_control_ids
	obligations := []V2Obligation{
		{
			ID:            "TEST-OBL-001",
			TOMControlIDs: []string{"TOM.GOV.01", "TOM.GOV.02"},
			Priority:      "kritisch",
		},
		{
			ID:            "TEST-OBL-002",
			TOMControlIDs: []string{"TOM.GOV.01", "TOM.CRYPTO.01"},
			Priority:      "hoch",
		},
	}

	mapper := NewTOMObligationMapperFromObligations(index, obligations)

	// Check obligation->control
	controls := mapper.GetControlsForObligation("TEST-OBL-001")
	if len(controls) != 2 {
		t.Errorf("expected 2 controls for TEST-OBL-001, got %d", len(controls))
	}

	// Check control->obligation (reverse)
	oblIDs := mapper.GetObligationsForControl("TOM.GOV.01")
	if len(oblIDs) != 2 {
		t.Errorf("expected 2 obligations for TOM.GOV.01, got %d", len(oblIDs))
	}

	// Check deduplicated requirements
	frameworkObls := make([]Obligation, len(obligations))
	for i, o := range obligations {
		frameworkObls[i] = Obligation{
			ID:                o.ID,
			Priority:          ObligationPriority(o.Priority),
			ExternalResources: o.TOMControlIDs,
		}
	}
	reqs := mapper.DeriveControlsFromObligations(frameworkObls)
	if len(reqs) == 0 {
		t.Error("expected derived control requirements")
	}

	// GOV.01 should appear once but with 2 obligation references
	for _, req := range reqs {
		if req.Control != nil && req.Control.ID == "TOM.GOV.01" {
			if req.RequiredByCount != 2 {
				t.Errorf("expected TOM.GOV.01 required by 2, got %d", req.RequiredByCount)
			}
			if req.Priority != "kritisch" {
				t.Errorf("expected highest priority 'kritisch', got '%s'", req.Priority)
			}
			return
		}
	}
	t.Error("TOM.GOV.01 not found in derived requirements")
}

func TestTOMGapAnalysis(t *testing.T) {
	index, err := LoadTOMControls()
	if err != nil {
		t.Skipf("TOM controls not found: %v", err)
	}

	obligations := []V2Obligation{
		{ID: "T-001", TOMControlIDs: []string{"TOM.GOV.01"}, Priority: "kritisch"},
		{ID: "T-002", TOMControlIDs: []string{"TOM.GOV.01", "TOM.CRYPTO.01"}, Priority: "hoch"},
	}
	mapper := NewTOMObligationMapperFromObligations(index, obligations)
	analyzer := NewTOMGapAnalyzer(mapper, index)

	frameworkObls := []Obligation{
		{ID: "T-001", Priority: "kritisch", ExternalResources: []string{"TOM.GOV.01"}},
		{ID: "T-002", Priority: "hoch", ExternalResources: []string{"TOM.GOV.01", "TOM.CRYPTO.01"}},
	}

	result := analyzer.Analyze(&GapAnalysisRequest{
		Obligations: frameworkObls,
		ControlStatusMap: map[string]ControlStatus{
			"TOM.GOV.01":    ControlImplemented,
			"TOM.CRYPTO.01": ControlNotImplemented,
		},
	})

	if result.TotalControls != 2 {
		t.Errorf("expected 2 total controls, got %d", result.TotalControls)
	}
	if result.ImplementedControls != 1 {
		t.Errorf("expected 1 implemented, got %d", result.ImplementedControls)
	}
	if result.MissingControls != 1 {
		t.Errorf("expected 1 missing, got %d", result.MissingControls)
	}
	if result.CompliancePercent != 50 {
		t.Errorf("expected 50%% compliance, got %.1f%%", result.CompliancePercent)
	}
	if len(result.Gaps) != 1 {
		t.Errorf("expected 1 gap, got %d", len(result.Gaps))
	}
}

func TestTOMGapAnalysis_AllImplemented(t *testing.T) {
	index, err := LoadTOMControls()
	if err != nil {
		t.Skipf("TOM controls not found: %v", err)
	}

	obligations := []V2Obligation{
		{ID: "T-001", TOMControlIDs: []string{"TOM.GOV.01"}, Priority: "hoch"},
	}
	mapper := NewTOMObligationMapperFromObligations(index, obligations)
	analyzer := NewTOMGapAnalyzer(mapper, index)

	result := analyzer.Analyze(&GapAnalysisRequest{
		Obligations: []Obligation{{ID: "T-001", Priority: "hoch", ExternalResources: []string{"TOM.GOV.01"}}},
		ControlStatusMap: map[string]ControlStatus{
			"TOM.GOV.01": ControlImplemented,
		},
	})

	if result.CompliancePercent != 100 {
		t.Errorf("expected 100%% compliance, got %.1f%%", result.CompliancePercent)
	}
	if len(result.Gaps) != 0 {
		t.Errorf("expected 0 gaps, got %d", len(result.Gaps))
	}
}