26 lines
2.4 KiB
TypeScript
26 lines
2.4 KiB
TypeScript
import { expect, test } from "@playwright/test";
|
|
|
|
const partialAnalysis = {
|
|
source: "partial.evtx",
|
|
events: [{ id: "1", timestamp: "2026-09-09T10:00:00Z", timestamp_source: "event", timestamp_valid: true, provider: "Synthetic", event_id: 1000, level: "error", channel: "Application", computer: "TEST-PC", category: "crash", summary: "Synthetic crash", fields: {} }],
|
|
incidents: [{ id: "incident-1", rule_id: "windows.generic.attention", start: "2026-09-09T10:00:00Z", end: "2026-09-09T10:00:00Z", title: "Synthetic crash", category: "crash", severity: "warning", reasons: ["Parser retained only a partial result."], evidence_event_ids: ["1"], original_count: 1, compressed_count: 1 }],
|
|
parse: { parser: "evtx-rs", status: "partial", parsed_events: 1, records_seen: 4, skipped_records: 2, issue_count: 1, truncated: true, truncation_reason: "event_limit_reached", duration_ms: 8, issues: [{ code: "event_limit_reached", record_id: 4, message: "later records were not analyzed", skipped_record: true }] },
|
|
};
|
|
|
|
test("partial result is unmistakable and invalid extension is rejected", async ({ page }) => {
|
|
await page.route("**/api/analyze", (route) => route.fulfill({ status: 200, contentType: "application/json", body: JSON.stringify(partialAnalysis) }));
|
|
await page.goto("/#analysis");
|
|
await expect(page.getByRole("heading", { name: "Analysis", exact: true })).toBeVisible();
|
|
await page.locator('input[type="file"]').setInputFiles({ name: "partial.evtx", mimeType: "application/octet-stream", buffer: Buffer.from("synthetic") });
|
|
await expect(page.getByRole("alert")).toContainText("Partial analysis");
|
|
await expect(page.getByRole("alert")).toContainText("incident reconstruction may be incomplete");
|
|
await expect(page.getByText("event_limit_reached", { exact: true })).toBeVisible();
|
|
await expect(page.getByText("Analysis status", { exact: true })).toBeVisible();
|
|
await expect(page.getByText("2 skipped · 1 parser issue", { exact: true })).toBeVisible();
|
|
await page.getByRole("button", { name: "Timeline", exact: false }).click();
|
|
await expect(page.getByRole("alert")).toContainText("incident reconstruction may be incomplete");
|
|
|
|
await page.locator('input[type="file"]').setInputFiles({ name: "not-an-evtx.txt", mimeType: "text/plain", buffer: Buffer.from("nope") });
|
|
await expect(page.getByRole("alert").filter({ hasText: "Choose a Windows .evtx file." })).toBeVisible();
|
|
});
|