# frozen_string_literal: true

require 'spec_helper'

RSpec.describe Security::VulnerabilityCountingService, '#execute' do
  before do
    stub_licensed_features(sast: true, dependency_scanning: true, container_scanning: true, dast: true)
  end

  let_it_be(:project) { create(:project, :repository) }
  let_it_be(:pipeline) { create(:ci_pipeline, :success, project: project) }

  context "The pipeline has security builds" do
    before_all do
      create(:ci_build, :success, name: 'dast_job', pipeline: pipeline, project: project) do |job|
        create(:ee_ci_job_artifact, :dast, job: job, project: project)
      end
      create(:ci_build, :success, name: 'sast_job', pipeline: pipeline, project: project) do |job|
        create(:ee_ci_job_artifact, :sast, job: job, project: project)
      end
      create(:ci_build, :success, name: 'cs_job', pipeline: pipeline, project: project) do |job|
        create(:ee_ci_job_artifact, :container_scanning, job: job, project: project)
      end
      create(:ci_build, :success, name: 'ds_job', pipeline: pipeline, project: project) do |job|
        create(:ee_ci_job_artifact, :dependency_scanning, job: job, project: project)
      end
    end

    context 'All report types are requested' do
      subject { described_class.new(pipeline, %w[sast dast container_scanning dependency_scanning]).execute }

      it {
        is_expected.to match(a_hash_including("sast" => 33,
                                              "dast" => 20,
                                              "container_scanning" => 8,
                                              "dependency_scanning" => 4))
      }
    end

    context 'Only the report type dast is requested' do
      subject { described_class.new(pipeline, %w[dast]).execute }

      it {
        is_expected.to eq({ "dast" => 20 })
      }
    end
  end

  context "The Pipeline has no security builds" do
    let_it_be(:pipeline) { create(:ci_pipeline, :success) }

    subject { described_class.new(pipeline, %w[sast dast container_scanning dependency_scanning]).execute }

    it {
      is_expected.to match(a_hash_including("sast" => 0,
                                            "dast" => 0,
                                            "container_scanning" => 0,
                                            "dependency_scanning" => 0))
    }
  end

  context 'performance' do
    it 'performs only one query' do
      count = ActiveRecord::QueryRecorder.new { described_class.new(pipeline, %w[dast]).execute }.count
      expect(count).to eq(1)

      count = ActiveRecord::QueryRecorder.new { described_class.new(pipeline, %w[dast sast container_scanning]).execute }.count
      expect(count).to eq(1)
    end
  end
end
