Metamorph/e2e/tests/m4-mitre.spec.ts

import { expect, test, type APIRequestContext, type Page } from '@playwright/test';

/**
 * M4 — MITRE ATT&CK Enterprise reference catalogue + tag picker.
 *
 * The seed itself (download + parse) is exercised by pytest with a small
 * fixture bundle. This spec hits the live stack with the real, pinned bundle
 * by calling `POST /mitre/sync` once and then validating the read endpoints
 * + the picker UI.
 */

const ADMIN_EMAIL = `admin-${Math.floor(Math.random() * 1e6)}@metamorph.local`;
const ADMIN_PASSWORD = 'AdminPass1234!';

async function resetAndMintToken(request: APIRequestContext): Promise<string> {
  const r = await request.post('/api/v1/diag/reset');
  expect(r.status()).toBe(200);
  return (await r.json()).install_token as string;
}

async function loginAndGetAccess(
  request: APIRequestContext,
  email: string,
  password: string,
): Promise<string> {
  const r = await request.post('/api/v1/auth/login', { data: { email, password } });
  expect(r.status()).toBe(200);
  return (await r.json()).access_token as string;
}

async function loginViaSpa(page: Page, email: string, password: string) {
  await page.goto('/login');
  await page.getByLabel(/email/i).fill(email);
  await page.getByLabel(/password/i).fill(password);
  await page.getByRole('button', { name: /sign in/i }).click();
  await expect(page.getByTestId('me-email')).toHaveText(email);
}

test.describe.configure({ mode: 'serial' });

test.describe('M4 — MITRE ATT&CK reference', () => {
  test.beforeAll(async ({ request }) => {
    const installToken = await resetAndMintToken(request);
    const setup = await request.post('/api/v1/setup', {
      data: { install_token: installToken, email: ADMIN_EMAIL, password: ADMIN_PASSWORD },
    });
    expect(setup.status()).toBe(201);

    // Trigger a real sync against the pinned MITRE URL. Idempotent — if the
    // mitre_* tables were left populated by a previous run, this is a no-op
    // upsert.
    const access = await loginAndGetAccess(request, ADMIN_EMAIL, ADMIN_PASSWORD);
    const sync = await request.post('/api/v1/mitre/sync', {
      headers: { Authorization: `Bearer ${access}` },
    });
    expect(sync.status(), `mitre sync failed: ${await sync.text()}`).toBe(200);
    const result = await sync.json();
    expect(result.tactics_upserted).toBeGreaterThanOrEqual(14);
    expect(result.techniques_upserted).toBeGreaterThanOrEqual(180);
    expect(result.subtechniques_upserted).toBeGreaterThanOrEqual(400);
  });

  test('GET /mitre/tactics returns 14+ Enterprise tactics', async ({ request }) => {
    const access = await loginAndGetAccess(request, ADMIN_EMAIL, ADMIN_PASSWORD);
    const r = await request.get('/api/v1/mitre/tactics', {
      headers: { Authorization: `Bearer ${access}` },
    });
    expect(r.status()).toBe(200);
    const body = await r.json();
    expect(body.total).toBeGreaterThanOrEqual(14);
    const ids = body.items.map((t: { external_id: string }) => t.external_id);
    expect(ids).toContain('TA0001'); // Initial Access
    expect(ids).toContain('TA0006'); // Credential Access
  });

  test('GET /mitre/techniques?tactic=TA0006 filters', async ({ request }) => {
    const access = await loginAndGetAccess(request, ADMIN_EMAIL, ADMIN_PASSWORD);
    const r = await request.get('/api/v1/mitre/techniques?tactic=TA0006&limit=200', {
      headers: { Authorization: `Bearer ${access}` },
    });
    expect(r.status()).toBe(200);
    const body = await r.json();
    expect(body.total).toBeGreaterThan(0);
    // OS Credential Dumping is the textbook TA0006 example.
    const ids = body.items.map((t: { external_id: string }) => t.external_id);
    expect(ids).toContain('T1003');
  });

  test('GET /mitre/subtechniques?technique=T1003 lists 8 sub-techniques', async ({ request }) => {
    const access = await loginAndGetAccess(request, ADMIN_EMAIL, ADMIN_PASSWORD);
    const r = await request.get('/api/v1/mitre/subtechniques?technique=T1003', {
      headers: { Authorization: `Bearer ${access}` },
    });
    expect(r.status()).toBe(200);
    const ids = (await r.json()).items.map((t: { external_id: string }) => t.external_id);
    expect(ids).toContain('T1003.001'); // LSASS Memory
    expect(ids.length).toBeGreaterThanOrEqual(5);
  });

  test('GET /mitre/status returns version + last_sync', async ({ request }) => {
    const access = await loginAndGetAccess(request, ADMIN_EMAIL, ADMIN_PASSWORD);
    const r = await request.get('/api/v1/mitre/status', {
      headers: { Authorization: `Bearer ${access}` },
    });
    expect(r.status()).toBe(200);
    const body = await r.json();
    expect(body.last_sync).toBeTruthy();
    expect(body.default_url).toContain('mitre-attack');
    expect(body.default_version).toBeTruthy();
  });

  test('SPA MITRE page renders + picker walks tactic → technique → subtechnique', async ({ page }) => {
    await loginViaSpa(page, ADMIN_EMAIL, ADMIN_PASSWORD);
    await page.goto('/mitre');

    // Status card shows a non-null last_sync.
    await expect(page.getByTestId('mitre-last-sync')).not.toHaveText('never');

    const picker = page.getByTestId('mitre-tag-picker');
    await expect(picker).toBeVisible();

    // 1. Click on TA0006 (Credential Access)
    await picker.getByTestId('mitre-tactic-TA0006').click();
    // 2. Techniques column populates; click T1003
    await expect(picker.getByTestId('mitre-technique-T1003')).toBeVisible();
    await picker.getByTestId('mitre-technique-T1003').click();
    // 3. Sub-techniques column populates with T1003.001 onward
    await expect(picker.getByTestId('mitre-subtechnique-T1003.001')).toBeVisible();
    // 4. Select the sub-technique → chip appears in the selection bar
    await picker.getByTestId('mitre-subtechnique-T1003.001').click();
    await expect(page.getByTestId('mitre-selected')).toContainText('T1003.001');
    // 5. Preview payload card shows the JSON encoded selection
    await expect(page.getByTestId('mitre-selected-json')).toContainText('"T1003.001"');
  });

  test('Non-admin cannot trigger /mitre/sync', async ({ page, request }) => {
    // Invite a no-perm user via the admin.
    const adminAccess = await loginAndGetAccess(request, ADMIN_EMAIL, ADMIN_PASSWORD);
    const eveEmail = `eve-${Math.floor(Math.random() * 1e6)}@metamorph.local`;
    const inv = await request.post('/api/v1/invitations', {
      headers: { Authorization: `Bearer ${adminAccess}` },
      data: { email_hint: eveEmail },
    });
    const token = (await inv.json()).token;
    await request.post(`/api/v1/invitations/accept/${token}`, {
      data: { email: eveEmail, password: 'EvePass1234!' },
    });

    const eveAccess = await loginAndGetAccess(request, eveEmail, 'EvePass1234!');
    const r = await request.post('/api/v1/mitre/sync', {
      headers: { Authorization: `Bearer ${eveAccess}` },
    });
    expect(r.status()).toBe(403);

    // The MITRE page is reachable in read-only mode for any logged-in user,
    // but the Sync card is hidden for non-admins.
    await loginViaSpa(page, eveEmail, 'EvePass1234!');
    await page.goto('/mitre');
    await expect(page.getByTestId('mitre-tag-picker')).toBeVisible();
    await expect(page.getByTestId('mitre-sync')).toHaveCount(0);
  });
});