foxhunt/trading_engine/tests/compliance_sox.rs

//! SOX Compliance Tests
//!
//! Comprehensive tests for Sarbanes-Oxley Act compliance including:
//! - Internal controls assessment
//! - Segregation of duties
//! - Change management controls
//! - Access control matrix
//! - Management certification
//! - Control deficiency tracking

use chrono::{Duration, Utc};
use std::collections::HashMap;
use trading_engine::compliance::sox_compliance::{
    CertificationLevel, ChangeApprovalStatus, ChangePriority, ChangeRequest, ChangeType,
    ControlDeficiency, ControlFrequency, ControlType, DeficiencySeverity, DeficiencyStatus,
    ImplementationStatus, InternalControl, OfficerRole, RiskLevel, SOXComplianceManager, SOXConfig,
    TestingFrequency,
};

/// Test SOX compliance manager initialization
#[tokio::test]
async fn test_sox_manager_initialization() {
    let config = SOXConfig::default();
    let manager = SOXComplianceManager::new(&config);

    // Verify manager initialized successfully
    assert!(true, "SOX compliance manager initialized");
}

/// Test internal controls assessment
#[tokio::test]
async fn test_internal_controls_assessment() {
    let config = SOXConfig::default();
    let manager = SOXComplianceManager::new(&config);

    let result = manager.assess_sox_compliance().await;

    assert!(result.is_ok(), "SOX compliance assessment should succeed");

    let assessment = result.unwrap();
    assert!(
        assessment.overall_score >= 0.0 && assessment.overall_score <= 100.0,
        "Compliance score should be between 0 and 100"
    );

    // Verify controls effectiveness is documented
    assert!(
        !assessment.controls_effectiveness.is_empty(),
        "Controls effectiveness should be documented"
    );
}

/// Test Section 302 compliance (internal controls)
#[tokio::test]
async fn test_section_302_compliance() {
    let config = SOXConfig {
        section_302_enabled: true,
        ..Default::default()
    };

    assert!(config.section_302_enabled, "Section 302 should be enabled");
    assert!(
        config
            .management_certification
            .required_officers
            .contains(&OfficerRole::CEO),
        "CEO certification should be required"
    );
    assert!(
        config
            .management_certification
            .required_officers
            .contains(&OfficerRole::CFO),
        "CFO certification should be required"
    );
}

/// Test Section 404 compliance (assessment of internal controls)
#[tokio::test]
async fn test_section_404_compliance() {
    let config = SOXConfig {
        section_404_enabled: true,
        controls_testing_frequency: TestingFrequency::Quarterly,
        ..Default::default()
    };

    assert!(config.section_404_enabled, "Section 404 should be enabled");
    assert_eq!(
        config.controls_testing_frequency,
        TestingFrequency::Quarterly,
        "Controls should be tested quarterly"
    );
}

/// Test internal control definition
#[tokio::test]
async fn test_internal_control_definition() {
    let control = InternalControl {
        control_id: "IC-001".to_string(),
        description: "Automated order limit validation".to_string(),
        objective: "Prevent orders exceeding position limits".to_string(),
        control_type: ControlType::Preventive,
        frequency: ControlFrequency::Continuous,
        risk_level: RiskLevel::High,
        owner: "risk_manager".to_string(),
        testing_procedures: Vec::new(),
        implementation_status: ImplementationStatus::OperatingEffectively,
        last_test_date: Some(Utc::now() - Duration::days(30)),
        next_test_date: Utc::now() + Duration::days(60),
    };

    // Verify control structure
    assert_eq!(control.control_type, ControlType::Preventive);
    assert_eq!(control.frequency, ControlFrequency::Continuous);
    assert_eq!(control.risk_level, RiskLevel::High);
    assert_eq!(
        control.implementation_status,
        ImplementationStatus::OperatingEffectively
    );
}

/// Test control types coverage
#[tokio::test]
async fn test_control_types() {
    let preventive = ControlType::Preventive;
    let detective = ControlType::Detective;
    let corrective = ControlType::Corrective;
    let compensating = ControlType::Compensating;

    // All control types should be properly categorized
    assert_eq!(preventive, ControlType::Preventive);
    assert_eq!(detective, ControlType::Detective);
    assert_eq!(corrective, ControlType::Corrective);
    assert_eq!(compensating, ControlType::Compensating);
}

/// Test control frequency options
#[tokio::test]
async fn test_control_frequencies() {
    let frequencies = vec![
        ControlFrequency::Continuous,
        ControlFrequency::Daily,
        ControlFrequency::Weekly,
        ControlFrequency::Monthly,
        ControlFrequency::Quarterly,
        ControlFrequency::Annual,
        ControlFrequency::EventDriven,
    ];

    assert_eq!(
        frequencies.len(),
        7,
        "Should have all control frequency types"
    );
}

/// Test management certification requirements
#[tokio::test]
async fn test_management_certification() {
    let config = SOXConfig::default();
    let manager = SOXComplianceManager::new(&config);

    let result = manager
        .generate_management_certification(&OfficerRole::CEO)
        .await;

    assert!(result.is_ok(), "Should generate CEO certification");

    let certification = result.unwrap();
    assert_eq!(certification.certifying_officer, OfficerRole::CEO);
    assert!(
        !certification.certification_statement.is_empty(),
        "Certification statement should not be empty"
    );
}

/// Test CFO certification
#[tokio::test]
async fn test_cfo_certification() {
    let config = SOXConfig::default();
    let manager = SOXComplianceManager::new(&config);

    let result = manager
        .generate_management_certification(&OfficerRole::CFO)
        .await;

    assert!(result.is_ok(), "Should generate CFO certification");

    let certification = result.unwrap();
    assert_eq!(certification.certifying_officer, OfficerRole::CFO);
}

/// Test control deficiency tracking
#[tokio::test]
async fn test_control_deficiency() {
    let deficiency = ControlDeficiency {
        deficiency_id: "DEF-001".to_string(),
        control_id: "IC-002".to_string(),
        deficiency_type:
            trading_engine::compliance::sox_compliance::DeficiencyType::OperatingDeficiency,
        severity: DeficiencySeverity::SignificantDeficiency,
        description: "Order validation control did not prevent limit breach".to_string(),
        root_cause: "Configuration error in limit calculation".to_string(),
        potential_impact: "Potential regulatory breach".to_string(),
        remediation_plan: trading_engine::compliance::sox_compliance::RemediationPlan {
            plan_id: "REM-001".to_string(),
            actions: Vec::new(),
            responsible_party: "it_manager".to_string(),
            target_completion_date: Utc::now() + Duration::days(30),
            progress: Vec::new(),
        },
        status: DeficiencyStatus::Open,
        identified_date: Utc::now(),
        due_date: Utc::now() + Duration::days(30),
    };

    // Verify deficiency structure
    assert_eq!(
        deficiency.severity,
        DeficiencySeverity::SignificantDeficiency
    );
    assert_eq!(deficiency.status, DeficiencyStatus::Open);
    assert!(!deficiency.description.is_empty());
    assert!(!deficiency.root_cause.is_empty());
}

/// Test material weakness tracking
#[tokio::test]
async fn test_material_weakness() {
    let material_weakness = ControlDeficiency {
        deficiency_id: "DEF-002".to_string(),
        control_id: "IC-003".to_string(),
        deficiency_type:
            trading_engine::compliance::sox_compliance::DeficiencyType::DesignDeficiency,
        severity: DeficiencySeverity::MaterialWeakness,
        description: "Segregation of duties not properly implemented".to_string(),
        root_cause: "Insufficient separation between trading and settlement".to_string(),
        potential_impact: "Financial misstatement risk".to_string(),
        remediation_plan: trading_engine::compliance::sox_compliance::RemediationPlan {
            plan_id: "REM-002".to_string(),
            actions: Vec::new(),
            responsible_party: "cfo".to_string(),
            target_completion_date: Utc::now() + Duration::days(14),
            progress: Vec::new(),
        },
        status: DeficiencyStatus::InRemediation,
        identified_date: Utc::now() - Duration::days(5),
        due_date: Utc::now() + Duration::days(14),
    };

    // Material weakness requires immediate attention
    assert_eq!(
        material_weakness.severity,
        DeficiencySeverity::MaterialWeakness
    );
    assert!(
        material_weakness.remediation_plan.target_completion_date < Utc::now() + Duration::days(30),
        "Material weakness should have shorter remediation timeline"
    );
}

/// Test change management controls
#[tokio::test]
async fn test_change_management() {
    let change_request = ChangeRequest {
        change_id: "CHG-001".to_string(),
        title: "Update trading algorithm parameters".to_string(),
        description: "Modify risk parameters for momentum strategy".to_string(),
        requestor: "portfolio_manager".to_string(),
        change_type: ChangeType::Normal,
        priority: ChangePriority::Medium,
        risk_assessment: trading_engine::compliance::sox_compliance::RiskAssessment {
            risk_level: RiskLevel::Medium,
            risk_factors: Vec::new(),
            mitigation_measures: Vec::new(),
            residual_risk: RiskLevel::Low,
        },
        impact_analysis: trading_engine::compliance::sox_compliance::ImpactAnalysis {
            affected_systems: vec!["trading_engine".to_string()],
            affected_processes: vec!["order_execution".to_string()],
            business_impact: trading_engine::compliance::sox_compliance::BusinessImpact {
                impact_level: trading_engine::compliance::sox_compliance::ImpactLevel::Medium,
                affected_functions: vec!["momentum_trading".to_string()],
                revenue_impact: None,
                customer_impact: "No direct customer impact".to_string(),
            },
            technical_impact: trading_engine::compliance::sox_compliance::TechnicalImpact {
                performance_impact: "Minimal performance impact".to_string(),
                security_impact: "No security impact".to_string(),
                integration_impact: "No integration changes".to_string(),
                capacity_impact: "No capacity changes".to_string(),
            },
            compliance_impact: trading_engine::compliance::sox_compliance::ComplianceImpact {
                affected_regulations: vec!["SOX".to_string()],
                compliance_risk: RiskLevel::Low,
                additional_controls: Vec::new(),
            },
        },
        implementation_plan: trading_engine::compliance::sox_compliance::ImplementationPlan {
            steps: Vec::new(),
            scheduled_start: Utc::now() + Duration::days(7),
            estimated_duration: Duration::hours(4),
            dependencies: Vec::new(),
            success_criteria: vec!["Parameters updated successfully".to_string()],
        },
        rollback_plan: trading_engine::compliance::sox_compliance::RollbackPlan {
            steps: Vec::new(),
            triggers: vec![
                "System error".to_string(),
                "Performance degradation".to_string(),
            ],
            rollback_owner: "it_manager".to_string(),
            max_rollback_time: Duration::minutes(30),
        },
        approval_status: ChangeApprovalStatus::Pending,
        implementation_status:
            trading_engine::compliance::sox_compliance::ChangeImplementationStatus::NotStarted,
    };

    // Verify change management structure
    assert_eq!(change_request.change_type, ChangeType::Normal);
    assert_eq!(
        change_request.approval_status,
        ChangeApprovalStatus::Pending
    );
    assert!(
        !change_request.rollback_plan.triggers.is_empty(),
        "Rollback triggers should be defined"
    );
}

/// Test emergency change handling
#[tokio::test]
async fn test_emergency_change() {
    let emergency_change = ChangeRequest {
        change_id: "CHG-EMERG-001".to_string(),
        title: "Emergency fix for order validation bug".to_string(),
        description: "Critical bug preventing order execution".to_string(),
        requestor: "incident_manager".to_string(),
        change_type: ChangeType::Emergency,
        priority: ChangePriority::Critical,
        risk_assessment: trading_engine::compliance::sox_compliance::RiskAssessment {
            risk_level: RiskLevel::Critical,
            risk_factors: Vec::new(),
            mitigation_measures: Vec::new(),
            residual_risk: RiskLevel::Medium,
        },
        impact_analysis: trading_engine::compliance::sox_compliance::ImpactAnalysis {
            affected_systems: vec!["trading_engine".to_string()],
            affected_processes: vec!["order_validation".to_string()],
            business_impact: trading_engine::compliance::sox_compliance::BusinessImpact {
                impact_level: trading_engine::compliance::sox_compliance::ImpactLevel::Critical,
                affected_functions: vec!["all_trading".to_string()],
                revenue_impact: Some(rust_decimal::Decimal::from(1_000_000)),
                customer_impact: "Trading halted for all clients".to_string(),
            },
            technical_impact: trading_engine::compliance::sox_compliance::TechnicalImpact {
                performance_impact: "System unavailable".to_string(),
                security_impact: "No security impact".to_string(),
                integration_impact: "All integrations affected".to_string(),
                capacity_impact: "Full capacity unavailable".to_string(),
            },
            compliance_impact: trading_engine::compliance::sox_compliance::ComplianceImpact {
                affected_regulations: vec!["SOX".to_string(), "MIFID2".to_string()],
                compliance_risk: RiskLevel::High,
                additional_controls: vec!["Post-implementation review".to_string()],
            },
        },
        implementation_plan: trading_engine::compliance::sox_compliance::ImplementationPlan {
            steps: Vec::new(),
            scheduled_start: Utc::now(),
            estimated_duration: Duration::hours(1),
            dependencies: Vec::new(),
            success_criteria: vec!["Order validation functional".to_string()],
        },
        rollback_plan: trading_engine::compliance::sox_compliance::RollbackPlan {
            steps: Vec::new(),
            triggers: vec!["Fix unsuccessful".to_string()],
            rollback_owner: "cto".to_string(),
            max_rollback_time: Duration::minutes(15),
        },
        approval_status: ChangeApprovalStatus::Approved,
        implementation_status:
            trading_engine::compliance::sox_compliance::ChangeImplementationStatus::InProgress,
    };

    // Emergency changes have expedited process
    assert_eq!(emergency_change.change_type, ChangeType::Emergency);
    assert_eq!(emergency_change.priority, ChangePriority::Critical);
    assert!(
        emergency_change.rollback_plan.max_rollback_time < Duration::hours(1),
        "Emergency changes should have quick rollback capability"
    );
}

/// Test segregation of duties compliance
#[tokio::test]
async fn test_segregation_of_duties() {
    let config = SOXConfig::default();
    let manager = SOXComplianceManager::new(&config);

    let assessment = manager
        .assess_sox_compliance()
        .await
        .expect("Assessment should succeed");

    // Verify segregation is assessed
    assert!(
        !assessment.segregation_compliance.is_empty(),
        "Segregation of duties should be assessed"
    );
}

/// Test access control assessment
#[tokio::test]
async fn test_access_control() {
    let config = SOXConfig::default();
    let manager = SOXComplianceManager::new(&config);

    let assessment = manager
        .assess_sox_compliance()
        .await
        .expect("Assessment should succeed");

    // Verify access controls are assessed
    assert!(
        !assessment.access_control_compliance.is_empty(),
        "Access controls should be assessed"
    );
}

/// Test audit retention requirements
#[tokio::test]
async fn test_audit_retention() {
    let config = SOXConfig {
        audit_retention_days: 2555, // 7 years
        ..Default::default()
    };

    assert_eq!(
        config.audit_retention_days, 2555,
        "Should retain audit data for 7 years"
    );
    assert!(
        config.audit_retention_days >= 2555,
        "Should meet SOX retention requirements"
    );
}

/// Test control testing frequency
#[tokio::test]
async fn test_testing_frequency() {
    let frequencies = vec![
        TestingFrequency::Daily,
        TestingFrequency::Weekly,
        TestingFrequency::Monthly,
        TestingFrequency::Quarterly,
        TestingFrequency::Annual,
    ];

    for freq in frequencies {
        // All frequencies should be valid
        match freq {
            TestingFrequency::Daily
            | TestingFrequency::Weekly
            | TestingFrequency::Monthly
            | TestingFrequency::Quarterly
            | TestingFrequency::Annual => assert!(true),
        }
    }
}

/// Test escalation policies
#[tokio::test]
async fn test_escalation_policies() {
    let config = SOXConfig::default();

    // Verify material weakness escalation
    let mw_policy = &config.escalation_policies.material_weakness_escalation;
    assert!(
        mw_policy.initial_escalation_time <= 30,
        "Material weakness should escalate quickly (<= 30 min)"
    );
    assert!(
        !mw_policy.escalation_levels.is_empty(),
        "Should have escalation levels defined"
    );

    // Verify significant deficiency escalation
    let sd_policy = &config.escalation_policies.significant_deficiency_escalation;
    assert!(
        sd_policy.initial_escalation_time <= 60,
        "Significant deficiency should escalate within 1 hour"
    );
}

/// Test compliance recommendations
#[tokio::test]
async fn test_compliance_recommendations() {
    let config = SOXConfig::default();
    let manager = SOXComplianceManager::new(&config);

    let assessment = manager
        .assess_sox_compliance()
        .await
        .expect("Assessment should succeed");

    // Should provide actionable recommendations
    for rec in &assessment.recommendations {
        assert!(
            !rec.description.is_empty(),
            "Recommendation should have description"
        );
        assert!(
            !rec.category.is_empty(),
            "Recommendation should have category"
        );
        assert!(
            rec.target_date > Utc::now(),
            "Target date should be in the future"
        );
    }
}

/// Test officer role requirements
#[tokio::test]
async fn test_officer_roles() {
    let config = SOXConfig::default();

    let required_officers = &config.management_certification.required_officers;

    assert!(
        required_officers.contains(&OfficerRole::CEO),
        "CEO certification required"
    );
    assert!(
        required_officers.contains(&OfficerRole::CFO),
        "CFO certification required"
    );
}

/// Test control implementation status tracking
#[tokio::test]
async fn test_implementation_status() {
    let statuses = vec![
        ImplementationStatus::NotImplemented,
        ImplementationStatus::InProgress,
        ImplementationStatus::Implemented,
        ImplementationStatus::OperatingEffectively,
        ImplementationStatus::Deficient,
    ];

    for status in statuses {
        match status {
            ImplementationStatus::NotImplemented
            | ImplementationStatus::InProgress
            | ImplementationStatus::Implemented
            | ImplementationStatus::OperatingEffectively
            | ImplementationStatus::Deficient => assert!(true, "Valid status"),
        }
    }
}