foxhunt/trading_engine/tests/compliance_sox.rs

//! SOX Compliance Tests
//!
//! Comprehensive tests for Sarbanes-Oxley Act compliance including:
//! - Internal controls assessment
//! - Segregation of duties
//! - Change management controls
//! - Access control matrix
//! - Management certification
//! - Control deficiency tracking

use trading_engine::compliance::sox_compliance::{
    SOXComplianceManager, SOXConfig, InternalControl, ControlType, ControlFrequency,
    RiskLevel, ImplementationStatus, TestingFrequency, CertificationLevel, OfficerRole,
    ControlDeficiency, DeficiencySeverity, DeficiencyStatus, ChangeRequest, ChangeType,
    ChangePriority, ChangeApprovalStatus,
};
use chrono::{Utc, Duration};
use std::collections::HashMap;

/// Test SOX compliance manager initialization
#[tokio::test]
async fn test_sox_manager_initialization() {
    let config = SOXConfig::default();
    let manager = SOXComplianceManager::new(&config);
    
    // Verify manager initialized successfully
    assert!(true, "SOX compliance manager initialized");
}

/// Test internal controls assessment
#[tokio::test]
async fn test_internal_controls_assessment() {
    let config = SOXConfig::default();
    let manager = SOXComplianceManager::new(&config);

    let result = manager.assess_sox_compliance().await;
    
    assert!(result.is_ok(), "SOX compliance assessment should succeed");
    
    let assessment = result.unwrap();
    assert!(assessment.overall_score >= 0.0 && assessment.overall_score <= 100.0,
            "Compliance score should be between 0 and 100");
    
    // Verify controls effectiveness is documented
    assert!(!assessment.controls_effectiveness.is_empty(),
            "Controls effectiveness should be documented");
}

/// Test Section 302 compliance (internal controls)
#[tokio::test]
async fn test_section_302_compliance() {
    let config = SOXConfig {
        section_302_enabled: true,
        ..Default::default()
    };

    assert!(config.section_302_enabled, "Section 302 should be enabled");
    assert!(config.management_certification.required_officers.contains(&OfficerRole::CEO),
            "CEO certification should be required");
    assert!(config.management_certification.required_officers.contains(&OfficerRole::CFO),
            "CFO certification should be required");
}

/// Test Section 404 compliance (assessment of internal controls)
#[tokio::test]
async fn test_section_404_compliance() {
    let config = SOXConfig {
        section_404_enabled: true,
        controls_testing_frequency: TestingFrequency::Quarterly,
        ..Default::default()
    };

    assert!(config.section_404_enabled, "Section 404 should be enabled");
    assert_eq!(config.controls_testing_frequency, TestingFrequency::Quarterly,
               "Controls should be tested quarterly");
}

/// Test internal control definition
#[tokio::test]
async fn test_internal_control_definition() {
    let control = InternalControl {
        control_id: "IC-001".to_string(),
        description: "Automated order limit validation".to_string(),
        objective: "Prevent orders exceeding position limits".to_string(),
        control_type: ControlType::Preventive,
        frequency: ControlFrequency::Continuous,
        risk_level: RiskLevel::High,
        owner: "risk_manager".to_string(),
        testing_procedures: Vec::new(),
        implementation_status: ImplementationStatus::OperatingEffectively,
        last_test_date: Some(Utc::now() - Duration::days(30)),
        next_test_date: Utc::now() + Duration::days(60),
    };

    // Verify control structure
    assert_eq!(control.control_type, ControlType::Preventive);
    assert_eq!(control.frequency, ControlFrequency::Continuous);
    assert_eq!(control.risk_level, RiskLevel::High);
    assert_eq!(control.implementation_status, ImplementationStatus::OperatingEffectively);
}

/// Test control types coverage
#[tokio::test]
async fn test_control_types() {
    let preventive = ControlType::Preventive;
    let detective = ControlType::Detective;
    let corrective = ControlType::Corrective;
    let compensating = ControlType::Compensating;

    // All control types should be properly categorized
    assert_eq!(preventive, ControlType::Preventive);
    assert_eq!(detective, ControlType::Detective);
    assert_eq!(corrective, ControlType::Corrective);
    assert_eq!(compensating, ControlType::Compensating);
}

/// Test control frequency options
#[tokio::test]
async fn test_control_frequencies() {
    let frequencies = vec![
        ControlFrequency::Continuous,
        ControlFrequency::Daily,
        ControlFrequency::Weekly,
        ControlFrequency::Monthly,
        ControlFrequency::Quarterly,
        ControlFrequency::Annual,
        ControlFrequency::EventDriven,
    ];

    assert_eq!(frequencies.len(), 7, "Should have all control frequency types");
}

/// Test management certification requirements
#[tokio::test]
async fn test_management_certification() {
    let config = SOXConfig::default();
    let manager = SOXComplianceManager::new(&config);

    let result = manager.generate_management_certification(&OfficerRole::CEO).await;
    
    assert!(result.is_ok(), "Should generate CEO certification");
    
    let certification = result.unwrap();
    assert_eq!(certification.certifying_officer, OfficerRole::CEO);
    assert!(!certification.certification_statement.is_empty(),
            "Certification statement should not be empty");
}

/// Test CFO certification
#[tokio::test]
async fn test_cfo_certification() {
    let config = SOXConfig::default();
    let manager = SOXComplianceManager::new(&config);

    let result = manager.generate_management_certification(&OfficerRole::CFO).await;
    
    assert!(result.is_ok(), "Should generate CFO certification");
    
    let certification = result.unwrap();
    assert_eq!(certification.certifying_officer, OfficerRole::CFO);
}

/// Test control deficiency tracking
#[tokio::test]
async fn test_control_deficiency() {
    let deficiency = ControlDeficiency {
        deficiency_id: "DEF-001".to_string(),
        control_id: "IC-002".to_string(),
        deficiency_type: trading_engine::compliance::sox_compliance::DeficiencyType::OperatingDeficiency,
        severity: DeficiencySeverity::SignificantDeficiency,
        description: "Order validation control did not prevent limit breach".to_string(),
        root_cause: "Configuration error in limit calculation".to_string(),
        potential_impact: "Potential regulatory breach".to_string(),
        remediation_plan: trading_engine::compliance::sox_compliance::RemediationPlan {
            plan_id: "REM-001".to_string(),
            actions: Vec::new(),
            responsible_party: "it_manager".to_string(),
            target_completion_date: Utc::now() + Duration::days(30),
            progress: Vec::new(),
        },
        status: DeficiencyStatus::Open,
        identified_date: Utc::now(),
        due_date: Utc::now() + Duration::days(30),
    };

    // Verify deficiency structure
    assert_eq!(deficiency.severity, DeficiencySeverity::SignificantDeficiency);
    assert_eq!(deficiency.status, DeficiencyStatus::Open);
    assert!(!deficiency.description.is_empty());
    assert!(!deficiency.root_cause.is_empty());
}

/// Test material weakness tracking
#[tokio::test]
async fn test_material_weakness() {
    let material_weakness = ControlDeficiency {
        deficiency_id: "DEF-002".to_string(),
        control_id: "IC-003".to_string(),
        deficiency_type: trading_engine::compliance::sox_compliance::DeficiencyType::DesignDeficiency,
        severity: DeficiencySeverity::MaterialWeakness,
        description: "Segregation of duties not properly implemented".to_string(),
        root_cause: "Insufficient separation between trading and settlement".to_string(),
        potential_impact: "Financial misstatement risk".to_string(),
        remediation_plan: trading_engine::compliance::sox_compliance::RemediationPlan {
            plan_id: "REM-002".to_string(),
            actions: Vec::new(),
            responsible_party: "cfo".to_string(),
            target_completion_date: Utc::now() + Duration::days(14),
            progress: Vec::new(),
        },
        status: DeficiencyStatus::InRemediation,
        identified_date: Utc::now() - Duration::days(5),
        due_date: Utc::now() + Duration::days(14),
    };

    // Material weakness requires immediate attention
    assert_eq!(material_weakness.severity, DeficiencySeverity::MaterialWeakness);
    assert!(material_weakness.remediation_plan.target_completion_date < 
            Utc::now() + Duration::days(30),
            "Material weakness should have shorter remediation timeline");
}

/// Test change management controls
#[tokio::test]
async fn test_change_management() {
    let change_request = ChangeRequest {
        change_id: "CHG-001".to_string(),
        title: "Update trading algorithm parameters".to_string(),
        description: "Modify risk parameters for momentum strategy".to_string(),
        requestor: "portfolio_manager".to_string(),
        change_type: ChangeType::Normal,
        priority: ChangePriority::Medium,
        risk_assessment: trading_engine::compliance::sox_compliance::RiskAssessment {
            risk_level: RiskLevel::Medium,
            risk_factors: Vec::new(),
            mitigation_measures: Vec::new(),
            residual_risk: RiskLevel::Low,
        },
        impact_analysis: trading_engine::compliance::sox_compliance::ImpactAnalysis {
            affected_systems: vec!["trading_engine".to_string()],
            affected_processes: vec!["order_execution".to_string()],
            business_impact: trading_engine::compliance::sox_compliance::BusinessImpact {
                impact_level: trading_engine::compliance::sox_compliance::ImpactLevel::Medium,
                affected_functions: vec!["momentum_trading".to_string()],
                revenue_impact: None,
                customer_impact: "No direct customer impact".to_string(),
            },
            technical_impact: trading_engine::compliance::sox_compliance::TechnicalImpact {
                performance_impact: "Minimal performance impact".to_string(),
                security_impact: "No security impact".to_string(),
                integration_impact: "No integration changes".to_string(),
                capacity_impact: "No capacity changes".to_string(),
            },
            compliance_impact: trading_engine::compliance::sox_compliance::ComplianceImpact {
                affected_regulations: vec!["SOX".to_string()],
                compliance_risk: RiskLevel::Low,
                additional_controls: Vec::new(),
            },
        },
        implementation_plan: trading_engine::compliance::sox_compliance::ImplementationPlan {
            steps: Vec::new(),
            scheduled_start: Utc::now() + Duration::days(7),
            estimated_duration: Duration::hours(4),
            dependencies: Vec::new(),
            success_criteria: vec!["Parameters updated successfully".to_string()],
        },
        rollback_plan: trading_engine::compliance::sox_compliance::RollbackPlan {
            steps: Vec::new(),
            triggers: vec!["System error".to_string(), "Performance degradation".to_string()],
            rollback_owner: "it_manager".to_string(),
            max_rollback_time: Duration::minutes(30),
        },
        approval_status: ChangeApprovalStatus::Pending,
        implementation_status: trading_engine::compliance::sox_compliance::ChangeImplementationStatus::NotStarted,
    };

    // Verify change management structure
    assert_eq!(change_request.change_type, ChangeType::Normal);
    assert_eq!(change_request.approval_status, ChangeApprovalStatus::Pending);
    assert!(!change_request.rollback_plan.triggers.is_empty(),
            "Rollback triggers should be defined");
}

/// Test emergency change handling
#[tokio::test]
async fn test_emergency_change() {
    let emergency_change = ChangeRequest {
        change_id: "CHG-EMERG-001".to_string(),
        title: "Emergency fix for order validation bug".to_string(),
        description: "Critical bug preventing order execution".to_string(),
        requestor: "incident_manager".to_string(),
        change_type: ChangeType::Emergency,
        priority: ChangePriority::Critical,
        risk_assessment: trading_engine::compliance::sox_compliance::RiskAssessment {
            risk_level: RiskLevel::Critical,
            risk_factors: Vec::new(),
            mitigation_measures: Vec::new(),
            residual_risk: RiskLevel::Medium,
        },
        impact_analysis: trading_engine::compliance::sox_compliance::ImpactAnalysis {
            affected_systems: vec!["trading_engine".to_string()],
            affected_processes: vec!["order_validation".to_string()],
            business_impact: trading_engine::compliance::sox_compliance::BusinessImpact {
                impact_level: trading_engine::compliance::sox_compliance::ImpactLevel::Critical,
                affected_functions: vec!["all_trading".to_string()],
                revenue_impact: Some(rust_decimal::Decimal::from(1_000_000)),
                customer_impact: "Trading halted for all clients".to_string(),
            },
            technical_impact: trading_engine::compliance::sox_compliance::TechnicalImpact {
                performance_impact: "System unavailable".to_string(),
                security_impact: "No security impact".to_string(),
                integration_impact: "All integrations affected".to_string(),
                capacity_impact: "Full capacity unavailable".to_string(),
            },
            compliance_impact: trading_engine::compliance::sox_compliance::ComplianceImpact {
                affected_regulations: vec!["SOX".to_string(), "MIFID2".to_string()],
                compliance_risk: RiskLevel::High,
                additional_controls: vec!["Post-implementation review".to_string()],
            },
        },
        implementation_plan: trading_engine::compliance::sox_compliance::ImplementationPlan {
            steps: Vec::new(),
            scheduled_start: Utc::now(),
            estimated_duration: Duration::hours(1),
            dependencies: Vec::new(),
            success_criteria: vec!["Order validation functional".to_string()],
        },
        rollback_plan: trading_engine::compliance::sox_compliance::RollbackPlan {
            steps: Vec::new(),
            triggers: vec!["Fix unsuccessful".to_string()],
            rollback_owner: "cto".to_string(),
            max_rollback_time: Duration::minutes(15),
        },
        approval_status: ChangeApprovalStatus::Approved,
        implementation_status: trading_engine::compliance::sox_compliance::ChangeImplementationStatus::InProgress,
    };

    // Emergency changes have expedited process
    assert_eq!(emergency_change.change_type, ChangeType::Emergency);
    assert_eq!(emergency_change.priority, ChangePriority::Critical);
    assert!(emergency_change.rollback_plan.max_rollback_time < Duration::hours(1),
            "Emergency changes should have quick rollback capability");
}

/// Test segregation of duties compliance
#[tokio::test]
async fn test_segregation_of_duties() {
    let config = SOXConfig::default();
    let manager = SOXComplianceManager::new(&config);

    let assessment = manager.assess_sox_compliance().await
        .expect("Assessment should succeed");

    // Verify segregation is assessed
    assert!(!assessment.segregation_compliance.is_empty(),
            "Segregation of duties should be assessed");
}

/// Test access control assessment
#[tokio::test]
async fn test_access_control() {
    let config = SOXConfig::default();
    let manager = SOXComplianceManager::new(&config);

    let assessment = manager.assess_sox_compliance().await
        .expect("Assessment should succeed");

    // Verify access controls are assessed
    assert!(!assessment.access_control_compliance.is_empty(),
            "Access controls should be assessed");
}

/// Test audit retention requirements
#[tokio::test]
async fn test_audit_retention() {
    let config = SOXConfig {
        audit_retention_days: 2555, // 7 years
        ..Default::default()
    };

    assert_eq!(config.audit_retention_days, 2555,
               "Should retain audit data for 7 years");
    assert!(config.audit_retention_days >= 2555,
            "Should meet SOX retention requirements");
}

/// Test control testing frequency
#[tokio::test]
async fn test_testing_frequency() {
    let frequencies = vec![
        TestingFrequency::Daily,
        TestingFrequency::Weekly,
        TestingFrequency::Monthly,
        TestingFrequency::Quarterly,
        TestingFrequency::Annual,
    ];

    for freq in frequencies {
        // All frequencies should be valid
        match freq {
            TestingFrequency::Daily |
            TestingFrequency::Weekly |
            TestingFrequency::Monthly |
            TestingFrequency::Quarterly |
            TestingFrequency::Annual => assert!(true),
        }
    }
}

/// Test escalation policies
#[tokio::test]
async fn test_escalation_policies() {
    let config = SOXConfig::default();

    // Verify material weakness escalation
    let mw_policy = &config.escalation_policies.material_weakness_escalation;
    assert!(mw_policy.initial_escalation_time <= 30,
            "Material weakness should escalate quickly (<= 30 min)");
    assert!(!mw_policy.escalation_levels.is_empty(),
            "Should have escalation levels defined");

    // Verify significant deficiency escalation
    let sd_policy = &config.escalation_policies.significant_deficiency_escalation;
    assert!(sd_policy.initial_escalation_time <= 60,
            "Significant deficiency should escalate within 1 hour");
}

/// Test compliance recommendations
#[tokio::test]
async fn test_compliance_recommendations() {
    let config = SOXConfig::default();
    let manager = SOXComplianceManager::new(&config);

    let assessment = manager.assess_sox_compliance().await
        .expect("Assessment should succeed");

    // Should provide actionable recommendations
    for rec in &assessment.recommendations {
        assert!(!rec.description.is_empty(),
                "Recommendation should have description");
        assert!(!rec.category.is_empty(),
                "Recommendation should have category");
        assert!(rec.target_date > Utc::now(),
                "Target date should be in the future");
    }
}

/// Test officer role requirements
#[tokio::test]
async fn test_officer_roles() {
    let config = SOXConfig::default();

    let required_officers = &config.management_certification.required_officers;
    
    assert!(required_officers.contains(&OfficerRole::CEO),
            "CEO certification required");
    assert!(required_officers.contains(&OfficerRole::CFO),
            "CFO certification required");
}

/// Test control implementation status tracking
#[tokio::test]
async fn test_implementation_status() {
    let statuses = vec![
        ImplementationStatus::NotImplemented,
        ImplementationStatus::InProgress,
        ImplementationStatus::Implemented,
        ImplementationStatus::OperatingEffectively,
        ImplementationStatus::Deficient,
    ];

    for status in statuses {
        match status {
            ImplementationStatus::NotImplemented |
            ImplementationStatus::InProgress |
            ImplementationStatus::Implemented |
            ImplementationStatus::OperatingEffectively |
            ImplementationStatus::Deficient => assert!(true, "Valid status"),
        }
    }
}