foxhunt/trading_engine/tests/sox_access_control_tests.rs

//! SOX Access Control Documentation Tests
//!
//! Validates that access control matrix, role hierarchies, separation of duties,
//! and exception processes are properly documented and enforceable.

use chrono::{Duration, Utc};
use trading_engine::compliance::sox_compliance::{
    AccessControlMatrix, AccessReview, AccessReviewType, AssignedRole, AssignmentStatus,
    IncompatibleRoles, Permission, RequiredSeparation, ReviewPeriod, ReviewScope, ReviewStatus,
    RiskLevel, RoleDefinition, RolePermissions, SegregationMatrix,
};

#[test]
fn test_complete_permission_matrix_validation() {
    // Test that all roles have complete permission definitions
    let access_matrix = AccessControlMatrix::new();

    // Define all critical roles for trading system
    let critical_roles = vec![
        "trader",
        "risk_manager",
        "compliance_officer",
        "operations",
        "admin",
        "auditor",
    ];

    // Validate each role has:
    // 1. Resource permissions defined
    // 2. Action constraints
    // 3. Risk level assigned
    for role in critical_roles {
        let role_def = RoleDefinition {
            role_id: format!("ROLE-{}", role.to_uppercase()),
            role_name: role.to_string(),
            description: format!("{} role with defined permissions", role),
            permissions: vec![
                Permission {
                    permission_id: format!("PERM-{}-001", role.to_uppercase()),
                    resource: "orders".to_string(),
                    actions: vec!["create".to_string(), "read".to_string()],
                    constraints: vec!["max_order_size: 1000000".to_string()],
                },
                Permission {
                    permission_id: format!("PERM-{}-002", role.to_uppercase()),
                    resource: "positions".to_string(),
                    actions: vec!["read".to_string()],
                    constraints: vec!["own_account_only".to_string()],
                },
            ],
            risk_level: match role {
                "trader" => RiskLevel::High,
                "admin" => RiskLevel::Critical,
                "auditor" => RiskLevel::Low,
                _ => RiskLevel::Medium,
            },
            requires_approval: match role {
                "admin" => true,
                "trader" => true,
                _ => false,
            },
        };

        // Validate role has permissions defined
        assert!(
            !role_def.permissions.is_empty(),
            "Role {} has no permissions defined",
            role
        );
        assert!(role_def.role_id != "", "Role ID missing for {}", role);
        assert!(
            role_def.description != "",
            "Role description missing for {}",
            role
        );

        // Validate each permission has constraints
        for perm in &role_def.permissions {
            assert!(
                !perm.actions.is_empty(),
                "No actions defined for permission {}",
                perm.permission_id
            );
            assert!(
                !perm.constraints.is_empty(),
                "No constraints for permission {}",
                perm.permission_id
            );
        }
    }
}

#[test]
fn test_role_hierarchy_enforcement() {
    // Test role hierarchy: Admin > Manager > Supervisor > User
    let access_matrix = AccessControlMatrix::new();

    let role_hierarchy = vec![
        ("admin", 4, vec!["*"]), // Full access
        ("manager", 3, vec!["orders", "positions", "reports"]),
        ("supervisor", 2, vec!["orders", "positions"]),
        ("user", 1, vec!["orders"]),
    ];

    for (role_name, level, resources) in role_hierarchy {
        let role = RoleDefinition {
            role_id: format!("ROLE-{}", role_name.to_uppercase()),
            role_name: role_name.to_string(),
            description: format!("Hierarchy level {}", level),
            permissions: resources
                .iter()
                .map(|res| Permission {
                    permission_id: format!(
                        "PERM-{}-{}",
                        role_name.to_uppercase(),
                        res.to_uppercase()
                    ),
                    resource: res.to_string(),
                    actions: vec!["read".to_string(), "write".to_string()],
                    constraints: vec![],
                })
                .collect(),
            risk_level: if level >= 3 {
                RiskLevel::High
            } else {
                RiskLevel::Medium
            },
            requires_approval: level >= 3,
        };

        // Validate hierarchy level reflected in permissions
        if level == 4 {
            // Admin has wildcard access
            assert!(
                role.permissions.iter().any(|p| p.resource == "*"),
                "Admin missing wildcard access"
            );
        } else {
            // Other roles have specific resources
            assert!(
                role.permissions.len() == resources.len(),
                "Role {} permission count mismatch",
                role_name
            );
        }

        // Higher levels require approval
        assert_eq!(
            role.requires_approval,
            level >= 3,
            "Approval requirement mismatch for {}",
            role_name
        );
    }
}

#[test]
fn test_separation_of_duties_matrix() {
    // Test SOD matrix prevents incompatible role combinations
    let sod_matrix = SegregationMatrix {
        roles: std::collections::HashMap::new(),
        incompatible_combinations: vec![
            IncompatibleRoles {
                rule_id: "SOD-001".to_string(),
                role_a: "trader".to_string(),
                role_b: "risk_approver".to_string(),
                reason: "Trader cannot approve own trades".to_string(),
                exception_process: Some("CFO approval required".to_string()),
            },
            IncompatibleRoles {
                rule_id: "SOD-002".to_string(),
                role_a: "order_creator".to_string(),
                role_b: "order_approver".to_string(),
                reason: "Cannot create and approve same order".to_string(),
                exception_process: None,
            },
            IncompatibleRoles {
                rule_id: "SOD-003".to_string(),
                role_a: "payment_initiator".to_string(),
                role_b: "payment_approver".to_string(),
                reason: "Financial control separation".to_string(),
                exception_process: Some("Dual approval from CFO + CEO".to_string()),
            },
        ],
        required_separations: vec![RequiredSeparation {
            separation_id: "SEP-001".to_string(),
            process_name: "Trade Execution".to_string(),
            separated_functions: vec![
                "trade_entry".to_string(),
                "trade_approval".to_string(),
                "trade_settlement".to_string(),
            ],
            justification: "SOX 404 control requirement".to_string(),
        }],
    };

    // Validate incompatible combinations defined
    assert_eq!(
        sod_matrix.incompatible_combinations.len(),
        3,
        "Insufficient SOD rules"
    );

    // Validate each rule has clear reason
    for rule in &sod_matrix.incompatible_combinations {
        assert!(rule.rule_id != "", "SOD rule missing ID");
        assert!(
            rule.role_a != rule.role_b,
            "SOD rule {} has same roles",
            rule.rule_id
        );
        assert!(
            rule.reason != "",
            "SOD rule {} missing reason",
            rule.rule_id
        );
    }

    // Validate required separations
    assert_eq!(
        sod_matrix.required_separations.len(),
        1,
        "Missing required separations"
    );
    assert!(
        sod_matrix.required_separations[0].separated_functions.len() >= 2,
        "Insufficient separation functions"
    );
}

#[test]
fn test_access_review_completeness() {
    // Test quarterly access reviews are properly documented
    let access_matrix = AccessControlMatrix::new();

    let access_review = AccessReview {
        review_id: "REVIEW-Q1-2025".to_string(),
        review_type: AccessReviewType::UserAccess,
        scope: ReviewScope {
            users: vec!["user_001".to_string(), "user_002".to_string()],
            roles: vec!["trader".to_string(), "risk_manager".to_string()],
            systems: vec!["trading_platform".to_string(), "risk_system".to_string()],
            period: ReviewPeriod {
                start_date: Utc::now() - Duration::days(90),
                end_date: Utc::now(),
            },
        },
        review_date: Utc::now(),
        reviewer: "compliance_officer_001".to_string(),
        findings: vec![], // Populated during review
        status: ReviewStatus::InProgress,
    };

    // Validate review covers all required elements
    assert!(access_review.review_id != "", "Review ID missing");
    assert!(
        !access_review.scope.users.is_empty(),
        "No users in review scope"
    );
    assert!(
        !access_review.scope.roles.is_empty(),
        "No roles in review scope"
    );
    assert!(access_review.reviewer != "", "Reviewer not assigned");

    // Validate review period is quarterly (90 days)
    let review_duration = access_review
        .scope
        .period
        .end_date
        .signed_duration_since(access_review.scope.period.start_date);
    assert!(
        review_duration.num_days() >= 85 && review_duration.num_days() <= 95,
        "Review period not quarterly (expected ~90 days, got {})",
        review_duration.num_days()
    );
}

#[test]
fn test_exception_approval_workflow() {
    // Test exception process for SOD violations
    let sod_matrix = SegregationMatrix {
        roles: std::collections::HashMap::new(),
        incompatible_combinations: vec![IncompatibleRoles {
            rule_id: "SOD-EXCEPTION-001".to_string(),
            role_a: "developer".to_string(),
            role_b: "production_deployer".to_string(),
            reason: "Developer cannot deploy own code".to_string(),
            exception_process: Some("CTO approval + independent code review required".to_string()),
        }],
        required_separations: vec![],
    };

    // Validate exception process defined for critical SOD rules
    let rule = &sod_matrix.incompatible_combinations[0];
    assert!(
        rule.exception_process.is_some(),
        "Exception process not defined for critical SOD rule"
    );

    let exception_process = rule.exception_process.as_ref().unwrap();
    assert!(
        exception_process.contains("approval"),
        "Exception process missing approval requirement"
    );
    assert!(
        exception_process.len() > 20,
        "Exception process not detailed enough"
    );

    // Exception workflow requires:
    // 1. Business justification
    // 2. Risk assessment
    // 3. Executive approval (CFO/CTO/CEO)
    // 4. Compensating controls
    // 5. Time-bound (temporary only)
}

#[test]
fn test_role_permission_documentation() {
    // Test that role permissions are fully documented
    let role_permissions = RolePermissions {
        role_id: "ROLE-TRADER".to_string(),
        permissions: vec![
            Permission {
                permission_id: "PERM-TRADER-001".to_string(),
                resource: "orders".to_string(),
                actions: vec![
                    "create".to_string(),
                    "read".to_string(),
                    "cancel".to_string(),
                ],
                constraints: vec![
                    "max_order_size: 1000000".to_string(),
                    "trading_hours_only".to_string(),
                    "pre_trade_risk_check_required".to_string(),
                ],
            },
            Permission {
                permission_id: "PERM-TRADER-002".to_string(),
                resource: "positions".to_string(),
                actions: vec!["read".to_string()],
                constraints: vec!["own_account_only".to_string()],
            },
            Permission {
                permission_id: "PERM-TRADER-003".to_string(),
                resource: "market_data".to_string(),
                actions: vec!["read".to_string()],
                constraints: vec!["real_time_feed_access".to_string()],
            },
        ],
        effective_date: Utc::now(),
        last_modified: Utc::now(),
        modified_by: "compliance_officer".to_string(),
    };

    // Validate documentation completeness
    assert!(role_permissions.role_id != "", "Role ID missing");
    assert!(
        !role_permissions.permissions.is_empty(),
        "No permissions defined"
    );
    assert!(
        role_permissions.modified_by != "",
        "Modifier not documented"
    );

    // Validate each permission has:
    // 1. Unique ID
    // 2. Resource target
    // 3. Allowed actions
    // 4. Constraints/limitations
    for perm in &role_permissions.permissions {
        assert!(
            perm.permission_id.starts_with("PERM-"),
            "Invalid permission ID format"
        );
        assert!(perm.resource != "", "Resource not specified");
        assert!(!perm.actions.is_empty(), "No actions defined");
        assert!(
            !perm.constraints.is_empty(),
            "No constraints defined (required for SOX)"
        );
    }
}

#[test]
fn test_user_role_assignment_tracking() {
    // Test that role assignments are properly tracked with audit trail
    use trading_engine::compliance::sox_compliance::UserRoleAssignment;

    let user_assignment = UserRoleAssignment {
        user_id: "user_trader_001".to_string(),
        roles: vec![AssignedRole {
            role_id: "ROLE-TRADER".to_string(),
            assigned_date: Utc::now() - Duration::days(30),
            assigned_by: "manager_001".to_string(),
            expiration_date: Some(Utc::now() + Duration::days(335)), // 1 year - 30 days
            justification: "Hired as junior trader, completed training".to_string(),
        }],
        last_review_date: Utc::now() - Duration::days(30),
        next_review_date: Utc::now() + Duration::days(60), // Quarterly review
        status: AssignmentStatus::Active,
    };

    // Validate assignment tracking
    assert!(user_assignment.user_id != "", "User ID missing");
    assert!(!user_assignment.roles.is_empty(), "No roles assigned");

    // Validate each role assignment has:
    // 1. Assigned by (WHO)
    // 2. Assigned date (WHEN)
    // 3. Business justification (WHY)
    // 4. Expiration tracking
    // 5. Review schedule
    for role in &user_assignment.roles {
        assert!(role.assigned_by != "", "Assigner not documented");
        assert!(
            role.justification != "",
            "Business justification missing (SOX requirement)"
        );
        assert!(
            role.expiration_date.is_some(),
            "No expiration date (SOX requires periodic review)"
        );
    }

    // Validate review schedule (quarterly)
    let review_interval = user_assignment
        .next_review_date
        .signed_duration_since(user_assignment.last_review_date);
    assert!(
        review_interval.num_days() >= 85 && review_interval.num_days() <= 95,
        "Review not quarterly"
    );
}

#[test]
fn test_privileged_access_monitoring() {
    // Test that privileged access (admin, root, etc.) is monitored
    let privileged_roles = vec!["admin", "root", "dba", "security_admin"];

    for role in privileged_roles {
        let role_def = RoleDefinition {
            role_id: format!("ROLE-{}", role.to_uppercase()),
            role_name: role.to_string(),
            description: format!("Privileged {} access", role),
            permissions: vec![Permission {
                permission_id: format!("PERM-{}-PRIVILEGED", role.to_uppercase()),
                resource: "*".to_string(),      // Wildcard access
                actions: vec!["*".to_string()], // All actions
                constraints: vec![
                    "mfa_required".to_string(),
                    "session_recording_required".to_string(),
                    "dual_approval_required".to_string(),
                    "time_limited_access".to_string(),
                ],
            }],
            risk_level: RiskLevel::Critical,
            requires_approval: true,
        };

        // Validate privileged roles have enhanced controls
        assert_eq!(
            role_def.risk_level,
            RiskLevel::Critical,
            "Privileged role {} not marked critical",
            role
        );
        assert!(
            role_def.requires_approval,
            "Privileged role {} missing approval requirement",
            role
        );

        // Validate enhanced constraints for privileged access
        let constraints = &role_def.permissions[0].constraints;
        assert!(
            constraints.contains(&"mfa_required".to_string()),
            "MFA not required for {}",
            role
        );
        assert!(
            constraints.contains(&"dual_approval_required".to_string()),
            "Dual approval missing for {}",
            role
        );
        assert!(
            constraints.len() >= 3,
            "Insufficient controls for privileged role {}",
            role
        );
    }
}

#[test]
fn test_inactive_account_detection() {
    // Test detection of inactive accounts requiring review/termination
    let inactive_threshold_days = 90;

    let user_assignment = trading_engine::compliance::sox_compliance::UserRoleAssignment {
        user_id: "user_inactive_001".to_string(),
        roles: vec![AssignedRole {
            role_id: "ROLE-TRADER".to_string(),
            assigned_date: Utc::now() - Duration::days(180),
            assigned_by: "manager_001".to_string(),
            expiration_date: None,
            justification: "Initial assignment".to_string(),
        }],
        last_review_date: Utc::now() - Duration::days(120), // Not reviewed in 120 days
        next_review_date: Utc::now() - Duration::days(30),  // Overdue by 30 days
        status: AssignmentStatus::Active,
    };

    // Check if account is inactive (last review > threshold)
    let days_since_review = Utc::now()
        .signed_duration_since(user_assignment.last_review_date)
        .num_days();

    assert!(
        days_since_review > inactive_threshold_days,
        "Inactive account detection failed: {} days since review (threshold: {})",
        days_since_review,
        inactive_threshold_days
    );

    // Check if review is overdue
    let is_overdue = user_assignment.next_review_date < Utc::now();
    assert!(is_overdue, "Overdue review not detected");

    // Inactive accounts require:
    // 1. Immediate access review
    // 2. Suspension if no activity
    // 3. Termination after extended inactivity
    // 4. Audit logging of all actions
}