n8n/packages/nodes-base/nodes/TheHiveProject/test/TheHiveProjectTrigger.node.test.ts

import { testWebhookTriggerNode } from '@test/nodes/TriggerHelpers';
import { TheHiveProjectTrigger } from '../TheHiveProjectTrigger.node';

describe('TheHiveProjectTrigger', () => {
	describe('Alert Created Event', () => {
		it('should process alert_create event correctly', async () => {
			const bodyData = {
				action: 'Create',
				objectType: 'Alert',
				object: {
					_id: '~12345',
					_type: 'Alert',
					title: 'Test Alert',
					description: 'Test alert description',
					severity: '2',
					date: 1698753600000,
					tags: ['malware', 'test'],
					tlp: 2,
					pap: 2,
					source: 'n8n-test',
					sourceRef: 'test-ref-001',
					follow: true,
					customFields: {},
				},
				organisationId: '~456',
				organisation: 'TestOrg',
				requestId: 'test-request-123',
			};

			const headerData = {
				'content-type': 'application/json',
				'user-agent': 'TheHive/5.0',
				'x-request-id': 'test-request-123',
			};

			const { responseData } = await testWebhookTriggerNode(TheHiveProjectTrigger, {
				node: {
					parameters: {
						events: ['alert_create'],
					},
				},
				request: { method: 'POST' },
				bodyData,
				headerData,
			});

			expect(responseData).toBeDefined();
			expect(responseData?.workflowData).toBeDefined();
			expect(responseData?.workflowData![0][0].json).toEqual({
				event: 'alert_create',
				body: bodyData,
				headers: headerData,
				query: {},
			});
		});
	});

	describe('Wildcard Event', () => {
		it('should process any event with * wildcard', async () => {
			const bodyData = {
				action: 'Update',
				objectType: 'Case',
				object: {
					_id: '~67890',
					_type: 'Case',
					title: 'Test Case',
					description: 'Test case description',
					severity: '1',
					status: 'Open',
				},
			};

			const { responseData } = await testWebhookTriggerNode(TheHiveProjectTrigger, {
				node: {
					parameters: {
						events: ['*'],
					},
				},
				request: { method: 'POST' },
				bodyData,
			});

			expect(responseData).toBeDefined();
			expect(responseData?.workflowData).toBeDefined();
			expect(responseData?.workflowData![0][0].json.event).toBe('case_update');
		});
	});

	describe('Filtering', () => {
		it('should apply equal filter correctly', async () => {
			const bodyData = {
				action: 'Create',
				objectType: 'Alert',
				object: {
					severity: '2',
					title: 'High Priority Alert',
				},
			};

			const { responseData } = await testWebhookTriggerNode(TheHiveProjectTrigger, {
				node: {
					parameters: {
						events: ['alert_create'],
						filters: {
							values: [
								{
									field: 'object.severity',
									operator: 'equal',
									value: '2',
								},
							],
						},
					},
				},
				request: { method: 'POST' },
				bodyData,
			});

			expect(responseData).toBeDefined();
			expect(responseData?.workflowData).toBeDefined();
		});

		it('should filter out events that do not match equal filter', async () => {
			const bodyData = {
				action: 'Create',
				objectType: 'Alert',
				object: {
					severity: '1',
					title: 'Low Priority Alert',
				},
			};

			const { responseData } = await testWebhookTriggerNode(TheHiveProjectTrigger, {
				node: {
					parameters: {
						events: ['alert_create'],
						filters: {
							values: [
								{
									field: 'object.severity',
									operator: 'equal',
									value: '2',
								},
							],
						},
					},
				},
				request: { method: 'POST' },
				bodyData,
			});

			expect(responseData).toEqual({});
		});

		it('should apply notEqual filter correctly', async () => {
			const bodyData = {
				action: 'Create',
				objectType: 'Alert',
				object: {
					severity: '1',
					title: 'Low Priority Alert',
				},
			};

			const { responseData } = await testWebhookTriggerNode(TheHiveProjectTrigger, {
				node: {
					parameters: {
						events: ['alert_create'],
						filters: {
							values: [
								{
									field: 'object.severity',
									operator: 'notEqual',
									value: '2',
								},
							],
						},
					},
				},
				request: { method: 'POST' },
				bodyData,
			});

			expect(responseData).toBeDefined();
			expect(responseData?.workflowData).toBeDefined();
		});

		it('should apply includes filter correctly', async () => {
			const bodyData = {
				action: 'Create',
				objectType: 'Alert',
				object: {
					title: 'Malware Detection Alert',
					tags: ['malware', 'detection'],
				},
			};

			const { responseData } = await testWebhookTriggerNode(TheHiveProjectTrigger, {
				node: {
					parameters: {
						events: ['alert_create'],
						filters: {
							values: [
								{
									field: 'object.title',
									operator: 'includes',
									value: 'Malware',
								},
							],
						},
					},
				},
				request: { method: 'POST' },
				bodyData,
			});

			expect(responseData).toBeDefined();
			expect(responseData?.workflowData).toBeDefined();
		});

		it('should filter out events that do not match includes filter', async () => {
			const bodyData = {
				action: 'Create',
				objectType: 'Alert',
				object: {
					title: 'Network Alert',
					tags: ['network', 'monitoring'],
				},
			};

			const { responseData } = await testWebhookTriggerNode(TheHiveProjectTrigger, {
				node: {
					parameters: {
						events: ['alert_create'],
						filters: {
							values: [
								{
									field: 'object.title',
									operator: 'includes',
									value: 'Malware',
								},
							],
						},
					},
				},
				request: { method: 'POST' },
				bodyData,
			});

			expect(responseData).toEqual({});
		});
	});

	describe('Output Options', () => {
		it('should output only data when outputOnlyData is true', async () => {
			const bodyData = {
				action: 'Create',
				objectType: 'Alert',
				object: {
					_id: '~12345',
					title: 'Test Alert',
				},
			};

			const { responseData } = await testWebhookTriggerNode(TheHiveProjectTrigger, {
				node: {
					parameters: {
						events: ['alert_create'],
						options: {
							outputOnlyData: true,
						},
					},
				},
				request: { method: 'POST' },
				bodyData,
			});

			expect(responseData).toBeDefined();
			expect(responseData?.workflowData).toBeDefined();
			expect(responseData?.workflowData![0][0].json).toEqual(bodyData);
		});

		it('should output full data structure when outputOnlyData is false', async () => {
			const bodyData = {
				action: 'Create',
				objectType: 'Alert',
				object: {
					_id: '~12345',
					title: 'Test Alert',
				},
			};

			const { responseData } = await testWebhookTriggerNode(TheHiveProjectTrigger, {
				node: {
					parameters: {
						events: ['alert_create'],
						options: {
							outputOnlyData: false,
						},
					},
				},
				request: { method: 'POST' },
				bodyData,
			});

			expect(responseData).toBeDefined();
			expect(responseData?.workflowData).toBeDefined();
			expect(responseData?.workflowData![0][0].json).toHaveProperty('event', 'alert_create');
			expect(responseData?.workflowData![0][0].json).toHaveProperty('body', bodyData);
			expect(responseData?.workflowData![0][0].json).toHaveProperty('headers');
			expect(responseData?.workflowData![0][0].json).toHaveProperty('query');
		});
	});

	describe('Invalid Data Handling', () => {
		it('should return empty response when action is missing', async () => {
			const bodyData = {
				objectType: 'Alert',
				object: {
					_id: '~12345',
					title: 'Test Alert',
				},
			};

			const { responseData } = await testWebhookTriggerNode(TheHiveProjectTrigger, {
				node: {
					parameters: {
						events: ['alert_create'],
					},
				},
				request: { method: 'POST' },
				bodyData,
			});

			expect(responseData).toEqual({});
		});

		it('should return empty response when objectType is missing', async () => {
			const bodyData = {
				action: 'Create',
				object: {
					_id: '~12345',
					title: 'Test Alert',
				},
			};

			const { responseData } = await testWebhookTriggerNode(TheHiveProjectTrigger, {
				node: {
					parameters: {
						events: ['alert_create'],
					},
				},
				request: { method: 'POST' },
				bodyData,
			});

			expect(responseData).toEqual({});
		});

		it('should return empty response when event is not in configured events list', async () => {
			const bodyData = {
				action: 'Delete',
				objectType: 'Alert',
				object: {
					_id: '~12345',
					title: 'Test Alert',
				},
			};

			const { responseData } = await testWebhookTriggerNode(TheHiveProjectTrigger, {
				node: {
					parameters: {
						events: ['alert_create', 'alert_update'],
					},
				},
				request: { method: 'POST' },
				bodyData,
			});

			expect(responseData).toEqual({});
		});
	});

	describe('Multiple Event Types', () => {
		it('should process case_create event', async () => {
			const bodyData = {
				action: 'Create',
				objectType: 'Case',
				object: {
					_id: '~case123',
					_type: 'Case',
					title: 'Test Case',
					description: 'Test case description',
					severity: '1',
					status: 'Open',
					tags: ['investigation'],
				},
			};

			const { responseData } = await testWebhookTriggerNode(TheHiveProjectTrigger, {
				node: {
					parameters: {
						events: ['case_create'],
					},
				},
				request: { method: 'POST' },
				bodyData,
			});

			expect(responseData).toBeDefined();
			expect(responseData?.workflowData![0][0].json.event).toBe('case_create');
		});

		it('should process task_create event', async () => {
			const bodyData = {
				action: 'Create',
				objectType: 'Task',
				object: {
					_id: '~task456',
					_type: 'Task',
					title: 'Investigate Alert',
					description: 'Investigate the suspicious activity',
					status: 'InProgress',
					assignee: 'analyst@company.com',
				},
			};

			const { responseData } = await testWebhookTriggerNode(TheHiveProjectTrigger, {
				node: {
					parameters: {
						events: ['task_create'],
					},
				},
				request: { method: 'POST' },
				bodyData,
			});

			expect(responseData).toBeDefined();
			expect(responseData?.workflowData![0][0].json.event).toBe('task_create');
		});

		it('should process observable_create event', async () => {
			const bodyData = {
				action: 'Create',
				objectType: 'Observable',
				object: {
					_id: '~observable789',
					_type: 'Observable',
					dataType: 'ip',
					data: '192.168.1.100',
					message: 'Suspicious IP address',
					tlp: 2,
					ioc: true,
					tags: ['malicious', 'c2'],
				},
			};

			const { responseData } = await testWebhookTriggerNode(TheHiveProjectTrigger, {
				node: {
					parameters: {
						events: ['observable_create'],
					},
				},
				request: { method: 'POST' },
				bodyData,
			});

			expect(responseData).toBeDefined();
			expect(responseData?.workflowData![0][0].json.event).toBe('observable_create');
		});

		it('should process comment_create event', async () => {
			const bodyData = {
				action: 'Create',
				objectType: 'Comment',
				object: {
					_id: '~comment101',
					_type: 'Comment',
					message: 'This requires immediate attention',
					createdBy: 'analyst@company.com',
					createdAt: 1698753600000,
				},
			};

			const { responseData } = await testWebhookTriggerNode(TheHiveProjectTrigger, {
				node: {
					parameters: {
						events: ['comment_create'],
					},
				},
				request: { method: 'POST' },
				bodyData,
			});

			expect(responseData).toBeDefined();
			expect(responseData?.workflowData![0][0].json.event).toBe('comment_create');
		});

		it('should process log_create event', async () => {
			const bodyData = {
				action: 'Create',
				objectType: 'Log',
				object: {
					_id: '~log202',
					_type: 'Log',
					message: 'Investigation completed',
					status: 'Success',
					attachment: {
						name: 'report.pdf',
						id: 'attachment123',
					},
				},
			};

			const { responseData } = await testWebhookTriggerNode(TheHiveProjectTrigger, {
				node: {
					parameters: {
						events: ['log_create'],
					},
				},
				request: { method: 'POST' },
				bodyData,
			});

			expect(responseData).toBeDefined();
			expect(responseData?.workflowData![0][0].json.event).toBe('log_create');
		});

		it('should process multiple configured events', async () => {
			const bodyData = {
				action: 'Update',
				objectType: 'Alert',
				object: {
					_id: '~alert303',
					title: 'Updated Alert',
					status: 'Imported',
				},
			};

			const { responseData } = await testWebhookTriggerNode(TheHiveProjectTrigger, {
				node: {
					parameters: {
						events: ['alert_create', 'alert_update', 'case_create'],
					},
				},
				request: { method: 'POST' },
				bodyData,
			});

			expect(responseData).toBeDefined();
			expect(responseData?.workflowData![0][0].json.event).toBe('alert_update');
		});
	});
});