santh-sigma 0.1.2

use sigma::SigmaCompiler;

#[test]
fn test_depth_integer_u64_max() {
    let yaml = format!(
        r#"
title: Oneshot u64 MAX
logsource:
  product: windows
detection:
  selection:
    EventID: {}
  condition: selection
level: high
"#,
        u64::MAX
    );

    let template = SigmaCompiler::compile_str(&yaml).expect("Failed to compile with u64::MAX");
    assert_eq!(
        template.requests[0].matchers[0].values[0],
        format!("(?im)^{}$", u64::MAX),
        "u64::MAX should be correctly mapped as an anchored regex matcher"
    );
}

#[test]
fn test_depth_integer_negative_boundary() {
    let yaml = r#"
title: Oneshot Negative Boundary
logsource:
  product: windows
detection:
  selection:
    EventID: -2147483648
  condition: selection
level: medium
"#;

    let template =
        SigmaCompiler::compile_str(yaml).expect("Failed to compile with extreme negative int");
    assert_eq!(
        template.requests[0].matchers[0].values[0], r"(?im)^\-2147483648$",
        "Negative numbers should be preserved as an anchored regex matcher"
    );
}

#[test]
fn test_depth_integer_extreme_large_numbers_in_yaml_types() {
    // Sigma/YAML allows ints to be larger than u64 natively in some parsers.
    // serde_yaml might fail or handle it as float/string, but we must ensure it doesn't panic.
    let yaml = r#"
title: Oneshot Out of Bounds Int
logsource:
  product: windows
detection:
  selection:
    EventID: 999999999999999999999999999999999999999999999999999
  condition: selection
level: medium
"#;
    let template = SigmaCompiler::compile_str(yaml);
    // Standard YAML parser likely casts this to a large string or float or returns an error.
    // We just want to assert that compilation doesn't crash.
    if let Ok(t) = template {
        assert_eq!(t.requests.len(), 1);
    }
}