Octa

0.1.2

tests/MalwareScan.Tests.ps1

                                $moduleRoot = Split-Path -Parent $PSScriptRoot

Import-Module (Join-Path $moduleRoot 'Octa.psd1') -Force

# A real Start-MpScan is slow and mutating (research.md/constitution: real side-effecting

# operations belong in the disposable VM, not an automated suite run on every commit) - mocked

# here so the branching logic is verified without ever triggering a real scan in CI/dev.

Describe 'Invoke-OctaMalwareScan' {

    It 'reports DefenderNotActive honestly instead of attempting a scan when Defender is not active' {

        Mock -CommandName Get-MpComputerStatus -ModuleName Octa -MockWith { [pscustomobject]@{ AMServiceEnabled = $false } }

        Mock -CommandName Start-MpScan -ModuleName Octa -MockWith { throw 'Start-MpScan should not have been called' }

        $result = Invoke-OctaMalwareScan

        $result.Status | Should Be 'DefenderNotActive'

    }

    It 'triggers a real scan and reports real Get-MpThreatDetection results when Defender is active' {

        Mock -CommandName Get-MpComputerStatus -ModuleName Octa -MockWith { [pscustomobject]@{ AMServiceEnabled = $true } }

        Mock -CommandName Start-MpScan -ModuleName Octa -MockWith { }

        Mock -CommandName Get-MpThreatDetection -ModuleName Octa -MockWith { @() }

        $result = Invoke-OctaMalwareScan

        $result.Status | Should Be 'Success'

        $result.ThreatsFound | Should Be 0

    }

}