Add regression tests for risk analysis

Author: josediegorobles

src/analyzer/psbt.rs

@@ -217,17 +217,42 @@ fn psbt_complexity_score(psbt: &Psbt, signals: &ScriptSignals) -> u32 {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use bitcoin::{Amount, ScriptBuf, TxOut};
 
-    #[test]
-    fn parses_minimal_psbt() {
+    fn minimal_psbt() -> Psbt {
         let bytes = STANDARD
             .decode("cHNidP8BAHECAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/////wD/////AugDAAAAAAAAFgAUAAAAAAAAAAAAAAAAAAAAAAAAAABkAAAAAAAAABYAFBERERERERERERERERERERERERERAAAAAAAAAAA=")
             .unwrap();
-        let psbt = Psbt::deserialize(&bytes).unwrap();
+
+        Psbt::deserialize(&bytes).unwrap()
+    }
+
+    #[test]
+    fn parses_minimal_psbt() {
+        let psbt = minimal_psbt();
 
         let report = analyze_psbt(&psbt);
 
         assert_eq!(report.psbt.unwrap().input_count, 1);
         assert_eq!(report.risk, RiskLevel::Medium);
     }
+
+    #[test]
+    fn warns_when_witness_utxo_implies_negative_fee() {
+        let mut psbt = minimal_psbt();
+        psbt.inputs[0].witness_utxo = Some(TxOut {
+            value: Amount::from_sat(1_000),
+            script_pubkey: ScriptBuf::new(),
+        });
+
+        let report = analyze_psbt(&psbt);
+
+        assert_eq!(report.psbt.unwrap().estimated_fee_sats, Some(-100));
+        assert_eq!(report.risk, RiskLevel::High);
+        assert!(report.missing_data.is_empty());
+        assert!(report
+            .warnings
+            .iter()
+            .any(|warning| warning.code == "negative-fee"));
+    }
 }

src/analyzer/tx.rs

@@ -230,16 +230,22 @@ fn complexity_score(tx: &Transaction, signals: &ScriptSignals) -> u32 {
 mod tests {
     use super::*;
 
+    const SAMPLE_TX_HEX: &str = "02000000010000000000000000000000000000000000000000000000000000000000000000ffffffff00ffffffff02e80300000000000016001400000000000000000000000000000000000000006400000000000000160014111111111111111111111111111111111111111100000000";
+
+    fn sample_tx() -> Transaction {
+        deserialize(&hex::decode(SAMPLE_TX_HEX).unwrap()).unwrap()
+    }
+
     #[test]
     fn estimates_fee_when_prevouts_are_present() {
         let input = TransactionInputFile {
-            hex: "02000000010000000000000000000000000000000000000000000000000000000000000000ffffffff00ffffffff02e80300000000000016001400000000000000000000000000000000000000006400000000000000160014111111111111111111111111111111111111111100000000".to_owned(),
+            hex: SAMPLE_TX_HEX.to_owned(),
             prevouts: vec![PrevoutInput {
                 value_sats: 2_000,
                 script_pubkey: None,
             }],
         };
-        let tx = deserialize::<Transaction>(&hex::decode(input.hex).unwrap()).unwrap();
+        let tx = sample_tx();
 
         let report = analyze_transaction(&tx, &input.prevouts, None);
 
@@ -249,15 +255,54 @@ mod tests {
 
     #[test]
     fn direct_hex_reports_fee_unavailable_without_prevouts() {
-        let report = analyze_transaction_hex(
-            "02000000010000000000000000000000000000000000000000000000000000000000000000ffffffff00ffffffff02e80300000000000016001400000000000000000000000000000000000000006400000000000000160014111111111111111111111111111111111111111100000000",
-        )
-        .unwrap();
+        let report = analyze_transaction_hex(SAMPLE_TX_HEX).unwrap();
 
         let tx = report.transaction.unwrap();
         assert_eq!(tx.estimated_fee_sats, None);
         assert!(report
             .missing_data
             .contains(&"prevout values for every input".to_owned()));
     }
+
+    #[test]
+    fn warns_when_prevouts_imply_negative_fee() {
+        let tx = sample_tx();
+        let prevouts = vec![PrevoutInput {
+            value_sats: 1_000,
+            script_pubkey: None,
+        }];
+
+        let report = analyze_transaction(&tx, &prevouts, None);
+
+        assert_eq!(report.transaction.unwrap().estimated_fee_sats, Some(-100));
+        assert_eq!(report.risk, RiskLevel::High);
+        assert!(report
+            .warnings
+            .iter()
+            .any(|warning| warning.code == "negative-fee"));
+    }
+
+    #[test]
+    fn detects_multisig_and_timelock_from_prevout_script_pubkeys() {
+        let tx = sample_tx();
+        let prevouts = vec![PrevoutInput {
+            value_sats: 2_000,
+            script_pubkey: Some("52aeb2".to_owned()),
+        }];
+
+        let report = analyze_transaction(&tx, &prevouts, None);
+        let analysis = report.transaction.unwrap();
+
+        assert!(analysis.signals.multisig);
+        assert!(analysis.signals.relative_timelock);
+        assert_eq!(report.risk, RiskLevel::Medium);
+        assert!(report
+            .warnings
+            .iter()
+            .any(|warning| warning.code == "multisig-signal"));
+        assert!(report
+            .warnings
+            .iter()
+            .any(|warning| warning.code == "timelock-signal"));
+    }
 }

src/report/mod.rs

@@ -114,3 +114,36 @@ fn artifact_name(artifact_type: &ArtifactType) -> &'static str {
         ArtifactType::Script => "script",
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::analyzer::analyze_script_input;
+
+    #[test]
+    fn renders_script_report_as_stable_json_shape() {
+        let report = analyze_script_input("OP_CHECKMULTISIG OP_CHECKSEQUENCEVERIFY").unwrap();
+
+        let rendered = render_report(&report, OutputFormat::Json).unwrap();
+        let json: serde_json::Value = serde_json::from_str(&rendered).unwrap();
+
+        assert_eq!(json["artifact_type"], "script");
+        assert_eq!(json["risk"], "medium");
+        assert_eq!(json["script"]["signals"]["multisig"], true);
+        assert_eq!(json["script"]["signals"]["relative_timelock"], true);
+    }
+
+    #[test]
+    fn renders_script_report_as_stable_markdown_sections() {
+        let report = analyze_script_input("OP_CHECKMULTISIG OP_CHECKSEQUENCEVERIFY").unwrap();
+
+        let rendered = render_report(&report, OutputFormat::Markdown).unwrap();
+
+        assert!(rendered.starts_with("# BTC Risk Lab Report\n\n"));
+        assert!(rendered.contains("- Artifact: `script`"));
+        assert!(rendered.contains("- Risk: `medium`"));
+        assert!(rendered.contains("## Warnings\n\n"));
+        assert!(rendered.contains("## Script Detail\n\n"));
+        assert!(rendered.contains("## Limitations\n\n"));
+    }
+}