Add test for ESMessage::deserialize

4 files changed, 48 insertions, 0 deletions

diff --git a/Cargo.lock b/Cargo.lock
index 2f5e37fc2c..b8ee16aaf8 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -5322,6 +5322,7 @@ dependencies = [
  "hickory-proto",
  "hickory-server",
  "inotify 0.10.2",
+ "insta",
  "ipnetwork",
  "jnix",
  "libc",
diff --git a/talpid-core/Cargo.toml b/talpid-core/Cargo.toml
index a0481cfa27..85d6d65094 100644
--- a/talpid-core/Cargo.toml
+++ b/talpid-core/Cargo.toml
@@ -112,3 +112,4 @@ tonic-build = { workspace = true, default-features = false, features = ["transpo
 [dev-dependencies]
 test-log = "0.2.17"
 tokio = { workspace = true, features = ["io-util", "test-util", "time"] }
+insta = "1.42"
diff --git a/talpid-core/src/split_tunnel/macos/process.rs b/talpid-core/src/split_tunnel/macos/process.rs
index 31e00b8df9..cec9a8d818 100644
--- a/talpid-core/src/split_tunnel/macos/process.rs
+++ b/talpid-core/src/split_tunnel/macos/process.rs
@@ -589,6 +589,23 @@ mod test {
         stdout_read
     }
 
+    /// Assert that we can deserialize output from different versions of `eslogger` into valid
+    /// [ESMessage]s.
+    #[test]
+    fn test_deserialize_esmessage() {
+        let valid_esmessages = [
+            // Example from macOS 15
+            r#"{"action":{"result":{"result":{"auth":0},"result_type":0}},"event_type":9,"global_seq_num":75,"action_type":1,"mach_time":289350913517,"process":{"is_platform_binary":false,"team_id":null,"signing_id":"nu-b9fb5b9dbba2e494","cdhash":"28CD2C759132B07D63C3A2B377AD440A6C66098E","executable":{"stat":{"st_size":38146864,"st_gid":80,"st_ino":13982224,"st_uid":501,"st_ctimespec":"2025-05-09T11:57:32.842789602Z","st_gen":0,"st_mtimespec":"2025-04-29T23:31:45.000000000Z","st_blocks":74512,"st_rdev":0,"st_dev":16777234,"st_atimespec":"2025-08-07T12:32:35.400606076Z","st_nlink":1,"st_mode":33133,"st_blksize":4096,"st_birthtimespec":"2025-04-29T23:31:45.000000000Z","st_flags":0},"path_truncated":false,"path":"\/bin\/nu"},"group_id":97391,"parent_audit_token":{"asid":100019,"ruid":501,"pidversion":87724,"egid":20,"rgid":20,"pid":58916,"euid":501,"auid":501},"session_id":58916,"audit_token":{"auid":501,"asid":100019,"egid":20,"pid":97391,"pidversion":149091,"rgid":20,"euid":501,"ruid":501},"ppid":58916,"responsible_audit_token":{"asid":100019,"ruid":501,"pidversion":2424,"egid":20,"rgid":20,"pid":938,"euid":501,"auid":501},"original_ppid":58916,"codesigning_flags":570556931,"start_time":"2025-08-07T13:21:35.877422Z","tty":{"stat":{"st_size":0,"st_gid":4,"st_uid":501,"st_ino":1223,"st_ctimespec":"2025-08-07T13:21:35.878404000Z","st_gen":0,"st_mtimespec":"2025-08-07T13:21:35.878404000Z","st_blocks":0,"st_rdev":268435459,"st_dev":1333267060,"st_atimespec":"2025-08-07T13:21:35.874434000Z","st_mode":8592,"st_nlink":1,"st_blksize":65536,"st_birthtimespec":"1970-01-01T00:00:00.000000000Z","st_flags":0},"path_truncated":false,"path":"\/dev\/ttys003"},"is_es_client":false},"time":"2025-08-07T13:21:35.880814738Z","seq_num":27,"version":9,"event":{"exec":{"cwd":{"stat":{"st_size":2624,"st_gid":20,"st_uid":501,"st_ino":539935,"st_ctimespec":"2025-08-07T12:36:24.368103159Z","st_gen":0,"st_mtimespec":"2025-08-07T12:36:24.368103159Z","st_blocks":0,"st_rdev":0,"st_dev":16777234,"st_atimespec":"2025-08-07T12:36:24.414321469Z","st_mode":16877,"st_nlink":82,"st_blksize":4096,"st_birthtimespec":"2024-09-25T14:04:33.178667447Z","st_flags":0},"path_truncated":false,"path":"\/bin\/mullvadvpn-app"},"env":["FOO=bar"],"target":{"team_id":null,"is_platform_binary":false,"signing_id":"connection_checker-04fde7bdb8bceee3","cdhash":"33F0A3D85BEA260FED5CAD0529AB0E84EC9A0DF1","executable":{"stat":{"st_size":5087360,"st_gid":20,"st_ino":14784254,"st_uid":501,"st_ctimespec":"2025-05-12T14:47:04.129389008Z","st_gen":0,"st_mtimespec":"2025-05-12T14:47:04.107254919Z","st_blocks":9944,"st_rdev":0,"st_dev":16777234,"st_atimespec":"2025-08-07T13:21:35.888621297Z","st_nlink":1,"st_mode":33261,"st_blksize":4096,"st_birthtimespec":"2025-05-12T14:47:04.106815000Z","st_flags":0},"path_truncated":false,"path":"\/bin\/connection-checker"},"group_id":97391,"parent_audit_token":{"pidversion":87724,"rgid":20,"pid":58916,"egid":20,"ruid":501,"euid":501,"asid":100019,"auid":501},"session_id":58916,"audit_token":{"pid":97391,"rgid":20,"euid":501,"auid":501,"egid":20,"asid":100019,"pidversion":149092,"ruid":501},"ppid":58916,"responsible_audit_token":{"pidversion":2424,"rgid":20,"pid":938,"egid":20,"ruid":501,"euid":501,"asid":100019,"auid":501},"original_ppid":58916,"codesigning_flags":570556931,"start_time":"2025-08-07T13:21:35.877422Z","tty":{"stat":{"st_size":0,"st_gid":4,"st_ino":1223,"st_uid":501,"st_ctimespec":"2025-08-07T13:21:35.878404000Z","st_gen":0,"st_mtimespec":"2025-08-07T13:21:35.878404000Z","st_blocks":0,"st_rdev":268435459,"st_dev":1333267060,"st_mode":8592,"st_nlink":1,"st_atimespec":"2025-08-07T13:21:35.874434000Z","st_blksize":65536,"st_birthtimespec":"1970-01-01T00:00:00.000000000Z","st_flags":0},"path_truncated":false,"path":"\/dev\/ttys003"},"is_es_client":false},"last_fd":9,"image_cpusubtype":0,"fds":[{"fdtype":1,"fd":0},{"fdtype":1,"fd":1},{"fdtype":1,"fd":2},{"fdtype":1,"fd":5},{"fdtype":1,"fd":6},{"fdtype":1,"fd":8},{"fdtype":1,"fd":9}],"image_cputype":16777228,"args":["\/bin\/connection-checker"],"dyld_exec_path":"\/bin\/connection-checker","script":null}},"thread":{"thread_id":505819},"schema_version":1}"#,
+            // Example from macOS 26
+            r#"{"version":10,"event":{"fork":{"child":{"signing_id":"net.mullvad.vpn","audit_token":[501,501,20,501,20,21497,100013,38282],"ppid":19745,"team_id":"CKG9MXH72F","parent_audit_token":[501,501,20,501,20,19745,100013,35165],"session_id":1,"group_id":19745,"cs_validation_category":6,"responsible_audit_token":[501,501,20,501,20,19745,100013,35165],"is_platform_binary":false,"tty":null,"is_es_client":false,"original_ppid":19745,"executable":{"path":"\/Applications\/Mullvad VPN.app\/Contents\/MacOS\/Mullvad VPN","stat":{"st_ctimespec":"2025-07-22T15:04:55.459801307Z","st_dev":16777234,"st_gid":0,"st_atimespec":"2025-07-22T15:05:14.889095406Z","st_blocks":272,"st_blksize":4096,"st_rdev":0,"st_mode":33261,"st_birthtimespec":"2025-06-23T14:48:03.000000000Z","st_size":135216,"st_flags":0,"st_uid":0,"st_mtimespec":"2025-06-23T14:48:03.000000000Z","st_ino":78460340,"st_nlink":1,"st_gen":0},"path_truncated":false},"codesigning_flags":570491649,"start_time":"2025-07-22T15:09:01.083979Z","cdhash":"C26BC5CF81E08B87DF707685A8EA3652446977F1"}}},"thread":{"thread_id":227846},"time":"2025-07-22T15:09:01.084030274Z","seq_num":0,"schema_version":1,"event_type":11,"action":{"result":{"result":{"auth":0},"result_type":0}},"global_seq_num":1,"process":{"team_id":"CKG9MXH72F","original_ppid":1,"audit_token":[501,501,20,501,20,19745,100013,35165],"signing_id":"net.mullvad.vpn","start_time":"2025-07-22T15:05:14.076236Z","responsible_audit_token":[501,501,20,501,20,19745,100013,35165],"parent_audit_token":[4294967295,0,0,0,0,1,100012,1029],"ppid":1,"codesigning_flags":570491649,"tty":null,"is_es_client":false,"group_id":19745,"session_id":1,"cs_validation_category":6,"executable":{"path_truncated":false,"path":"\/Applications\/Mullvad VPN.app\/Contents\/MacOS\/Mullvad VPN","stat":{"st_size":135216,"st_atimespec":"2025-07-22T15:05:14.889095406Z","st_mode":33261,"st_blocks":272,"st_ctimespec":"2025-07-22T15:04:55.459801307Z","st_uid":0,"st_gen":0,"st_blksize":4096,"st_gid":0,"st_rdev":0,"st_birthtimespec":"2025-06-23T14:48:03.000000000Z","st_nlink":1,"st_dev":16777234,"st_flags":0,"st_ino":78460340,"st_mtimespec":"2025-06-23T14:48:03.000000000Z"}},"is_platform_binary":false,"cdhash":"C26BC5CF81E08B87DF707685A8EA3652446977F1"},"action_type":1,"mach_time":241051246374}"#,
+        ];
+
+        for s in valid_esmessages {
+            let result = serde_json::from_str::<ESMessage>(s);
+            insta::assert_debug_snapshot!((s, result));
+        }
+    }
+
     #[test]
     fn test_min_os_version() {
         assert!(check_os_version_support_inner(MIN_OS_VERSION.clone()).is_ok());
diff --git a/talpid-core/src/split_tunnel/macos/snapshots/talpid_core__split_tunnel__imp__process__test__deserialize_esmessage.snap b/talpid-core/src/split_tunnel/macos/snapshots/talpid_core__split_tunnel__imp__process__test__deserialize_esmessage.snap
new file mode 100644
index 0000000000..afb2a98087
--- /dev/null
+++ b/talpid-core/src/split_tunnel/macos/snapshots/talpid_core__split_tunnel__imp__process__test__deserialize_esmessage.snap
@@ -0,0 +1,29 @@
+---
+source: talpid-core/src/split_tunnel/macos/process.rs
+expression: "(s, result)"
+---
+(
+    "{\"action\":{\"result\":{\"result\":{\"auth\":0},\"result_type\":0}},\"event_type\":9,\"global_seq_num\":75,\"action_type\":1,\"mach_time\":289350913517,\"process\":{\"is_platform_binary\":false,\"team_id\":null,\"signing_id\":\"nu-b9fb5b9dbba2e494\",\"cdhash\":\"28CD2C759132B07D63C3A2B377AD440A6C66098E\",\"executable\":{\"stat\":{\"st_size\":38146864,\"st_gid\":80,\"st_ino\":13982224,\"st_uid\":501,\"st_ctimespec\":\"2025-05-09T11:57:32.842789602Z\",\"st_gen\":0,\"st_mtimespec\":\"2025-04-29T23:31:45.000000000Z\",\"st_blocks\":74512,\"st_rdev\":0,\"st_dev\":16777234,\"st_atimespec\":\"2025-08-07T12:32:35.400606076Z\",\"st_nlink\":1,\"st_mode\":33133,\"st_blksize\":4096,\"st_birthtimespec\":\"2025-04-29T23:31:45.000000000Z\",\"st_flags\":0},\"path_truncated\":false,\"path\":\"\\/bin\\/nu\"},\"group_id\":97391,\"parent_audit_token\":{\"asid\":100019,\"ruid\":501,\"pidversion\":87724,\"egid\":20,\"rgid\":20,\"pid\":58916,\"euid\":501,\"auid\":501},\"session_id\":58916,\"audit_token\":{\"auid\":501,\"asid\":100019,\"egid\":20,\"pid\":97391,\"pidversion\":149091,\"rgid\":20,\"euid\":501,\"ruid\":501},\"ppid\":58916,\"responsible_audit_token\":{\"asid\":100019,\"ruid\":501,\"pidversion\":2424,\"egid\":20,\"rgid\":20,\"pid\":938,\"euid\":501,\"auid\":501},\"original_ppid\":58916,\"codesigning_flags\":570556931,\"start_time\":\"2025-08-07T13:21:35.877422Z\",\"tty\":{\"stat\":{\"st_size\":0,\"st_gid\":4,\"st_uid\":501,\"st_ino\":1223,\"st_ctimespec\":\"2025-08-07T13:21:35.878404000Z\",\"st_gen\":0,\"st_mtimespec\":\"2025-08-07T13:21:35.878404000Z\",\"st_blocks\":0,\"st_rdev\":268435459,\"st_dev\":1333267060,\"st_atimespec\":\"2025-08-07T13:21:35.874434000Z\",\"st_mode\":8592,\"st_nlink\":1,\"st_blksize\":65536,\"st_birthtimespec\":\"1970-01-01T00:00:00.000000000Z\",\"st_flags\":0},\"path_truncated\":false,\"path\":\"\\/dev\\/ttys003\"},\"is_es_client\":false},\"time\":\"2025-08-07T13:21:35.880814738Z\",\"seq_num\":27,\"version\":9,\"event\":{\"exec\":{\"cwd\":{\"stat\":{\"st_size\":2624,\"st_gid\":20,\"st_uid\":501,\"st_ino\":539935,\"st_ctimespec\":\"2025-08-07T12:36:24.368103159Z\",\"st_gen\":0,\"st_mtimespec\":\"2025-08-07T12:36:24.368103159Z\",\"st_blocks\":0,\"st_rdev\":0,\"st_dev\":16777234,\"st_atimespec\":\"2025-08-07T12:36:24.414321469Z\",\"st_mode\":16877,\"st_nlink\":82,\"st_blksize\":4096,\"st_birthtimespec\":\"2024-09-25T14:04:33.178667447Z\",\"st_flags\":0},\"path_truncated\":false,\"path\":\"\\/bin\\/mullvadvpn-app\"},\"env\":[\"FOO=bar\"],\"target\":{\"team_id\":null,\"is_platform_binary\":false,\"signing_id\":\"connection_checker-04fde7bdb8bceee3\",\"cdhash\":\"33F0A3D85BEA260FED5CAD0529AB0E84EC9A0DF1\",\"executable\":{\"stat\":{\"st_size\":5087360,\"st_gid\":20,\"st_ino\":14784254,\"st_uid\":501,\"st_ctimespec\":\"2025-05-12T14:47:04.129389008Z\",\"st_gen\":0,\"st_mtimespec\":\"2025-05-12T14:47:04.107254919Z\",\"st_blocks\":9944,\"st_rdev\":0,\"st_dev\":16777234,\"st_atimespec\":\"2025-08-07T13:21:35.888621297Z\",\"st_nlink\":1,\"st_mode\":33261,\"st_blksize\":4096,\"st_birthtimespec\":\"2025-05-12T14:47:04.106815000Z\",\"st_flags\":0},\"path_truncated\":false,\"path\":\"\\/bin\\/connection-checker\"},\"group_id\":97391,\"parent_audit_token\":{\"pidversion\":87724,\"rgid\":20,\"pid\":58916,\"egid\":20,\"ruid\":501,\"euid\":501,\"asid\":100019,\"auid\":501},\"session_id\":58916,\"audit_token\":{\"pid\":97391,\"rgid\":20,\"euid\":501,\"auid\":501,\"egid\":20,\"asid\":100019,\"pidversion\":149092,\"ruid\":501},\"ppid\":58916,\"responsible_audit_token\":{\"pidversion\":2424,\"rgid\":20,\"pid\":938,\"egid\":20,\"ruid\":501,\"euid\":501,\"asid\":100019,\"auid\":501},\"original_ppid\":58916,\"codesigning_flags\":570556931,\"start_time\":\"2025-08-07T13:21:35.877422Z\",\"tty\":{\"stat\":{\"st_size\":0,\"st_gid\":4,\"st_ino\":1223,\"st_uid\":501,\"st_ctimespec\":\"2025-08-07T13:21:35.878404000Z\",\"st_gen\":0,\"st_mtimespec\":\"2025-08-07T13:21:35.878404000Z\",\"st_blocks\":0,\"st_rdev\":268435459,\"st_dev\":1333267060,\"st_mode\":8592,\"st_nlink\":1,\"st_atimespec\":\"2025-08-07T13:21:35.874434000Z\",\"st_blksize\":65536,\"st_birthtimespec\":\"1970-01-01T00:00:00.000000000Z\",\"st_flags\":0},\"path_truncated\":false,\"path\":\"\\/dev\\/ttys003\"},\"is_es_client\":false},\"last_fd\":9,\"image_cpusubtype\":0,\"fds\":[{\"fdtype\":1,\"fd\":0},{\"fdtype\":1,\"fd\":1},{\"fdtype\":1,\"fd\":2},{\"fdtype\":1,\"fd\":5},{\"fdtype\":1,\"fd\":6},{\"fdtype\":1,\"fd\":8},{\"fdtype\":1,\"fd\":9}],\"image_cputype\":16777228,\"args\":[\"\\/bin\\/connection-checker\"],\"dyld_exec_path\":\"\\/bin\\/connection-checker\",\"script\":null}},\"thread\":{\"thread_id\":505819},\"schema_version\":1}",
+    Ok(
+        ESMessage {
+            event: Exec(
+                ESExecEvent {
+                    target: EsExecTarget {
+                        executable: EsExecTargetExecutable {
+                            path: "/bin/connection-checker",
+                            path_truncated: false,
+                        },
+                    },
+                },
+            ),
+            process: ESProcess {
+                audit_token: ESAuditToken {
+                    pid: 97391,
+                },
+                executable: ESExecutable {
+                    path: "/bin/nu",
+                },
+            },
+        },
+    ),
+)