From b31a7fa2c8809b7b516b8d423a05186ba0bb58c1 Mon Sep 17 00:00:00 2001
From: Jacinta Ferrant <jacinta.ferrant@gmail.com>
Date: Thu, 18 Jun 2026 20:54:48 -0700
Subject: [PATCH] test(rust): add native cargo tests for the regex pattern
 prefilter

Signed-off-by: Jacinta Ferrant <jacinta.ferrant@gmail.com>
---
 rust/src/pattern_prefilter.rs | 72 +++++++++++++++++++++++++++++++++++
 1 file changed, 72 insertions(+)

diff --git a/rust/src/pattern_prefilter.rs b/rust/src/pattern_prefilter.rs
index beb6e1354c5..f1c377547a4 100644
--- a/rust/src/pattern_prefilter.rs
+++ b/rust/src/pattern_prefilter.rs
@@ -61,3 +61,75 @@ pub fn build_pattern_prefilter(patterns: Vec<String>) -> (PatternPrefilter, Vec<
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use crate::pattern_prefilter::build_pattern_prefilter;
+
+    #[test]
+    fn empty_pattern_list_defaults_to_match_anything() {
+        let (prefilter, rejected) = build_pattern_prefilter(vec![]);
+        assert!(rejected.is_empty());
+        assert!(prefilter.any_match("anything at all"));
+    }
+
+    #[test]
+    fn matching_is_case_insensitive() {
+        let (prefilter, _) = build_pattern_prefilter(vec!["secret".into()]);
+        assert!(prefilter.any_match("this is a SECRET"));
+    }
+
+    #[test]
+    fn lookbehind_pattern_is_rejected_by_index_and_others_still_build() {
+        let (prefilter, rejected) =
+            build_pattern_prefilter(vec!["\\d{3}-\\d{2}-\\d{4}".into(), "(?<=\\$)\\d+".into()]);
+        assert_eq!(rejected, vec![1]);
+        assert!(prefilter.any_match("123-45-6789"));
+    }
+
+    #[test]
+    fn rejected_pattern_does_not_suppress_matches_on_covered_ones() {
+        let (prefilter, rejected) =
+            build_pattern_prefilter(vec!["(?<=\\$)\\d+".into(), "\\d{3}-\\d{2}-\\d{4}".into()]);
+        assert_eq!(rejected, vec![0]);
+        assert!(prefilter.any_match("123-45-6789"));
+        assert!(!prefilter.any_match("no match here"));
+    }
+
+    #[test]
+    fn all_patterns_rejected_defaults_to_match_anything() {
+        let (prefilter, rejected) = build_pattern_prefilter(vec!["(?<=\\$)\\d+".into()]);
+        assert_eq!(rejected, vec![0]);
+        assert!(prefilter.any_match("anything at all"));
+    }
+
+    #[test]
+    fn interleaved_covered_and_rejected_indices_preserve_order() {
+        let (prefilter, rejected) = build_pattern_prefilter(vec![
+            "(?<=\\$)\\d+".into(),
+            "alpha".into(),
+            "(?<=#)\\d+".into(),
+            "beta".into(),
+            "(?<=@)\\d+".into(),
+        ]);
+        assert_eq!(rejected, vec![0, 2, 4]);
+        assert!(prefilter.any_match("alpha"));
+        assert!(prefilter.any_match("beta"));
+        assert!(!prefilter.any_match("gamma"));
+    }
+
+    #[test]
+    fn regex_set_exceeding_size_limit_defaults_to_match_anything() {
+        // Each of these compiles fine on its own (RegexBuilder succeeds), but
+        // combining 14 of them into a single RegexSet overflows the crate's
+        // default 10MB compiled-program size limit, exercising the fallback
+        // that's distinct from "no pattern was individually valid."
+        let oversized = "a{1,4000}b{1,4000}c{1,4000}";
+        let mut sources: Vec<String> = vec![oversized.into(); 14];
+        sources.push("simple".into());
+        let expected_rejected_count = sources.len();
+        let (prefilter, rejected) = build_pattern_prefilter(sources);
+        assert_eq!(rejected.len(), expected_rejected_count);
+        assert!(prefilter.any_match("anything at all"));
+    }
+}