From 8582a3309dcec031fb423dad9cb8889fe3593e90 Mon Sep 17 00:00:00 2001
From: tux3 <barrdetwix@gmail.com>
Date: Fri, 10 Mar 2023 15:39:45 +0100
Subject: [PATCH] 0.3.1: Allow creating events with raw IDs, pretty print IDs
 in hex

---
 Cargo.toml               |  2 +-
 src/services/ts/event.rs | 37 ++++++++++++++++++++++++++++++++++++-
 2 files changed, 37 insertions(+), 2 deletions(-)

diff --git a/Cargo.toml b/Cargo.toml
index 555af5e..34502cb 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -5,7 +5,7 @@ repository = "https://github.com/tux3/crowdstrike-cloudproto/"
 categories = ["network-programming", "api-bindings"]
 keywords = ["async", "api", "protocol"]
 license = "MIT OR Apache-2.0"
-version = "0.3.0"
+version = "0.3.1"
 edition = "2021"
 rust-version = "1.64"
 readme = "README.md"
diff --git a/src/services/ts/event.rs b/src/services/ts/event.rs
index 906d274..8c1700b 100644
--- a/src/services/ts/event.rs
+++ b/src/services/ts/event.rs
@@ -30,12 +30,20 @@ impl Event {
         }
     }
 
+    pub fn new_raw(raw_event_id: u32, data: Vec<u8>) -> Self {
+        Self {
+            raw_event_id,
+            event_id: None,
+            data,
+        }
+    }
+
     /// Best effort text representation of the event ID using know [`EventId`][EventId] values
     pub fn ev_id_string(&self) -> String {
         if let Some(id) = self.event_id {
             id.to_string()
         } else {
-            self.raw_event_id.to_string()
+            format!("{:#X}", self.raw_event_id)
         }
     }
 
@@ -102,3 +110,30 @@ pub enum EventId {
     AgentOnline =                   0x338000ac,
     UNK_0x340000ee =                0x340000ee, // No search results in sensor
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use bytes::Buf;
+
+    #[test]
+    fn test_known_id_string() {
+        let ev = Event::new(EventId::AgentOnline, vec![]);
+        assert_eq!(ev.ev_id_string(), "AgentOnline")
+    }
+
+    #[test]
+    fn test_unknown_id_string() {
+        let ev = Event::new_raw(0xAABBCCDD, vec![]);
+        assert_eq!(ev.ev_id_string(), "0xAABBCCDD")
+    }
+
+    #[test]
+    fn test_event_serde_rountrip() {
+        let ev = Event::new_raw(0xAABBCCDD, vec![]);
+        let mut buf = Vec::new();
+        ev.clone().into_write(&mut buf).unwrap();
+        let ev2 = Event::from_read(&mut buf.reader()).unwrap();
+        assert_eq!(ev, ev2);
+    }
+}