from pathlib import Path

from applepy.checks.common_paths import check_cron_periodic_surface
from applepy.context import RunContext


def test_cron_periodic_returns_finding(tmp_path: Path) -> None:
    ctx = RunContext(home=tmp_path, output_dir=tmp_path, phase="unprivileged")
    out = check_cron_periodic_surface(ctx)
    assert len(out) == 1
    assert out[0].id == "soc-011"
    assert "/etc/crontab" in out[0].evidence or "crontab" in out[0].evidence.lower()