$ErrorActionPreference='Stop';$root=Split-Path $PSScriptRoot -Parent
. (Join-Path $root 'scripts/WefArrival.ps1');. (Join-Path $PSScriptRoot 'RegistrySaclLifecycleEvidence.ps1')
$operation=[pscustomobject]@{Computer='FIXTURE';ProcessId=1234;Engine='C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe';NativePath='\REGISTRY\USER\S-1-5-21-1-2-3-1001\Software\Microsoft\Windows\CurrentVersion\RunOnce';RecordIdBefore=10;Token=[pscustomobject]@{Sid='S-1-5-21-4-5-6-500';AuthenticationId='0x1234'};Write=[pscustomobject]@{ValueName='WelaProbe_nonce';Value='nonce';HandleId='0x456';StartedUtc='2026-09-22T00:00:00.0001000Z';ReturnedUtc='2026-09-22T00:00:00.0001500Z';CompletedUtc='2026-09-22T00:00:00.0002000Z'}}
$xml=@"
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System><Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}"/><EventID>4657</EventID><Version>0</Version><Task>12801</Task><Keywords>0x8020000000000000</Keywords><Channel>Security</Channel><Computer>FIXTURE</Computer><EventRecordID>11</EventRecordID><TimeCreated SystemTime="2026-09-22T00:00:00.0001800Z"/></System><EventData><Data Name="SubjectUserSid">S-1-5-21-4-5-6-500</Data><Data Name="SubjectUserName">Reader</Data><Data Name="SubjectDomainName">FIXTURE</Data><Data Name="SubjectLogonId">0x1234</Data><Data Name="ObjectName">$($operation.NativePath)</Data><Data Name="ObjectValueName">WelaProbe_nonce</Data><Data Name="HandleId">0x456</Data><Data Name="OperationType">%%1904</Data><Data Name="OldValueType">-</Data><Data Name="OldValue">-</Data><Data Name="NewValueType">%%1873</Data><Data Name="NewValue">nonce</Data><Data Name="ProcessId">0x4d2</Data><Data Name="ProcessName">$($operation.Engine)</Data></EventData></Event>
"@
$count=0
function Assert($value,$message){if(-not $value){throw $message};$script:count++}
Assert (Test-WelaRegistrySaclFixtureEvent $xml $operation) 'Exact native-schema creation must match the measured write/readback phase.'
foreach($change in @(@('4657','4663'),@('%%1904','%%1905'),@('%%1873','%%1874'),@('0x1234','0x1235'),@('0x456','0x457'),@('0x4d2','0x4d3'),@('6-500','6-501'),@('RunOnce','Other'),@('>nonce<','>other<'),@('0001800Z','0000999Z'),@('0001800Z','0002001Z'),@('EventRecordID>11','EventRecordID>10'),@('12801','12800'),@('8020000000000000','8010000000000000'))){Assert (-not(Test-WelaRegistrySaclFixtureEvent $xml.Replace($change[0],$change[1]) $operation)) ('Changed attribution must fail: '+$change[0])}
Assert (-not(Test-WelaRegistrySaclFixtureEvent $xml.Replace('</EventData>','<Data Name="ProcessId">0x4d2</Data></EventData>') $operation)) 'Duplicate identity fields must fail.'
Assert (-not(Test-WelaRegistrySaclFixtureEvent ('<!DOCTYPE Event [<!ENTITY x "x">]>'+$xml) $operation)) 'DTD input must fail.'
Write-Host "Passed $count registry SACL fixture evidence assertions."