ad VS

tests/test_recommendations.py

@@ -0,0 +1,38 @@
+import os
+import unittest
+from unittest.mock import patch
+
+from fgai.anomaly import detect_source_anomalies
+from fgai.logs import parse_log_line
+from fgai.recommendations import build_recommendations
+from fgai.threat_intel import ThreatIntelClient
+
+
+class RecommendationTests(unittest.TestCase):
+    def test_recommends_review_for_utm_anomaly(self):
+        events = [
+            parse_log_line(
+                'type=utm subtype=ips srcip=8.8.8.8 dstip=10.0.0.10 policyid=4 '
+                'service=https action=blocked severity=critical'
+            )
+            for _ in range(5)
+        ]
+        anomalies = detect_source_anomalies(events)
+
+        recommendations = build_recommendations(events, anomalies)
+
+        self.assertGreaterEqual(recommendations[0].score, 60)
+        self.assertIn("4", recommendations[0].related_policy_ids)
+        self.assertIn("https", recommendations[0].related_services)
+
+    def test_threat_intel_disabled_by_default(self):
+        with patch.dict(os.environ, {}, clear=True):
+            client = ThreatIntelClient(cache_file="/tmp/fgai-test-threat-cache.json")
+
+            result = client.lookup_ip("8.8.8.8")
+
+        self.assertEqual(result["status"], "disabled")
+
+
+if __name__ == "__main__":
+    unittest.main()