import tempfile
import unittest
from pathlib import Path

from fgai.baseline import BaselineStore
from fgai.logs import parse_log_line
from fgai.stream_profiles import parse_profiles


class BaselineTests(unittest.TestCase):
    def test_creates_profile_after_twelve_completed_windows(self):
        with tempfile.TemporaryDirectory() as directory:
            store = BaselineStore(str(Path(directory) / "baseline.sqlite3"))
            for index in range(13):
                store.ingest([parse_log_line(f"srcip=10.0.0.1 dstport={1000 + index} hitcount=2 sentbyte=5")], observed_at=1_700_000_000 + index * 300)
            profiles = store.profiles({"10.0.0.1"})
            self.assertEqual(profiles["10.0.0.1"]["samples"], 12)
            self.assertIn("1000", profiles["10.0.0.1"]["known_destination_ports"])

    def test_profile_events_are_deduplicated_between_polls(self):
        with tempfile.TemporaryDirectory() as directory:
            store = BaselineStore(str(Path(directory) / "baseline.sqlite3"))
            profiles = parse_profiles([{"stream_id": "windows", "entity_field": "username", "categorical_fields": ["action"]}])
            events = [
                parse_log_line(f"fgai_stream_id=windows username=alice action=login event={index}")
                for index in range(12)
            ]
            self.assertEqual(store.ingest_profile_fields(events, profiles, observed_at=1_700_000_000), 1)
            self.assertEqual(store.ingest_profile_fields(events, profiles, observed_at=1_700_000_300), 0)