import unittest

from fgai.entities import sample_timeline
from fgai.logs import parse_log_line


class NormalizationTests(unittest.TestCase):
    def test_firewall_aliases_populate_common_event_fields(self):
        event = parse_log_line(
            'timestamp=2026-06-29T16:45:52.000Z fgai_stream="Illuminate:Fortigate Messages" '
            "src_addr=10.251.62.26 dst_addr=198.51.100.10 dest_port=443 fw_action=allow priority=high proto=tcp "
            'full_message="allowed outbound session"'
        )

        self.assertEqual(event.src_ip, "10.251.62.26")
        self.assertEqual(event.dst_ip, "198.51.100.10")
        self.assertEqual(event.action, "allow")
        self.assertEqual(event.severity, "high")
        self.assertEqual(event.fields["dstport"], "443")
        self.assertEqual(event.fields["service"], "tcp")

    def test_related_activity_timeline_uses_aliases(self):
        event = parse_log_line(
            'timestamp=2026-06-29T16:45:52.000Z fgai_stream="Illuminate:Fortigate Messages" '
            "src_addr=10.251.62.26 dst_addr=198.51.100.10 dest_port=443 fw_action=allow priority=high proto=tcp "
            'full_message="allowed outbound session"'
        )

        row = sample_timeline([event])[0]

        self.assertEqual(row["action"], "allow")
        self.assertEqual(row["severity"], "high")
        self.assertEqual(row["destination"], "198.51.100.10")
        self.assertEqual(row["service"], "tcp")
        self.assertEqual(row["context"], "allowed outbound session")


if __name__ == "__main__":
    unittest.main()