import unittest

from fgai.event_context import build_event_context
from fgai.logs import parse_log_line


class EventContextTests(unittest.TestCase):
    def test_includes_each_source_and_security_sample(self):
        events = [
            parse_log_line("srcip=10.0.0.1 dstip=1.1.1.1 action=accept"),
            parse_log_line("srcip=10.0.0.2 dstip=8.8.8.8 type=utm subtype=ips action=blocked severity=high"),
        ]
        context = build_event_context(events)
        self.assertEqual(context["entities_total"], 2)
        self.assertEqual(context["source_profiles"][0]["entity"], "10.0.0.2")
        self.assertEqual(len(context["security_event_samples"]), 1)

    def test_ip_entity_prefers_hostname_display_label(self):
        events = [
            parse_log_line("srcip=10.0.0.2 hostname=win01 dstip=8.8.8.8 type=utm action=blocked severity=high"),
        ]
        context = build_event_context(events)
        self.assertEqual(context["source_profiles"][0]["entity"], "10.0.0.2")
        self.assertEqual(context["source_profiles"][0]["entity_label"], "win01 (10.0.0.2)")
        self.assertEqual(context["security_event_samples"][0]["entity_label"], "win01 (10.0.0.2)")

    def test_ip_entity_falls_back_to_username_display_label(self):
        events = [
            parse_log_line("srcip=10.0.0.3 username=alice type=utm action=blocked severity=high"),
        ]
        context = build_event_context(events)
        self.assertEqual(context["source_profiles"][0]["entity_label"], "alice (10.0.0.3)")


if __name__ == "__main__":
    unittest.main()