import unittest

from fgai.stream_profiles import parse_profiles


class StreamProfileTests(unittest.TestCase):
    def test_parses_field_level_profile(self):
        profiles = parse_profiles([{"stream_id": "dns", "name": "DNS client behavior", "entity_field": "IP", "categorical_fields": ["QH"], "numeric_fields": ["Elapsed"]}])
        self.assertEqual(profiles["dns"].name, "DNS client behavior")
        self.assertEqual(profiles["dns"].entity_field, "IP")
        self.assertEqual(profiles["dns"].entity_fields, ("IP",))
        self.assertEqual(profiles["dns"].numeric_fields, ("Elapsed",))

    def test_parses_multiple_entity_fields(self):
        profiles = parse_profiles([{"stream_id": "vpn", "entity_fields": ["username", "srcip", "hostname"], "categorical_fields": ["action"]}])
        self.assertEqual(profiles["vpn"].entity_field, "username")
        self.assertEqual(profiles["vpn"].entity_fields, ("username", "srcip", "hostname"))

    def test_parses_detector_thresholds(self):
        profiles = parse_profiles([{"stream_id": "windows", "entity_field": "username", "detectors": {"auth_failure": {"enabled": False, "minimum": 7, "z_threshold": 4.5}}}])
        self.assertEqual(profiles["windows"].detectors["auth_failure"], {"enabled": False, "minimum": 7, "z_threshold": 4.5})

    def test_parses_field_weights(self):
        profiles = parse_profiles([{"stream_id": "dns", "entity_field": "IP", "field_weights": {"QH": 1.5, "query_domain": {"rare_value": 2}, "bad": "nope"}}])
        self.assertEqual(profiles["dns"].field_weights["qh"], 1.5)
        self.assertEqual(profiles["dns"].field_weights["query_domain"]["rare_value"], 2.0)
        self.assertNotIn("bad", profiles["dns"].field_weights)