import unittest
from fgai.incidents import build_incidents
from fgai.models import AnomalyFinding

class IncidentTests(unittest.TestCase):
    def test_merges_anomaly_and_correlation(self):
        anomaly = AnomalyFinding("10.0.0.1", 60, "high", "high", ["burst"], {})
        result = build_incidents([anomaly], {"10.0.0.1": [{"score": 15, "reason": "new domain"}]}, [{"source_ip": "10.0.0.1", "streams": ["DNS", "Firewall"]}])
        self.assertEqual(result[0]["score"], 85)

    def test_creates_incident_for_profile_entity_without_network_anomaly(self):
        result = build_incidents([], {"alice": [{"score": 15, "reason": "new login country", "stream_id": "windows"}]}, [])
        self.assertEqual(result[0]["entity"], "alice")
        self.assertEqual(result[0]["field_deviations"], 1)