import unittest

from fgai.exports import investigation_report, investigation_report_markdown


class InvestigationExportTests(unittest.TestCase):
    def test_report_filters_incident_and_related_recommendations(self):
        status = {
            "summary": {"total": 42},
            "anomaly_summary": {"critical": 1},
            "incidents": [
                {"id": "one", "entity": "alice", "severity": "high", "score": 70, "timeline": []},
                {"id": "two", "entity": "10.0.0.5", "severity": "medium", "score": 35, "timeline": []},
            ],
            "recommendations": [
                {"subject": "alice", "title": "Review login", "severity": "high", "score": 70},
                {"subject": "other", "title": "Ignore", "severity": "low", "score": 10},
            ],
        }

        report = investigation_report(status, incident_id="one")

        self.assertEqual([item["id"] for item in report["incidents"]], ["one"])
        self.assertEqual([item["subject"] for item in report["recommendations"]], ["alice"])
        self.assertEqual(report["summary"]["total"], 42)

    def test_markdown_includes_evidence_timeline_and_query_details(self):
        report = investigation_report(
            {
                "summary": {"total": 10},
                "anomaly_summary": {"high": 1},
                "baseline": {"sources_ready": 2},
                "stream_coverage": [
                    {"stream_name": "Windows", "enabled": True, "profile_name": "Windows profile", "events_fetched": 9, "health": "ready"}
                ],
                "incidents": [
                    {
                        "id": "abc123",
                        "entity": "alice",
                        "entity_type": "user",
                        "score": 88,
                        "severity": "critical",
                        "lifecycle_status": "acknowledged",
                        "note": "Known test account.",
                        "correlated_streams": ["Windows", "Firewall"],
                        "first_seen": "2026-06-29T10:00:00Z",
                        "last_seen": "2026-06-29T10:05:00Z",
                        "evidence": ["failed logins above baseline"],
                        "timeline": [
                            {
                                "timestamp": "2026-06-29T10:00:00Z",
                                "stream_name": "Windows",
                                "action": "failure",
                                "destination": "host01",
                                "service": "logon",
                                "context": "4625",
                                "query_details": {"query": 'username:"alice" AND event_id:4625'},
                            }
                        ],
                    }
                ],
            }
        )

        markdown = investigation_report_markdown(report)

        self.assertIn("SignalScope Investigation Report", markdown)
        self.assertIn("alice (critical)", markdown)
        self.assertIn("Known test account.", markdown)
        self.assertIn('username:"alice" AND event_id:4625', markdown)
        self.assertIn("Windows profile", markdown)


if __name__ == "__main__":
    unittest.main()