import unittest

from fgai.logs import parse_log_line
from fgai.replay import replay_events
from fgai.stream_profiles import parse_profiles


class ReplayTests(unittest.TestCase):
    def test_replay_uses_temporary_profile_baseline(self):
        profiles = parse_profiles([{"stream_id": "windows", "entity_field": "username", "categorical_fields": ["action"]}])
        events = [
            parse_log_line(f"timestamp={1_700_000_000 + index * 300} username=alice action=failed event={index}")
            for index in range(12)
        ]
        events.extend(
            parse_log_line(f"timestamp={1_700_003_600} username=alice action=failed burst={index}")
            for index in range(5)
        )
        result = replay_events(events, profiles, stream_id="windows")
        self.assertEqual(result["events"], 17)
        self.assertGreaterEqual(result["field_detector_counts"].get("auth_failure_burst", 0), 1)