import os
import unittest
from unittest.mock import patch

from fgai.anomaly import detect_source_anomalies
from fgai.logs import parse_log_line
from fgai.recommendations import build_recommendations
from fgai.threat_intel import ThreatIntelClient


class RecommendationTests(unittest.TestCase):
    def test_recommends_review_for_utm_anomaly(self):
        events = [
            parse_log_line(
                'type=utm subtype=ips srcip=8.8.8.8 dstip=10.0.0.10 policyid=4 '
                'service=https action=blocked severity=critical'
            )
            for _ in range(5)
        ]
        anomalies = detect_source_anomalies(events)

        recommendations = build_recommendations(events, anomalies)

        self.assertGreaterEqual(recommendations[0].score, 60)
        self.assertIn("4", recommendations[0].related_policy_ids)
        self.assertIn("https", recommendations[0].related_services)

    def test_threat_intel_disabled_by_default(self):
        with patch.dict(os.environ, {}, clear=True):
            client = ThreatIntelClient(cache_file="/tmp/fgai-test-threat-cache.json")

            result = client.lookup_ip("8.8.8.8")

        self.assertEqual(result["status"], "disabled")


if __name__ == "__main__":
    unittest.main()