v.0.11.4

tests/test_live.py

@@ -8,11 +8,13 @@ from datetime import datetime, timezone
 from app.store import AlertStore
 
 from app.live import (
+    MAX_ANALYTICS_DIMENSION_KEYS,
     EventBus,
     LiveEventPipeline,
     RedisUnavailableError,
     TrafficHistory,
     TrafficNormalizer,
+    _AnalyticsAccumulator,
     event_matches,
 )
 
@@ -410,6 +412,19 @@ class LiveTests(unittest.TestCase):
             self.assertEqual(store.traffic_archive_status()["events"], 0)
             store.close()
 
+    def test_sqlite_analytics_high_cardinality_counters_are_bounded(self):
+        now = int(time.time() * 1000)
+        acc = _AnalyticsAccumulator(now - 60_000, now, 60, track_high_cardinality=False)
+        for idx in range(MAX_ANALYTICS_DIMENSION_KEYS + 100):
+            acc.add_event({
+                "ts_ms": now,
+                "type": "fileinfo",
+                "filename": f"unique-{idx}.bin",
+                "file_sha256": f"{idx:064x}"[-64:],
+                "direction": "outbound",
+            })
+        self.assertEqual(len(acc.file_activity), MAX_ANALYTICS_DIMENSION_KEYS)
+
 
 if __name__ == "__main__":
     unittest.main()