import unittest

from app.tuning import AlertTuner


def event(severity=2, sid=123, category="Attempted Information Leak"):
    return {
        "event_type": "alert",
        "alert": {
            "severity": severity,
            "signature_id": sid,
            "category": category,
        },
    }


class TuningTests(unittest.TestCase):
    def test_keeps_high_and_medium_priority_by_default_profile(self):
        tuner = AlertTuner(2)
        self.assertTrue(tuner.evaluate(event(1)).keep)
        self.assertTrue(tuner.evaluate(event(2)).keep)

    def test_filters_low_priority(self):
        tuner = AlertTuner(2)
        decision = tuner.evaluate(event(3))
        self.assertFalse(decision.keep)
        self.assertEqual(decision.reason, "low_priority")

    def test_filters_ignored_sid_and_category(self):
        tuner = AlertTuner(3, "123,456", "Policy Violation,Misc activity")
        self.assertEqual(tuner.evaluate(event(1, sid=123)).reason, "ignored_sid")
        self.assertEqual(
            tuner.evaluate(event(1, sid=999, category="misc activity")).reason,
            "ignored_category",
        )


if __name__ == "__main__":
    unittest.main()