from app.normalize import classify, normalize_record


def test_normalizes_rust_evtx_json_shape():
    payload = {"Event": {"System": {"Provider": {"#attributes": {"Name": "Microsoft-Windows-Security-Auditing"}},"EventID": 4625,"Level": 0,"Channel": "Security","Computer": "LAB-PC","EventRecordID": 77,"TimeCreated": {"#attributes": {"SystemTime": "2026-09-09T08:32:11.000000Z"}}},"EventData": {"TargetUserName": "jens", "Status": "0xc000006d"}}}
    event = normalize_record(payload)
    assert event.id == "77"
    assert event.event_id == 4625
    assert event.category == "authentication"
    assert event.summary == "Failed sign-in for jens"
    assert event.fields["EventData.Status"] == "0xc000006d"


def test_classification_handles_common_windows_sources():
    assert classify("Service Control Manager", 7031, "System") == "service"
    assert classify("Microsoft-Windows-DNS-Client", 1014, "System") == "network"
    assert classify("Application Error", 1000, "Application") == "crash"