from datetime import UTC, datetime, timedelta

from app.correlate import correlate
from app.demo import load_demo
from app.models import NormalizedEvent


def test_demo_resolves_into_named_rules():
    rule_ids={incident.rule_id for incident in correlate(load_demo())}
    assert "windows.system.startup" in rule_ids
    assert "windows.service.failure" in rule_ids
    assert "windows.network.dns-timeout" in rule_ids
    assert "windows.crash.application-report" in rule_ids


def test_repeated_dns_events_are_compressed_in_incident_summary():
    start=datetime(2026,9,9,8,0,tzinfo=UTC)
    events=[NormalizedEvent(id=str(index),timestamp=start+timedelta(seconds=index*10),provider="Microsoft-Windows-DNS-Client",event_id=1014,level="warning",channel="System",computer="LAB-PC",category="network",summary="DNS timeout") for index in range(3)]
    incident=correlate(events)[0]
    assert incident.rule_id == "windows.network.dns-timeout"
    assert incident.original_count == 3
    assert incident.compressed_count == 1


def test_incident_ids_are_deterministic():
    events=load_demo()
    assert [incident.id for incident in correlate(events)] == [incident.id for incident in correlate(events)]