import os
from pathlib import Path

import pytest

from app.parser import parse_evtx_bytes

FIXTURE = os.environ.get("EVENTLENS_EVTX_FIXTURE")


@pytest.mark.skipif(not FIXTURE, reason="EVENTLENS_EVTX_FIXTURE is only supplied by CI/release qualification")
def test_pinned_real_evtx_fixture_end_to_end():
    data = Path(FIXTURE).read_bytes()
    assert data.startswith(b"ElfFile\x00")
    result = parse_evtx_bytes(data, max_events=100, max_seconds=10.0)
    assert len(result.events) == 7
    assert [event.event_id for event in result.events] == [5152, 4611, 4776, 4625, 5152, 5157, 4673]
    assert all(event.provider == "Microsoft-Windows-Security-Auditing" for event in result.events)
    assert all(event.channel == "Security" for event in result.events)