package normalize

import (
	"testing"
	"time"

	"example.com/siem-greenfield/internal/contracts"
)

func TestEvent4740ExtractsCallerComputer(t *testing.T) {
	xml := `<Event><System><Provider Name="Microsoft-Windows-Security-Auditing"/><Computer>DC01.example.local</Computer></System><EventData><Data Name="TargetUserName">alice</Data><Data Name="CallerComputerName">CLIENT-42</Data></EventData></Event>`
	env := contracts.IngestEnvelope{TenantID: "default", AgentID: "agent-1", BatchUID: "batch-abc", ReceivedAt: time.Date(2026, 7, 23, 12, 0, 1, 0, time.UTC)}
	p := contracts.LogPayload{Hostname: "DC01", Channel: "Security", EventID: 4740, Source: "windows-agent", Time: time.Date(2026, 7, 23, 12, 0, 0, 0, time.UTC), Message: xml}
	e := Event(env, p, "2026/07/raw.json.gz", 3, 99, 4)
	if e.EventUID != "batch-abc:4" {
		t.Fatalf("event uid = %q", e.EventUID)
	}
	if e.TargetUser != "alice" || e.Workstation != "CLIENT-42" {
		t.Fatalf("unexpected normalized event: %#v", e)
	}
	if e.Action != "account_locked" || e.Severity != 4 {
		t.Fatalf("unexpected classification: action=%s severity=%d", e.Action, e.Severity)
	}
	if e.Message != "" {
		t.Fatalf("raw XML must not be stored as message")
	}
	if len(e.Attributes) != 0 {
		t.Fatalf("promoted fields must not be duplicated in attributes: %#v", e.Attributes)
	}
}

func TestWMI5857IsGenericNotDetectionClass(t *testing.T) {
	cat, action, _, sev := classify("Microsoft-Windows-WMI-Activity/Operational", 5857)
	if cat != "event" || action != "observed" || sev != 1 {
		t.Fatalf("unexpected WMI classification: %s %s %d", cat, action, sev)
	}
}