use acaua_core::{doctor, fusion, pillar1, pillar2, pillar3, pillar4, storage, zeek, AcauaError};

#[test]
fn pillar1_returns_a_skeleton_score() {
    let input = pillar1::BeaconingInput {
        timestamps: vec![1.0, 2.0, 3.0],
    };
    let score = pillar1::score(&input).unwrap();
    assert_eq!(score.observations, 3);
    assert_eq!(score.status, "insufficient_data");
}

#[test]
fn pillar2_counts_long_connections_without_panicking() {
    let input = pillar2::SessionInput {
        durations_secs: vec![1.0, 400.0],
        bytes: vec![10, 20],
    };
    let score = pillar2::score(&input).unwrap();
    assert_eq!(score.long_connections, 1);
    assert_eq!(score.status, "skeleton");
}

#[test]
fn pillar3_handles_an_empty_protocol_list() {
    let score = pillar3::score(&pillar3::ProtocolInput::default()).unwrap();
    assert_eq!(score.distinct_protocols, 0);
    assert_eq!(score.status, "skeleton");
}

#[test]
fn pillar4_fuses_three_inputs() {
    let score = pillar4::score(&pillar4::FusionInput::default()).unwrap();
    assert_eq!(score.inputs, 3);
    assert_eq!(score.status, "skeleton");
}

#[test]
fn fusion_returns_no_alerts_yet() {
    let report = fusion::fuse(&[0.1, 0.2]).unwrap();
    assert!(report.alerts.is_empty());
    assert_eq!(report.status, "skeleton");
}

#[test]
fn storage_reports_the_reserved_backend() {
    let store = storage::Storage::open(std::env::temp_dir()).unwrap();
    let summary = store.summary().unwrap();
    assert_eq!(summary.ttl_days, 7);
    assert_eq!(summary.records, 0);
}

#[test]
fn zeek_rejects_a_missing_directory() {
    let error =
        zeek::analyze_dir("/definitely/not/a/zeek/directory", std::env::temp_dir()).unwrap_err();
    assert!(matches!(error, AcauaError::InvalidInput(_)));
}

#[test]
fn zeek_classifies_known_logs() {
    assert_eq!(zeek::classify_log("dns.log"), zeek::ZeekLogKind::Dns);
    assert_eq!(zeek::classify_log("other.log"), zeek::ZeekLogKind::Unknown);
}

#[test]
fn doctor_reports_checks() {
    let report = doctor::run();
    assert!(!report.checks.is_empty());
    assert_eq!(report.status, "skeleton");
}