62 lines
2.0 KiB
Python
62 lines
2.0 KiB
Python
from models.event_model import _make_dedupe_key, normalize_event
|
|
|
|
|
|
def test_make_dedupe_key_prefers_id_and_category():
|
|
e = {"id": "evt-123", "category": "Directory"}
|
|
assert _make_dedupe_key(e) == "evt-123|Directory"
|
|
|
|
|
|
def test_make_dedupe_key_fallback_without_id():
|
|
e = {
|
|
"activityDateTime": "2024-01-01T00:00:00Z",
|
|
"category": "Exchange",
|
|
"activityDisplayName": "Update setting",
|
|
}
|
|
key = _make_dedupe_key(e)
|
|
assert "2024-01-01T00:00:00Z|Exchange|Update setting" in key
|
|
|
|
|
|
def test_normalize_event_basic():
|
|
e = {
|
|
"id": "abc",
|
|
"activityDateTime": "2024-01-15T10:30:00Z",
|
|
"category": "UserManagement",
|
|
"activityDisplayName": "Add user",
|
|
"result": "success",
|
|
"initiatedBy": {
|
|
"user": {
|
|
"id": "u1",
|
|
"displayName": "Alice",
|
|
"userPrincipalName": "alice@example.com",
|
|
}
|
|
},
|
|
"targetResources": [{"id": "t1", "displayName": "Bob", "type": "User"}],
|
|
}
|
|
out = normalize_event(e)
|
|
assert out["id"] == "abc"
|
|
assert out["timestamp"] == "2024-01-15T10:30:00Z"
|
|
assert out["service"] == "UserManagement"
|
|
assert out["operation"] == "Add user"
|
|
assert out["result"] == "success"
|
|
assert out["actor_display"] == "Alice (alice@example.com)"
|
|
assert out["target_displays"] == ["Bob"]
|
|
assert out["dedupe_key"] == "abc|UserManagement"
|
|
assert "raw_text" in out
|
|
|
|
|
|
def test_normalize_event_with_resolved_actor():
|
|
e = {
|
|
"id": "def",
|
|
"activityDateTime": "2024-01-15T11:00:00Z",
|
|
"category": "ApplicationManagement",
|
|
"activityDisplayName": "Add app",
|
|
"result": "success",
|
|
"initiatedBy": {"servicePrincipal": {"id": "sp1"}},
|
|
"targetResources": [],
|
|
"_resolvedActor": {"id": "sp1", "type": "servicePrincipal", "name": "MyApp"},
|
|
"_resolvedActorOwners": ["Owner1"],
|
|
}
|
|
out = normalize_event(e)
|
|
assert out["actor_display"] == "MyApp (owners: Owner1)"
|
|
assert out["display_category"] == "Application"
|