Function TestComputeFirewallDiff_RemovedDeniedDomain

pkg/cli/audit_diff_test.go:88–113

TestComputeFirewallDiff_RemovedDeniedDomain verifies that a domain which was denied in the base run but is absent from the comparison run is flagged as an anomaly. This covers the false-red scenario where awmg-mcpg:8080 is blocked in the failed run but is simply absent (no traffic) in the green run

(t *testing.T)

// covers the false-red scenario where awmg-mcpg:8080 is blocked in the failed run but
// is simply absent (no traffic) in the green run — the block should still be surfaced.
func TestComputeFirewallDiff_RemovedDeniedDomain(t *testing.T) {
	run1 := &FirewallAnalysis{
		RequestsByDomain: map[string]DomainRequestStats{
			"api.github.com:443": {Allowed: 10, Blocked: 0},
			"awmg-mcpg:8080":     {Allowed: 0, Blocked: 1},
		},
	}
	run2 := &FirewallAnalysis{
		RequestsByDomain: map[string]DomainRequestStats{
			"api.github.com:443": {Allowed: 10, Blocked: 0},
		},
	}

	diff := computeFirewallDiff(100, 200, run1, run2)

	assert.Len(t, diff.RemovedDomains, 1, "Should have 1 removed domain")
	entry := diff.RemovedDomains[0]
	assert.Equal(t, "awmg-mcpg:8080", entry.Domain)
	assert.Equal(t, "removed", entry.Status)
	assert.Equal(t, "denied", entry.Run1Status, "Domain was denied in run 1")
	assert.Equal(t, 1, entry.Run1Blocked, "Domain had 1 blocked request")
	assert.True(t, entry.IsAnomaly, "Denied removed domain should be an anomaly")
	assert.NotEmpty(t, entry.AnomalyNote, "Anomaly note should be set")
	assert.True(t, diff.Summary.HasAnomalies, "Summary should report anomalies")
	assert.Equal(t, 1, diff.Summary.AnomalyCount, "Should have 1 anomaly")
}

func TestComputeFirewallDiff_StatusChanges(t *testing.T) {
	run1 := &FirewallAnalysis{