Function TestComputeFirewallDiff_RemovedDomains

pkg/cli/audit_diff_test.go:58–82

(t *testing.T)

}

func TestComputeFirewallDiff_RemovedDomains(t *testing.T) {
	run1 := &FirewallAnalysis{
		RequestsByDomain: map[string]DomainRequestStats{
			"api.github.com:443":       {Allowed: 5, Blocked: 0},
			"old-api.internal.com:443": {Allowed: 8, Blocked: 0},
		},
	}
	run2 := &FirewallAnalysis{
		RequestsByDomain: map[string]DomainRequestStats{
			"api.github.com:443": {Allowed: 5, Blocked: 0},
		},
	}

	diff := computeFirewallDiff(100, 200, run1, run2)

	assert.Len(t, diff.RemovedDomains, 1, "Should have 1 removed domain")
	assert.Equal(t, "old-api.internal.com:443", diff.RemovedDomains[0].Domain, "Removed domain should be old-api.internal.com")
	assert.Equal(t, "removed", diff.RemovedDomains[0].Status, "Status should be 'removed'")
	assert.Equal(t, "allowed", diff.RemovedDomains[0].Run1Status, "Domain was allowed in run 1")
	assert.Equal(t, 8, diff.RemovedDomains[0].Run1Allowed, "Domain had 8 allowed requests")
	assert.Equal(t, 1, diff.Summary.RemovedDomainCount, "Summary should show 1 removed domain")
	// An allowed-only removed domain must NOT be an anomaly.
	assert.False(t, diff.RemovedDomains[0].IsAnomaly, "Allowed removed domain should not be an anomaly")
	assert.False(t, diff.Summary.HasAnomalies, "No anomalies expected for an allowed removed domain")
}

// TestComputeFirewallDiff_RemovedDeniedDomain verifies that a domain which was denied in
// the base run but is absent from the comparison run is flagged as an anomaly.  This