Function TestComputeFirewallDiff_StatusChanges

pkg/cli/audit_diff_test.go:115–150

(t *testing.T)

}

func TestComputeFirewallDiff_StatusChanges(t *testing.T) {
	run1 := &FirewallAnalysis{
		RequestsByDomain: map[string]DomainRequestStats{
			"staging.api.com:443":    {Allowed: 10, Blocked: 0},
			"legacy.service.com:443": {Allowed: 0, Blocked: 5},
		},
	}
	run2 := &FirewallAnalysis{
		RequestsByDomain: map[string]DomainRequestStats{
			"staging.api.com:443":    {Allowed: 0, Blocked: 3},
			"legacy.service.com:443": {Allowed: 7, Blocked: 0},
		},
	}

	diff := computeFirewallDiff(100, 200, run1, run2)

	assert.Len(t, diff.StatusChanges, 2, "Should have 2 status changes")

	// legacy.service.com: denied → allowed (anomaly: previously denied, now allowed)
	legacyEntry := findDiffEntry(diff.StatusChanges, "legacy.service.com:443")
	require.NotNil(t, legacyEntry, "Should find legacy.service.com in status changes")
	assert.Equal(t, "denied", legacyEntry.Run1Status, "Was denied in run 1")
	assert.Equal(t, "allowed", legacyEntry.Run2Status, "Now allowed in run 2")
	assert.True(t, legacyEntry.IsAnomaly, "Should be flagged as anomaly")
	assert.Equal(t, "previously denied, now allowed", legacyEntry.AnomalyNote, "Anomaly note should explain the flip")

	// staging.api.com: allowed → denied (anomaly)
	stagingEntry := findDiffEntry(diff.StatusChanges, "staging.api.com:443")
	require.NotNil(t, stagingEntry, "Should find staging.api.com in status changes")
	assert.Equal(t, "allowed", stagingEntry.Run1Status, "Was allowed in run 1")
	assert.Equal(t, "denied", stagingEntry.Run2Status, "Now denied in run 2")
	assert.True(t, stagingEntry.IsAnomaly, "Should be flagged as anomaly")

	assert.Equal(t, 2, diff.Summary.StatusChangeCount, "Summary should show 2 status changes")
	assert.True(t, diff.Summary.HasAnomalies, "Should have anomalies")
}

func TestComputeFirewallDiff_VolumeChanges(t *testing.T) {
	run1 := &FirewallAnalysis{