Function TestComputeFirewallDiff_VolumeChanges

pkg/cli/audit_diff_test.go:152–176

(t *testing.T)

}

func TestComputeFirewallDiff_VolumeChanges(t *testing.T) {
	run1 := &FirewallAnalysis{
		RequestsByDomain: map[string]DomainRequestStats{
			"api.github.com:443":  {Allowed: 23, Blocked: 0},
			"cdn.example.com:443": {Allowed: 50, Blocked: 0},
		},
	}
	run2 := &FirewallAnalysis{
		RequestsByDomain: map[string]DomainRequestStats{
			"api.github.com:443":  {Allowed: 89, Blocked: 0},
			"cdn.example.com:443": {Allowed: 55, Blocked: 0},
		},
	}

	diff := computeFirewallDiff(100, 200, run1, run2)

	// api.github.com: 23 → 89 = +287% (over 100% threshold)
	assert.Len(t, diff.VolumeChanges, 1, "Should have 1 volume change (api.github.com, not cdn)")
	assert.Equal(t, "api.github.com:443", diff.VolumeChanges[0].Domain, "Volume change should be for api.github.com")
	assert.Equal(t, "+287%", diff.VolumeChanges[0].VolumeChange, "Volume change should be +287%")

	// cdn.example.com: 50 → 55 = +10% (under threshold, not flagged)
	assert.Equal(t, 1, diff.Summary.VolumeChangeCount, "Summary should show 1 volume change")
	assert.False(t, diff.Summary.HasAnomalies, "Volume changes alone should not create anomalies")
}

func TestComputeFirewallDiff_BothNil(t *testing.T) {
	diff := computeFirewallDiff(100, 200, nil, nil)