// SPDX-License-Identifier: GPL-3.0-or-later

package schema

import (
	"testing"
	"time"
)

func TestBuildMatchesEventV1Shape(t *testing.T) {
	payload := map[string]any{"sid": 100010}
	event, err := Build("alert", payload, "host-a", "2026-07-10T00:00:00-07:00")
	if err != nil {
		t.Fatal(err)
	}
	if event["schema"] != EventV1 || event["event_type"] != "alert" || event["host"] != "host-a" {
		t.Fatalf("unexpected envelope: %#v", event)
	}
	if event["alert"].(map[string]any)["sid"] != 100010 {
		t.Fatalf("payload not preserved: %#v", event["alert"])
	}
}

func TestBuildDefaultsParseAndUnknownTypeFails(t *testing.T) {
	event, err := Build("status", map[string]any{"running": true}, "", "")
	if err != nil {
		t.Fatal(err)
	}
	if _, err := time.Parse(time.RFC3339Nano, event["timestamp"].(string)); err != nil {
		t.Fatalf("timestamp is not RFC3339: %v", err)
	}
	if event["host"] == "" {
		t.Fatal("default host must be populated")
	}
	if _, err := Build("nope", nil, "", ""); err == nil {
		t.Fatal("unknown event type must fail")
	}
}