"""Tests for D3FEND mapping import — review_required trigger parity.

Every other import source (Atomic Red Team, Caldera, Elastic, Sigma, LOLBAS)
flags a technique with review_required=True when it gains new content, so a
lead knows to look at it. D3FEND mapping import was missing this — this test
locks in the fix.
"""

from app.models.defensive_technique import DefensiveTechnique
from app.models.technique import Technique
from app.services.d3fend_import_service import import_d3fend_mappings


def test_import_d3fend_mappings_sets_review_required(db):
    technique = Technique(mitre_id="T1590", name="Gather Victim Network Information", review_required=False)
    db.add(technique)
    db.add(DefensiveTechnique(d3fend_id="D3-NTA", name="Network Traffic Analysis"))
    db.commit()

    result = import_d3fend_mappings(db)

    assert result["created"] >= 1
    db.refresh(technique)
    assert technique.review_required is True


def test_import_d3fend_mappings_skips_existing_without_reflagging(db):
    technique = Technique(mitre_id="T1590", name="Gather Victim Network Information", review_required=False)
    db.add(technique)
    db.add(DefensiveTechnique(d3fend_id="D3-NTA", name="Network Traffic Analysis"))
    db.commit()

    import_d3fend_mappings(db)
    db.refresh(technique)
    technique.review_required = False
    db.commit()

    result = import_d3fend_mappings(db)

    assert result["created"] == 0
    db.refresh(technique)
    assert technique.review_required is False