"""Proofline confidence-scoring tests."""

from __future__ import annotations

from psyc.lines.proof import prove
from conftest import make_case


def test_kev_source_is_high_confidence():
    case = prove(make_case(feed="cisa-kev", cves=["CVE-2026-0001"], age_days=1))
    assert case.confidence.source_reliability == "A"
    assert case.confidence.level == "high"


def test_urlhaus_source_is_medium_confidence():
    case = prove(make_case(feed="urlhaus", urls=["http://1.2.3.4/x"], age_days=1))
    assert case.confidence.source_reliability == "B"
    assert case.confidence.level == "medium"


def test_freshness_buckets():
    assert prove(make_case(age_days=1)).confidence.freshness == "new"
    assert prove(make_case(age_days=7)).confidence.freshness == "recent"
    assert prove(make_case(age_days=30)).confidence.freshness == "stale"
    assert prove(make_case(age_days=200)).confidence.freshness == "resurfaced"


def test_stale_kev_case_is_docked_to_medium():
    case = prove(make_case(feed="cisa-kev", cves=["CVE-2026-0001"], age_days=200))
    assert case.confidence.level == "medium"  # high docked by staleness


def test_malformed_ioc_drops_confidence_to_low():
    case = make_case(feed="cisa-kev", ips=["999.999.0.1"], age_days=1)
    proved = prove(case)
    assert proved.confidence.iocs_valid is False
    assert proved.confidence.level == "low"


def test_valid_iocs_pass():
    case = prove(make_case(feed="urlhaus", ips=["8.8.8.8"], cves=["CVE-2026-1234"], age_days=1))
    assert case.confidence.iocs_valid is True