MS365DefenderUserListToTable

def test_count_dict_multiple_users():
    """
    Given:
      - A comma-separated string of multiple users.
    When:
      - Running the MS365DefenderUserListToTable transformer.
    Then:
      - Ensure every user is returned as its own row (not collapsed into a single row).
    """
    from MS365DefenderUserListToTable import count_dict

    input_value = "username@domain (BOQDEVUSER.LOCAL),admin@contoso.com (CONTOSO)"
    expected_output = [
        {"User": "username@domain (BOQDEVUSER.LOCAL)"},
        {"User": "admin@contoso.com (CONTOSO)"},
    ]
    assert count_dict(input_value) == expected_output


def test_count_dict_single_user():
    """
    Given:
      - A single user string.
    When:
      - Running the MS365DefenderUserListToTable transformer.
    Then:
      - Ensure a single row is returned.
    """
    from MS365DefenderUserListToTable import count_dict

    assert count_dict("username@domain (BOQDEVUSER.LOCAL)") == [{"User": "username@domain (BOQDEVUSER.LOCAL)"}]


def test_count_dict_non_string_passthrough():
    """
    Given:
      - A non-string value.
    When:
      - Running the MS365DefenderUserListToTable transformer.
    Then:
      - Ensure the value is returned unchanged.
    """
    from MS365DefenderUserListToTable import count_dict

    value = [{"User": "already-a-table"}]
    assert count_dict(value) == value