import pytest from diplayMappedFields import ( convert_to_html, extract_keys_with_values, format_data_to_rows, remove_empty_rows, ) MULTISELECT_JSON_VALUE = ( '{"process_evidence":[{"verdict":"suspicious","tags":[],' '"userAccount":{"resourceAccessEvents":[]}}],"custom_details":{}}' ) def test_extract_keys_with_values_keeps_list_values() -> None: """A multiSelect field value (a list) must be preserved as a list, not flattened away.""" fields = {"additionaldata": [MULTISELECT_JSON_VALUE]} items = extract_keys_with_values(fields) assert ("additionaldata", [MULTISELECT_JSON_VALUE]) in items def test_multiselect_value_survives_to_html() -> None: """ A multiSelect field (additionaldata/rawevent) whose value contains empty objects/arrays must still be rendered in the Mapped Fields HTML. Previously the row was dropped/corrupted because the value was flattened into a pipe-delimited row string that (a) was substring-matched against EMPTY_VALUES (dropping any row containing "{}") and (b) was re-split on "|". """ fields = {"additionaldata": [MULTISELECT_JSON_VALUE]} items = extract_keys_with_values(fields) rows = format_data_to_rows(items) filtered_rows = remove_empty_rows(rows) html = convert_to_html(filtered_rows) assert "additionaldata" in html assert "process_evidence" in html assert "suspicious" in html def test_value_containing_pipe_is_not_split_into_extra_columns() -> None: """ A field value that literally contains a pipe character must not be broken into extra table columns (delimiter collision). """ fields = {"somefield": "a|b|c"} items = extract_keys_with_values(fields) rows = format_data_to_rows(items) filtered_rows = remove_empty_rows(rows) html = convert_to_html(filtered_rows) # Exactly one key cell and one value cell -> two