@transaction.atomic
def form_valid(self, form):
    old_instance = SecurityIncident.objects.select_for_update().get(pk=self.object.pk)  # Line 56

# Line 56: Capture OLD state BEFORE save
old_instance = SecurityIncident.objects.select_for_update().get(pk=self.object.pk)

# Line 59: Save the form (updates self.object)
response = super().form_valid(form)

# Lines 64-77: Compare old_instance (before save) vs self.object (after save)
for field in fields_to_track:
    old_val = getattr(old_instance, field)  # ← OLD state
    new_val = getattr(self.object, field)   # ← NEW state

except Exception:  # noqa: BLE001 – log and surface a controlled error
    logger.exception("Error while generating SecurityIncident CSV export")
    return HttpResponse("Error generating CSV export.", status=500, content_type="text/plain")

value = value.strip()  # Remove leading whitespace
if value[0] in ("=", "+", "-", "@", "\t", "\r", "\n"):
    return "'" + value  # Escape with single quote

history_qs = self.object.history.select_related("changed_by").order_by("-changed_at")
context["history_count"] = history_qs.count()  # Triggers COUNT(*) query
context["history_entries"] = history_qs  # Later triggers SELECT query

history_entries = list(history_qs)
context["history_entries"] = history_entries
context["history_count"] = len(history_entries)

SECURITY_LABEL_ID = 4  # Defined at line 31

# Line 210:
context["security_issues"] = Issue.objects.filter(label=SECURITY_LABEL_ID).order_by("-created")[:10]

from django.contrib.auth import get_user_model
from django.test import TestCase
from django.utils import timezone

from website.models import SecurityIncident, SecurityIncidentHistory

User = get_user_model()


class SecurityIncidentModelTest(TestCase):
    """Test SecurityIncident model behavior"""

    def setUp(self):
        self.user = User.objects.create_user(
            username="testuser",
            email="[email protected]",
            password="testpass123"
        )
        self.incident = SecurityIncident.objects.create(
            title="Test Incident",
            severity=SecurityIncident.Severity.HIGH,
            status=SecurityIncident.Status.OPEN,
            affected_systems="server1, server2",
            description="Test description",
            reporter=self.user
        )

    def test_incident_creation(self):
        """Test that SecurityIncident is created correctly"""
        self.assertEqual(self.incident.title, "Test Incident")
        self.assertEqual(self.incident.severity, SecurityIncident.Severity.HIGH)
        self.assertEqual(self.incident.status, SecurityIncident.Status.OPEN)
        self.assertIsNotNone(self.incident.created_at)
        self.assertIsNone(self.incident.resolved_at)

    def test_incident_str_representation(self):
        """Test __str__ method returns expected format"""
        expected = "Test Incident (HIGH - OPEN)"
        self.assertEqual(str(self.incident), expected)

    def test_resolved_at_auto_set_on_resolved(self):
        """Test that resolved_at is auto-set when status changes to RESOLVED"""
        self.assertIsNone(self.incident.resolved_at)
        
        self.incident.status = SecurityIncident.Status.RESOLVED
        self.incident.save()
        
        self.assertIsNotNone(self.incident.resolved_at)
        self.assertIsInstance(self.incident.resolved_at, timezone.datetime)

    def test_resolved_at_cleared_on_reopen(self):
        """Test that resolved_at is cleared when reopening an incident"""
        # First resolve it
        self.incident.status = SecurityIncident.Status.RESOLVED
        self.incident.save()
        self.assertIsNotNone(self.incident.resolved_at)
        
        # Then reopen
        self.incident.status = SecurityIncident.Status.INVESTIGATING
        self.incident.save()
        
        self.assertIsNone(self.incident.resolved_at)

    def test_severity_choices(self):
        """Test all severity choices are valid"""
        severities = [
            SecurityIncident.Severity.LOW,
            SecurityIncident.Severity.MEDIUM,
            SecurityIncident.Severity.HIGH,
            SecurityIncident.Severity.CRITICAL,
        ]
        for severity in severities:
            incident = SecurityIncident.objects.create(
                title=f"Test {severity}",
                severity=severity,
                status=SecurityIncident.Status.OPEN,
                reporter=self.user
            )
            self.assertEqual(incident.severity, severity)

    def test_status_choices(self):
        """Test all status choices are valid"""
        statuses = [
            SecurityIncident.Status.OPEN,
            SecurityIncident.Status.INVESTIGATING,
            SecurityIncident.Status.RESOLVED,
        ]
        for status in statuses:
            incident = SecurityIncident.objects.create(
                title=f"Test {status}",
                severity=SecurityIncident.Severity.MEDIUM,
                status=status,
                reporter=self.user
            )
            self.assertEqual(incident.status, status)

    def test_ordering_by_created_at_desc(self):
        """Test that incidents are ordered by created_at descending"""
        incident2 = SecurityIncident.objects.create(
            title="Newer Incident",
            severity=SecurityIncident.Severity.LOW,
            status=SecurityIncident.Status.OPEN,
            reporter=self.user
        )
        
        incidents = list(SecurityIncident.objects.all())
        self.assertEqual(incidents[0].id, incident2.id)
        self.assertEqual(incidents[1].id, self.incident.id)


class SecurityIncidentHistoryModelTest(TestCase):
    """Test SecurityIncidentHistory model behavior"""

    def setUp(self):
        self.user = User.objects.create_user(
            username="testuser",
            email="[email protected]",
            password="testpass123"
        )
        self.incident = SecurityIncident.objects.create(
            title="Test Incident",
            severity=SecurityIncident.Severity.HIGH,
            status=SecurityIncident.Status.OPEN,
            reporter=self.user
        )

    def test_history_creation(self):
        """Test that history records are created correctly"""
        history = SecurityIncidentHistory.objects.create(
            incident=self.incident,
            field_name="severity",
            old_value="MEDIUM",
            new_value="HIGH",
            changed_by=self.user
        )
        
        self.assertEqual(history.incident, self.incident)
        self.assertEqual(history.field_name, "severity")
        self.assertEqual(history.old_value, "MEDIUM")
        self.assertEqual(history.new_value, "HIGH")
        self.assertEqual(history.changed_by, self.user)
        self.assertIsNotNone(history.changed_at)

    def test_history_ordering_by_changed_at_desc(self):
        """Test that history records are ordered by changed_at descending"""
        history1 = SecurityIncidentHistory.objects.create(
            incident=self.incident,
            field_name="status",
            old_value="OPEN",
            new_value="INVESTIGATING",
            changed_by=self.user
        )
        
        history2 = SecurityIncidentHistory.objects.create(
            incident=self.incident,
            field_name="status",
            old_value="INVESTIGATING",
            new_value="RESOLVED",
            changed_by=self.user
        )
        
        histories = list(SecurityIncidentHistory.objects.all())
        self.assertEqual(histories[0].id, history2.id)
        self.assertEqual(histories[1].id, history1.id)

    def test_history_cascade_delete(self):
        """Test that history is deleted when incident is deleted"""
        SecurityIncidentHistory.objects.create(
            incident=self.incident,
            field_name="severity",
            old_value="LOW",
            new_value="HIGH",
            changed_by=self.user
        )
        
        history_count = SecurityIncidentHistory.objects.filter(incident=self.incident).count()
        self.assertEqual(history_count, 1)
        
        # Delete the incident
        self.incident.delete()
        
        # History should also be deleted
        history_count = SecurityIncidentHistory.objects.filter(incident=self.incident).count()
        self.assertEqual(history_count, 0)

from django.contrib.auth import get_user_model
from django.test import TestCase
from django.urls import reverse

from website.models import SecurityIncident, SecurityIncidentHistory

User = get_user_model()


class SecurityDashboardViewTest(TestCase):
    """Test SecurityDashboardView"""

    def setUp(self):
        self.user = User.objects.create_user(
            username="testuser",
            email="[email protected]",
            password="testpass123"
        )
        self.staff_user = User.objects.create_user(
            username="staffuser",
            email="[email protected]",
            password="testpass123",
            is_staff=True
        )
        self.superuser = User.objects.create_superuser(
            username="admin",
            email="[email protected]",
            password="testpass123"
        )
        
        # Create test incidents
        SecurityIncident.objects.create(
            title="Critical Security Issue",
            severity=SecurityIncident.Severity.CRITICAL,
            status=SecurityIncident.Status.OPEN,
            reporter=self.staff_user
        )
        SecurityIncident.objects.create(
            title="Minor Issue",
            severity=SecurityIncident.Severity.LOW,
            status=SecurityIncident.Status.RESOLVED,
            reporter=self.staff_user
        )

    def test_dashboard_requires_authentication(self):
        """Test that dashboard requires login"""
        response = self.client.get(reverse("security_dashboard"))
        self.assertEqual(response.status_code, 302)  # Redirect to login

    def test_dashboard_requires_staff(self):
        """Test that regular users cannot access dashboard"""
        self.client.login(username="testuser", password="testpass123")
        response = self.client.get(reverse("security_dashboard"))
        self.assertEqual(response.status_code, 403)  # Forbidden

    def test_dashboard_accessible_by_staff(self):
        """Test that staff users can access dashboard"""
        self.client.login(username="staffuser", password="testpass123")
        response = self.client.get(reverse("security_dashboard"))
        self.assertEqual(response.status_code, 200)
        self.assertContains(response, "Critical Security Issue")

    def test_dashboard_accessible_by_superuser(self):
        """Test that superusers can access dashboard"""
        self.client.login(username="admin", password="testpass123")
        response = self.client.get(reverse("security_dashboard"))
        self.assertEqual(response.status_code, 200)

    def test_dashboard_filter_by_severity(self):
        """Test filtering incidents by severity"""
        self.client.login(username="staffuser", password="testpass123")
        response = self.client.get(reverse("security_dashboard"), {"severity": "CRITICAL"})
        self.assertEqual(response.status_code, 200)
        self.assertContains(response, "Critical Security Issue")
        self.assertNotContains(response, "Minor Issue")

    def test_dashboard_filter_by_status(self):
        """Test filtering incidents by status"""
        self.client.login(username="staffuser", password="testpass123")
        response = self.client.get(reverse("security_dashboard"), {"status": "RESOLVED"})
        self.assertEqual(response.status_code, 200)
        self.assertContains(response, "Minor Issue")
        self.assertNotContains(response, "Critical Security Issue")

    def test_dashboard_context_data(self):
        """Test that dashboard provides expected context"""
        self.client.login(username="staffuser", password="testpass123")
        response = self.client.get(reverse("security_dashboard"))
        
        self.assertIn("incidents", response.context)
        self.assertIn("severity_breakdown", response.context)
        self.assertIn("status_breakdown", response.context)
        self.assertIn("total_incidents", response.context)
        
        self.assertEqual(response.context["total_incidents"], 2)


class SecurityIncidentCreateViewTest(TestCase):
    """Test SecurityIncidentCreateView"""

    def setUp(self):
        self.staff_user = User.objects.create_user(
            username="staffuser",
            email="[email protected]",
            password="testpass123",
            is_staff=True
        )
        self.regular_user = User.objects.create_user(
            username="testuser",
            email="[email protected]",
            password="testpass123"
        )

    def test_create_requires_staff(self):
        """Test that only staff can create incidents"""
        self.client.login(username="testuser", password="testpass123")
        response = self.client.get(reverse("security_incident_add"))
        self.assertEqual(response.status_code, 403)

    def test_create_view_accessible_by_staff(self):
        """Test that staff can access create view"""
        self.client.login(username="staffuser", password="testpass123")
        response = self.client.get(reverse("security_incident_add"))
        self.assertEqual(response.status_code, 200)
        self.assertContains(response, "Create Security Incident")

    def test_create_incident_success(self):
        """Test successful incident creation"""
        self.client.login(username="staffuser", password="testpass123")
        data = {
            "title": "New Security Incident",
            "severity": SecurityIncident.Severity.HIGH,
            "status": SecurityIncident.Status.OPEN,
            "affected_systems": "server1, database",
            "description": "Test incident"
        }
        response = self.client.post(reverse("security_incident_add"), data)
        
        self.assertEqual(response.status_code, 302)  # Redirect on success
        self.assertEqual(SecurityIncident.objects.count(), 1)
        
        incident = SecurityIncident.objects.first()
        self.assertEqual(incident.title, "New Security Incident")
        self.assertEqual(incident.reporter, self.staff_user)


class SecurityIncidentUpdateViewTest(TestCase):
    """Test SecurityIncidentUpdateView with history tracking"""

    def setUp(self):
        self.staff_user = User.objects.create_user(
            username="staffuser",
            email="[email protected]",
            password="testpass123",
            is_staff=True
        )
        self.incident = SecurityIncident.objects.create(
            title="Original Title",
            severity=SecurityIncident.Severity.MEDIUM,
            status=SecurityIncident.Status.OPEN,
            affected_systems="server1",
            description="Original description",
            reporter=self.staff_user
        )

    def test_update_creates_history_record(self):
        """Test that updating an incident creates history records"""
        self.client.login(username="staffuser", password="testpass123")
        
        data = {
            "title": "Updated Title",
            "severity": SecurityIncident.Severity.HIGH,
            "status": SecurityIncident.Status.INVESTIGATING,
            "affected_systems": "server1, server2",
            "description": "Updated description"
        }
        response = self.client.post(
            reverse("security_incident_edit", kwargs={"pk": self.incident.pk}),
            data
        )
        
        self.assertEqual(response.status_code, 302)
        
        # Check history records were created
        histories = SecurityIncidentHistory.objects.filter(incident=self.incident)
        self.assertGreater(histories.count(), 0)
        
        # Verify specific field changes
        title_history = histories.filter(field_name="title").first()
        self.assertIsNotNone(title_history)
        self.assertEqual(title_history.old_value, "Original Title")
        self.assertEqual(title_history.new_value, "Updated Title")
        self.assertEqual(title_history.changed_by, self.staff_user)

    def test_update_unchanged_fields_no_history(self):
        """Test that unchanged fields don't create history records"""
        self.client.login(username="staffuser", password="testpass123")
        
        # Update only title
        data = {
            "title": "Updated Title",
            "severity": self.incident.severity,  # Unchanged
            "status": self.incident.status,  # Unchanged
            "affected_systems": self.incident.affected_systems,  # Unchanged
            "description": self.incident.description  # Unchanged
        }
        response = self.client.post(
            reverse("security_incident_edit", kwargs={"pk": self.incident.pk}),
            data
        )
        
        # Only one history record (for title)
        histories = SecurityIncidentHistory.objects.filter(incident=self.incident)
        self.assertEqual(histories.count(), 1)
        self.assertEqual(histories.first().field_name, "title")


class SecurityIncidentDetailViewTest(TestCase):
    """Test SecurityIncidentDetailView"""

    def setUp(self):
        self.staff_user = User.objects.create_user(
            username="staffuser",
            email="[email protected]",
            password="testpass123",
            is_staff=True
        )
        self.incident = SecurityIncident.objects.create(
            title="Test Incident",
            severity=SecurityIncident.Severity.HIGH,
            status=SecurityIncident.Status.OPEN,
            reporter=self.staff_user
        )
        
        # Create history
        SecurityIncidentHistory.objects.create(
            incident=self.incident,
            field_name="severity",
            old_value="MEDIUM",
            new_value="HIGH",
            changed_by=self.staff_user
        )

    def test_detail_view_shows_incident(self):
        """Test that detail view displays incident information"""
        self.client.login(username="staffuser", password="testpass123")
        response = self.client.get(
            reverse("security_incident_detail", kwargs={"pk": self.incident.pk})
        )
        
        self.assertEqual(response.status_code, 200)
        self.assertContains(response, "Test Incident")
        self.assertContains(response, "HIGH")

    def test_detail_view_shows_history(self):
        """Test that detail view includes history context"""
        self.client.login(username="staffuser", password="testpass123")
        response = self.client.get(
            reverse("security_incident_detail", kwargs={"pk": self.incident.pk})
        )
        
        self.assertIn("history_entries", response.context)
        self.assertIn("history_count", response.context)
        self.assertEqual(response.context["history_count"], 1)

from django.contrib.auth import get_user_model
from django.test import TestCase
from rest_framework import status
from rest_framework.test import APIClient

from website.models import SecurityIncident

User = get_user_model()


class SecurityIncidentAPITest(TestCase):
    """Test SecurityIncidentViewSet API"""

    def setUp(self):
        self.client = APIClient()
        
        self.regular_user = User.objects.create_user(
            username="testuser",
            email="[email protected]",
            password="testpass123"
        )
        self.staff_user = User.objects.create_user(
            username="staffuser",
            email="[email protected]",
            password="testpass123",
            is_staff=True
        )
        self.superuser = User.objects.create_superuser(
            username="admin",
            email="[email protected]",
            password="testpass123"
        )
        
        self.incident = SecurityIncident.objects.create(
            title="API Test Incident",
            severity=SecurityIncident.Severity.HIGH,
            status=SecurityIncident.Status.OPEN,
            reporter=self.staff_user
        )

    def test_api_requires_authentication(self):
        """Test that API endpoints require authentication"""
        response = self.client.get("/api/v1/security-incidents/")
        self.assertEqual(response.status_code, 401)  # Unauthorized

    def test_api_requires_admin(self):
        """Test that regular users cannot access API"""
        self.client.force_authenticate(user=self.regular_user)
        response = self.client.get("/api/v1/security-incidents/")
        self.assertEqual(response.status_code, 403)  # Forbidden

    def test_api_list_accessible_by_staff(self):
        """Test that staff users can list incidents via API"""
        self.client.force_authenticate(user=self.staff_user)
        response = self.client.get("/api/v1/security-incidents/")
        
        self.assertEqual(response.status_code, 200)
        data = response.json()
        self.assertIsInstance(data, list)
        self.assertEqual(len(data), 1)
        self.assertEqual(data[0]["title"], "API Test Incident")

    def test_api_retrieve_incident(self):
        """Test retrieving a specific incident"""
        self.client.force_authenticate(user=self.staff_user)
        response = self.client.get(f"/api/v1/security-incidents/{self.incident.id}/")
        
        self.assertEqual(response.status_code, 200)
        data = response.json()
        self.assertEqual(data["title"], "API Test Incident")
        self.assertEqual(data["severity"], "HIGH")

    def test_api_filter_by_severity(self):
        """Test filtering incidents by severity"""
        # Create another incident with different severity
        SecurityIncident.objects.create(
            title="Low Severity Incident",
            severity=SecurityIncident.Severity.LOW,
            status=SecurityIncident.Status.OPEN,
            reporter=self.staff_user
        )
        
        self.client.force_authenticate(user=self.staff_user)
        response = self.client.get("/api/v1/security-incidents/?severity=HIGH")
        
        self.assertEqual(response.status_code, 200)
        data = response.json()
        self.assertEqual(len(data), 1)
        self.assertEqual(data[0]["severity"], "HIGH")

    def test_api_filter_by_status(self):
        """Test filtering incidents by status"""
        # Create resolved incident
        SecurityIncident.objects.create(
            title="Resolved Incident",
            severity=SecurityIncident.Severity.MEDIUM,
            status=SecurityIncident.Status.RESOLVED,
            reporter=self.staff_user
        )
        
        self.client.force_authenticate(user=self.staff_user)
        response = self.client.get("/api/v1/security-incidents/?status=RESOLVED")
        
        self.assertEqual(response.status_code, 200)
        data = response.json()
        self.assertEqual(len(data), 1)
        self.assertEqual(data[0]["status"], "RESOLVED")

    def test_api_create_incident(self):
        """Test creating an incident via API"""
        self.client.force_authenticate(user=self.staff_user)
        data = {
            "title": "API Created Incident",
            "severity": "CRITICAL",
            "status": "OPEN",
            "affected_systems": "api-server",
            "description": "Created via API"
        }
        response = self.client.post("/api/v1/security-incidents/", data)
        
        self.assertEqual(response.status_code, 201)
        self.assertEqual(SecurityIncident.objects.count(), 2)
        
        new_incident = SecurityIncident.objects.get(title="API Created Incident")
        self.assertEqual(new_incident.severity, SecurityIncident.Severity.CRITICAL)

    def test_api_update_incident(self):
        """Test updating an incident via API"""
        self.client.force_authenticate(user=self.staff_user)
        data = {
            "title": "Updated Title",
            "severity": "CRITICAL",
            "status": "INVESTIGATING",
            "affected_systems": "server1, server2",
            "description": "Updated via API"
        }
        response = self.client.put(
            f"/api/v1/security-incidents/{self.incident.id}/",
            data
        )
        
        self.assertEqual(response.status_code, 200)
        self.incident.refresh_from_db()
        self.assertEqual(self.incident.title, "Updated Title")
        self.assertEqual(self.incident.severity, SecurityIncident.Severity.CRITICAL)

    def test_api_delete_incident(self):
        """Test deleting an incident via API"""
        self.client.force_authenticate(user=self.staff_user)
        response = self.client.delete(f"/api/v1/security-incidents/{self.incident.id}/")
        
        self.assertEqual(response.status_code, 204)
        self.assertEqual(SecurityIncident.objects.count(), 0)

from django.test import TestCase

from website.models import SecurityIncident
from website.security_incident_form import SecurityIncidentForm


class SecurityIncidentFormTest(TestCase):
    """Test SecurityIncidentForm validation and cleaning"""

    def test_form_valid_data(self):
        """Test form with valid data"""
        data = {
            "title": "Test Incident",
            "severity": SecurityIncident.Severity.HIGH,
            "status": SecurityIncident.Status.OPEN,
            "affected_systems": "server1, server2",
            "description": "Test description"
        }
        form = SecurityIncidentForm(data=data)
        self.assertTrue(form.is_valid())

    def test_form_missing_required_fields(self):
        """Test form validation with missing required fields"""
        data = {
            "severity": SecurityIncident.Severity.HIGH,
            # Missing title
        }
        form = SecurityIncidentForm(data=data)
        self.assertFalse(form.is_valid())
        self.assertIn("title", form.errors)

    def test_clean_affected_systems_strips_whitespace(self):
        """Test that affected_systems cleaning strips whitespace"""
        data = {
            "title": "Test",
            "severity": SecurityIncident.Severity.MEDIUM,
            "status": SecurityIncident.Status.OPEN,
            "affected_systems": "  server1, server2  ",
            "description": "Test"
        }
        form = SecurityIncidentForm(data=data)
        self.assertTrue(form.is_valid())
        self.assertEqual(form.cleaned_data["affected_systems"], "server1, server2")

    def test_form_all_fields_present(self):
        """Test that form includes all expected fields"""
        form = SecurityIncidentForm()
        expected_fields = ["title", "severity", "status", "affected_systems", "description"]
        for field in expected_fields:
            self.assertIn(field, form.fields)

from django.contrib.auth import get_user_model
from django.core.cache import cache
from django.test import TestCase
from django.urls import reverse

from website.models import SecurityIncident
from website.views.security import _escape_csv_formula

User = get_user_model()


class CSVSanitizationTest(TestCase):
    """Test CSV formula injection mitigation"""

    def test_escape_leading_equals(self):
        """Test escaping leading = character"""
        result = _escape_csv_formula("=cmd")
        self.assertEqual(result, "'=cmd")

    def test_escape_leading_plus(self):
        """Test escaping leading + character"""
        result = _escape_csv_formula("+cmd")
        self.assertEqual(result, "'+cmd")

    def test_escape_leading_minus(self):
        """Test escaping leading - character"""
        result = _escape_csv_formula("-cmd")
        self.assertEqual(result, "'-cmd")

    def test_escape_leading_at(self):
        """Test escaping leading @ character"""
        result = _escape_csv_formula("@cmd")
        self.assertEqual(result, "'@cmd")

    def test_escape_leading_tab(self):
        """Test escaping leading tab character"""
        result = _escape_csv_formula("\tcmd")
        self.assertEqual(result, "'\tcmd")

    def test_escape_leading_carriage_return(self):
        """Test escaping leading CR character"""
        result = _escape_csv_formula("\rcmd")
        self.assertEqual(result, "'\rcmd")

    def test_escape_leading_line_feed(self):
        """Test escaping leading LF character"""
        result = _escape_csv_formula("\ncmd")
        self.assertEqual(result, "'\ncmd")

    def test_whitespace_bypass_prevention(self):
        """Test that leading whitespace is stripped before checking"""
        result = _escape_csv_formula("  =cmd")
        self.assertEqual(result, "'=cmd")

    def test_safe_content_unchanged(self):
        """Test that safe content is not modified"""
        result = _escape_csv_formula("Safe content")
        self.assertEqual(result, "Safe content")

    def test_middle_formula_chars_unchanged(self):
        """Test that formula chars in middle are left unchanged (OWASP compliant)"""
        result = _escape_csv_formula("Safe=formula+here")
        self.assertEqual(result, "Safe=formula+here")

    def test_non_string_passthrough(self):
        """Test that non-string values pass through unchanged"""
        self.assertEqual(_escape_csv_formula(123), 123)
        self.assertEqual(_escape_csv_formula(None), None)

    def test_empty_string(self):
        """Test empty string handling"""
        result = _escape_csv_formula("")
        self.assertEqual(result, "")


class CSVExportTest(TestCase):
    """Test CSV export functionality"""

    def setUp(self):
        self.superuser = User.objects.create_superuser(
            username="admin",
            email="[email protected]",
            password="testpass123"
        )
        self.staff_user = User.objects.create_user(
            username="staffuser",
            email="[email protected]",
            password="testpass123",
            is_staff=True
        )
        
        SecurityIncident.objects.create(
            title="Test Incident",
            severity=SecurityIncident.Severity.HIGH,
            status=SecurityIncident.Status.OPEN,
            affected_systems="server1",
            reporter=self.superuser
        )

    def tearDown(self):
        # Clear rate limit cache between tests
        cache.clear()

    def test_csv_export_requires_superuser(self):
        """Test that CSV export requires superuser"""
        self.client.login(username="staffuser", password="testpass123")
        response = self.client.get(reverse("security_dashboard"), {"export": "csv"})
        self.assertEqual(response.status_code, 403)

    def test_csv_export_accessible_by_superuser(self):
        """Test that superusers can export CSV"""
        self.client.login(username="admin", password="testpass123")
        response = self.client.get(reverse("security_dashboard"), {"export": "csv"})
        
        self.assertEqual(response.status_code, 200)
        self.assertEqual(response["Content-Type"], "text/csv")
        self.assertIn("attachment", response["Content-Disposition"])

    def test_csv_export_content(self):
        """Test CSV export content structure"""
        self.client.login(username="admin", password="testpass123")
        response = self.client.get(reverse("security_dashboard"), {"export": "csv"})
        
        content = response.content.decode("utf-8")
        self.assertIn("ID", content)  # Header
        self.assertIn("Title", content)
        self.assertIn("Severity", content)
        self.assertIn("Test Incident", content)  # Data

    def test_csv_export_escapes_dangerous_content(self):
        """Test that CSV export sanitizes formula injection attempts"""
        SecurityIncident.objects.create(
            title="=cmd|'/c calc'!A1",
            severity=SecurityIncident.Severity.CRITICAL,
            status=SecurityIncident.Status.OPEN,
            affected_systems="=SUM(A1:A10)",
            reporter=self.superuser
        )
        
        self.client.login(username="admin", password="testpass123")
        response = self.client.get(reverse("security_dashboard"), {"export": "csv"})
        
        content = response.content.decode("utf-8")
        # Dangerous content should be escaped
        self.assertIn("'=cmd", content)
        self.assertIn("'=SUM", content)

    def test_csv_export_rate_limiting(self):
        """Test that CSV export is rate limited"""
        self.client.login(username="admin", password="testpass123")
        
        # Make multiple export requests
        for i in range(5):
            response = self.client.get(reverse("security_dashboard"), {"export": "csv"})
            self.assertEqual(response.status_code, 200)
        
        # 6th request should be rate limited
        response = self.client.get(reverse("security_dashboard"), {"export": "csv"})
        self.assertEqual(response.status_code, 429)  # Too Many Requests
        self.assertIn("rate limit", response.content.decode("utf-8").lower())

class UserLoginEvent(models.Model):
    """Track user login attempts and patterns"""
    user = models.ForeignKey(User, on_delete=models.CASCADE, related_name="login_events")
    login_time = models.DateTimeField(auto_now_add=True)
    ip_address = models.GenericIPAddressField()
    user_agent = models.TextField()
    location = models.CharField(max_length=100, blank=True)  # City, Country
    is_successful = models.BooleanField(default=True)
    is_suspicious = models.BooleanField(default=False)
    
    class Meta:
        ordering = ["-login_time"]
        indexes = [
            models.Index(fields=["user", "-login_time"]),
            models.Index(fields=["is_suspicious", "-login_time"]),
        ]

class UserAccessLog(models.Model):
    """Track access to sensitive resources"""
    user = models.ForeignKey(User, on_delete=models.CASCADE, related_name="access_logs")
    resource_type = models.CharField(max_length=50)  # issue, domain, bounty, security_incident
    resource_id = models.IntegerField()
    action = models.CharField(max_length=50)  # view, edit, delete, export
    timestamp = models.DateTimeField(auto_now_add=True)
    ip_address = models.GenericIPAddressField()
    
    class Meta:
        ordering = ["-timestamp"]
        indexes = [
            models.Index(fields=["user", "-timestamp"]),
            models.Index(fields=["resource_type", "resource_id"]),
        ]

from django.contrib.auth.signals import user_logged_in, user_login_failed
from django.dispatch import receiver
from website.models import UserLoginEvent

@receiver(user_logged_in)
def log_successful_login(sender, request, user, **kwargs):
    """Log successful login event"""
    UserLoginEvent.objects.create(
        user=user,
        ip_address=get_client_ip(request),
        user_agent=request.META.get("HTTP_USER_AGENT", "")[:500],
        is_successful=True,
        is_suspicious=detect_suspicious_login(user, request)
    )

@receiver(user_login_failed)
def log_failed_login(sender, credentials, request, **kwargs):
    """Log failed login attempt"""
    # Implementation...

def detect_suspicious_login(user, request):
    """Basic anomaly detection"""
    # Check for:
    # - New IP address
    # - Unusual time of day
    # - Multiple failed attempts
    # - Different geolocation
    return False  # Placeholder

def ready(self):
    import website.signals.user_behavior_signals  # noqa

# Add to SecurityDashboardView.get_context_data()

# User Behavior Analytics section
recent_logins = UserLoginEvent.objects.filter(
    is_suspicious=True
).select_related("user").order_by("-login_time")[:10]

failed_login_count = UserLoginEvent.objects.filter(
    is_successful=False,
    login_time__gte=timezone.now() - timedelta(days=7)
).count()

context.update({
    "suspicious_logins": recent_logins,
    "failed_login_count": failed_login_count,
    "top_active_users": get_top_active_users(),  # New helper
})

class UserLoginEventViewSet(viewsets.ReadOnlyModelViewSet):
    """API for user login events"""
    authentication_classes = [SessionAuthentication, TokenAuthentication]
    serializer_class = UserLoginEventSerializer
    permission_classes = [IsAdminUser]
    
    def get_queryset(self):
        queryset = UserLoginEvent.objects.select_related("user")
        if self.request.query_params.get("suspicious") == "true":
            queryset = queryset.filter(is_suspicious=True)
        return queryset.order_by("-login_time")

class UserLoginEventSerializer(serializers.ModelSerializer):
    username = serializers.CharField(source="user.username", read_only=True)
    
    class Meta:
        model = UserLoginEvent
        fields = ["id", "username", "login_time", "ip_address", "is_successful", "is_suspicious"]

router.register(r"user-login-events", UserLoginEventViewSet, basename="userloginevent")