/**
 * Auth Anti-Patterns Test Fixtures
 * Tests for detecting missing or weak authentication patterns
 */

import type { TestGroup } from '../../types'

export const authAntipatternsTests: TestGroup = {
  name: 'Auth Anti-Patterns',
  tier: 'B',
  layer: 2,
  description: 'Detection of missing or weak authentication patterns in API routes',
  
  truePositives: [
    {
      name: 'Auth Anti-Patterns - True Positives',
      expectFindings: true,
      expectedCategories: ['missing_auth'],
      description: 'Missing auth patterns that MUST be detected',
      file: {
        path: 'src/api/admin/route.ts',
        content: `
import { NextRequest, NextResponse } from 'next/server'
import { db } from '@/lib/db'

// No authentication on sensitive endpoint - HIGH
export async function GET(request: NextRequest) {
  // No auth check!
  const users = await db.user.findMany({
    include: { apiKeys: true }  // Exposing sensitive data
  })
  return NextResponse.json(users)
}

// No authentication on data mutation - CRITICAL
export async function POST(request: NextRequest) {
  // No auth check!
  const body = await request.json()
  await db.user.update({
    where: { id: body.userId },
    data: { role: 'admin' }  // Anyone can make themselves admin!
  })
  return NextResponse.json({ success: true })
}

// No authentication on delete - CRITICAL
export async function DELETE(request: NextRequest) {
  const { searchParams } = new URL(request.url)
  const userId = searchParams.get('userId')
  // No auth check!
  await db.user.delete({ where: { id: userId } })
  return NextResponse.json({ success: true })
}
`,
        language: 'typescript',
        size: 900,
      },
    },
    {
      name: 'Auth Anti-Patterns - IDOR Vulnerabilities',
      expectFindings: true,
      expectedCategories: ['missing_auth'],
      description: 'Insecure Direct Object Reference patterns',
      file: {
        path: 'src/api/users/[id]/route.ts',
        content: `
import { NextRequest, NextResponse } from 'next/server'
import { db } from '@/lib/db'

// IDOR - accessing any user's data without ownership check
export async function GET(
  request: NextRequest,
  { params }: { params: { id: string } }
) {
  // No check that current user owns this resource!
  const user = await db.user.findUnique({
    where: { id: params.id },
    include: { 
      apiKeys: true,
      sessions: true,
      billingInfo: true
    }
  })
  return NextResponse.json(user)
}

// IDOR - updating any user's data
export async function PUT(
  request: NextRequest,
  { params }: { params: { id: string } }
) {
  const body = await request.json()
  // No ownership verification!
  await db.user.update({
    where: { id: params.id },
    data: body
  })
  return NextResponse.json({ success: true })
}
`,
        language: 'typescript',
        size: 800,
      },
    },
  ],
  
  falseNegatives: [
    {
      name: 'Auth Anti-Patterns - False Negatives',
      expectFindings: false,
      description: 'Properly authenticated patterns that should NOT be flagged',
      file: {
        path: 'src/api/protected/route.ts',
        content: `
import { NextRequest, NextResponse } from 'next/server'
import { auth } from '@/lib/auth'
import { getCurrentUserId } from '@/lib/auth-helpers'
import { db } from '@/lib/db'

// Authenticated with session check - SAFE
export async function GET(request: NextRequest) {
  const session = await auth()
  if (!session?.user) {
    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
  }

  const userData = await db.user.findUnique({
    where: { id: session.user.id }
  })
  return NextResponse.json(userData)
}

// Using throwing auth helper - SAFE
export async function POST(request: NextRequest) {
  // This throws if not authenticated
  const userId = await getCurrentUserId()

  // userId is guaranteed to exist here
  const body = await request.json()
  await db.post.create({
    data: {
      ...body,
      authorId: userId
    }
  })
  return NextResponse.json({ success: true })
}

// Public health check - SAFE (intentionally public)
export async function HEAD() {
  return new Response(null, { status: 200 })
}
`,
        language: 'typescript',
        size: 1000,
      },
    },
  ],
}
