/**
 * Hardcoded Secrets Test Fixtures
 * Tests for detecting API keys, tokens, passwords, and other secrets in code
 */

import type { TestGroup } from '../../types'

export const hardcodedSecretsTests: TestGroup = {
  name: 'Hardcoded Secrets',
  tier: 'A',
  layer: 1,
  description: 'Detection of API keys, tokens, passwords, and other secrets hardcoded in source code',
  
  truePositives: [
    {
      name: 'Hardcoded Secrets - True Positives',
      expectFindings: true,
      expectedCategories: ['hardcoded_secret'],
      description: 'Various hardcoded secrets that MUST be detected',
      file: {
        path: 'src/config/secrets.ts',
        content: `
// AWS Credentials (Critical)
const AWS_ACCESS_KEY_ID = "AKIAIOSFODNN7EXAMPLE"
const AWS_SECRET_ACCESS_KEY = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"

// API Keys (Critical)
const OPENAI_API_KEY = "sk-proj-abc123def456ghi789jkl012mno345pqr678stu901vwx"
const ANTHROPIC_API_KEY = "sk-ant-api03-abcdefghijklmnopqrstuvwxyz0123456789"
const STRIPE_SECRET_KEY = "sk_live_51AbCdEfGhIjKlMnOpQrStUvWxYz0123456789"
const STRIPE_PUBLISHABLE_KEY = "pk_live_51AbCdEfGhIjKlMnOpQrStUvWxYz0123456789"

// GitHub Tokens (High)
const GITHUB_TOKEN = "ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
const GITHUB_PAT = "github_pat_11ABCDEFG_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

// Database Credentials (Critical)
const DATABASE_URL = "postgresql://admin:SuperSecret123!@prod-db.example.com:5432/production"
const MONGO_URI = "mongodb+srv://admin:password123@cluster0.mongodb.net/prod?retryWrites=true"
const REDIS_URL = "redis://:secretpassword@redis.example.com:6379"

// JWT Secrets (High)
const JWT_SECRET = "super_secret_jwt_signing_key_12345"
const SESSION_SECRET = "my-session-secret-dont-share"

// Private Keys (Critical)
const PRIVATE_KEY = \`-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEA0Z3VS5JJcds3xfn/ygWyF8PbnGy...
-----END RSA PRIVATE KEY-----\`

// Slack/Discord Webhooks (Medium)
const SLACK_WEBHOOK = "https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXXXXXXXXXXXXXXXXXX"
const DISCORD_WEBHOOK = "https://discord.com/api/webhooks/123456789012345678/abcdefghijklmnopqrstuvwxyz0123456789ABCDEFGHIJKLMNOP"

// SendGrid/Twilio (High)
const SENDGRID_API_KEY = "SG.xxxxxxxxxxxxxxxxxxxx.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
const TWILIO_AUTH_TOKEN = "12345678901234567890123456789012"
`,
        language: 'typescript',
        size: 2000,
      },
    },
    {
      name: 'Hardcoded Secrets - Cloud Provider Keys',
      expectFindings: true,
      expectedCategories: ['hardcoded_secret'],
      description: 'Cloud provider API keys and service account credentials',
      file: {
        path: 'src/config/cloud-keys.ts',
        content: `
// Google Cloud
const GCP_API_KEY = "AIzaSyDaGmWKa4JsXZ-HjGw7ISLn_3namBGewQe"
const GCP_SERVICE_ACCOUNT = {
  "type": "service_account",
  "project_id": "my-project",
  "private_key_id": "key123",
  "private_key": "-----BEGIN PRIVATE KEY-----\\nMIIEvQIBADANBg..."
}

// Azure
const AZURE_STORAGE_KEY = "DefaultEndpointsProtocol=https;AccountName=myaccount;AccountKey=abc123def456..."
const AZURE_CLIENT_SECRET = "~Ab1.cDeF2gHiJ3kLmN4oPqR5sTuV6wXyZ"

// DigitalOcean
const DO_API_TOKEN = "dop_v1_abc123def456ghi789jkl012mno345pqr678stu901"

// Cloudflare
const CF_API_KEY = "c2547eb745079dac9320b638f5e225cf483cc5cfdda41"
`,
        language: 'typescript',
        size: 800,
      },
    },
  ],
  
  falseNegatives: [
    {
      name: 'Hardcoded Secrets - False Negatives',
      expectFindings: false,
      description: 'Patterns that should NOT be flagged as hardcoded secrets',
      file: {
        path: 'src/config/config.ts',
        content: `
// Environment variables - SAFE
const API_KEY = process.env.API_KEY
const DATABASE_URL = process.env.DATABASE_URL
const JWT_SECRET = process.env.JWT_SECRET || ''

// Next.js public env vars - SAFE
const NEXT_PUBLIC_API_URL = process.env.NEXT_PUBLIC_API_URL

// Placeholder values - SAFE
const PLACEHOLDER_KEY = "your-api-key-here"
const EXAMPLE_SECRET = "<INSERT_SECRET>"
const TODO_KEY = "TODO: replace with real key"
const TEST_KEY = "test_key_not_real"

// Type definitions - SAFE
interface Config {
  apiKey: string
  secretKey: string
  jwtSecret: string
}

// Function parameters - SAFE
function authenticate(apiKey: string, secretKey: string) {
  return fetch('/api/auth', {
    headers: { 'Authorization': \`Bearer \${apiKey}\` }
  })
}

// Comments discussing secrets - SAFE (not actual secrets)
// The API key should be stored in AWS_SECRET_ACCESS_KEY
// Format: sk-ant-api03-xxxxx

// Documentation examples - SAFE
/*
 * Example usage:
 * const client = new Client({ apiKey: "sk-..." })
 */
`,
        language: 'typescript',
        size: 1000,
      },
    },
    {
      name: 'Hardcoded Secrets - Env File Template',
      expectFindings: false,
      description: '.env.example files should not be flagged',
      file: {
        path: '.env.example',
        content: `
# Database
DATABASE_URL=postgresql://user:password@localhost:5432/mydb

# API Keys (replace with your own)
OPENAI_API_KEY=sk-your-key-here
ANTHROPIC_API_KEY=sk-ant-your-key-here

# Auth
JWT_SECRET=generate-a-random-string-here
NEXTAUTH_SECRET=another-random-string

# Third party
STRIPE_SECRET_KEY=sk_test_your_key
STRIPE_PUBLISHABLE_KEY=pk_test_your_key
`,
        language: 'text',
        size: 400,
      },
    },
  ],
}
