/**
 * Security Headers Test Fixtures
 * Tests for detecting missing HTTP security headers
 */

import type { TestGroup } from '../../types'

export const securityHeadersTests: TestGroup = {
  name: 'Security Headers',
  tier: 'B',
  layer: 2,
  description: 'Detection of missing HTTP security headers (CSP, HSTS, helmet, etc.)',

  truePositives: [
    {
      name: 'Security Headers - True Positives',
      expectFindings: true,
      expectedCategories: ['missing_security_headers'],
      description: 'Missing security header patterns that MUST be detected',
      file: {
        path: 'src/server/app.ts',
        content: `
import express from 'express'

// Express app without helmet middleware
const app = express()

app.use(express.json())

app.get('/api/data', (req, res) => {
  res.json({ status: 'ok' })
})

app.listen(3000, () => {
  console.log('Server running')
})
`,
        language: 'typescript',
        size: 250,
      },
    },
    {
      name: 'Security Headers - Helmet CSP Disabled',
      expectFindings: true,
      expectedCategories: ['missing_security_headers'],
      description: 'Helmet with CSP explicitly disabled',
      file: {
        path: 'src/server/secure-app.ts',
        content: `
import express from 'express'
import helmet from 'helmet'

const app = express()

// CSP disabled - this weakens security
app.use(helmet({
  contentSecurityPolicy: false,
}))

app.get('/api/data', (req, res) => {
  res.json({ status: 'ok' })
})
`,
        language: 'typescript',
        size: 250,
      },
    },
    {
      name: 'Security Headers - Next.js Config Missing Headers',
      expectFindings: true,
      expectedCategories: ['missing_security_headers'],
      description: 'Next.js config without headers export',
      file: {
        path: 'next.config.mjs',
        content: `
/** @type {import('next').NextConfig} */
const nextConfig = {
  reactStrictMode: true,
  images: {
    remotePatterns: [
      { hostname: 'example.com' },
    ],
  },
}

export default nextConfig
`,
        language: 'javascript',
        size: 200,
      },
    },
  ],

  falseNegatives: [
    {
      name: 'Security Headers - Express with Helmet (safe)',
      expectFindings: false,
      description: 'Express app WITH helmet properly configured should not be flagged',
      file: {
        path: 'src/server/safe-app.ts',
        content: `
import express from 'express'
import helmet from 'helmet'

const app = express()

app.use(helmet())
app.use(express.json())

app.get('/api/data', (req, res) => {
  res.json({ status: 'ok' })
})
`,
        language: 'typescript',
        size: 200,
      },
    },
    {
      name: 'Security Headers - Next.js Config with Headers',
      expectFindings: false,
      description: 'Next.js config WITH headers export should not be flagged',
      file: {
        path: 'next.config.mjs',
        content: `
/** @type {import('next').NextConfig} */
const nextConfig = {
  reactStrictMode: true,
  async headers() {
    return [
      {
        source: '/:path*',
        headers: [
          { key: 'X-Frame-Options', value: 'DENY' },
          { key: 'X-Content-Type-Options', value: 'nosniff' },
          { key: 'Strict-Transport-Security', value: 'max-age=31536000; includeSubDomains' },
        ],
      },
    ]
  },
}

export default nextConfig
`,
        language: 'javascript',
        size: 400,
      },
    },
    {
      name: 'Security Headers - Client Component (not server)',
      expectFindings: false,
      description: 'Client-side React component should not be checked for server headers',
      file: {
        path: 'src/components/Button.tsx',
        content: `
'use client'

import { useState } from 'react'

export function Button({ children, onClick }) {
  const [loading, setLoading] = useState(false)

  return (
    <button onClick={onClick} disabled={loading}>
      {children}
    </button>
  )
}
`,
        language: 'typescript',
        size: 200,
      },
    },
    {
      name: 'Security Headers - Fastify Helmet (safe)',
      expectFindings: false,
      description: 'Express app with @fastify/helmet should not be flagged',
      file: {
        path: 'src/server/fastify-app.ts',
        content: `
import express from 'express'
import helmet from '@fastify/helmet'

const app = express()

app.use(helmet())
app.use(express.json())

app.get('/api/data', (req, res) => {
  res.json({ ok: true })
})
`,
        language: 'typescript',
        size: 200,
      },
    },
  ],
}
