/**
 * Weak Cryptography Test Fixtures
 * Tests for detecting insecure cryptographic algorithms and practices
 */

import type { TestGroup } from '../../types'

export const weakCryptoTests: TestGroup = {
  name: 'Weak Cryptography',
  tier: 'A',
  layer: 1,
  description: 'Detection of weak hash algorithms, insecure ciphers, and poor cryptographic practices',
  
  truePositives: [
    {
      name: 'Weak Crypto - True Positives',
      expectFindings: true,
      expectedCategories: ['weak_crypto'],
      description: 'Weak cryptographic patterns that MUST be detected',
      file: {
        path: 'src/utils/crypto.ts',
        content: `
import crypto from 'crypto'

// MD5 for passwords (Critical)
function hashPassword(password: string) {
  return crypto.createHash('md5').update(password).digest('hex')
}

// SHA1 for security tokens (High)
function generateToken(data: string) {
  return crypto.createHash('sha1').update(data).digest('hex')
}

// Weak ciphers (High)
function encryptData(data: string, key: string) {
  const cipher = crypto.createCipher('des', key)
  return cipher.update(data, 'utf8', 'hex') + cipher.final('hex')
}

// ECB mode (High - vulnerable to pattern analysis)
function encryptECB(data: string, key: Buffer) {
  const cipher = crypto.createCipheriv('aes-128-ecb', key, null)
  return cipher.update(data, 'utf8', 'hex') + cipher.final('hex')
}

// RC4 (Critical - broken)
function encryptRC4(data: string, key: string) {
  const cipher = crypto.createCipher('rc4', key)
  return cipher.update(data, 'utf8', 'hex')
}

// Math.random for security tokens (High)
function generateSecureToken() {
  return Math.random().toString(36).substring(2)
}

// Low PBKDF2 iterations (Medium)
function deriveKey(password: string, salt: Buffer) {
  return crypto.pbkdf2Sync(password, salt, 100, 32, 'sha256')
}

// Hardcoded IV (High)
const STATIC_IV = Buffer.from('1234567890123456')
function encryptWithStaticIV(data: string, key: Buffer) {
  const cipher = crypto.createCipheriv('aes-256-cbc', key, STATIC_IV)
  return cipher.update(data, 'utf8', 'hex') + cipher.final('hex')
}
`,
        language: 'typescript',
        size: 1500,
      },
    },
    {
      name: 'Weak Crypto - Insecure Password Hashing',
      expectFindings: true,
      expectedCategories: ['weak_crypto'],
      description: 'Weak password hashing implementations',
      file: {
        path: 'src/auth/password.ts',
        content: `
import crypto from 'crypto'
import bcrypt from 'bcrypt'

// MD5 password hash (Critical)
export function hashPasswordMD5(password: string): string {
  return crypto.createHash('md5').update(password).digest('hex')
}

// SHA1 password hash (High)
export function hashPasswordSHA1(password: string): string {
  return crypto.createHash('sha1').update(password).digest('hex')
}

// Bcrypt with low rounds (Medium)
export async function hashPasswordWeakBcrypt(password: string): Promise<string> {
  return bcrypt.hash(password, 4) // Should be at least 10
}

// Unsalted hash (High)
export function hashPasswordUnsalted(password: string): string {
  return crypto.createHash('sha256').update(password).digest('hex')
}
`,
        language: 'typescript',
        size: 700,
      },
    },
  ],
  
  falseNegatives: [
    {
      name: 'Weak Crypto - False Negatives',
      expectFindings: false,
      description: 'Secure cryptographic patterns that should NOT be flagged',
      file: {
        path: 'src/utils/secure-crypto.ts',
        content: `
import crypto from 'crypto'

// MD5 for checksums (not security) - SAFE
function generateChecksum(data: Buffer) {
  return crypto.createHash('md5').update(data).digest('hex')
}

// SHA256 for passwords - SAFE
function hashPasswordSecurely(password: string, salt: string) {
  return crypto.createHash('sha256').update(password + salt).digest('hex')
}

// AES-256-GCM - SAFE
function encryptSecurely(data: string, key: Buffer) {
  const iv = crypto.randomBytes(16)
  const cipher = crypto.createCipheriv('aes-256-gcm', key, iv)
  const encrypted = cipher.update(data, 'utf8', 'hex') + cipher.final('hex')
  const tag = cipher.getAuthTag()
  return { encrypted, iv, tag }
}

// crypto.randomBytes for tokens - SAFE
function generateSecureToken() {
  return crypto.randomBytes(32).toString('hex')
}

// High PBKDF2 iterations - SAFE
function deriveKeySecurely(password: string, salt: Buffer) {
  return crypto.pbkdf2Sync(password, salt, 100000, 32, 'sha256')
}

// Random IV per encryption - SAFE
function encryptWithRandomIV(data: string, key: Buffer) {
  const iv = crypto.randomBytes(16)
  const cipher = crypto.createCipheriv('aes-256-cbc', key, iv)
  return { encrypted: cipher.update(data, 'utf8', 'hex') + cipher.final('hex'), iv }
}
`,
        language: 'typescript',
        size: 1200,
      },
    },
    {
      name: 'Weak Crypto - MD5 for Checksums',
      expectFindings: false,
      description: 'MD5 used for non-security checksums should not be flagged',
      file: {
        path: 'src/utils/checksum.ts',
        content: `
import crypto from 'crypto'
import fs from 'fs'

// MD5 checksum for file integrity (not security) - SAFE
export function getFileChecksum(filePath: string): string {
  const content = fs.readFileSync(filePath)
  return crypto.createHash('md5').update(content).digest('hex')
}

// MD5 for etag generation - SAFE
export function generateEtag(content: string): string {
  return crypto.createHash('md5').update(content).digest('hex')
}

// MD5 for content fingerprint - SAFE
export function contentFingerprint(data: Buffer): string {
  return crypto.createHash('md5').update(data).digest('hex')
}

// MD5 for cache key - SAFE
export function cacheKey(input: string): string {
  return 'cache_' + crypto.createHash('md5').update(input).digest('hex')
}
`,
        language: 'typescript',
        size: 600,
      },
    },
  ],
}
