/**
 * Log Injection Test Fixtures
 * Tests for detecting unsanitized user input in log statements
 */

import type { TestGroup } from '../../types'

export const logInjectionTests: TestGroup = {
  name: 'Log Injection',
  tier: 'B',
  layer: 2,
  description: 'Detection of log injection patterns where user input flows to log sinks',

  truePositives: [
    {
      name: 'Log Injection - True Positives',
      expectFindings: true,
      expectedCategories: ['log_injection'],
      description: 'Log injection patterns that MUST be detected',
      file: {
        path: 'src/api/login.ts',
        content: `
import express from 'express'
import winston from 'winston'

const app = express()
const logger = winston.createLogger()

// User input directly in log
app.post('/api/login', (req, res) => {
  console.log(\`Login attempt: \${req.body.username}\`)

  // Header in log (CRLF risk)
  logger.info({ ip: req.headers['x-forwarded-for'] })

  // Entire body logged
  console.log('Request:', req.body)

  // Query param in log
  winston.info(req.query.search)

  res.json({ success: true })
})
`,
        language: 'typescript',
        size: 400,
      },
    },
  ],

  falseNegatives: [
    {
      name: 'Log Injection - Error Object (safe)',
      expectFindings: false,
      description: 'Logging error objects is standard practice, not user input',
      file: {
        path: 'src/services/data.ts',
        content: `
export async function fetchData() {
  try {
    return await fetch('/api/data').then(r => r.json())
  } catch (err) {
    // Error object logging - standard practice
    console.error(err)
    console.error('Failed:', err)
    throw err
  }
}

export async function processItem(item: any) {
  try {
    return transform(item)
  } catch (error) {
    console.error(error.message)
    return null
  }
}
`,
        language: 'typescript',
        size: 300,
      },
    },
    {
      name: 'Log Injection - Static String (safe)',
      expectFindings: false,
      description: 'Static string logging is safe',
      file: {
        path: 'src/server/startup.ts',
        content: `
import winston from 'winston'

const logger = winston.createLogger()

export function startServer(port: number) {
  logger.info('Server started on port 3000')
  logger.info('Environment: production')
  console.log('Ready to accept connections')
}
`,
        language: 'typescript',
        size: 200,
      },
    },
    {
      name: 'Log Injection - Internal ID (safe)',
      expectFindings: false,
      description: 'Logging internal IDs is safe',
      file: {
        path: 'src/services/user.ts',
        content: `
const logger = require('pino')()

export function processUser(user: { id: string; name: string }) {
  logger.info({ userId: user.id })
  logger.info({ count: results.length })
  console.log('Processing user:', user.id)
}
`,
        language: 'typescript',
        size: 200,
      },
    },
    {
      name: 'Log Injection - Morgan Middleware (safe)',
      expectFindings: false,
      description: 'Morgan middleware is intentional request logging',
      file: {
        path: 'src/server/app.ts',
        content: `
import express from 'express'
import morgan from 'morgan'

const app = express()

// Intentional request logging middleware
app.use(morgan('combined'))

app.get('/api/data', (req, res) => {
  res.json({ ok: true })
})
`,
        language: 'typescript',
        size: 200,
      },
    },
  ],
}
