/**
 * Tests for Framework-Aware Fix Suggestions (PRO-83)
 */

import {
  FRAMEWORK_FIX_REGISTRY,
  getFrameworkFix,
} from '../framework-fixes'
import type { FrameworkContext, DataAccessContext } from '../../utils/project-context-builder'
import type { VulnerabilityCategory } from '../../types'

// Helper to create a minimal FrameworkContext
function createFrameworkContext(overrides: Partial<FrameworkContext> = {}): FrameworkContext {
  return {
    primary: undefined,
    frontend: undefined,
    isMonorepo: false,
    usesTypeScript: false,
    usesServerComponents: false,
    usesServerActions: false,
    ...overrides,
  }
}

// Helper to create a minimal DataAccessContext
function createDataAccessContext(overrides: Partial<DataAccessContext> = {}): DataAccessContext {
  return {
    usesParameterizedQueries: false,
    hasRLS: false,
    ...overrides,
  }
}

describe('Framework-Aware Fix Suggestions', () => {
  describe('FRAMEWORK_FIX_REGISTRY coverage', () => {
    it('should have sql_injection fixes for major ORMs', () => {
      const sqlFixes = FRAMEWORK_FIX_REGISTRY.sql_injection
      expect(sqlFixes).toBeDefined()

      expect(sqlFixes!.prisma).toBeDefined()
      expect(sqlFixes!.drizzle).toBeDefined()
      expect(sqlFixes!.supabase).toBeDefined()
      expect(sqlFixes!.mongoose).toBeDefined()
      expect(sqlFixes!.knex).toBeDefined()
    })

    it('should have missing_auth fixes for backend frameworks', () => {
      const authFixes = FRAMEWORK_FIX_REGISTRY.missing_auth
      expect(authFixes).toBeDefined()

      expect(authFixes!.nextjs).toBeDefined()
      expect(authFixes!.express).toBeDefined()
      expect(authFixes!.fastify).toBeDefined()
      expect(authFixes!.nestjs).toBeDefined()
    })

    it('should have xss fixes for frontend frameworks', () => {
      const xssFixes = FRAMEWORK_FIX_REGISTRY.xss
      expect(xssFixes).toBeDefined()

      expect(xssFixes!.react).toBeDefined()
      expect(xssFixes!.vue).toBeDefined()
    })

    it('should have hardcoded_secret fixes for common frameworks', () => {
      const secretFixes = FRAMEWORK_FIX_REGISTRY.hardcoded_secret
      expect(secretFixes).toBeDefined()

      expect(secretFixes!.nextjs).toBeDefined()
      expect(secretFixes!.express).toBeDefined()
    })

    it('should have cors_misconfiguration fixes', () => {
      const corsFixes = FRAMEWORK_FIX_REGISTRY.cors_misconfiguration
      expect(corsFixes).toBeDefined()

      expect(corsFixes!.nextjs).toBeDefined()
      expect(corsFixes!.express).toBeDefined()
      expect(corsFixes!.fastify).toBeDefined()
    })

    it('should have dangerous_function fixes for frontend frameworks', () => {
      const dangerousFixes = FRAMEWORK_FIX_REGISTRY.dangerous_function
      expect(dangerousFixes).toBeDefined()

      expect(dangerousFixes!.react).toBeDefined()
      expect(dangerousFixes!.vue).toBeDefined()
    })
  })

  describe('Fix content quality', () => {
    it('all fixes should have non-empty fixSteps', () => {
      for (const [_category, frameworkFixes] of Object.entries(FRAMEWORK_FIX_REGISTRY)) {
        for (const [_framework, fix] of Object.entries(frameworkFixes || {})) {
          expect(fix.fixSteps).toBeDefined()
          expect(Array.isArray(fix.fixSteps)).toBe(true)
          expect(fix.fixSteps.length).toBeGreaterThan(0)

          // Each step should be meaningful (at least 10 characters)
          for (const step of fix.fixSteps) {
            expect(step.length).toBeGreaterThan(10)
          }
        }
      }
    })

    it('code examples should be present for key fixes', () => {
      // SQL injection fixes should have code examples
      const sqlFixes = FRAMEWORK_FIX_REGISTRY.sql_injection
      expect(sqlFixes!.prisma!.codeExample).toBeDefined()
      expect(sqlFixes!.drizzle!.codeExample).toBeDefined()
      expect(sqlFixes!.supabase!.codeExample).toBeDefined()
      expect(sqlFixes!.mongoose!.codeExample).toBeDefined()
      expect(sqlFixes!.knex!.codeExample).toBeDefined()

      // Auth fixes should have code examples
      const authFixes = FRAMEWORK_FIX_REGISTRY.missing_auth
      expect(authFixes!.nextjs!.codeExample).toBeDefined()
      expect(authFixes!.express!.codeExample).toBeDefined()
      expect(authFixes!.fastify!.codeExample).toBeDefined()
      expect(authFixes!.nestjs!.codeExample).toBeDefined()

      // XSS fixes should have code examples
      const xssFixes = FRAMEWORK_FIX_REGISTRY.xss
      expect(xssFixes!.react!.codeExample).toBeDefined()
      expect(xssFixes!.vue!.codeExample).toBeDefined()

      // CORS fixes should have code examples
      const corsFixes = FRAMEWORK_FIX_REGISTRY.cors_misconfiguration
      expect(corsFixes!.nextjs!.codeExample).toBeDefined()
      expect(corsFixes!.express!.codeExample).toBeDefined()
      expect(corsFixes!.fastify!.codeExample).toBeDefined()
    })

    it('fix steps should be actionable (start with verbs)', () => {
      for (const [_category, frameworkFixes] of Object.entries(FRAMEWORK_FIX_REGISTRY)) {
        for (const [_framework, fix] of Object.entries(frameworkFixes || {})) {
          for (const step of fix.fixSteps) {
            // Each step should start with a capital letter (typically a verb)
            expect(step[0]).toBe(step[0].toUpperCase())
          }
        }
      }
    })

    it('code examples should contain actual code patterns', () => {
      // Prisma examples should reference prisma client
      expect(FRAMEWORK_FIX_REGISTRY.sql_injection!.prisma!.codeExample).toMatch(/prisma\./i)

      // React examples should reference JSX or React patterns
      expect(FRAMEWORK_FIX_REGISTRY.xss!.react!.codeExample).toMatch(/dangerouslySetInnerHTML|<div>|DOMPurify/i)

      // Express examples should reference middleware patterns
      expect(FRAMEWORK_FIX_REGISTRY.missing_auth!.express!.codeExample).toMatch(/middleware|req|res|next/i)
    })

    it('fix steps should mention framework-specific concepts', () => {
      // Prisma fixes should mention Prisma-specific concepts
      const prismaFix = FRAMEWORK_FIX_REGISTRY.sql_injection!.prisma!
      const prismaText = prismaFix.fixSteps.join(' ')
      expect(prismaText).toMatch(/\$queryRaw|findUnique|Prisma/i)

      // Next.js auth fixes should mention middleware.ts
      const nextAuthFix = FRAMEWORK_FIX_REGISTRY.missing_auth!.nextjs!
      const nextAuthText = nextAuthFix.fixSteps.join(' ')
      expect(nextAuthText).toMatch(/middleware\.ts|auth\(\)|getServerSession/i)

      // React XSS fixes should mention JSX auto-escaping
      const reactXssFix = FRAMEWORK_FIX_REGISTRY.xss!.react!
      const reactXssText = reactXssFix.fixSteps.join(' ')
      expect(reactXssText).toMatch(/JSX|auto-escape|dangerouslySetInnerHTML/i)
    })
  })

  describe('getFrameworkFix', () => {
    describe('ORM priority for sql_injection', () => {
      it('should return Prisma fix when Prisma is detected', () => {
        const frameworks = createFrameworkContext({ primary: 'nextjs', frontend: 'react' })
        const dataAccess = createDataAccessContext({ orm: 'prisma' })

        const fix = getFrameworkFix('sql_injection', frameworks, dataAccess)

        expect(fix).toBeDefined()
        expect(fix!.fixSteps[0]).toContain('Prisma')
      })

      it('should return Drizzle fix when Drizzle is detected', () => {
        const frameworks = createFrameworkContext({ primary: 'nextjs' })
        const dataAccess = createDataAccessContext({ orm: 'drizzle' })

        const fix = getFrameworkFix('sql_injection', frameworks, dataAccess)

        expect(fix).toBeDefined()
        expect(fix!.fixSteps[0]).toContain('Drizzle')
      })

      it('should return Supabase fix when Supabase is detected', () => {
        const frameworks = createFrameworkContext({ primary: 'nextjs' })
        const dataAccess = createDataAccessContext({ orm: 'supabase', hasRLS: true })

        const fix = getFrameworkFix('sql_injection', frameworks, dataAccess)

        expect(fix).toBeDefined()
        expect(fix!.fixSteps[0]).toContain('Supabase')
      })

      it('should return Mongoose fix when Mongoose is detected', () => {
        const frameworks = createFrameworkContext({ primary: 'express' })
        const dataAccess = createDataAccessContext({ orm: 'mongoose' })

        const fix = getFrameworkFix('sql_injection', frameworks, dataAccess)

        expect(fix).toBeDefined()
        expect(fix!.fixSteps[0]).toContain('Mongoose')
      })

      it('should return Knex fix when Knex is detected', () => {
        const frameworks = createFrameworkContext({ primary: 'express' })
        const dataAccess = createDataAccessContext({ orm: 'knex' })

        const fix = getFrameworkFix('sql_injection', frameworks, dataAccess)

        expect(fix).toBeDefined()
        expect(fix!.fixSteps[0]).toContain('Knex')
      })
    })

    describe('frontend framework priority for XSS', () => {
      it('should return React fix for xss when React is detected', () => {
        const frameworks = createFrameworkContext({ primary: 'nextjs', frontend: 'react' })

        const fix = getFrameworkFix('xss', frameworks)

        expect(fix).toBeDefined()
        expect(fix!.fixSteps[0]).toContain('JSX')
      })

      it('should return Vue fix for xss when Vue is detected', () => {
        const frameworks = createFrameworkContext({ primary: 'express', frontend: 'vue' })

        const fix = getFrameworkFix('xss', frameworks)

        expect(fix).toBeDefined()
        expect(fix!.fixSteps[0]).toContain('v-text')
      })

      it('should return React fix for dangerous_function when React is detected', () => {
        const frameworks = createFrameworkContext({ frontend: 'react' })

        const fix = getFrameworkFix('dangerous_function', frameworks)

        expect(fix).toBeDefined()
        expect(fix!.fixSteps[0]).toContain('innerHTML')
      })

      it('should return Vue fix for dangerous_function when Vue is detected', () => {
        const frameworks = createFrameworkContext({ frontend: 'vue' })

        const fix = getFrameworkFix('dangerous_function', frameworks)

        expect(fix).toBeDefined()
        expect(fix!.fixSteps[0]).toContain('Vue')
      })
    })

    describe('backend framework fixes', () => {
      it('should return Next.js fix for missing_auth', () => {
        const frameworks = createFrameworkContext({ primary: 'nextjs', frontend: 'react' })

        const fix = getFrameworkFix('missing_auth', frameworks)

        expect(fix).toBeDefined()
        expect(fix!.fixSteps[0]).toContain('middleware.ts')
      })

      it('should return Express fix for missing_auth', () => {
        const frameworks = createFrameworkContext({ primary: 'express' })

        const fix = getFrameworkFix('missing_auth', frameworks)

        expect(fix).toBeDefined()
        expect(fix!.fixSteps[0]).toContain('middleware')
      })

      it('should return Fastify fix for missing_auth', () => {
        const frameworks = createFrameworkContext({ primary: 'fastify' })

        const fix = getFrameworkFix('missing_auth', frameworks)

        expect(fix).toBeDefined()
        expect(fix!.fixSteps[0]).toContain('@fastify')
      })

      it('should return NestJS fix for missing_auth', () => {
        const frameworks = createFrameworkContext({ primary: 'nestjs' })

        const fix = getFrameworkFix('missing_auth', frameworks)

        expect(fix).toBeDefined()
        expect(fix!.fixSteps[0]).toContain('@nestjs')
      })

      it('should return Next.js fix for hardcoded_secret', () => {
        const frameworks = createFrameworkContext({ primary: 'nextjs' })

        const fix = getFrameworkFix('hardcoded_secret', frameworks)

        expect(fix).toBeDefined()
        expect(fix!.fixSteps[0]).toContain('.env.local')
      })

      it('should return Express fix for hardcoded_secret', () => {
        const frameworks = createFrameworkContext({ primary: 'express' })

        const fix = getFrameworkFix('hardcoded_secret', frameworks)

        expect(fix).toBeDefined()
        expect(fix!.fixSteps[0]).toContain('dotenv')
      })

      it('should return Next.js fix for cors_misconfiguration', () => {
        const frameworks = createFrameworkContext({ primary: 'nextjs' })

        const fix = getFrameworkFix('cors_misconfiguration', frameworks)

        expect(fix).toBeDefined()
        expect(fix!.fixSteps[0]).toContain('next.config')
      })

      it('should return Express fix for cors_misconfiguration', () => {
        const frameworks = createFrameworkContext({ primary: 'express' })

        const fix = getFrameworkFix('cors_misconfiguration', frameworks)

        expect(fix).toBeDefined()
        expect(fix!.fixSteps[0]).toContain('cors')
      })

      it('should return Fastify fix for cors_misconfiguration', () => {
        const frameworks = createFrameworkContext({ primary: 'fastify' })

        const fix = getFrameworkFix('cors_misconfiguration', frameworks)

        expect(fix).toBeDefined()
        expect(fix!.fixSteps[0]).toContain('@fastify/cors')
      })
    })

    describe('fallback behavior', () => {
      it('should return undefined for categories without framework fixes', () => {
        const frameworks = createFrameworkContext({ primary: 'nextjs' })

        // These categories have no framework-specific fixes
        const categoriesWithoutFixes: VulnerabilityCategory[] = [
          'suspicious_package',
          'root_container',
          'weak_crypto',
          'command_injection',
          'security_bypass',
          'insecure_config',
          'high_entropy_string',
          'sensitive_variable',
          'dangerous_file',
          'data_exposure',
          'ai_pattern',
          'ai_prompt_injection',
          'ai_unsafe_execution',
          'ai_overpermissive_tool',
          'ai_rag_exfiltration',
          'ai_endpoint_unprotected',
          'ai_schema_mismatch',
        ]

        for (const category of categoriesWithoutFixes) {
          const fix = getFrameworkFix(category, frameworks)
          expect(fix).toBeUndefined()
        }
      })

      it('should return undefined when no framework is detected', () => {
        const frameworks = createFrameworkContext() // All undefined

        const fix = getFrameworkFix('missing_auth', frameworks)

        expect(fix).toBeUndefined()
      })

      it('should return undefined when framework has no fix for category', () => {
        const frameworks = createFrameworkContext({ primary: 'nestjs' })

        // NestJS has missing_auth fix but no hardcoded_secret fix
        const fix = getFrameworkFix('hardcoded_secret', frameworks)

        expect(fix).toBeUndefined()
      })

      it('should return undefined for sql_injection when ORM has no fix', () => {
        const frameworks = createFrameworkContext({ primary: 'express' })
        const dataAccess = createDataAccessContext({ orm: 'sequelize' }) // Not in registry

        const fix = getFrameworkFix('sql_injection', frameworks, dataAccess)

        expect(fix).toBeUndefined()
      })

      it('should return undefined for sql_injection when no ORM detected', () => {
        const frameworks = createFrameworkContext({ primary: 'express' })
        const dataAccess = createDataAccessContext({ orm: undefined })

        const fix = getFrameworkFix('sql_injection', frameworks, dataAccess)

        expect(fix).toBeUndefined()
      })

      it('should return undefined for sql_injection when raw_sql is detected', () => {
        const frameworks = createFrameworkContext({ primary: 'express' })
        const dataAccess = createDataAccessContext({ orm: 'raw_sql' })

        const fix = getFrameworkFix('sql_injection', frameworks, dataAccess)

        // raw_sql is not in the registry (no framework-specific fix)
        expect(fix).toBeUndefined()
      })
    })

    describe('priority ordering', () => {
      it('should prioritize ORM over backend framework for sql_injection', () => {
        const frameworks = createFrameworkContext({ primary: 'express' }) // Express has no sql_injection fix
        const dataAccess = createDataAccessContext({ orm: 'prisma' }) // Prisma has sql_injection fix

        const fix = getFrameworkFix('sql_injection', frameworks, dataAccess)

        // Should return Prisma fix, not undefined/fallback
        expect(fix).toBeDefined()
        expect(fix!.fixSteps[0]).toContain('Prisma')
      })

      it('should prioritize frontend framework for xss over backend', () => {
        const frameworks = createFrameworkContext({ primary: 'express', frontend: 'react' })

        const fix = getFrameworkFix('xss', frameworks)

        // Should return React fix since frontend takes priority for XSS
        expect(fix).toBeDefined()
        expect(fix!.fixSteps[0]).toContain('JSX')
      })

      it('should use backend framework when no frontend detected for xss', () => {
        const frameworks = createFrameworkContext({ primary: 'express', frontend: undefined })

        const fix = getFrameworkFix('xss', frameworks)

        // Express has no XSS fix, so should return undefined
        expect(fix).toBeUndefined()
      })

      it('should prioritize frontend for dangerous_function over backend', () => {
        const frameworks = createFrameworkContext({ primary: 'nextjs', frontend: 'vue' })

        const fix = getFrameworkFix('dangerous_function', frameworks)

        // Should return Vue fix since frontend takes priority
        expect(fix).toBeDefined()
        expect(fix!.fixSteps[0]).toContain('Vue')
      })
    })

    describe('edge cases', () => {
      it('should handle empty dataAccess object', () => {
        const frameworks = createFrameworkContext({ primary: 'nextjs' })
        const dataAccess = createDataAccessContext()

        const fix = getFrameworkFix('sql_injection', frameworks, dataAccess)

        // No ORM specified, should return undefined
        expect(fix).toBeUndefined()
      })

      it('should handle undefined dataAccess', () => {
        const frameworks = createFrameworkContext({ primary: 'nextjs' })

        const fix = getFrameworkFix('sql_injection', frameworks, undefined)

        // No dataAccess at all, should return undefined
        expect(fix).toBeUndefined()
      })

      it('should handle unknown ORM type gracefully', () => {
        const frameworks = createFrameworkContext({ primary: 'express' })
        const dataAccess = createDataAccessContext({ orm: 'typeorm' as any }) // Not in registry

        const fix = getFrameworkFix('sql_injection', frameworks, dataAccess)

        expect(fix).toBeUndefined()
      })

      it('should handle unknown framework type gracefully', () => {
        const frameworks = createFrameworkContext({ primary: 'django' as any }) // Not in registry

        const fix = getFrameworkFix('missing_auth', frameworks)

        expect(fix).toBeUndefined()
      })

      it('should handle unknown frontend framework gracefully', () => {
        const frameworks = createFrameworkContext({ frontend: 'svelte' as any }) // Not in XSS registry

        const fix = getFrameworkFix('xss', frameworks)

        expect(fix).toBeUndefined()
      })

      it('should work with only frontend defined (no primary)', () => {
        const frameworks = createFrameworkContext({ frontend: 'react' })

        const fix = getFrameworkFix('xss', frameworks)

        expect(fix).toBeDefined()
        expect(fix!.fixSteps[0]).toContain('JSX')
      })

      it('should work with only ORM defined (no frameworks)', () => {
        const frameworks = createFrameworkContext()
        const dataAccess = createDataAccessContext({ orm: 'prisma' })

        const fix = getFrameworkFix('sql_injection', frameworks, dataAccess)

        expect(fix).toBeDefined()
        expect(fix!.fixSteps[0]).toContain('Prisma')
      })

      it('should not throw on invalid category', () => {
        const frameworks = createFrameworkContext({ primary: 'nextjs' })

        // @ts-expect-error - testing invalid input
        const fix = getFrameworkFix('invalid_category', frameworks)

        expect(fix).toBeUndefined()
      })

      it('should handle category that exists in registry but has no matching framework', () => {
        // hardcoded_secret has nextjs and express, but not fastify
        const frameworks = createFrameworkContext({ primary: 'fastify' })

        const fix = getFrameworkFix('hardcoded_secret', frameworks)

        expect(fix).toBeUndefined()
      })
    })

    describe('real-world scenarios', () => {
      it('Next.js + Prisma + React stack', () => {
        const frameworks = createFrameworkContext({
          primary: 'nextjs',
          frontend: 'react',
          usesTypeScript: true,
          usesServerComponents: true,
        })
        const dataAccess = createDataAccessContext({
          orm: 'prisma',
          usesParameterizedQueries: true,
        })

        // SQL injection should use Prisma fix
        const sqlFix = getFrameworkFix('sql_injection', frameworks, dataAccess)
        expect(sqlFix).toBeDefined()
        expect(sqlFix!.fixSteps[0]).toContain('Prisma')

        // XSS should use React fix
        const xssFix = getFrameworkFix('xss', frameworks)
        expect(xssFix).toBeDefined()
        expect(xssFix!.fixSteps[0]).toContain('JSX')

        // Auth should use Next.js fix
        const authFix = getFrameworkFix('missing_auth', frameworks)
        expect(authFix).toBeDefined()
        expect(authFix!.fixSteps[0]).toContain('middleware.ts')

        // Secrets should use Next.js fix
        const secretFix = getFrameworkFix('hardcoded_secret', frameworks)
        expect(secretFix).toBeDefined()
        expect(secretFix!.fixSteps[0]).toContain('.env.local')
      })

      it('Express + Mongoose + Vue stack', () => {
        const frameworks = createFrameworkContext({
          primary: 'express',
          frontend: 'vue',
          usesTypeScript: false,
        })
        const dataAccess = createDataAccessContext({
          orm: 'mongoose',
          databaseType: 'mongodb',
        })

        // SQL injection should use Mongoose fix
        const sqlFix = getFrameworkFix('sql_injection', frameworks, dataAccess)
        expect(sqlFix).toBeDefined()
        expect(sqlFix!.fixSteps[0]).toContain('Mongoose')

        // XSS should use Vue fix
        const xssFix = getFrameworkFix('xss', frameworks)
        expect(xssFix).toBeDefined()
        expect(xssFix!.fixSteps[0]).toContain('v-text')

        // Auth should use Express fix
        const authFix = getFrameworkFix('missing_auth', frameworks)
        expect(authFix).toBeDefined()
        expect(authFix!.fixSteps[0]).toContain('middleware')

        // CORS should use Express fix
        const corsFix = getFrameworkFix('cors_misconfiguration', frameworks)
        expect(corsFix).toBeDefined()
        expect(corsFix!.fixSteps[0]).toContain('cors')
      })

      it('Supabase + Next.js stack with RLS', () => {
        const frameworks = createFrameworkContext({
          primary: 'nextjs',
          frontend: 'react',
        })
        const dataAccess = createDataAccessContext({
          orm: 'supabase',
          hasRLS: true,
          databaseType: 'postgres',
        })

        // SQL injection should use Supabase fix
        const sqlFix = getFrameworkFix('sql_injection', frameworks, dataAccess)
        expect(sqlFix).toBeDefined()
        expect(sqlFix!.fixSteps[0]).toContain('Supabase')
        // Supabase fix should mention RLS
        expect(sqlFix!.fixSteps.join(' ')).toContain('Row Level Security')
      })

      it('NestJS + TypeORM stack (partial coverage)', () => {
        const frameworks = createFrameworkContext({
          primary: 'nestjs',
          usesTypeScript: true,
        })
        const dataAccess = createDataAccessContext({
          orm: 'typeorm', // Not in registry
        })

        // SQL injection should return undefined (TypeORM not supported)
        const sqlFix = getFrameworkFix('sql_injection', frameworks, dataAccess)
        expect(sqlFix).toBeUndefined()

        // Auth should use NestJS fix
        const authFix = getFrameworkFix('missing_auth', frameworks)
        expect(authFix).toBeDefined()
        expect(authFix!.fixSteps[0]).toContain('@nestjs')

        // Secrets should return undefined (NestJS not supported)
        const secretFix = getFrameworkFix('hardcoded_secret', frameworks)
        expect(secretFix).toBeUndefined()
      })

      it('API-only backend (no frontend framework)', () => {
        const frameworks = createFrameworkContext({
          primary: 'fastify',
          frontend: undefined,
        })
        const dataAccess = createDataAccessContext({
          orm: 'drizzle',
        })

        // SQL injection should use Drizzle fix
        const sqlFix = getFrameworkFix('sql_injection', frameworks, dataAccess)
        expect(sqlFix).toBeDefined()
        expect(sqlFix!.fixSteps[0]).toContain('Drizzle')

        // XSS should return undefined (no frontend)
        const xssFix = getFrameworkFix('xss', frameworks)
        expect(xssFix).toBeUndefined()

        // Auth should use Fastify fix
        const authFix = getFrameworkFix('missing_auth', frameworks)
        expect(authFix).toBeDefined()
        expect(authFix!.fixSteps[0]).toContain('@fastify')

        // CORS should use Fastify fix
        const corsFix = getFrameworkFix('cors_misconfiguration', frameworks)
        expect(corsFix).toBeDefined()
        expect(corsFix!.fixSteps[0]).toContain('@fastify/cors')
      })
    })
  })
})
