/**
 * SSRF Detection Test Fixtures
 * Tests for detecting Server-Side Request Forgery patterns
 */

import type { TestGroup } from '../../types'

export const ssrfDetectionTests: TestGroup = {
  name: 'SSRF Detection',
  tier: 'A',
  layer: 2,
  description: 'Detection of SSRF patterns where user input flows to server-side HTTP requests',

  truePositives: [
    {
      name: 'SSRF - True Positives',
      expectFindings: true,
      expectedCategories: ['ssrf'],
      description: 'SSRF patterns that MUST be detected',
      file: {
        path: 'src/api/proxy.ts',
        content: `
import express from 'express'
import axios from 'axios'

const app = express()

// Direct taint: fetch(req.body.url)
app.post('/api/fetch-url', async (req, res) => {
  const response = await fetch(req.body.url)
  const data = await response.json()
  res.json(data)
})

// Direct taint: axios.get(req.query.endpoint)
app.get('/api/proxy', async (req, res) => {
  const response = await axios.get(req.query.endpoint)
  res.json(response.data)
})

// Open redirect: res.redirect(req.query.next)
app.get('/auth/callback', (req, res) => {
  res.redirect(req.query.next)
})
`,
        language: 'typescript',
        size: 500,
      },
    },
    {
      name: 'SSRF - Variable Mediated',
      expectFindings: true,
      expectedCategories: ['ssrf'],
      description: 'Variable-mediated SSRF that should be detected',
      file: {
        path: 'src/api/webhook.ts',
        content: `
import express from 'express'

const app = express()

// Variable-mediated taint
app.post('/api/webhook/test', async (req, res) => {
  const webhookUrl = req.body.url
  const payload = { event: 'test' }

  // Tainted variable used in fetch
  const response = await fetch(webhookUrl, {
    method: 'POST',
    body: JSON.stringify(payload),
  })

  res.json({ status: response.status })
})
`,
        language: 'typescript',
        size: 400,
      },
    },
    {
      name: 'SSRF - Template Literal',
      expectFindings: true,
      expectedCategories: ['ssrf'],
      description: 'Template literal with user input in HTTP request URL',
      file: {
        path: 'src/api/service.ts',
        content: `
import express from 'express'

const app = express()

// Template literal with user input
app.get('/api/resource', async (req, res) => {
  const response = await fetch(\`\${req.query.baseUrl}/api/resource\`)
  const data = await response.json()
  res.json(data)
})
`,
        language: 'typescript',
        size: 250,
      },
    },
  ],

  falseNegatives: [
    {
      name: 'SSRF - Env Var URL (safe)',
      expectFindings: false,
      description: 'Fetching from environment variable URL should not be flagged',
      file: {
        path: 'src/api/internal.ts',
        content: `
import express from 'express'

const API_URL = process.env.API_URL

const app = express()

app.get('/api/data', async (req, res) => {
  // URL from env var, not user input
  const response = await fetch(API_URL + '/data')
  res.json(await response.json())
})
`,
        language: 'typescript',
        size: 200,
      },
    },
    {
      name: 'SSRF - Client-Side Fetch (safe)',
      expectFindings: false,
      description: 'Client-side fetch with user input is not SSRF (browser-only)',
      file: {
        path: 'src/components/SearchForm.tsx',
        content: `
'use client'

import { useState } from 'react'

export function SearchForm() {
  const [query, setQuery] = useState('')

  const handleSearch = async () => {
    // Client-side fetch - not SSRF
    const response = await fetch(\`/api/search?q=\${query}\`)
    const data = await response.json()
    console.log(data)
  }

  return <input value={query} onChange={(e) => setQuery(e.target.value)} />
}
`,
        language: 'typescript',
        size: 300,
      },
    },
    {
      name: 'SSRF - Hardcoded URL (safe)',
      expectFindings: false,
      description: 'Fetching from hardcoded URL is safe',
      file: {
        path: 'src/services/api.ts',
        content: `
const HARDCODED_URL = 'https://api.example.com/v1'

export async function getData() {
  const response = await fetch(HARDCODED_URL + '/data')
  return response.json()
}

export async function getConfig() {
  return fetch('https://config.example.com/settings').then(r => r.json())
}
`,
        language: 'typescript',
        size: 200,
      },
    },
    {
      name: 'SSRF - Allowlist Validation (safe)',
      expectFindings: false,
      description: 'Fetch with allowlist validation should not be flagged',
      file: {
        path: 'src/api/validated-proxy.ts',
        content: `
import express from 'express'

const allowedDomains = ['api.example.com', 'cdn.example.com']

const app = express()

app.post('/api/fetch', async (req, res) => {
  const url = req.body.url
  const parsed = new URL(url)

  // Allowlist validation
  if (!allowedDomains.includes(parsed.hostname)) {
    return res.status(403).json({ error: 'Domain not allowed' })
  }

  const response = await fetch(url)
  res.json(await response.json())
})
`,
        language: 'typescript',
        size: 350,
      },
    },
  ],
}
