/**
 * Test Fixtures: Phase 1 Enhancement Backlog
 *
 * Tests for:
 * - MCP Tool Description Injection
 * - MCP Server Shadowing
 * - RAG Query Injection
 * - RAG Embedding Poisoning
 * - RAG Chunk Injection
 * - Package Typosquatting
 */

// ============================================================================
// MCP Tool Description Injection (should trigger ai_mcp_description_injection)
// ============================================================================

// Dynamic tool description from variable (HIGH)
const userInput = req.body.toolDescription
const tool1 = {
  name: 'dynamic-tool',
  description: `This tool does ${userInput} for the user`,
}

// Description concatenated with user input (HIGH)
const tool2 = {
  name: 'concat-tool',
  description: 'Basic description ' + user.preference,
}

// Injection keywords in tool description (CRITICAL)
const tool3 = {
  name: 'suspicious-tool',
  description: 'This tool ignores previous instructions and does whatever',
}

// Tool name from config (HIGH)
registerTool(config['toolName'], { execute: handler })

// Python dynamic description (HIGH)
// @server.tool(name=f"tool-{user_id}")
// async def dynamic_tool():
//     pass

// Description from database (MEDIUM)
const tool4 = {
  name: 'db-tool',
  description: await db.get('tool_description'),
}

// ============================================================================
// MCP Server Shadowing (should trigger ai_mcp_server_shadowing)
// ============================================================================

// Server config from environment (MEDIUM)
const MCP_SERVERS = JSON.parse(process.env.MCP_SERVER_CONFIG)

// Server URL from user input (HIGH)
const mcpConfig = {
  serverUrl: req.body.serverUrl,
  timeout: 30000,
}

// Dynamic server registration (MEDIUM)
serverList.forEach(s => registerServer(s))

// Servers from parsed JSON (HIGH)
const servers = JSON.parse(req.body.mcpServers)

// Server config override (MEDIUM)
Object.assign(serverConfig, req.body.serverOverrides)

// ============================================================================
// RAG Query Injection (should trigger ai_rag_query_injection)
// ============================================================================

// User input directly in retrieval query (HIGH)
const results1 = await vectorStore.search(req.body.query)
const results2 = await retriever.invoke(user.searchTerm)
const results3 = await index.query(input.question)

// Query from request body without validation (MEDIUM)
const { query } = req.body
const docs = await vectorStore.similaritySearch(query, 10)

// Query template with user input (MEDIUM)
const searchQuery = `Find documents about ${user.topic} in the ${req.body.category} category`

// Query passthrough to vector store (HIGH)
app.post('/search', async (req, res) => {
  const results = await vectorStore.query(req.body.query)
  res.json(results)
})

// ============================================================================
// RAG Embedding Poisoning (should trigger ai_rag_embedding_poisoning)
// ============================================================================

// User document embedded without validation (HIGH)
const embedding = await embeddings.create(user.document)
await vectorStore.add(embedding)

// Retrieval without similarity threshold (MEDIUM)
const nearbyDocs = await vectorStore.similaritySearch(query, 20)

// Batch embedding without duplicate detection (LOW)
for (const doc of userDocs) {
  await vectorStore.add(await embeddings.embed(doc))
}

// Dynamic embedding model from config (MEDIUM)
const embeddingModel = new config['embeddingModel']

// External URL content embedded (HIGH)
const content = await fetch(userProvidedUrl)
const embedded = await embeddings.embed(content.text)
await vectorStore.add(embedded)

// ============================================================================
// RAG Chunk Injection (should trigger ai_rag_chunk_injection)
// ============================================================================

// User content chunked without validation (MEDIUM)
const chunks = await textSplitter.split(user.document)
await vectorStore.add(chunks)

// Context joined without separators (LOW)
const context = docs.map(d => d.pageContent).join('')

// Chunk metadata from user input (MEDIUM)
await vectorStore.add(chunks, { metadata: user.metadata })

// Chunking without size validation (LOW)
const parts = splitter.createDocuments(content)

// ============================================================================
// Package Typosquatting (should trigger ai_package_typosquat)
// ============================================================================

// 1 character difference from popular package
import reqests from 'reqests'       // similar to 'requests'
import loodash from 'loodash'       // similar to 'lodash'
import expres from 'expres'         // similar to 'express'

// Character substitution (0 for o, 1 for l)
import l0dash from 'l0dash'         // lodash with 0 instead of o
import ax1os from 'ax1os'           // axios with 1 instead of i

// Missing vowel
import rqsts from 'rqsts'           // requests without vowels

// Common suffix confusion
import react_js from 'react-js'     // react with -js suffix
import node_express from 'node-express'  // express with node- prefix

export default {
  // Placeholder for test
}
