/**
 * Risky Imports Test Fixtures
 * Tests for detecting deprecated, vulnerable, or risky package imports
 */

import type { TestGroup } from '../../types'

export const riskyImportsTests: TestGroup = {
  name: 'Risky Imports',
  tier: 'C',
  layer: 2,
  description: 'Detection of deprecated, vulnerable, or risky package imports',

  truePositives: [
    {
      name: 'Risky Imports - True Positives (JavaScript/TypeScript)',
      expectFindings: true,
      expectedCategories: ['suspicious_package'],
      description: 'Risky package imports that MUST be detected',
      file: {
        path: 'src/lib/http-client.ts',
        content: `
// Deprecated packages - MEDIUM/LOW
import request from 'request'
const request = require('request')

import uuid from 'node-uuid'
const nodeUuid = require('node-uuid')

// Full lodash import (bundle size/attack surface) - LOW
import _ from 'lodash'
import * as lodash from 'lodash'
const _ = require('lodash')

// Deprecated moment.js - LOW
import moment from 'moment'
const moment = require('moment')

// Deprecated bcrypt-nodejs - MEDIUM
import bcrypt from 'bcrypt-nodejs'
const bcrypt = require('bcrypt-nodejs')

// Less maintained mysql package - LOW
import mysql from 'mysql'
const mysql = require('mysql')

// Outdated crypto - LOW
import CryptoJS from 'crypto-js'

// serialize-javascript RCE risk - MEDIUM
import serialize from 'serialize-javascript'

// express-jwt CVE history - MEDIUM
import expressJwt from 'express-jwt'
const jwt = require('express-jwt')

// Native module concerns - LOW
import gyp from 'node-gyp'

// Analytics packages (privacy) - LOW
import analytics from 'analytics'
import segment from 'segment'
import mixpanel from 'mixpanel'
import amplitude from 'amplitude'

// vm2 sandbox (info - for awareness) - INFO
import { VM } from 'vm2'
const vm2 = require('vm2')
`,
        language: 'typescript',
        size: 1000,
      },
    },
    {
      name: 'Risky Imports - True Positives (Python)',
      expectFindings: true,
      expectedCategories: ['suspicious_package'],
      description: 'Python risky patterns that MUST be detected',
      file: {
        path: 'src/scripts/processor.py',
        content: `
# Pickle unsafe deserialization - HIGH
import pickle
from pickle import load, dump

# Load pickle data from file
data = pickle.load(open('data.pkl', 'rb'))

# YAML unsafe load - HIGH
import yaml

config = yaml.load(open('config.yml'))  # Missing Loader parameter
data = yaml.load(file_content)

# subprocess shell injection - HIGH
import subprocess

subprocess.call(user_command, shell=True)
subprocess.run(cmd, shell=True)
subprocess.Popen(command, shell=True)
subprocess.check_output(user_input, shell=True)
`,
        language: 'python',
        size: 500,
      },
    },
  ],

  falseNegatives: [
    {
      name: 'Risky Imports - False Negatives (Safe Alternatives)',
      expectFindings: false,
      description: 'Modern/safe alternatives that should NOT be flagged',
      allowedInfoFindings: [
        {
          category: 'suspicious_package',
          maxCount: 1,
          reason: 'Some packages may still generate info-level awareness findings',
        },
      ],
      file: {
        path: 'src/lib/safe-client.ts',
        content: `
// Modern HTTP clients - SAFE
import axios from 'axios'
import fetch from 'node-fetch'

// Modern UUID - SAFE
import { v4 as uuidv4 } from 'uuid'

// Tree-shakeable lodash imports - SAFE
import get from 'lodash/get'
import set from 'lodash/set'
import { get, set } from 'lodash-es'

// Modern date libraries - SAFE
import { format, parse } from 'date-fns'
import dayjs from 'dayjs'

// Modern bcrypt - SAFE
import bcrypt from 'bcrypt'
import bcryptjs from 'bcryptjs'

// mysql2 (maintained) - SAFE
import mysql from 'mysql2'

// Native crypto - SAFE
import crypto from 'crypto'
import { randomBytes } from 'crypto'

// jose for JWT - SAFE
import { SignJWT, jwtVerify } from 'jose'
import jwt from 'jsonwebtoken'
`,
        language: 'typescript',
        size: 600,
      },
    },
    {
      name: 'Risky Imports - False Negatives (Python Safe Patterns)',
      expectFindings: false,
      description: 'Safe Python patterns that should NOT be flagged',
      allowedInfoFindings: [
        {
          category: 'suspicious_package',
          maxCount: 8,
          reason: 'Package imports may still be flagged at info level even when used safely',
        },
        {
          category: 'dangerous_function',
          maxCount: 3,
          reason: 'Subprocess and file operations may trigger dangerous function detection',
        },
        {
          category: 'insecure_config',
          maxCount: 2,
          reason: 'Config loading patterns may trigger config detection',
        },
      ],
      file: {
        path: 'src/scripts/safe_processor.py',
        content: `
# Safe YAML loading with explicit safe loader - SAFE
import yaml

# Using safe_load is the recommended approach
config = yaml.safe_load(open('config.yml'))

# JSON is always safe for serialization - SAFE
import json

data = json.load(open('data.json'))
`,
        language: 'python',
        size: 200,
      },
    },
    {
      name: 'Comments About Risky Packages',
      expectFindings: false,
      description: 'Comments mentioning risky packages should NOT be flagged',
      file: {
        path: 'src/MIGRATION.md',
        content: `
# Migration Guide

## HTTP Client Migration

We migrated from the deprecated 'request' package to axios.
The old code used: import request from 'request'
New code uses: import axios from 'axios'

## Date Library Migration

// Old: import moment from 'moment'
// New: import { format } from 'date-fns'

Note: moment.js is now in maintenance mode.

## UUID Migration

Previously we used node-uuid which is deprecated.
// const uuid = require('node-uuid')
Now we use the uuid package directly.
`,
        language: 'markdown',
        size: 400,
      },
    },
  ],
}
