/**
 * Sensitive Variables Test Fixtures
 * Tests for detecting sensitive variable names with hardcoded values
 */

import type { TestGroup } from '../../types'

export const sensitiveVariablesTests: TestGroup = {
  name: 'Sensitive Variables',
  tier: 'C',
  layer: 2,
  description: 'Detection of sensitive variable names with hardcoded values',

  truePositives: [
    {
      name: 'Sensitive Variables - True Positives',
      expectFindings: true,
      expectedCategories: ['sensitive_variable'],
      description: 'Hardcoded sensitive variables that MUST be detected',
      file: {
        path: 'src/config/secrets.ts',
        content: `
// Password-related variables with hardcoded values - HIGH/CRITICAL
const password = 'my-secret-password-123'
const passwd = 'admin123'
const pwd = 'password456'
const user_password = 'userpass789'
const admin_password = 'admin@secure!'
const db_password = 'database-pass-abc'
const database_password = 'dbpass123456'

// Token-related variables - HIGH
const auth_token = 'eyJhbGciOiJIUzI1NiJ9.token'
const access_token = 'ya29.access-token-value'
const refresh_token = 'refresh-token-12345'
const bearer_token = 'Bearer abc123def456'
const api_token = 'tok_live_1234567890'
const api_key = 'sk-proj-abcdefghijklmnop'
const apikey = 'api-key-secret-value'

// Secret-related variables - HIGH/CRITICAL
const secret = 'my-application-secret'
const secret_key = 'secret-key-value-here'
const private_key = 'private-key-content'
const signing_key = 'signing-key-abc123'
const client_secret = 'client-secret-xyz789'
const app_secret = 'app-secret-12345'
const jwt_secret = 'jwt-signing-secret-key'

// Credential-related - HIGH
const credential = 'user:password@host'
const credentials = 'admin:secretpassword'
const creds = 'authentication-creds'

// Connection strings - HIGH
const connection_string = 'postgresql://user:pass@host:5432/db'
const conn_string = 'mysql://root:password@localhost/mydb'
const database_url = 'mongodb://admin:secret@cluster.mongodb.net'
const db_url = 'redis://user:password@redis-host:6379'

// Encryption keys - CRITICAL
const encryption_key = 'aes-256-encryption-key-value'
const decrypt_key = 'decryption-key-secret'
const cipher_key = 'cipher-key-for-encryption'
const aes_key = 'AES-secret-key-32bytes'

// SSH/Certificate keys - CRITICAL
const ssh_key = 'ssh-rsa AAAAB3NzaC1yc2E...'
const ssl_key = 'ssl-private-key-content'
const cert_key = 'certificate-key-value'
`,
        language: 'typescript',
        size: 1500,
      },
    },
  ],

  falseNegatives: [
    {
      name: 'Sensitive Variables - False Negatives',
      expectFindings: false,
      description: 'Safe patterns that should NOT be flagged',
      allowedInfoFindings: [
        {
          category: 'sensitive_variable',
          maxCount: 5,
          reason: 'Variable names may still trigger sensitive variable detection even with safe values',
        },
        {
          category: 'hardcoded_secret',
          maxCount: 3,
          reason: 'Layer 1 may detect placeholder patterns at info level',
        },
        {
          category: 'ai_pattern',
          maxCount: 2,
          reason: 'Placeholder patterns may trigger AI detection',
        },
      ],
      file: {
        path: 'src/config/safe-config.ts',
        content: `
// Environment variable references - SAFE
const dbUrl = process.env.DATABASE_URL
const apiUrl = process.env.API_URL

// Type definitions (not actual values) - SAFE
interface Config {
  databaseUrl: string
  apiUrl: string
}

// Empty/default values - SAFE
const configValue = ''
const setting = null

// Environment-based configuration - SAFE
const endpoint = process.env.ENDPOINT || 'localhost'
`,
        language: 'typescript',
        size: 400,
      },
    },
    {
      name: 'Test File Patterns',
      expectFindings: false,
      description: 'Test files may have mock sensitive variables',
      allowedInfoFindings: [
        {
          category: 'sensitive_variable',
          maxCount: 8,
          reason: 'Test files may have mock credentials for testing',
        },
        {
          category: 'hardcoded_secret',
          maxCount: 5,
          reason: 'Test credentials may be detected at low severity',
        },
        {
          category: 'high_entropy_string',
          maxCount: 2,
          reason: 'Test strings may trigger entropy detection',
        },
      ],
      file: {
        path: 'src/__tests__/config.test.ts',
        content: `
import { describe, it, expect } from 'vitest'

describe('Config', () => {
  it('should mask sensitive values in logs', () => {
    const value = 'test-value'
    expect(maskValue(value)).toBe('***')
  })

  it('should validate format', () => {
    const input = 'valid-input'
    expect(isValid(input)).toBe(true)
  })
})
`,
        language: 'typescript',
        size: 300,
      },
    },
  ],
}
