/**
 * Sensitive URLs Test Fixtures
 * Tests for detecting sensitive URLs with embedded credentials or internal endpoints
 */

import type { TestGroup } from '../../types'

export const sensitiveUrlsTests: TestGroup = {
  name: 'Sensitive URLs',
  tier: 'A',
  layer: 1,
  description: 'Detection of URLs with embedded credentials, internal endpoints, and webhook URLs',
  
  truePositives: [
    {
      name: 'Sensitive URLs - True Positives',
      expectFindings: true,
      expectedCategories: ['sensitive_url', 'hardcoded_secret'],
      description: 'Sensitive URLs that MUST be detected',
      file: {
        path: 'src/config/endpoints.ts',
        content: `
// Webhook URLs with embedded tokens (High)
const SLACK_WEBHOOK = "https://hooks.slack.com/services/T00000000/B00000000/XXXXXXXX"
const DISCORD_WEBHOOK = "https://discord.com/api/webhooks/123456789/abcdef"
const GITHUB_WEBHOOK = "https://api.github.com/repos/owner/repo/hooks?token=abc123"

// Internal infrastructure URLs (Medium)
const INTERNAL_API = "http://internal-api.prod.company.com/admin"
const KUBERNETES_API = "https://10.0.0.1:6443/api/v1/namespaces"
const VAULT_URL = "http://vault.internal:8200/v1/secret/data"

// URLs with embedded credentials (Critical)
const DB_ADMIN = "https://admin:password@db.example.com:5432"
const REDIS_ADMIN = "redis://:secretpass@redis.prod.internal:6379"
const GRAFANA_URL = "https://admin:grafana123@monitoring.internal/d/dashboard"

// Production hardcoded endpoints (Medium)
const PROD_API = "https://api.production.company.com/v1"
const ADMIN_PANEL = "https://admin.production.company.com/dashboard"

// S3 with access key in URL (High)
const S3_URL = "https://AKIAIOSFODNN7EXAMPLE:wJalrXUtnFEMI@s3.amazonaws.com/bucket"
`,
        language: 'typescript',
        size: 1000,
      },
    },
  ],
  
  falseNegatives: [
    {
      name: 'Sensitive URLs - False Negatives',
      expectFindings: false,
      description: 'Safe URL patterns that should NOT be flagged',
      allowedInfoFindings: [
        {
          category: 'sensitive_url',
          maxCount: 2,
          reason: 'Localhost URLs in dev context are info-level findings, not security issues',
        },
      ],
      file: {
        path: 'src/config/urls.ts',
        content: `
// Public API endpoints - SAFE
const PUBLIC_API = "https://api.example.com/v1"
const CDN_URL = "https://cdn.example.com/assets"

// Environment-based URLs - SAFE
const API_URL = process.env.API_URL
const WEBHOOK_URL = process.env.WEBHOOK_URL

// Localhost for development - SAFE (info at most)
const DEV_API = "http://localhost:3000/api"
const DEV_DB = "postgresql://localhost:5432/dev"

// Documentation URLs - SAFE
const DOCS_URL = "https://docs.example.com"
const SWAGGER_URL = "https://api.example.com/swagger"

// Template URLs - SAFE
const URL_TEMPLATE = "https://{subdomain}.example.com/{path}"
`,
        language: 'typescript',
        size: 500,
      },
    },
  ],
}
