// security/python-scaffold.ts — SPEC-058b Section G
// Builds Python/pytest security test file content as a string.
export function buildPythonSecurityTest(title, auth, upload, publicApi) {
    const cls = title.replace(/[^a-zA-Z0-9]/g, '');
    const owaspSection = publicApi
        ? `
    def test_sql_injection_rejected(self) -> None:
        """SQL injection in query parameters is rejected."""
        # response = client.get("/api/users?id=' OR 1=1 --")
        # assert response.status_code == 400
        pass

    def test_xss_payload_escaped(self) -> None:
        """XSS payloads are escaped in response."""
        pass

    def test_csrf_token_validated(self) -> None:
        """CSRF token is required on state-changing requests."""
        pass

    def test_auth_bypass_rejected(self) -> None:
        """Auth bypass attempts are rejected."""
        pass
`
        : '';
    const authSection = auth
        ? `
    def test_expired_token_returns_401(self) -> None:
        """Expired token is rejected with 401."""
        pass

    def test_refresh_token_returns_new_access_token(self) -> None:
        """Refresh token flow issues a new access token."""
        pass

    def test_privilege_escalation_prevented(self) -> None:
        """User cannot access admin-only endpoints."""
        pass

    def test_session_fixation_prevented(self) -> None:
        """Session fixation attack is prevented."""
        pass
`
        : '';
    const uploadSection = upload
        ? `
    def test_disallowed_file_type_rejected(self) -> None:
        """Disallowed file types are rejected on upload."""
        pass

    def test_max_file_size_enforced(self) -> None:
        """Files exceeding size limit are rejected."""
        pass

    def test_path_traversal_in_filename_prevented(self) -> None:
        """Path traversal in filename is sanitized."""
        pass

    def test_malicious_content_detected(self) -> None:
        """Malicious file content is detected and rejected."""
        pass
`
        : '';
    const apiSection = publicApi
        ? `
    def test_rate_limiter_blocks_excess(self) -> None:
        """Rate limiter returns 429 after threshold."""
        pass

    def test_cors_rejects_unauthorized_origin(self) -> None:
        """CORS policy rejects requests from unauthorized origins."""
        pass

    def test_api_key_rotation_supported(self) -> None:
        """API key rotation works without downtime."""
        pass
`
        : '';
    return `"""Security tests for: ${title}
Generated by Planu SDD MCP Server (SPEC-058b).
"""
import pytest


class Test${cls}Security:
    """Security test suite for ${title}."""
${owaspSection}${authSection}${uploadSection}${apiSection}`;
}
//# sourceMappingURL=python-scaffold.js.map