// security/ts-scaffold.ts — SPEC-058b Section G
// Builds TypeScript/Vitest security test file content as a string.
export function buildTsSecurityTest(title, auth, upload, publicApi) {
    const owaspSection = publicApi
        ? `
  describe('OWASP Top 10', () => {
    it('rejects SQL injection in query parameters', async () => {
      // const res = await request(app).get("/api/users?id=' OR 1=1 --");
      // expect(res.status).toBe(400);
      expect(true).toBe(true);
    });

    it('escapes XSS payloads in response', async () => {
      // const res = await request(app).post('/api/comments')
      //   .send({ body: '<script>alert("xss")</script>' });
      // expect(res.body.body).not.toContain('<script>');
      expect(true).toBe(true);
    });

    it('validates CSRF token on state-changing requests', async () => {
      expect(true).toBe(true);
    });

    it('rejects auth bypass attempts', async () => {
      expect(true).toBe(true);
    });
  });
`
        : '';
    const authSection = auth
        ? `
  describe('Authentication (${auth})', () => {
    it('rejects expired token with 401', async () => {
      // const expiredToken = signToken({ exp: Math.floor(Date.now()/1000) - 60 });
      // const res = await request(app).get('/api/me').set('Authorization', \`Bearer \${expiredToken}\`);
      // expect(res.status).toBe(401);
      expect(true).toBe(true);
    });

    it('refresh token returns new access token', async () => {
      expect(true).toBe(true);
    });

    it('prevents privilege escalation (user cannot access admin)', async () => {
      expect(true).toBe(true);
    });

    it('prevents session fixation attack', async () => {
      expect(true).toBe(true);
    });
  });
`
        : '';
    const uploadSection = upload
        ? `
  describe('File upload (${upload})', () => {
    it('rejects disallowed file types', async () => {
      // const res = await request(app).post('/api/upload')
      //   .attach('file', Buffer.from('#!/bin/sh'), { filename: 'evil.sh' });
      // expect(res.status).toBe(400);
      expect(true).toBe(true);
    });

    it('enforces maximum file size', async () => {
      expect(true).toBe(true);
    });

    it('prevents path traversal in filename', async () => {
      // filename: '../../etc/passwd' → should be sanitized
      expect(true).toBe(true);
    });

    it('scans for malicious content', async () => {
      expect(true).toBe(true);
    });
  });
`
        : '';
    const apiSection = publicApi
        ? `
  describe('API security', () => {
    it('rate limiter blocks excessive requests', async () => {
      // for (let i = 0; i < 101; i++) await request(app).get('/api/data');
      // const res = await request(app).get('/api/data');
      // expect(res.status).toBe(429);
      expect(true).toBe(true);
    });

    it('CORS rejects requests from unauthorized origins', async () => {
      expect(true).toBe(true);
    });

    it('supports API key rotation without downtime', async () => {
      expect(true).toBe(true);
    });
  });
`
        : '';
    return `// Security tests for: ${title}
// Generated by Planu SDD MCP Server (SPEC-058b)
import { describe, it, expect } from 'vitest';

describe('${title} — Security Tests', () => {
${owaspSection}${authSection}${uploadSection}${apiSection}});
`;
}
//# sourceMappingURL=ts-scaffold.js.map