// security/test-defs.ts — SPEC-058b Section G
// Generates TestDefinition[] entries for security test scenarios.
import { hasPublicApi, detectAuth, detectFileUpload } from './detectors.js';
export function generateSecurityTestDefs(title, testDir, _testExt, knowledge) {
    const defs = [];
    if (hasPublicApi(knowledge)) {
        defs.push({
            name: `${title} — OWASP Top 10: injection, XSS, CSRF, auth bypass`,
            type: 'integration',
            file: `${testDir}/security/`,
            description: 'Verify protection against OWASP Top 10 vulnerabilities on public endpoints',
            priority: 'critical',
            automatable: true,
        });
    }
    if (detectAuth(knowledge) !== null) {
        defs.push({
            name: `${title} — auth: token expiration, refresh flow, privilege escalation`,
            type: 'integration',
            file: `${testDir}/security/`,
            description: 'Verify auth token lifecycle, refresh flow, and privilege escalation prevention',
            priority: 'critical',
            automatable: true,
        });
    }
    if (detectFileUpload(knowledge) !== null) {
        defs.push({
            name: `${title} — file upload: type validation, size limits, path traversal`,
            type: 'integration',
            file: `${testDir}/security/`,
            description: 'Verify file upload security: type validation, size limits, path traversal prevention',
            priority: 'high',
            automatable: true,
        });
    }
    if (hasPublicApi(knowledge)) {
        defs.push({
            name: `${title} — API security: rate limiting, CORS, API key rotation`,
            type: 'integration',
            file: `${testDir}/security/`,
            description: 'Verify rate limiting effectiveness, CORS policy, and API key rotation support',
            priority: 'high',
            automatable: true,
        });
    }
    return defs;
}
//# sourceMappingURL=test-defs.js.map