// tools/challenge-spec/platform-challenge-scenarios-b1.ts
// SPEC-015b: Bot + Web3 advanced challenge scenarios
// === SPEC-015b: Bot advanced challenges — rate limits + Discord 3s timeout ===
export function buildBotAdvancedChallenges(spec, content) {
    const lower = content.toLowerCase();
    const hasMention = (keywords) => keywords.some((kw) => lower.includes(kw));
    void spec;
    const scenarios = [
        {
            scenario: 'Discord slash command not responded within 3 seconds — interaction token expires',
            probability: 'high',
            impact: 'high',
            currentHandling: hasMention(['defer', 'deferred', 'interaction.defer'])
                ? 'Deferred response noted'
                : 'Not addressed',
            requiredHandling: 'Immediately defer the interaction (interaction.deferReply()) before any async work. ' +
                'Discord allows up to 15 minutes for deferred responses. ' +
                'Never do heavy computation before acknowledging.',
            dataConsistency: 'Deferred acknowledgment must be sent before any database or API calls.',
            userExperience: 'Show "Bot is thinking..." spinner via deferred reply. Follow up with actual result.',
        },
        {
            scenario: 'Message exceeds 2000 characters — Discord silently truncates or throws API error',
            probability: 'medium',
            impact: 'medium',
            currentHandling: hasMention(['chunk', 'paginate', 'truncate'])
                ? 'Message chunking noted'
                : 'Not addressed',
            requiredHandling: 'Check message length before sending. Split into chunks of ≤2000 chars. ' +
                'For large outputs, use Discord attachments (.txt file) or embeds with pagination. ' +
                'Telegram limit is 4096 chars — handle separately per platform.',
            dataConsistency: 'All message chunks must be sent atomically; partial sends must retry.',
            userExperience: 'Long responses paginated with ◀ ▶ navigation buttons or sent as file attachment.',
        },
        {
            scenario: 'Multiple users invoke the same command simultaneously causing race conditions on shared state',
            probability: 'medium',
            impact: 'high',
            currentHandling: hasMention(['mutex', 'lock', 'queue', 'atomic'])
                ? 'Concurrency handling noted'
                : 'Not addressed',
            requiredHandling: 'Use per-user command queuing. For global resources, apply mutex or database-level locking. ' +
                'Idempotent commands are safer — design commands to be re-executable without side effects.',
            dataConsistency: 'Concurrent commands must not corrupt shared counters, balances, or state.',
            userExperience: 'If command is already running for user, respond: "Your previous command is still processing."',
        },
    ];
    return scenarios;
}
// === SPEC-015b: OWASP Smart Contract Top 10 + advanced Web3 challenges ===
export function buildWeb3AdvancedChallenges(spec, content) {
    const lower = content.toLowerCase();
    const hasMention = (keywords) => keywords.some((kw) => lower.includes(kw));
    void spec;
    const scenarios = [
        {
            scenario: 'OWASP SC-1: Flash loan attack used to manipulate on-chain price oracle in same transaction',
            probability: 'medium',
            impact: 'critical',
            currentHandling: hasMention(['twap', 'oracle', 'chainlink'])
                ? 'Oracle protection noted'
                : 'Not addressed',
            requiredHandling: 'Use Chainlink or TWAP (Time-Weighted Average Price) oracles instead of spot price. ' +
                'Add minimum time delays between price updates and sensitive operations. ' +
                'Validate price data with bounds checks.',
            dataConsistency: 'Price used for calculation must be from a manipulation-resistant source (TWAP, Chainlink).',
            userExperience: 'Transaction reverts with "Price deviation too high" if oracle price deviates from expected bounds.',
        },
        {
            scenario: 'OWASP SC-2: Logic error in access control — admin function callable by any address',
            probability: 'high',
            impact: 'critical',
            currentHandling: hasMention(['accesscontrol', 'onlyowner', 'modifier'])
                ? 'Access control present'
                : 'Not addressed',
            requiredHandling: 'Audit every public/external function. Apply onlyOwner, AccessControl, or custom modifiers. ' +
                'Test with a non-privileged account that every restricted function reverts. ' +
                'Reference: SWC-105 (Unprotected Ether Withdrawal), SWC-106 (Unprotected SELFDESTRUCT).',
            dataConsistency: 'All state-mutating admin functions must require explicit authorization.',
            userExperience: 'Unauthorized calls revert with descriptive error: "Caller is not authorized to perform this action."',
        },
        {
            scenario: 'OWASP SC-3: Integer arithmetic in Solidity 0.7 or with unchecked {} blocks silently overflows',
            probability: 'low',
            impact: 'critical',
            currentHandling: hasMention(['unchecked', 'safemath'])
                ? 'Overflow handling noted'
                : 'Default Solidity 0.8+ protection',
            requiredHandling: 'If using Solidity <0.8.0: use SafeMath for all arithmetic. ' +
                'If using unchecked {}: document why overflow is safe and add invariant tests. ' +
                'Reference: SWC-101 (Integer Overflow and Underflow).',
            dataConsistency: 'Token balances, total supply, and counters must never wrap around silently.',
            userExperience: 'Overflow causes revert in Solidity 0.8+. Document behavior for older versions.',
        },
        {
            scenario: 'OWASP SC-5: Self-destruct without access control destroys contract permanently',
            probability: 'low',
            impact: 'critical',
            currentHandling: hasMention(['selfdestruct', 'self-destruct', 'destroy'])
                ? 'Self-destruct addressed'
                : 'Not addressed',
            requiredHandling: 'Remove selfdestruct entirely (deprecated in EIP-6049) or guard with time-lock + multi-sig. ' +
                'Ensure ETH withdrawal path exists before removing selfdestruct. ' +
                'Reference: SWC-106.',
            dataConsistency: 'Contract destruction is irreversible — all funds must be safely withdrawable before destroy.',
            userExperience: 'If self-destruct is required, require 2-of-3 multi-sig + 72h time lock before execution.',
        },
    ];
    return scenarios;
}
//# sourceMappingURL=platform-challenge-scenarios-b1.js.map