// tools/challenge-spec/scenarios-security.ts — Authentication, injection, and CSRF scenarios
import { contentMentions, hasAnyAffirmedMatch } from './scenarios-utils.js';
const AUTH_SIGNALS = [
    /\b(auth|authentication|login|session|token|jwt|oauth|permission|role|rbac)\b/i,
];
const INPUT_SIGNALS = [
    /\b(user input|form|query param|search input|request body|payload|html input)\b/i,
];
const STATE_CHANGING_WEB_SIGNALS = [
    /\b(form submit|post request|put request|delete request|mutation|state-changing|cookie auth)\b/i,
];
export function generateSecurityScenarios(_spec, content, _knowledge) {
    const scenarios = [];
    const lower = content.toLowerCase();
    const text = content;
    // Authentication bypass
    if (hasAnyAffirmedMatch(text, AUTH_SIGNALS)) {
        scenarios.push({
            scenario: 'Unauthorized access attempt / authentication bypass',
            probability: 'high',
            impact: 'critical',
            currentHandling: contentMentions(lower, ['auth', 'jwt', 'session', 'middleware'])
                ? 'Authentication mentioned'
                : 'No explicit auth handling',
            requiredHandling: 'Validate auth tokens on every request. Implement RBAC. Never trust client-side auth state.',
            dataConsistency: 'Ensure RLS policies are enabled. No data leak through unauthorized queries.',
            userExperience: 'Redirect to login on 401. Clear error messages without leaking implementation details.',
        });
    }
    // Injection attacks
    if (hasAnyAffirmedMatch(text, INPUT_SIGNALS)) {
        scenarios.push({
            scenario: 'SQL injection / XSS / command injection via user input',
            probability: 'high',
            impact: 'critical',
            currentHandling: contentMentions(lower, ['sanitiz', 'escap', 'parameterized', 'prepared'])
                ? 'Some sanitization mentioned'
                : 'Not explicitly addressed',
            requiredHandling: 'Use parameterized queries (never string concatenation). Sanitize HTML output. Use CSP headers.',
            dataConsistency: 'Injection can corrupt or exfiltrate data. Use least-privilege DB connections.',
            userExperience: 'Transparent to user. Invalid input is silently sanitized.',
        });
    }
    // CSRF / rate limiting only applies when the spec explicitly involves auth or
    // state-changing web input. Tooling/spec-cleanup tasks should not get this as noise.
    if (hasAnyAffirmedMatch(text, AUTH_SIGNALS) ||
        hasAnyAffirmedMatch(text, STATE_CHANGING_WEB_SIGNALS)) {
        scenarios.push({
            scenario: 'CSRF attack or brute-force attempt',
            probability: 'medium',
            impact: 'high',
            currentHandling: contentMentions(lower, ['csrf', 'rate limit', 'throttle', 'captcha'])
                ? 'Some protection mentioned'
                : 'Not addressed',
            requiredHandling: 'Implement CSRF tokens for state-changing operations. Rate-limit sensitive endpoints. Add CAPTCHA for auth endpoints.',
            dataConsistency: 'Prevent mass data modifications from automated attacks.',
            userExperience: 'Show rate limit message. Require CAPTCHA after N failed attempts.',
        });
    }
    return scenarios;
}
//# sourceMappingURL=scenarios-security.js.map