"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
const security_predictor_1 = require("../../walls/03-knowledge/decisions/security-predictor");
describe('SecurityPredictor', () => {
    let predictor;
    beforeEach(() => {
        predictor = new security_predictor_1.SecurityPredictor();
    });
    test('detects XSS via innerHTML', () => {
        const code = 'element.innerHTML = userInput;';
        const predictions = predictor.predict(code);
        expect(predictions.some((p) => p.type === 'xss')).toBe(true);
    });
    test('detects SQL injection', () => {
        const code = 'const query = "SELECT * FROM users WHERE id = " + userId;';
        const predictions = predictor.predict(code);
        expect(predictions.some((p) => p.type === 'sql_injection')).toBe(true);
    });
    test('detects path traversal', () => {
        const code = "const data = fs.readFileSync('../secret/file.txt');";
        const predictions = predictor.predict(code);
        expect(predictions.some((p) => p.type === 'path_traversal')).toBe(true);
    });
    test('detects hardcoded secret', () => {
        const code = "const API_KEY = 'sk-1234567890abcdef';";
        const predictions = predictor.predict(code);
        expect(predictions.some((p) => p.type === 'hardcoded_secret')).toBe(true);
    });
    test('returns empty for clean code', () => {
        const code = 'const x = 1 + 2;';
        const predictions = predictor.predict(code);
        expect(predictions).toHaveLength(0);
    });
    test('AST detects innerHTML assignment as XSS', () => {
        const code = 'document.getElementById("root").innerHTML = userInput;';
        const predictions = predictor.predict(code);
        expect(predictions.some((p) => p.type === 'xss' && p.line === 1)).toBe(true);
    });
    test('AST ignores variable named innerHTML', () => {
        const code = 'const innerHTML = "safe";';
        const predictions = predictor.predict(code);
        expect(predictions.some((p) => p.type === 'xss')).toBe(false);
    });
    test('AST detects hardcoded secret in variable declaration', () => {
        const code = 'const apiKey = "sk-123";';
        const predictions = predictor.predict(code);
        expect(predictions.some((p) => p.type === 'hardcoded_secret')).toBe(true);
    });
    test('AST ignores secret with process.env', () => {
        const code = 'const apiKey = process.env.API_KEY;';
        const predictions = predictor.predict(code);
        expect(predictions.some((p) => p.type === 'hardcoded_secret')).toBe(false);
    });
    test('AST detects dangerouslySetInnerHTML in JSX', () => {
        const code = 'function App() { return <div dangerouslySetInnerHTML={{ __html: html }} />; }';
        const predictions = predictor.predict(code);
        expect(predictions.some((p) => p.type === 'xss')).toBe(true);
    });
});
//# sourceMappingURL=security-predictor.test.js.map