/**
 * Healthcare Compliance Tests
 *
 * Integration tests for HIPAA and 42 CFR Part 2 compliance assessment.
 *
 * @module __tests__/healthcare-compliance
 */
import { describe, it, expect } from "vitest";
import { getHIPAAControls, getHIPAACategories, getCFR42Part2Controls, getCFR42Part2Categories, CFR42_TO_HIPAA_MAPPING, mapFindingsToControls, generateComplianceReport, runHealthcareComplianceAssessment, generateHealthcareComplianceSummary, } from "../compliance/index.js";
describe("HIPAA Controls", () => {
    it("should have at least 15 controls", () => {
        const controls = getHIPAAControls();
        expect(controls.length).toBeGreaterThanOrEqual(15);
    });
    it("should have controls in expected categories", () => {
        const categories = getHIPAACategories();
        expect(categories).toContain("Administrative Safeguards");
        expect(categories).toContain("Technical Safeguards");
    });
    it("should have healthcare-specific finding categories", () => {
        const controls = getHIPAAControls();
        const allCategories = controls.flatMap((c) => c.findingCategories);
        expect(allCategories).toContain("phi-exposure");
        expect(allCategories).toContain("audit-gap");
        expect(allCategories).toContain("consent-bypass");
    });
    it("should map encryption control to CWE-311", () => {
        const controls = getHIPAAControls();
        const encryptionControl = controls.find((c) => c.id === "164.312(a)(2)(iv)");
        expect(encryptionControl).toBeDefined();
        expect(encryptionControl.cweIds).toContain("CWE-311");
    });
});
describe("42 CFR Part 2 Controls", () => {
    it("should have at least 15 controls", () => {
        const controls = getCFR42Part2Controls();
        expect(controls.length).toBeGreaterThanOrEqual(15);
    });
    it("should have controls in expected categories", () => {
        const categories = getCFR42Part2Categories();
        expect(categories).toContain("General Provisions");
        expect(categories).toContain("Disclosures With Consent");
        expect(categories).toContain("Security Safeguards");
    });
    it("should have SUD-specific finding categories", () => {
        const controls = getCFR42Part2Controls();
        const allCategories = controls.flatMap((c) => c.findingCategories);
        expect(allCategories).toContain("sud-disclosure");
        expect(allCategories).toContain("consent-bypass");
        expect(allCategories).toContain("redisclosure-violation");
        expect(allCategories).toContain("qsoa-violation");
    });
    it("should have prohibition on disclosure control", () => {
        const controls = getCFR42Part2Controls();
        const prohibition = controls.find((c) => c.id === "2.12");
        expect(prohibition).toBeDefined();
        expect(prohibition.title).toBe("Prohibition on Disclosure");
        expect(prohibition.findingCategories).toContain("sud-disclosure");
    });
});
describe("CFR42 to HIPAA Mapping", () => {
    it("should map CFR42 controls to HIPAA controls", () => {
        expect(CFR42_TO_HIPAA_MAPPING["2.12"]).toBeDefined();
        expect(CFR42_TO_HIPAA_MAPPING["2.12"]).toContain("164.308(a)(1)");
    });
    it("should map consent requirements to HIPAA authorization", () => {
        expect(CFR42_TO_HIPAA_MAPPING["2.31"]).toBeDefined();
        expect(CFR42_TO_HIPAA_MAPPING["2.31"]).toContain("164.508");
    });
});
describe("Finding to Control Mapping", () => {
    const createFinding = (id, severity, category, description) => ({
        id,
        severity,
        category,
        description,
        confidence: 100,
        evidence: "Test evidence",
        verifications: [],
        created_at: new Date().toISOString(),
    });
    it("should map phi-exposure findings to HIPAA controls", () => {
        const findings = [
            createFinding("phi-001", "critical", "phi-exposure", "SSN found in logs"),
        ];
        const mappings = mapFindingsToControls(findings, "HIPAA");
        const affectedControls = mappings.filter((m) => m.findings.length > 0);
        expect(affectedControls.length).toBeGreaterThan(0);
        expect(affectedControls.some((m) => m.control.id === "164.308(a)(1)")).toBe(true);
    });
    it("should map consent-bypass findings to 42 CFR Part 2 controls", () => {
        const findings = [
            createFinding("consent-001", "high", "consent-bypass", "Consent not validated before data access"),
        ];
        const mappings = mapFindingsToControls(findings, "42-CFR-PART-2");
        const affectedControls = mappings.filter((m) => m.findings.length > 0);
        expect(affectedControls.length).toBeGreaterThan(0);
        expect(affectedControls.some((m) => m.control.id === "2.31")).toBe(true);
    });
    it("should map audit-gap findings to audit controls", () => {
        const findings = [
            createFinding("audit-001", "high", "audit-gap", "PHI access not logged"),
        ];
        const hipaaMapping = mapFindingsToControls(findings, "HIPAA");
        const cfr42Mapping = mapFindingsToControls(findings, "42-CFR-PART-2");
        expect(hipaaMapping.some((m) => m.findings.length > 0 && m.control.id === "164.312(b)")).toBe(true);
        expect(cfr42Mapping.some((m) => m.findings.length > 0 && m.control.id === "2.52")).toBe(true);
    });
});
describe("Compliance Report Generation", () => {
    const mockFindings = [
        {
            id: "test-001",
            severity: "high",
            category: "phi-exposure",
            description: "PHI data exposed in API response",
            confidence: 100,
            evidence: "Response contains SSN field",
            verifications: [],
            created_at: new Date().toISOString(),
        },
        {
            id: "test-002",
            severity: "medium",
            category: "audit-gap",
            description: "Missing audit log for patient data access",
            confidence: 80,
            evidence: "No audit log call found",
            verifications: [],
            created_at: new Date().toISOString(),
        },
    ];
    it("should generate HIPAA compliance report", () => {
        const report = generateComplianceReport(mockFindings, "HIPAA", "/test/project");
        expect(report.framework).toBe("HIPAA");
        expect(report.status.totalControls).toBeGreaterThan(0);
        expect(report.nonCompliantControls.length).toBeGreaterThanOrEqual(0);
    });
    it("should generate 42 CFR Part 2 compliance report", () => {
        const report = generateComplianceReport(mockFindings, "42-CFR-PART-2", "/test/project");
        expect(report.framework).toBe("42-CFR-PART-2");
        expect(report.status.totalControls).toBeGreaterThan(0);
    });
    it("should generate recommendations for non-compliant controls", () => {
        const report = generateComplianceReport(mockFindings, "HIPAA", "/test/project");
        if (report.nonCompliantControls.length > 0 || report.atRiskControls.length > 0) {
            expect(report.recommendations.length).toBeGreaterThan(0);
        }
    });
});
describe("Healthcare Compliance Assessment", () => {
    const mockFindings = [
        {
            id: "hc-001",
            severity: "critical",
            category: "sud-disclosure",
            description: "SUD patient data shared without consent",
            confidence: 100,
            evidence: "API returns SUD records without authorization check",
            verifications: [],
            created_at: new Date().toISOString(),
        },
    ];
    it("should run combined assessment", async () => {
        const result = await runHealthcareComplianceAssessment({
            projectPath: "/test/project",
            findings: mockFindings,
            collectEvidence: false,
            verifyAuditTrail: false,
            storeEvidence: false,
        });
        expect(result.hipaaReport).toBeDefined();
        expect(result.cfr42Report).toBeDefined();
        expect(result.combinedScore).toBeGreaterThanOrEqual(0);
        expect(result.combinedScore).toBeLessThanOrEqual(100);
    });
    it("should generate markdown report", async () => {
        const result = await runHealthcareComplianceAssessment({
            projectPath: "/test/project",
            findings: mockFindings,
            collectEvidence: false,
            verifyAuditTrail: false,
            storeEvidence: false,
        });
        expect(result.markdownReport).toContain("Healthcare Compliance Assessment");
        expect(result.markdownReport).toContain("HIPAA");
        expect(result.markdownReport).toContain("42 CFR Part 2");
    });
    it("should generate summary", async () => {
        const result = await runHealthcareComplianceAssessment({
            projectPath: "/test/project",
            findings: mockFindings,
            collectEvidence: false,
            verifyAuditTrail: false,
            storeEvidence: false,
        });
        const summary = generateHealthcareComplianceSummary(result);
        expect(summary).toContain("Healthcare Compliance");
        expect(summary).toContain("HIPAA");
        expect(summary).toContain("42 CFR Part 2");
    });
    it("should determine status based on findings", async () => {
        const criticalFindings = [
            {
                id: "crit-001",
                severity: "critical",
                category: "phi-exposure",
                description: "Critical PHI exposure",
                confidence: 100,
                evidence: "Test",
                verifications: [],
                created_at: new Date().toISOString(),
            },
        ];
        const result = await runHealthcareComplianceAssessment({
            projectPath: "/test/project",
            findings: criticalFindings,
            collectEvidence: false,
            verifyAuditTrail: false,
            storeEvidence: false,
        });
        // Critical findings should result in at_risk or non_compliant status
        expect(["at_risk", "non_compliant"]).toContain(result.status);
    });
});
describe("Healthcare Scanner Types", () => {
    it("should include healthcare in scanner types", async () => {
        const { toFindingId } = await import("../scanners/types.js");
        const findingId = toFindingId("healthcare", "phi-exposure", 0);
        expect(findingId).toBe("hc-001");
    });
});
//# sourceMappingURL=healthcare-compliance.test.js.map