/**
 * Test Fixture: Consent Bypass
 *
 * This file contains intentional consent validation bypass patterns that
 * should be detected by the healthcare scanner. Used for testing only.
 *
 * EXPECTED FINDINGS:
 * - Always-true consent check (high)
 * - Missing consent validation in PHI access (high)
 * - Consent check commented out (high)
 *
 * @module eval/fixtures/healthcare/consent-bypass
 */
// Always-true consent check - SHOULD BE DETECTED
export function hasConsent() {
    return true; // BUG: Always returns true without validation
}
// Another always-true pattern - SHOULD BE DETECTED
export function checkConsentStatus() {
    const consentGiven = true;
    return consentGiven; // BUG: Hard-coded consent
}
// Consent check commented out - SHOULD BE DETECTED
export async function accessPatientRecord(patientId) {
    // if (!await checkConsentStatus()) {
    //   throw new Error("Consent not given");
    // }
    return fetchPatientData(patientId);
}
// Missing consent validation before PHI access - SHOULD BE DETECTED
export async function getPatientMedicalHistory(patientId) {
    // No consent check before accessing sensitive data
    const patient = await fetchPatientData(patientId);
    return patient.medicalHistory;
}
// Missing consent check with SUD data - SHOULD BE DETECTED
export async function getSUDTreatmentPlan(patientId) {
    // SUD data requires explicit consent under 42 CFR Part 2
    // but no consent validation here
    return await fetchSUDRecords(patientId);
}
// Helper functions (simulated)
async function fetchPatientData(patientId) {
    return { id: patientId, medicalHistory: [], ssn: "123-45-6789" };
}
async function fetchSUDRecords(patientId) {
    return { patientId, treatmentPlan: "Methadone maintenance" };
}
// This is OK - proper consent check
export async function properConsentCheck(patientId, userId) {
    const consent = await validateConsent(patientId, userId);
    if (!consent.valid) {
        throw new Error("Patient consent not obtained");
    }
    return await fetchPatientData(patientId);
}
async function validateConsent(patientId, userId) {
    // Real implementation would check database
    return { valid: false, scope: [], expiresAt: null };
}
//# sourceMappingURL=consent-bypass.js.map