import { describe, it, expect } from "vitest";
import { formatDASTFindings, convertToSARIF, getDASTInstallInstructions, } from "../../../scanners/dast/index.js";
describe("dast index", () => {
    describe("formatDASTFindings", () => {
        it("returns message for empty findings", () => {
            const result = formatDASTFindings([]);
            expect(result).toBe("No vulnerabilities found.");
        });
        it("formats findings grouped by severity", () => {
            const findings = [
                createMockFinding({ severity: "critical", name: "SQL Injection" }),
                createMockFinding({ severity: "high", name: "XSS" }),
                createMockFinding({ severity: "medium", name: "CSRF" }),
            ];
            const result = formatDASTFindings(findings);
            expect(result).toContain("## DAST Scan Results");
            expect(result).toContain("Found 3 unique vulnerabilities");
            expect(result).toContain("### 🔴 CRITICAL (1)");
            expect(result).toContain("### 🟠 HIGH (1)");
            expect(result).toContain("### 🟡 MEDIUM (1)");
            expect(result).toContain("SQL Injection");
            expect(result).toContain("XSS");
            expect(result).toContain("CSRF");
        });
        it("includes CWE IDs when present", () => {
            const findings = [
                createMockFinding({ cweIds: ["CWE-89", "CWE-564"] }),
            ];
            const result = formatDASTFindings(findings);
            expect(result).toContain("CWE: CWE-89, CWE-564");
        });
        it("includes truncated solution when present", () => {
            const longSolution = "A".repeat(300);
            const findings = [
                createMockFinding({ solution: longSolution }),
            ];
            const result = formatDASTFindings(findings);
            expect(result).toContain("Fix:");
            expect(result).toContain("...");
            expect(result.length).toBeLessThan(longSolution.length + 500);
        });
        it("shows scanner name for each finding", () => {
            const findings = [
                createMockFinding({ scanner: "zap", name: "From ZAP" }),
                createMockFinding({ scanner: "nuclei", name: "From Nuclei" }),
            ];
            const result = formatDASTFindings(findings);
            expect(result).toContain("(zap)");
            expect(result).toContain("(nuclei)");
        });
    });
    describe("convertToSARIF", () => {
        it("generates valid SARIF structure", () => {
            const result = createMockAggregatedResult();
            const sarif = convertToSARIF(result);
            expect(sarif.$schema).toContain("sarif-schema-2.1.0");
            expect(sarif.version).toBe("2.1.0");
            expect(sarif.runs).toHaveLength(1);
            expect(sarif.runs[0].tool.driver.name).toBe("Vaspera DAST");
        });
        it("includes rules for each unique finding", () => {
            const result = createMockAggregatedResult([
                createMockFinding({ ruleId: "zap-40012", name: "XSS" }),
                createMockFinding({ ruleId: "nuclei-CVE-2021-44228", name: "Log4j" }),
            ]);
            const sarif = convertToSARIF(result);
            const rules = sarif.runs[0].tool.driver.rules;
            expect(rules).toHaveLength(2);
            expect(rules.map((r) => r.id)).toContain("zap-40012");
            expect(rules.map((r) => r.id)).toContain("nuclei-CVE-2021-44228");
        });
        it("deduplicates rules", () => {
            const result = createMockAggregatedResult([
                createMockFinding({ ruleId: "zap-40012", url: "https://a.com" }),
                createMockFinding({ ruleId: "zap-40012", url: "https://b.com" }),
            ]);
            const sarif = convertToSARIF(result);
            expect(sarif.runs[0].tool.driver.rules).toHaveLength(1);
            expect(sarif.runs[0].results).toHaveLength(2);
        });
        it("maps severity to SARIF levels", () => {
            const result = createMockAggregatedResult([
                createMockFinding({ severity: "critical", ruleId: "rule-1" }),
                createMockFinding({ severity: "high", ruleId: "rule-2" }),
                createMockFinding({ severity: "medium", ruleId: "rule-3" }),
                createMockFinding({ severity: "low", ruleId: "rule-4" }),
            ]);
            const sarif = convertToSARIF(result);
            const results = sarif.runs[0].results;
            const findLevel = (ruleId) => results.find((r) => r.ruleId === ruleId)?.level;
            expect(findLevel("rule-1")).toBe("error");
            expect(findLevel("rule-2")).toBe("error");
            expect(findLevel("rule-3")).toBe("warning");
            expect(findLevel("rule-4")).toBe("note");
        });
        it("includes finding properties", () => {
            const result = createMockAggregatedResult([
                createMockFinding({
                    scanner: "zap",
                    confidence: 90,
                    cweIds: ["CWE-79"],
                    cveIds: ["CVE-2021-12345"],
                    evidence: "test evidence",
                }),
            ]);
            const sarif = convertToSARIF(result);
            const props = sarif.runs[0].results[0].properties;
            expect(props.scanner).toBe("zap");
            expect(props.confidence).toBe(90);
            expect(props.cweIds).toContain("CWE-79");
            expect(props.cveIds).toContain("CVE-2021-12345");
            expect(props.evidence).toBe("test evidence");
        });
    });
    describe("getDASTInstallInstructions", () => {
        it("returns success message when all tools available", () => {
            const availability = [
                { scanner: "zap", available: true, version: "2.14.0" },
                { scanner: "nuclei", available: true, version: "3.1.0" },
            ];
            const result = getDASTInstallInstructions(availability);
            expect(result).toBe("All DAST tools are installed and available.");
        });
        it("returns ZAP instructions when ZAP unavailable", () => {
            const availability = [
                { scanner: "zap", available: false, error: "Not found" },
                { scanner: "nuclei", available: true, version: "3.1.0" },
            ];
            const result = getDASTInstallInstructions(availability);
            expect(result).toContain("OWASP ZAP");
            expect(result).toContain("docker pull owasp/zap2docker-stable");
        });
        it("returns Nuclei instructions when Nuclei unavailable", () => {
            const availability = [
                { scanner: "zap", available: true, version: "2.14.0" },
                { scanner: "nuclei", available: false, error: "Not found" },
            ];
            const result = getDASTInstallInstructions(availability);
            expect(result).toContain("Nuclei");
            expect(result).toContain("go install");
        });
        it("returns both instructions when both unavailable", () => {
            const availability = [
                { scanner: "zap", available: false, error: "Not found" },
                { scanner: "nuclei", available: false, error: "Not found" },
            ];
            const result = getDASTInstallInstructions(availability);
            expect(result).toContain("OWASP ZAP");
            expect(result).toContain("Nuclei");
            expect(result).toContain("docker pull owasp/zap2docker-stable");
            expect(result).toContain("go install");
        });
    });
});
function createMockFinding(overrides = {}) {
    return {
        scanner: "zap",
        ruleId: "zap-test",
        name: "Test Finding",
        description: "Test description",
        severity: "medium",
        confidence: 80,
        url: "https://example.com/test",
        timestamp: new Date().toISOString(),
        ...overrides,
    };
}
function createMockAggregatedResult(findings = [createMockFinding()]) {
    const target = { url: "https://example.com" };
    return {
        timestamp: new Date().toISOString(),
        target,
        scanners: [],
        totalFindings: findings.length,
        uniqueFindings: findings,
        bySeverity: {},
        byScanner: { zap: 0, nuclei: 0 },
        totalDuration: 1000,
        allSucceeded: true,
        failedScanners: [],
    };
}
//# sourceMappingURL=index.test.js.map