import { describe, it, expect } from "vitest";
import { formatLogicResults, getVulnerabilityDescription, } from "../../../scanners/logic/index.js";
describe("logic index", () => {
    describe("formatLogicResults", () => {
        it("formats empty results", () => {
            const result = {
                projectPath: "/test",
                framework: "nextjs",
                endpoints: [],
                vulnerabilities: [],
                findings: [],
                stats: {
                    filesAnalyzed: 0,
                    endpointsFound: 0,
                    vulnerabilitiesFound: 0,
                    bySeverity: {},
                    byVulnType: {},
                },
                duration: 1000,
                success: true,
            };
            const output = formatLogicResults(result);
            expect(output).toContain("Business Logic Security Scan");
            expect(output).toContain("Framework**: nextjs");
            expect(output).toContain("No authorization vulnerabilities detected");
        });
        it("formats results with vulnerabilities", () => {
            const vuln = {
                vulnType: "bola",
                name: "Broken Object Level Authorization",
                description: "Endpoint accesses user data without ownership check",
                severity: "high",
                confidence: 80,
                endpoint: "/api/users/:id",
                method: "GET",
                file: "src/routes/users.ts",
                line: 15,
                authCheck: { present: true, bypassable: false },
                cweIds: ["CWE-639"],
                owaspRefs: ["OWASP API1:2023"],
                remediation: "Add ownership verification",
            };
            const result = {
                projectPath: "/test",
                framework: "express",
                endpoints: [],
                vulnerabilities: [vuln],
                findings: [],
                stats: {
                    filesAnalyzed: 5,
                    endpointsFound: 10,
                    vulnerabilitiesFound: 1,
                    bySeverity: { high: 1 },
                    byVulnType: { bola: 1 },
                },
                duration: 2000,
                success: true,
            };
            const output = formatLogicResults(result);
            expect(output).toContain("HIGH (1)");
            expect(output).toContain("Broken Object Level Authorization");
            expect(output).toContain("/api/users/:id");
            expect(output).toContain("CWE-639");
            expect(output).toContain("OWASP API1:2023");
        });
        it("handles failed scans", () => {
            const result = {
                projectPath: "/test",
                framework: "auto",
                endpoints: [],
                vulnerabilities: [],
                findings: [],
                stats: {
                    filesAnalyzed: 0,
                    endpointsFound: 0,
                    vulnerabilitiesFound: 0,
                    bySeverity: {},
                    byVulnType: {},
                },
                duration: 100,
                success: false,
                error: "Failed to read project files",
            };
            const output = formatLogicResults(result);
            expect(output).toContain("Error");
            expect(output).toContain("Failed to read project files");
        });
        it("groups vulnerabilities by severity", () => {
            const criticalVuln = {
                vulnType: "missing-auth",
                name: "Missing Authentication",
                description: "No auth required",
                severity: "critical",
                confidence: 90,
                endpoint: "/api/admin",
                method: "DELETE",
                file: "src/routes/admin.ts",
                line: 5,
                authCheck: { present: false, bypassable: false },
                cweIds: ["CWE-306"],
                owaspRefs: ["OWASP API2:2023"],
                remediation: "Add authentication",
            };
            const highVuln = {
                vulnType: "bola",
                name: "BOLA",
                description: "BOLA vuln",
                severity: "high",
                confidence: 80,
                endpoint: "/api/orders/:id",
                method: "GET",
                file: "src/routes/orders.ts",
                line: 10,
                authCheck: { present: true, bypassable: false },
                cweIds: ["CWE-639"],
                owaspRefs: ["OWASP API1:2023"],
                remediation: "Add ownership check",
            };
            const result = {
                projectPath: "/test",
                framework: "express",
                endpoints: [],
                vulnerabilities: [highVuln, criticalVuln], // Order shouldn't matter
                findings: [],
                stats: {
                    filesAnalyzed: 2,
                    endpointsFound: 2,
                    vulnerabilitiesFound: 2,
                    bySeverity: { critical: 1, high: 1 },
                    byVulnType: { "missing-auth": 1, bola: 1 },
                },
                duration: 1000,
                success: true,
            };
            const output = formatLogicResults(result);
            // Critical should appear before high
            const criticalIndex = output.indexOf("CRITICAL");
            const highIndex = output.indexOf("HIGH");
            expect(criticalIndex).toBeLessThan(highIndex);
        });
    });
    describe("getVulnerabilityDescription", () => {
        it("returns description for BOLA", () => {
            const desc = getVulnerabilityDescription("bola");
            expect(desc.name).toBe("Broken Object Level Authorization");
            expect(desc.description).toContain("API");
            expect(desc.cweIds).toContain("CWE-639");
            expect(desc.owaspRefs).toContain("OWASP API1:2023");
            expect(desc.severity).toBe("high");
        });
        it("returns description for missing-auth", () => {
            const desc = getVulnerabilityDescription("missing-auth");
            expect(desc.name).toBe("Missing Authentication");
            expect(desc.cweIds).toContain("CWE-306");
            expect(desc.severity).toBe("critical");
        });
        it("returns description for mass-assignment", () => {
            const desc = getVulnerabilityDescription("mass-assignment");
            expect(desc.name).toBe("Mass Assignment");
            expect(desc.cweIds).toContain("CWE-915");
            expect(desc.severity).toBe("medium");
        });
    });
});
//# sourceMappingURL=index.test.js.map