/**
 * Test Fixture: Audit Gaps
 *
 * This file contains intentional audit trail gaps that should be
 * detected by the healthcare scanner. Used for testing only.
 *
 * EXPECTED FINDINGS:
 * - PHI access without audit log (high)
 * - Missing user ID in audit entries (medium)
 * - Audit log without timestamp (medium)
 *
 * @module eval/fixtures/healthcare/audit-gaps
 */
// PHI access without audit logging - SHOULD BE DETECTED
export async function readPatientRecord(patientId, userId) {
    // No audit log call before or after PHI access
    const patient = await database.query(`SELECT * FROM patients WHERE id = ?`, [patientId]);
    return patient;
}
// Another missing audit log - SHOULD BE DETECTED
export async function updateMedicalRecord(patientId, updates) {
    await database.query(`UPDATE patients SET ? WHERE id = ?`, [updates, patientId]);
    // No audit trail for this modification
    return { success: true };
}
// Missing user ID in audit - SHOULD BE DETECTED
export async function viewPatientData(patientId) {
    await auditLog.write({
        action: "view_patient",
        resourceId: patientId,
        // Missing: userId
        timestamp: new Date().toISOString(),
    });
    return await fetchPatient(patientId);
}
// Audit log without timestamp - SHOULD BE DETECTED
export async function deletePatientData(patientId, userId) {
    await auditLog.write({
        action: "delete_patient",
        userId: userId,
        resourceId: patientId,
        // Missing: timestamp
    });
    return await database.delete("patients", patientId);
}
// Deletable audit log - SHOULD BE DETECTED
export async function clearAuditLogs(adminId) {
    // Audit logs should be immutable
    await database.query("DELETE FROM audit_logs WHERE created_at < ?", [thirtyDaysAgo()]);
}
// Simulated database and audit
const database = {
    query: async (sql, params) => ({}),
    delete: async (table, id) => true,
};
const auditLog = {
    write: async (entry) => true,
};
function thirtyDaysAgo() {
    return new Date(Date.now() - 30 * 24 * 60 * 60 * 1000).toISOString();
}
async function fetchPatient(id) {
    return { id, name: "Test Patient" };
}
// This is OK - proper audit trail
export async function properAuditedAccess(patientId, userId) {
    // Log before access
    await auditLog.write({
        action: "phi_access",
        userId: userId,
        resourceType: "patient",
        resourceId: patientId,
        timestamp: new Date().toISOString(),
        ipAddress: "127.0.0.1",
        outcome: "pending",
    });
    const patient = await fetchPatient(patientId);
    // Log after access with outcome
    await auditLog.write({
        action: "phi_access",
        userId: userId,
        resourceType: "patient",
        resourceId: patientId,
        timestamp: new Date().toISOString(),
        outcome: "success",
        dataAccessed: ["name", "dob", "mrn"],
    });
    return patient;
}
//# sourceMappingURL=audit-gaps.js.map