import test from 'node:test';
import assert from 'node:assert/strict';
import { synthesizeAndInjectPatch } from '../dist/patch/patch_engine.js';

test('Patch Engine: Rewrites vulnerable template SQL into parameterized query', () => {
  const vuln = 'const res = await db.query(`SELECT * FROM users WHERE email = ${email} AND status = ${status}`);';
  const result = synthesizeAndInjectPatch({ sourceCode: vuln, filename: 'auth.ts' });

  assert.equal(result.applied, true);
  assert.ok(result.patchedCode.includes("db.query('SELECT * FROM users WHERE email = $1 AND status = $2', [email, status])"));
  assert.ok(result.diff.includes('+'));
});

test('Patch Engine: Injects security headers into Express server setup', () => {
  const code = `
    import express from 'express';
    const app = express();
    app.listen(3000);
  `;
  const result = synthesizeAndInjectPatch({ sourceCode: code, filename: 'server.ts' });

  assert.equal(result.applied, true);
  assert.ok(result.patchedCode.includes('Content-Security-Policy'));
  assert.ok(result.patchedCode.includes('Strict-Transport-Security'));
});

test('Patch Engine: Sanitizes plain innerHTML assignments into textContent', () => {
  const code = 'document.getElementById("status").innerHTML = message;';
  const result = synthesizeAndInjectPatch({ sourceCode: code });

  assert.equal(result.applied, true);
  assert.ok(result.patchedCode.includes('.textContent = message;'));
});