/**
 * Demo: feed a handful of realistic recorded checks into the report renderer
 * and print the Markdown. This is the only part of pentest that's runnable
 * today (the scan entry point — driving the agent — is not built yet).
 *
 *   pnpm --filter @hover-dev/pentest exec tsx scripts/demo.ts
 */
import { renderFindingsReport } from '../src/index.js';
import type { SecurityCheckStep } from '@hover-dev/probe-engine';

const checks: SecurityCheckStep[] = [
  // IDOR confirmed, replayed as a second identity → High
  {
    id: 1, sourceFlowId: 'f1', replayId: 'r1',
    class: 'idor',
    intent: "IDOR: read another user's order",
    expectStatus: 403,
    request: { method: 'GET', url: 'https://shop.test/api/orders/1043', headers: { cookie: 'sid=AAA' }, bodyText: null },
    crossIdentity: { identityB: 'state/userB.json' },
    observed: { method: 'GET', url: 'https://shop.test/api/orders/1043', status: 200, statusMessage: 'OK', bodyExcerpt: '{"id":1043,"owner":"alice"}' },
    matched: false, recordedAt: 0,
  },
  // Mass-assignment confirmed (carries a body, with a secret to redact) → High
  {
    id: 2, sourceFlowId: 'f2', replayId: 'r2',
    class: 'mass-assignment',
    intent: 'Mass assignment: escalate own role to admin',
    expectStatus: 403,
    request: { method: 'PATCH', url: 'https://shop.test/api/me', headers: { 'content-type': 'application/json', cookie: 'sid=AAA' }, bodyText: '{"name":"me","role":"admin","password":"hunter2"}' },
    observed: { method: 'PATCH', url: 'https://shop.test/api/me', status: 200, statusMessage: 'OK', bodyExcerpt: '{"role":"admin"}' },
    matched: false, recordedAt: 0,
  },
  // A verified control (server denied as expected)
  {
    id: 3, sourceFlowId: 'f3', replayId: 'r3',
    class: 'idor',
    intent: "IDOR: read another user's invoice",
    expectStatus: 403,
    request: { method: 'GET', url: 'https://shop.test/api/invoices/77?token=supersecret', headers: { cookie: 'sid=AAA' }, bodyText: null },
    observed: { method: 'GET', url: 'https://shop.test/api/invoices/77?token=supersecret', status: 403, statusMessage: 'Forbidden', bodyExcerpt: null },
    matched: true, recordedAt: 0,
  },
  // Noise — suppressed by the gate, never a finding
  {
    id: 4, sourceFlowId: 'f4', replayId: 'r4',
    intent: 'Self-XSS in the profile bio field',
    expectStatus: 200,
    observed: { method: 'POST', url: 'https://shop.test/api/profile', status: 200, statusMessage: 'OK', bodyExcerpt: null },
    matched: false, recordedAt: 0,
  },
];

process.stdout.write(renderFindingsReport(checks, {
  name: 'shop.test',
  notTested: [
    'destructive probes (DELETE / state-changing) — re-run with --allow-destructive',
    'the /admin area — outside the requested scope ("checkout flow")',
    'blind SSRF on /webhook — only confirmable out-of-band (left as suspected)',
  ],
}));
