@avi770/testteam 1.2.0 → 3.0.0

package/agents/__tests__/34-xss-scanner.test.ts

@@ -0,0 +1,258 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { ValidatedConfig } from '../../core/config';
+import type { Phase } from '../../core/types';
+
+// ---------------------------------------------------------------------------
+// Stub config helpers
+// ---------------------------------------------------------------------------
+
+function makeConfig(overrides: Partial<ValidatedConfig> = {}): ValidatedConfig {
+  return {
+    schemaVersion: 1,
+    name: 'test',
+    auth: {
+      loginUrl: 'http://localhost/login',
+      credentials: {
+        admin: { email: 'admin@test.com', password: 'secret' },
+      },
+    },
+    modules: [
+      { id: 'dashboard', route: '/dashboard', sidebarIcon: true },
+    ],
+    environments: {
+      alpha: { baseUrl: 'http://localhost:3000', seed: false },
+    },
+    portals: [],
+    breakpoints: [],
+    integrations: [],
+    workers: [],
+    workflows: [],
+    accuracy: { enabled: false, decimalPrecision: 2, currencySymbol: '$', timezone: 'UTC' },
+    tenancy: { enabled: false, isolationField: 'firmId', testFirms: [] },
+    costBudget: { maxPerRun: 100, maxPerAgent: 10, alertThreshold: 0.8, onExceeded: 'abort' },
+    agentClassification: { blocking: [], advisory: [34] },
+    thresholds: {
+      unitCoverage: { lines: 80, functions: 80, branches: 80, statements: 80 },
+      lighthouse: { accessibility: 90, performance: 90, bestPractices: 90, seo: 90 },
+      apiResponseTime: 2000,
+      bundleSizeLimit: 500000,
+      maxConsoleErrors: 0,
+    },
+    disabledAgents: [],
+    disabledAgentSet: new Set<number>(),
+    ...overrides,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Mock fetch
+// ---------------------------------------------------------------------------
+
+const fetchMock = vi.fn();
+vi.stubGlobal('fetch', fetchMock);
+
+// ---------------------------------------------------------------------------
+// Mock helpers
+// ---------------------------------------------------------------------------
+
+const loginMock = vi.fn().mockResolvedValue(undefined);
+
+vi.mock('../../helpers/navigation', () => ({
+  login: (...args: unknown[]) => loginMock(...args),
+  waitForSectionLoad: vi.fn().mockResolvedValue(undefined),
+  navigateToSection: vi.fn().mockResolvedValue(undefined),
+  switchPortal: vi.fn().mockResolvedValue(undefined),
+}));
+
+// ---------------------------------------------------------------------------
+// Mock Playwright
+// ---------------------------------------------------------------------------
+
+interface MockLocator {
+  count: ReturnType<typeof vi.fn>;
+  first: ReturnType<typeof vi.fn>;
+  nth: ReturnType<typeof vi.fn>;
+  fill: ReturnType<typeof vi.fn>;
+}
+
+function makeMockLocator(countVal = 0): MockLocator {
+  const locator: MockLocator = {
+    count: vi.fn().mockResolvedValue(countVal),
+    first: vi.fn(),
+    nth: vi.fn(),
+    fill: vi.fn().mockResolvedValue(undefined),
+  };
+  locator.first.mockReturnValue(locator);
+  locator.nth.mockReturnValue(locator);
+  return locator;
+}
+
+interface MockPage {
+  close: ReturnType<typeof vi.fn>;
+  goto: ReturnType<typeof vi.fn>;
+  locator: ReturnType<typeof vi.fn>;
+  on: ReturnType<typeof vi.fn>;
+  removeListener: ReturnType<typeof vi.fn>;
+}
+
+function makeMockPage(): MockPage {
+  const defaultLocator = makeMockLocator(0);
+  return {
+    close: vi.fn().mockResolvedValue(undefined),
+    goto: vi.fn().mockResolvedValue(undefined),
+    locator: vi.fn().mockReturnValue(defaultLocator),
+    on: vi.fn(),
+    removeListener: vi.fn(),
+  };
+}
+
+let currentMockPage: MockPage;
+let mockBrowser: { newPage: ReturnType<typeof vi.fn>; close: ReturnType<typeof vi.fn> };
+
+vi.mock('playwright', async () => ({
+  chromium: {
+    launch: vi.fn().mockImplementation(async () => mockBrowser),
+  },
+}));
+
+// ---------------------------------------------------------------------------
+// Dynamic import AFTER mocks
+// ---------------------------------------------------------------------------
+
+const { XssScannerAgent } = await import('../34-xss-scanner');
+
+function createAgent(
+  config: ValidatedConfig = makeConfig(),
+  phase: Phase = 'beta',
+): InstanceType<typeof XssScannerAgent> {
+  return new XssScannerAgent(config, phase, '/tmp/test-run');
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe('XssScannerAgent', () => {
+  beforeEach(() => {
+    fetchMock.mockReset().mockResolvedValue({ ok: true, status: 200 });
+    loginMock.mockReset().mockResolvedValue(undefined);
+
+    currentMockPage = makeMockPage();
+    mockBrowser = {
+      newPage: vi.fn().mockResolvedValue(currentMockPage),
+      close: vi.fn().mockResolvedValue(undefined),
+    };
+  });
+
+  it('has agentId 34 and correct agentName', () => {
+    const agent = createAgent();
+    expect(agent.agentId).toBe(34);
+    expect(agent.agentName).toBe('XSS Scanner');
+  });
+
+  it('throws when modules array is empty', async () => {
+    const config = makeConfig({ modules: [] });
+    const agent = createAgent(config);
+    const result = await agent.run();
+    expect(result.status).toBe('failed');
+    expect(result.findings[0].description).toContain('module');
+  });
+
+  it('produces low finding when no inputs found', async () => {
+    currentMockPage.locator.mockReturnValue(makeMockLocator(0));
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const noInputs = result.findings.find(f => f.id.includes('no-inputs'));
+    expect(noInputs).toBeDefined();
+    expect(noInputs!.severity).toBe('low');
+  });
+
+  it('tests XSS payloads on discovered inputs', async () => {
+    const inputLocator = makeMockLocator(1);
+    currentMockPage.locator.mockReturnValue(inputLocator);
+
+    const agent = createAgent();
+    await agent.run();
+
+    expect(inputLocator.fill).toHaveBeenCalled();
+  });
+
+  it('registers and removes dialog listeners', async () => {
+    const inputLocator = makeMockLocator(1);
+    currentMockPage.locator.mockReturnValue(inputLocator);
+
+    const agent = createAgent();
+    await agent.run();
+
+    expect(currentMockPage.on).toHaveBeenCalledWith('dialog', expect.any(Function));
+    expect(currentMockPage.removeListener).toHaveBeenCalledWith('dialog', expect.any(Function));
+  });
+
+  it('produces medium finding when login fails', async () => {
+    loginMock.mockRejectedValue(new Error('Auth failed'));
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const loginFinding = result.findings.find(f => f.id.includes('login-failed'));
+    expect(loginFinding).toBeDefined();
+    expect(loginFinding!.severity).toBe('medium');
+  });
+
+  it('produces medium finding when navigation fails', async () => {
+    currentMockPage.goto.mockRejectedValue(new Error('Navigation failed'));
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const navFinding = result.findings.find(f => f.id.includes('nav-failed'));
+    expect(navFinding).toBeDefined();
+  });
+
+  it('produces medium finding when Playwright crashes', async () => {
+    mockBrowser.newPage.mockRejectedValue(new Error('Browser crashed'));
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const pwFinding = result.findings.find(f => f.id.includes('playwright-failure'));
+    expect(pwFinding).toBeDefined();
+  });
+
+  it('closes browser even when an error occurs', async () => {
+    mockBrowser.newPage.mockRejectedValue(new Error('Launch error'));
+    const agent = createAgent();
+    await agent.run();
+    expect(mockBrowser.close).toHaveBeenCalled();
+  });
+
+  it('tests at most 3 modules', async () => {
+    const manyModules = Array.from({ length: 6 }, (_, i) => ({
+      id: `mod-${i}`, route: `/mod-${i}`, sidebarIcon: true,
+    }));
+    const config = makeConfig({ modules: manyModules });
+    currentMockPage.locator.mockReturnValue(makeMockLocator(0));
+
+    const agent = createAgent(config);
+    await agent.run();
+
+    const navCalls = currentMockPage.goto.mock.calls.filter(
+      (c: unknown[]) => typeof c[0] === 'string' && (c[0] as string).includes('/mod-'),
+    );
+    const uniqueModules = new Set(navCalls.map((c: unknown[]) => (c[0] as string)));
+    expect(uniqueModules.size).toBeLessThanOrEqual(3);
+  });
+
+  it('handles fill errors gracefully', async () => {
+    const inputLocator = makeMockLocator(1);
+    inputLocator.fill.mockRejectedValue(new Error('Fill failed'));
+    currentMockPage.locator.mockReturnValue(inputLocator);
+
+    const agent = createAgent();
+    const result = await agent.run();
+    // Should not crash
+    expect(result.status).toBeDefined();
+  });
+});

package/agents/__tests__/35-csrf-tester.test.ts

@@ -0,0 +1,200 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { ValidatedConfig } from '../../core/config';
+import type { Phase } from '../../core/types';
+
+// ---------------------------------------------------------------------------
+// Stub config helpers
+// ---------------------------------------------------------------------------
+
+function makeConfig(overrides: Partial<ValidatedConfig> = {}): ValidatedConfig {
+  return {
+    schemaVersion: 1,
+    name: 'test',
+    auth: {
+      loginUrl: 'http://localhost/login',
+      credentials: {},
+    },
+    modules: [
+      { id: 'dashboard', route: '/dashboard', sidebarIcon: true },
+    ],
+    environments: {
+      alpha: { baseUrl: 'http://localhost:3000', seed: false },
+    },
+    portals: [],
+    breakpoints: [],
+    integrations: [],
+    workers: [],
+    workflows: [],
+    accuracy: { enabled: false, decimalPrecision: 2, currencySymbol: '$', timezone: 'UTC' },
+    tenancy: { enabled: false, isolationField: 'firmId', testFirms: [] },
+    costBudget: { maxPerRun: 100, maxPerAgent: 10, alertThreshold: 0.8, onExceeded: 'abort' },
+    agentClassification: { blocking: [], advisory: [35] },
+    thresholds: {
+      unitCoverage: { lines: 80, functions: 80, branches: 80, statements: 80 },
+      lighthouse: { accessibility: 90, performance: 90, bestPractices: 90, seo: 90 },
+      apiResponseTime: 2000,
+      bundleSizeLimit: 500000,
+      maxConsoleErrors: 0,
+    },
+    disabledAgents: [],
+    disabledAgentSet: new Set<number>(),
+    ...overrides,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Mock fetch
+// ---------------------------------------------------------------------------
+
+const fetchMock = vi.fn();
+vi.stubGlobal('fetch', fetchMock);
+
+// ---------------------------------------------------------------------------
+// Dynamic import AFTER mocks
+// ---------------------------------------------------------------------------
+
+const { CsrfTesterAgent } = await import('../35-csrf-tester');
+
+function createAgent(
+  config: ValidatedConfig = makeConfig(),
+  phase: Phase = 'beta',
+): InstanceType<typeof CsrfTesterAgent> {
+  return new CsrfTesterAgent(config, phase, '/tmp/test-run');
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe('CsrfTesterAgent', () => {
+  beforeEach(() => {
+    fetchMock.mockReset().mockResolvedValue({ ok: true, status: 200 });
+  });
+
+  it('has agentId 35 and correct agentName', () => {
+    const agent = createAgent();
+    expect(agent.agentId).toBe(35);
+    expect(agent.agentName).toBe('CSRF Tester');
+  });
+
+  it('produces high finding when POST returns 200 without CSRF', async () => {
+    fetchMock.mockResolvedValue({ ok: true, status: 200 });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const csrfFinding = result.findings.find(f => f.id.includes('no-csrf'));
+    expect(csrfFinding).toBeDefined();
+    expect(csrfFinding!.severity).toBe('high');
+  });
+
+  it('produces high finding when POST returns 201 without CSRF', async () => {
+    fetchMock
+      .mockResolvedValueOnce({ ok: true, status: 200 }) // env check
+      .mockResolvedValue({ ok: true, status: 201 });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const csrfFinding = result.findings.find(f => f.id.includes('no-csrf'));
+    expect(csrfFinding).toBeDefined();
+  });
+
+  it('does not flag when POST returns 403', async () => {
+    fetchMock
+      .mockResolvedValueOnce({ ok: true, status: 200 }) // env check
+      .mockResolvedValue({ ok: false, status: 403 });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const csrfFinding = result.findings.find(f => f.id.includes('no-csrf'));
+    expect(csrfFinding).toBeUndefined();
+  });
+
+  it('does not flag when POST returns 401', async () => {
+    fetchMock
+      .mockResolvedValueOnce({ ok: true, status: 200 }) // env check
+      .mockResolvedValue({ ok: false, status: 401 });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const csrfFinding = result.findings.find(f => f.id.includes('no-csrf'));
+    expect(csrfFinding).toBeUndefined();
+  });
+
+  it('handles fetch errors gracefully', async () => {
+    fetchMock
+      .mockResolvedValueOnce({ ok: true, status: 200 }) // env check
+      .mockRejectedValue(new Error('Network error'));
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const errorFinding = result.findings.find(f => f.id.includes('request-failed'));
+    expect(errorFinding).toBeDefined();
+    expect(errorFinding!.severity).toBe('low');
+  });
+
+  it('tests module-derived endpoints', async () => {
+    const config = makeConfig({
+      modules: [{ id: 'invoices', route: '/invoices', sidebarIcon: true }],
+    });
+
+    fetchMock.mockResolvedValue({ ok: false, status: 403 });
+
+    const agent = createAgent(config);
+    await agent.run();
+
+    const invoiceCalls = fetchMock.mock.calls.filter(
+      (call: unknown[]) => typeof call[0] === 'string' && (call[0] as string).includes('/api/invoices'),
+    );
+    expect(invoiceCalls.length).toBeGreaterThan(0);
+  });
+
+  it('tests default endpoints when no modules', async () => {
+    const config = makeConfig({ modules: undefined as unknown as ValidatedConfig['modules'] });
+    fetchMock.mockResolvedValue({ ok: false, status: 403 });
+
+    const agent = createAgent(config);
+    await agent.run();
+
+    const loginCalls = fetchMock.mock.calls.filter(
+      (call: unknown[]) => typeof call[0] === 'string' && (call[0] as string).includes('/api/auth/login'),
+    );
+    expect(loginCalls.length).toBeGreaterThan(0);
+  });
+
+  it('records evidence for each endpoint test', async () => {
+    fetchMock.mockResolvedValue({ ok: false, status: 403 });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    expect(result.evidence.length).toBeGreaterThan(0);
+  });
+
+  it('sends POST with JSON content type', async () => {
+    fetchMock.mockResolvedValue({ ok: false, status: 403 });
+
+    const agent = createAgent();
+    await agent.run();
+
+    const postCalls = fetchMock.mock.calls.filter(
+      (call: unknown[]) => {
+        const opts = call[1] as Record<string, unknown> | undefined;
+        return opts?.method === 'POST';
+      },
+    );
+    expect(postCalls.length).toBeGreaterThan(0);
+    const firstPost = postCalls[0][1] as Record<string, unknown>;
+    expect((firstPost.headers as Record<string, string>)['Content-Type']).toBe('application/json');
+  });
+
+  it('resolves environment in preFlight', async () => {
+    const agent = createAgent();
+    const result = await agent.run();
+    expect(result.findings.every(f => !f.description.includes('preFlight'))).toBe(true);
+  });
+});

package/agents/__tests__/36-auth-fuzzer.test.ts

@@ -0,0 +1,214 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { ValidatedConfig } from '../../core/config';
+import type { Phase } from '../../core/types';
+
+// ---------------------------------------------------------------------------
+// Stub config helpers
+// ---------------------------------------------------------------------------
+
+function makeConfig(overrides: Partial<ValidatedConfig> = {}): ValidatedConfig {
+  return {
+    schemaVersion: 1,
+    name: 'test',
+    auth: {
+      loginUrl: 'http://localhost/login',
+      credentials: {},
+    },
+    modules: [],
+    environments: {
+      alpha: { baseUrl: 'http://localhost:3000', seed: false },
+    },
+    portals: [],
+    breakpoints: [],
+    integrations: [],
+    workers: [],
+    workflows: [],
+    accuracy: { enabled: false, decimalPrecision: 2, currencySymbol: '$', timezone: 'UTC' },
+    tenancy: { enabled: false, isolationField: 'firmId', testFirms: [] },
+    costBudget: { maxPerRun: 100, maxPerAgent: 10, alertThreshold: 0.8, onExceeded: 'abort' },
+    agentClassification: { blocking: [], advisory: [36] },
+    thresholds: {
+      unitCoverage: { lines: 80, functions: 80, branches: 80, statements: 80 },
+      lighthouse: { accessibility: 90, performance: 90, bestPractices: 90, seo: 90 },
+      apiResponseTime: 2000,
+      bundleSizeLimit: 500000,
+      maxConsoleErrors: 0,
+    },
+    disabledAgents: [],
+    disabledAgentSet: new Set<number>(),
+    ...overrides,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Mock fetch
+// ---------------------------------------------------------------------------
+
+const fetchMock = vi.fn();
+vi.stubGlobal('fetch', fetchMock);
+
+// ---------------------------------------------------------------------------
+// Dynamic import AFTER mocks
+// ---------------------------------------------------------------------------
+
+const { AuthFuzzerAgent } = await import('../36-auth-fuzzer');
+
+function createAgent(
+  config: ValidatedConfig = makeConfig(),
+  phase: Phase = 'beta',
+): InstanceType<typeof AuthFuzzerAgent> {
+  return new AuthFuzzerAgent(config, phase, '/tmp/test-run');
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe('AuthFuzzerAgent', () => {
+  beforeEach(() => {
+    fetchMock.mockReset().mockResolvedValue({ ok: false, status: 401 });
+  });
+
+  it('has agentId 36 and correct agentName', () => {
+    const agent = createAgent();
+    expect(agent.agentId).toBe(36);
+    expect(agent.agentName).toBe('Auth Fuzzer');
+  });
+
+  it('detects SQL injection vulnerability when login succeeds with malicious input', async () => {
+    fetchMock.mockResolvedValue({ ok: true, status: 200 });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const sqlFinding = result.findings.find(f => f.id.includes('sql-injection-login'));
+    expect(sqlFinding).toBeDefined();
+    expect(sqlFinding!.severity).toBe('critical');
+  });
+
+  it('does not flag SQL injection when login returns 401', async () => {
+    fetchMock.mockResolvedValue({ ok: false, status: 401 });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const sqlFinding = result.findings.find(f => f.id.includes('sql-injection-login'));
+    expect(sqlFinding).toBeUndefined();
+  });
+
+  it('detects missing account lockout when no 429 received', async () => {
+    fetchMock.mockResolvedValue({ ok: false, status: 401 });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const lockoutFinding = result.findings.find(f => f.id.includes('no-lockout'));
+    expect(lockoutFinding).toBeDefined();
+    expect(lockoutFinding!.severity).toBe('medium');
+  });
+
+  it('does not flag lockout when 429 is received', async () => {
+    let callCount = 0;
+    fetchMock.mockImplementation(() => {
+      callCount++;
+      if (callCount <= 1) return Promise.resolve({ ok: true, status: 200 }); // env check
+      if (callCount === 2) return Promise.resolve({ ok: false, status: 401 }); // SQL injection test
+      if (callCount <= 7) return Promise.resolve({ ok: false, status: 401 }); // lockout attempts
+      return Promise.resolve({ ok: false, status: 429 }); // lockout triggered
+    });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const lockoutFinding = result.findings.find(f => f.id.includes('no-lockout'));
+    expect(lockoutFinding).toBeUndefined();
+  });
+
+  it('detects JWT alg:none bypass when protected endpoint returns 200', async () => {
+    let callCount = 0;
+    fetchMock.mockImplementation(() => {
+      callCount++;
+      if (callCount <= 1) return Promise.resolve({ ok: true, status: 200 }); // env check
+      if (callCount === 2) return Promise.resolve({ ok: false, status: 401 }); // SQL injection
+      // lockout attempts - return 401
+      if (callCount <= 12) return Promise.resolve({ ok: false, status: 401 });
+      // JWT alg:none - return 200 (vulnerability!)
+      return Promise.resolve({ ok: true, status: 200 });
+    });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const jwtFinding = result.findings.find(f => f.id.includes('jwt-alg-none'));
+    expect(jwtFinding).toBeDefined();
+    expect(jwtFinding!.severity).toBe('critical');
+  });
+
+  it('does not flag JWT bypass when protected endpoint returns 401', async () => {
+    fetchMock.mockResolvedValue({ ok: false, status: 401 });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const jwtFinding = result.findings.find(f => f.id.includes('jwt-alg-none'));
+    expect(jwtFinding).toBeUndefined();
+  });
+
+  it('handles fetch errors gracefully for SQL injection test', async () => {
+    fetchMock
+      .mockResolvedValueOnce({ ok: true, status: 200 }) // env check
+      .mockRejectedValue(new Error('Network error'));
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const errorFinding = result.findings.find(f => f.id.includes('sql-injection-error'));
+    expect(errorFinding).toBeDefined();
+  });
+
+  it('handles fetch errors gracefully for JWT test', async () => {
+    let callCount = 0;
+    fetchMock.mockImplementation(() => {
+      callCount++;
+      if (callCount <= 1) return Promise.resolve({ ok: true, status: 200 }); // env check
+      if (callCount === 2) return Promise.resolve({ ok: false, status: 401 }); // SQL injection
+      if (callCount <= 12) return Promise.resolve({ ok: false, status: 401 }); // lockout
+      return Promise.reject(new Error('Connection refused')); // JWT test
+    });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const jwtError = result.findings.find(f => f.id.includes('jwt-test-error'));
+    expect(jwtError).toBeDefined();
+  });
+
+  it('records evidence for each test', async () => {
+    fetchMock.mockResolvedValue({ ok: false, status: 401 });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    expect(result.evidence.length).toBeGreaterThanOrEqual(2);
+  });
+
+  it('resolves environment in preFlight', async () => {
+    const agent = createAgent();
+    const result = await agent.run();
+    expect(result.findings.every(f => !f.description.includes('preFlight'))).toBe(true);
+  });
+
+  it('sends SQL injection payload in request body', async () => {
+    fetchMock.mockResolvedValue({ ok: false, status: 401 });
+
+    const agent = createAgent();
+    await agent.run();
+
+    const sqlCall = fetchMock.mock.calls.find((call: unknown[]) => {
+      const opts = call[1] as Record<string, unknown> | undefined;
+      const body = opts?.body as string | undefined;
+      return body?.includes("OR 1=1");
+    });
+    expect(sqlCall).toBeDefined();
+  });
+});