@avi770/testteam 3.0.0 → 3.2.0

package/agents/__tests__/34-xss-scanner.test.ts

@@ -1,258 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import type { ValidatedConfig } from '../../core/config';
-import type { Phase } from '../../core/types';
-
-// ---------------------------------------------------------------------------
-// Stub config helpers
-// ---------------------------------------------------------------------------
-
-function makeConfig(overrides: Partial<ValidatedConfig> = {}): ValidatedConfig {
-  return {
-    schemaVersion: 1,
-    name: 'test',
-    auth: {
-      loginUrl: 'http://localhost/login',
-      credentials: {
-        admin: { email: 'admin@test.com', password: 'secret' },
-      },
-    },
-    modules: [
-      { id: 'dashboard', route: '/dashboard', sidebarIcon: true },
-    ],
-    environments: {
-      alpha: { baseUrl: 'http://localhost:3000', seed: false },
-    },
-    portals: [],
-    breakpoints: [],
-    integrations: [],
-    workers: [],
-    workflows: [],
-    accuracy: { enabled: false, decimalPrecision: 2, currencySymbol: '$', timezone: 'UTC' },
-    tenancy: { enabled: false, isolationField: 'firmId', testFirms: [] },
-    costBudget: { maxPerRun: 100, maxPerAgent: 10, alertThreshold: 0.8, onExceeded: 'abort' },
-    agentClassification: { blocking: [], advisory: [34] },
-    thresholds: {
-      unitCoverage: { lines: 80, functions: 80, branches: 80, statements: 80 },
-      lighthouse: { accessibility: 90, performance: 90, bestPractices: 90, seo: 90 },
-      apiResponseTime: 2000,
-      bundleSizeLimit: 500000,
-      maxConsoleErrors: 0,
-    },
-    disabledAgents: [],
-    disabledAgentSet: new Set<number>(),
-    ...overrides,
-  };
-}
-
-// ---------------------------------------------------------------------------
-// Mock fetch
-// ---------------------------------------------------------------------------
-
-const fetchMock = vi.fn();
-vi.stubGlobal('fetch', fetchMock);
-
-// ---------------------------------------------------------------------------
-// Mock helpers
-// ---------------------------------------------------------------------------
-
-const loginMock = vi.fn().mockResolvedValue(undefined);
-
-vi.mock('../../helpers/navigation', () => ({
-  login: (...args: unknown[]) => loginMock(...args),
-  waitForSectionLoad: vi.fn().mockResolvedValue(undefined),
-  navigateToSection: vi.fn().mockResolvedValue(undefined),
-  switchPortal: vi.fn().mockResolvedValue(undefined),
-}));
-
-// ---------------------------------------------------------------------------
-// Mock Playwright
-// ---------------------------------------------------------------------------
-
-interface MockLocator {
-  count: ReturnType<typeof vi.fn>;
-  first: ReturnType<typeof vi.fn>;
-  nth: ReturnType<typeof vi.fn>;
-  fill: ReturnType<typeof vi.fn>;
-}
-
-function makeMockLocator(countVal = 0): MockLocator {
-  const locator: MockLocator = {
-    count: vi.fn().mockResolvedValue(countVal),
-    first: vi.fn(),
-    nth: vi.fn(),
-    fill: vi.fn().mockResolvedValue(undefined),
-  };
-  locator.first.mockReturnValue(locator);
-  locator.nth.mockReturnValue(locator);
-  return locator;
-}
-
-interface MockPage {
-  close: ReturnType<typeof vi.fn>;
-  goto: ReturnType<typeof vi.fn>;
-  locator: ReturnType<typeof vi.fn>;
-  on: ReturnType<typeof vi.fn>;
-  removeListener: ReturnType<typeof vi.fn>;
-}
-
-function makeMockPage(): MockPage {
-  const defaultLocator = makeMockLocator(0);
-  return {
-    close: vi.fn().mockResolvedValue(undefined),
-    goto: vi.fn().mockResolvedValue(undefined),
-    locator: vi.fn().mockReturnValue(defaultLocator),
-    on: vi.fn(),
-    removeListener: vi.fn(),
-  };
-}
-
-let currentMockPage: MockPage;
-let mockBrowser: { newPage: ReturnType<typeof vi.fn>; close: ReturnType<typeof vi.fn> };
-
-vi.mock('playwright', async () => ({
-  chromium: {
-    launch: vi.fn().mockImplementation(async () => mockBrowser),
-  },
-}));
-
-// ---------------------------------------------------------------------------
-// Dynamic import AFTER mocks
-// ---------------------------------------------------------------------------
-
-const { XssScannerAgent } = await import('../34-xss-scanner');
-
-function createAgent(
-  config: ValidatedConfig = makeConfig(),
-  phase: Phase = 'beta',
-): InstanceType<typeof XssScannerAgent> {
-  return new XssScannerAgent(config, phase, '/tmp/test-run');
-}
-
-// ---------------------------------------------------------------------------
-// Tests
-// ---------------------------------------------------------------------------
-
-describe('XssScannerAgent', () => {
-  beforeEach(() => {
-    fetchMock.mockReset().mockResolvedValue({ ok: true, status: 200 });
-    loginMock.mockReset().mockResolvedValue(undefined);
-
-    currentMockPage = makeMockPage();
-    mockBrowser = {
-      newPage: vi.fn().mockResolvedValue(currentMockPage),
-      close: vi.fn().mockResolvedValue(undefined),
-    };
-  });
-
-  it('has agentId 34 and correct agentName', () => {
-    const agent = createAgent();
-    expect(agent.agentId).toBe(34);
-    expect(agent.agentName).toBe('XSS Scanner');
-  });
-
-  it('throws when modules array is empty', async () => {
-    const config = makeConfig({ modules: [] });
-    const agent = createAgent(config);
-    const result = await agent.run();
-    expect(result.status).toBe('failed');
-    expect(result.findings[0].description).toContain('module');
-  });
-
-  it('produces low finding when no inputs found', async () => {
-    currentMockPage.locator.mockReturnValue(makeMockLocator(0));
-
-    const agent = createAgent();
-    const result = await agent.run();
-
-    const noInputs = result.findings.find(f => f.id.includes('no-inputs'));
-    expect(noInputs).toBeDefined();
-    expect(noInputs!.severity).toBe('low');
-  });
-
-  it('tests XSS payloads on discovered inputs', async () => {
-    const inputLocator = makeMockLocator(1);
-    currentMockPage.locator.mockReturnValue(inputLocator);
-
-    const agent = createAgent();
-    await agent.run();
-
-    expect(inputLocator.fill).toHaveBeenCalled();
-  });
-
-  it('registers and removes dialog listeners', async () => {
-    const inputLocator = makeMockLocator(1);
-    currentMockPage.locator.mockReturnValue(inputLocator);
-
-    const agent = createAgent();
-    await agent.run();
-
-    expect(currentMockPage.on).toHaveBeenCalledWith('dialog', expect.any(Function));
-    expect(currentMockPage.removeListener).toHaveBeenCalledWith('dialog', expect.any(Function));
-  });
-
-  it('produces medium finding when login fails', async () => {
-    loginMock.mockRejectedValue(new Error('Auth failed'));
-
-    const agent = createAgent();
-    const result = await agent.run();
-
-    const loginFinding = result.findings.find(f => f.id.includes('login-failed'));
-    expect(loginFinding).toBeDefined();
-    expect(loginFinding!.severity).toBe('medium');
-  });
-
-  it('produces medium finding when navigation fails', async () => {
-    currentMockPage.goto.mockRejectedValue(new Error('Navigation failed'));
-
-    const agent = createAgent();
-    const result = await agent.run();
-
-    const navFinding = result.findings.find(f => f.id.includes('nav-failed'));
-    expect(navFinding).toBeDefined();
-  });
-
-  it('produces medium finding when Playwright crashes', async () => {
-    mockBrowser.newPage.mockRejectedValue(new Error('Browser crashed'));
-
-    const agent = createAgent();
-    const result = await agent.run();
-
-    const pwFinding = result.findings.find(f => f.id.includes('playwright-failure'));
-    expect(pwFinding).toBeDefined();
-  });
-
-  it('closes browser even when an error occurs', async () => {
-    mockBrowser.newPage.mockRejectedValue(new Error('Launch error'));
-    const agent = createAgent();
-    await agent.run();
-    expect(mockBrowser.close).toHaveBeenCalled();
-  });
-
-  it('tests at most 3 modules', async () => {
-    const manyModules = Array.from({ length: 6 }, (_, i) => ({
-      id: `mod-${i}`, route: `/mod-${i}`, sidebarIcon: true,
-    }));
-    const config = makeConfig({ modules: manyModules });
-    currentMockPage.locator.mockReturnValue(makeMockLocator(0));
-
-    const agent = createAgent(config);
-    await agent.run();
-
-    const navCalls = currentMockPage.goto.mock.calls.filter(
-      (c: unknown[]) => typeof c[0] === 'string' && (c[0] as string).includes('/mod-'),
-    );
-    const uniqueModules = new Set(navCalls.map((c: unknown[]) => (c[0] as string)));
-    expect(uniqueModules.size).toBeLessThanOrEqual(3);
-  });
-
-  it('handles fill errors gracefully', async () => {
-    const inputLocator = makeMockLocator(1);
-    inputLocator.fill.mockRejectedValue(new Error('Fill failed'));
-    currentMockPage.locator.mockReturnValue(inputLocator);
-
-    const agent = createAgent();
-    const result = await agent.run();
-    // Should not crash
-    expect(result.status).toBeDefined();
-  });
-});

package/agents/__tests__/35-csrf-tester.test.ts

@@ -1,200 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import type { ValidatedConfig } from '../../core/config';
-import type { Phase } from '../../core/types';
-
-// ---------------------------------------------------------------------------
-// Stub config helpers
-// ---------------------------------------------------------------------------
-
-function makeConfig(overrides: Partial<ValidatedConfig> = {}): ValidatedConfig {
-  return {
-    schemaVersion: 1,
-    name: 'test',
-    auth: {
-      loginUrl: 'http://localhost/login',
-      credentials: {},
-    },
-    modules: [
-      { id: 'dashboard', route: '/dashboard', sidebarIcon: true },
-    ],
-    environments: {
-      alpha: { baseUrl: 'http://localhost:3000', seed: false },
-    },
-    portals: [],
-    breakpoints: [],
-    integrations: [],
-    workers: [],
-    workflows: [],
-    accuracy: { enabled: false, decimalPrecision: 2, currencySymbol: '$', timezone: 'UTC' },
-    tenancy: { enabled: false, isolationField: 'firmId', testFirms: [] },
-    costBudget: { maxPerRun: 100, maxPerAgent: 10, alertThreshold: 0.8, onExceeded: 'abort' },
-    agentClassification: { blocking: [], advisory: [35] },
-    thresholds: {
-      unitCoverage: { lines: 80, functions: 80, branches: 80, statements: 80 },
-      lighthouse: { accessibility: 90, performance: 90, bestPractices: 90, seo: 90 },
-      apiResponseTime: 2000,
-      bundleSizeLimit: 500000,
-      maxConsoleErrors: 0,
-    },
-    disabledAgents: [],
-    disabledAgentSet: new Set<number>(),
-    ...overrides,
-  };
-}
-
-// ---------------------------------------------------------------------------
-// Mock fetch
-// ---------------------------------------------------------------------------
-
-const fetchMock = vi.fn();
-vi.stubGlobal('fetch', fetchMock);
-
-// ---------------------------------------------------------------------------
-// Dynamic import AFTER mocks
-// ---------------------------------------------------------------------------
-
-const { CsrfTesterAgent } = await import('../35-csrf-tester');
-
-function createAgent(
-  config: ValidatedConfig = makeConfig(),
-  phase: Phase = 'beta',
-): InstanceType<typeof CsrfTesterAgent> {
-  return new CsrfTesterAgent(config, phase, '/tmp/test-run');
-}
-
-// ---------------------------------------------------------------------------
-// Tests
-// ---------------------------------------------------------------------------
-
-describe('CsrfTesterAgent', () => {
-  beforeEach(() => {
-    fetchMock.mockReset().mockResolvedValue({ ok: true, status: 200 });
-  });
-
-  it('has agentId 35 and correct agentName', () => {
-    const agent = createAgent();
-    expect(agent.agentId).toBe(35);
-    expect(agent.agentName).toBe('CSRF Tester');
-  });
-
-  it('produces high finding when POST returns 200 without CSRF', async () => {
-    fetchMock.mockResolvedValue({ ok: true, status: 200 });
-
-    const agent = createAgent();
-    const result = await agent.run();
-
-    const csrfFinding = result.findings.find(f => f.id.includes('no-csrf'));
-    expect(csrfFinding).toBeDefined();
-    expect(csrfFinding!.severity).toBe('high');
-  });
-
-  it('produces high finding when POST returns 201 without CSRF', async () => {
-    fetchMock
-      .mockResolvedValueOnce({ ok: true, status: 200 }) // env check
-      .mockResolvedValue({ ok: true, status: 201 });
-
-    const agent = createAgent();
-    const result = await agent.run();
-
-    const csrfFinding = result.findings.find(f => f.id.includes('no-csrf'));
-    expect(csrfFinding).toBeDefined();
-  });
-
-  it('does not flag when POST returns 403', async () => {
-    fetchMock
-      .mockResolvedValueOnce({ ok: true, status: 200 }) // env check
-      .mockResolvedValue({ ok: false, status: 403 });
-
-    const agent = createAgent();
-    const result = await agent.run();
-
-    const csrfFinding = result.findings.find(f => f.id.includes('no-csrf'));
-    expect(csrfFinding).toBeUndefined();
-  });
-
-  it('does not flag when POST returns 401', async () => {
-    fetchMock
-      .mockResolvedValueOnce({ ok: true, status: 200 }) // env check
-      .mockResolvedValue({ ok: false, status: 401 });
-
-    const agent = createAgent();
-    const result = await agent.run();
-
-    const csrfFinding = result.findings.find(f => f.id.includes('no-csrf'));
-    expect(csrfFinding).toBeUndefined();
-  });
-
-  it('handles fetch errors gracefully', async () => {
-    fetchMock
-      .mockResolvedValueOnce({ ok: true, status: 200 }) // env check
-      .mockRejectedValue(new Error('Network error'));
-
-    const agent = createAgent();
-    const result = await agent.run();
-
-    const errorFinding = result.findings.find(f => f.id.includes('request-failed'));
-    expect(errorFinding).toBeDefined();
-    expect(errorFinding!.severity).toBe('low');
-  });
-
-  it('tests module-derived endpoints', async () => {
-    const config = makeConfig({
-      modules: [{ id: 'invoices', route: '/invoices', sidebarIcon: true }],
-    });
-
-    fetchMock.mockResolvedValue({ ok: false, status: 403 });
-
-    const agent = createAgent(config);
-    await agent.run();
-
-    const invoiceCalls = fetchMock.mock.calls.filter(
-      (call: unknown[]) => typeof call[0] === 'string' && (call[0] as string).includes('/api/invoices'),
-    );
-    expect(invoiceCalls.length).toBeGreaterThan(0);
-  });
-
-  it('tests default endpoints when no modules', async () => {
-    const config = makeConfig({ modules: undefined as unknown as ValidatedConfig['modules'] });
-    fetchMock.mockResolvedValue({ ok: false, status: 403 });
-
-    const agent = createAgent(config);
-    await agent.run();
-
-    const loginCalls = fetchMock.mock.calls.filter(
-      (call: unknown[]) => typeof call[0] === 'string' && (call[0] as string).includes('/api/auth/login'),
-    );
-    expect(loginCalls.length).toBeGreaterThan(0);
-  });
-
-  it('records evidence for each endpoint test', async () => {
-    fetchMock.mockResolvedValue({ ok: false, status: 403 });
-
-    const agent = createAgent();
-    const result = await agent.run();
-
-    expect(result.evidence.length).toBeGreaterThan(0);
-  });
-
-  it('sends POST with JSON content type', async () => {
-    fetchMock.mockResolvedValue({ ok: false, status: 403 });
-
-    const agent = createAgent();
-    await agent.run();
-
-    const postCalls = fetchMock.mock.calls.filter(
-      (call: unknown[]) => {
-        const opts = call[1] as Record<string, unknown> | undefined;
-        return opts?.method === 'POST';
-      },
-    );
-    expect(postCalls.length).toBeGreaterThan(0);
-    const firstPost = postCalls[0][1] as Record<string, unknown>;
-    expect((firstPost.headers as Record<string, string>)['Content-Type']).toBe('application/json');
-  });
-
-  it('resolves environment in preFlight', async () => {
-    const agent = createAgent();
-    const result = await agent.run();
-    expect(result.findings.every(f => !f.description.includes('preFlight'))).toBe(true);
-  });
-});

package/agents/__tests__/36-auth-fuzzer.test.ts

@@ -1,214 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import type { ValidatedConfig } from '../../core/config';
-import type { Phase } from '../../core/types';
-
-// ---------------------------------------------------------------------------
-// Stub config helpers
-// ---------------------------------------------------------------------------
-
-function makeConfig(overrides: Partial<ValidatedConfig> = {}): ValidatedConfig {
-  return {
-    schemaVersion: 1,
-    name: 'test',
-    auth: {
-      loginUrl: 'http://localhost/login',
-      credentials: {},
-    },
-    modules: [],
-    environments: {
-      alpha: { baseUrl: 'http://localhost:3000', seed: false },
-    },
-    portals: [],
-    breakpoints: [],
-    integrations: [],
-    workers: [],
-    workflows: [],
-    accuracy: { enabled: false, decimalPrecision: 2, currencySymbol: '$', timezone: 'UTC' },
-    tenancy: { enabled: false, isolationField: 'firmId', testFirms: [] },
-    costBudget: { maxPerRun: 100, maxPerAgent: 10, alertThreshold: 0.8, onExceeded: 'abort' },
-    agentClassification: { blocking: [], advisory: [36] },
-    thresholds: {
-      unitCoverage: { lines: 80, functions: 80, branches: 80, statements: 80 },
-      lighthouse: { accessibility: 90, performance: 90, bestPractices: 90, seo: 90 },
-      apiResponseTime: 2000,
-      bundleSizeLimit: 500000,
-      maxConsoleErrors: 0,
-    },
-    disabledAgents: [],
-    disabledAgentSet: new Set<number>(),
-    ...overrides,
-  };
-}
-
-// ---------------------------------------------------------------------------
-// Mock fetch
-// ---------------------------------------------------------------------------
-
-const fetchMock = vi.fn();
-vi.stubGlobal('fetch', fetchMock);
-
-// ---------------------------------------------------------------------------
-// Dynamic import AFTER mocks
-// ---------------------------------------------------------------------------
-
-const { AuthFuzzerAgent } = await import('../36-auth-fuzzer');
-
-function createAgent(
-  config: ValidatedConfig = makeConfig(),
-  phase: Phase = 'beta',
-): InstanceType<typeof AuthFuzzerAgent> {
-  return new AuthFuzzerAgent(config, phase, '/tmp/test-run');
-}
-
-// ---------------------------------------------------------------------------
-// Tests
-// ---------------------------------------------------------------------------
-
-describe('AuthFuzzerAgent', () => {
-  beforeEach(() => {
-    fetchMock.mockReset().mockResolvedValue({ ok: false, status: 401 });
-  });
-
-  it('has agentId 36 and correct agentName', () => {
-    const agent = createAgent();
-    expect(agent.agentId).toBe(36);
-    expect(agent.agentName).toBe('Auth Fuzzer');
-  });
-
-  it('detects SQL injection vulnerability when login succeeds with malicious input', async () => {
-    fetchMock.mockResolvedValue({ ok: true, status: 200 });
-
-    const agent = createAgent();
-    const result = await agent.run();
-
-    const sqlFinding = result.findings.find(f => f.id.includes('sql-injection-login'));
-    expect(sqlFinding).toBeDefined();
-    expect(sqlFinding!.severity).toBe('critical');
-  });
-
-  it('does not flag SQL injection when login returns 401', async () => {
-    fetchMock.mockResolvedValue({ ok: false, status: 401 });
-
-    const agent = createAgent();
-    const result = await agent.run();
-
-    const sqlFinding = result.findings.find(f => f.id.includes('sql-injection-login'));
-    expect(sqlFinding).toBeUndefined();
-  });
-
-  it('detects missing account lockout when no 429 received', async () => {
-    fetchMock.mockResolvedValue({ ok: false, status: 401 });
-
-    const agent = createAgent();
-    const result = await agent.run();
-
-    const lockoutFinding = result.findings.find(f => f.id.includes('no-lockout'));
-    expect(lockoutFinding).toBeDefined();
-    expect(lockoutFinding!.severity).toBe('medium');
-  });
-
-  it('does not flag lockout when 429 is received', async () => {
-    let callCount = 0;
-    fetchMock.mockImplementation(() => {
-      callCount++;
-      if (callCount <= 1) return Promise.resolve({ ok: true, status: 200 }); // env check
-      if (callCount === 2) return Promise.resolve({ ok: false, status: 401 }); // SQL injection test
-      if (callCount <= 7) return Promise.resolve({ ok: false, status: 401 }); // lockout attempts
-      return Promise.resolve({ ok: false, status: 429 }); // lockout triggered
-    });
-
-    const agent = createAgent();
-    const result = await agent.run();
-
-    const lockoutFinding = result.findings.find(f => f.id.includes('no-lockout'));
-    expect(lockoutFinding).toBeUndefined();
-  });
-
-  it('detects JWT alg:none bypass when protected endpoint returns 200', async () => {
-    let callCount = 0;
-    fetchMock.mockImplementation(() => {
-      callCount++;
-      if (callCount <= 1) return Promise.resolve({ ok: true, status: 200 }); // env check
-      if (callCount === 2) return Promise.resolve({ ok: false, status: 401 }); // SQL injection
-      // lockout attempts - return 401
-      if (callCount <= 12) return Promise.resolve({ ok: false, status: 401 });
-      // JWT alg:none - return 200 (vulnerability!)
-      return Promise.resolve({ ok: true, status: 200 });
-    });
-
-    const agent = createAgent();
-    const result = await agent.run();
-
-    const jwtFinding = result.findings.find(f => f.id.includes('jwt-alg-none'));
-    expect(jwtFinding).toBeDefined();
-    expect(jwtFinding!.severity).toBe('critical');
-  });
-
-  it('does not flag JWT bypass when protected endpoint returns 401', async () => {
-    fetchMock.mockResolvedValue({ ok: false, status: 401 });
-
-    const agent = createAgent();
-    const result = await agent.run();
-
-    const jwtFinding = result.findings.find(f => f.id.includes('jwt-alg-none'));
-    expect(jwtFinding).toBeUndefined();
-  });
-
-  it('handles fetch errors gracefully for SQL injection test', async () => {
-    fetchMock
-      .mockResolvedValueOnce({ ok: true, status: 200 }) // env check
-      .mockRejectedValue(new Error('Network error'));
-
-    const agent = createAgent();
-    const result = await agent.run();
-
-    const errorFinding = result.findings.find(f => f.id.includes('sql-injection-error'));
-    expect(errorFinding).toBeDefined();
-  });
-
-  it('handles fetch errors gracefully for JWT test', async () => {
-    let callCount = 0;
-    fetchMock.mockImplementation(() => {
-      callCount++;
-      if (callCount <= 1) return Promise.resolve({ ok: true, status: 200 }); // env check
-      if (callCount === 2) return Promise.resolve({ ok: false, status: 401 }); // SQL injection
-      if (callCount <= 12) return Promise.resolve({ ok: false, status: 401 }); // lockout
-      return Promise.reject(new Error('Connection refused')); // JWT test
-    });
-
-    const agent = createAgent();
-    const result = await agent.run();
-
-    const jwtError = result.findings.find(f => f.id.includes('jwt-test-error'));
-    expect(jwtError).toBeDefined();
-  });
-
-  it('records evidence for each test', async () => {
-    fetchMock.mockResolvedValue({ ok: false, status: 401 });
-
-    const agent = createAgent();
-    const result = await agent.run();
-
-    expect(result.evidence.length).toBeGreaterThanOrEqual(2);
-  });
-
-  it('resolves environment in preFlight', async () => {
-    const agent = createAgent();
-    const result = await agent.run();
-    expect(result.findings.every(f => !f.description.includes('preFlight'))).toBe(true);
-  });
-
-  it('sends SQL injection payload in request body', async () => {
-    fetchMock.mockResolvedValue({ ok: false, status: 401 });
-
-    const agent = createAgent();
-    await agent.run();
-
-    const sqlCall = fetchMock.mock.calls.find((call: unknown[]) => {
-      const opts = call[1] as Record<string, unknown> | undefined;
-      const body = opts?.body as string | undefined;
-      return body?.includes("OR 1=1");
-    });
-    expect(sqlCall).toBeDefined();
-  });
-});