@oculum/scanner 1.0.9 → 1.0.11

package/src/rules/__tests__/framework-fixes.test.ts

@@ -0,0 +1,689 @@
+/**
+ * Tests for Framework-Aware Fix Suggestions (PRO-83)
+ */
+
+import {
+  FRAMEWORK_FIX_REGISTRY,
+  getFrameworkFix,
+} from '../framework-fixes'
+import type { FrameworkContext, DataAccessContext } from '../../utils/project-context-builder'
+import type { VulnerabilityCategory } from '../../types'
+
+// Helper to create a minimal FrameworkContext
+function createFrameworkContext(overrides: Partial<FrameworkContext> = {}): FrameworkContext {
+  return {
+    primary: undefined,
+    frontend: undefined,
+    isMonorepo: false,
+    usesTypeScript: false,
+    usesServerComponents: false,
+    usesServerActions: false,
+    ...overrides,
+  }
+}
+
+// Helper to create a minimal DataAccessContext
+function createDataAccessContext(overrides: Partial<DataAccessContext> = {}): DataAccessContext {
+  return {
+    usesParameterizedQueries: false,
+    hasRLS: false,
+    ...overrides,
+  }
+}
+
+describe('Framework-Aware Fix Suggestions', () => {
+  describe('FRAMEWORK_FIX_REGISTRY coverage', () => {
+    it('should have sql_injection fixes for major ORMs', () => {
+      const sqlFixes = FRAMEWORK_FIX_REGISTRY.sql_injection
+      expect(sqlFixes).toBeDefined()
+
+      expect(sqlFixes!.prisma).toBeDefined()
+      expect(sqlFixes!.drizzle).toBeDefined()
+      expect(sqlFixes!.supabase).toBeDefined()
+      expect(sqlFixes!.mongoose).toBeDefined()
+      expect(sqlFixes!.knex).toBeDefined()
+    })
+
+    it('should have missing_auth fixes for backend frameworks', () => {
+      const authFixes = FRAMEWORK_FIX_REGISTRY.missing_auth
+      expect(authFixes).toBeDefined()
+
+      expect(authFixes!.nextjs).toBeDefined()
+      expect(authFixes!.express).toBeDefined()
+      expect(authFixes!.fastify).toBeDefined()
+      expect(authFixes!.nestjs).toBeDefined()
+    })
+
+    it('should have xss fixes for frontend frameworks', () => {
+      const xssFixes = FRAMEWORK_FIX_REGISTRY.xss
+      expect(xssFixes).toBeDefined()
+
+      expect(xssFixes!.react).toBeDefined()
+      expect(xssFixes!.vue).toBeDefined()
+    })
+
+    it('should have hardcoded_secret fixes for common frameworks', () => {
+      const secretFixes = FRAMEWORK_FIX_REGISTRY.hardcoded_secret
+      expect(secretFixes).toBeDefined()
+
+      expect(secretFixes!.nextjs).toBeDefined()
+      expect(secretFixes!.express).toBeDefined()
+    })
+
+    it('should have cors_misconfiguration fixes', () => {
+      const corsFixes = FRAMEWORK_FIX_REGISTRY.cors_misconfiguration
+      expect(corsFixes).toBeDefined()
+
+      expect(corsFixes!.nextjs).toBeDefined()
+      expect(corsFixes!.express).toBeDefined()
+      expect(corsFixes!.fastify).toBeDefined()
+    })
+
+    it('should have dangerous_function fixes for frontend frameworks', () => {
+      const dangerousFixes = FRAMEWORK_FIX_REGISTRY.dangerous_function
+      expect(dangerousFixes).toBeDefined()
+
+      expect(dangerousFixes!.react).toBeDefined()
+      expect(dangerousFixes!.vue).toBeDefined()
+    })
+  })
+
+  describe('Fix content quality', () => {
+    it('all fixes should have non-empty fixSteps', () => {
+      for (const [_category, frameworkFixes] of Object.entries(FRAMEWORK_FIX_REGISTRY)) {
+        for (const [_framework, fix] of Object.entries(frameworkFixes || {})) {
+          expect(fix.fixSteps).toBeDefined()
+          expect(Array.isArray(fix.fixSteps)).toBe(true)
+          expect(fix.fixSteps.length).toBeGreaterThan(0)
+
+          // Each step should be meaningful (at least 10 characters)
+          for (const step of fix.fixSteps) {
+            expect(step.length).toBeGreaterThan(10)
+          }
+        }
+      }
+    })
+
+    it('code examples should be present for key fixes', () => {
+      // SQL injection fixes should have code examples
+      const sqlFixes = FRAMEWORK_FIX_REGISTRY.sql_injection
+      expect(sqlFixes!.prisma!.codeExample).toBeDefined()
+      expect(sqlFixes!.drizzle!.codeExample).toBeDefined()
+      expect(sqlFixes!.supabase!.codeExample).toBeDefined()
+      expect(sqlFixes!.mongoose!.codeExample).toBeDefined()
+      expect(sqlFixes!.knex!.codeExample).toBeDefined()
+
+      // Auth fixes should have code examples
+      const authFixes = FRAMEWORK_FIX_REGISTRY.missing_auth
+      expect(authFixes!.nextjs!.codeExample).toBeDefined()
+      expect(authFixes!.express!.codeExample).toBeDefined()
+      expect(authFixes!.fastify!.codeExample).toBeDefined()
+      expect(authFixes!.nestjs!.codeExample).toBeDefined()
+
+      // XSS fixes should have code examples
+      const xssFixes = FRAMEWORK_FIX_REGISTRY.xss
+      expect(xssFixes!.react!.codeExample).toBeDefined()
+      expect(xssFixes!.vue!.codeExample).toBeDefined()
+
+      // CORS fixes should have code examples
+      const corsFixes = FRAMEWORK_FIX_REGISTRY.cors_misconfiguration
+      expect(corsFixes!.nextjs!.codeExample).toBeDefined()
+      expect(corsFixes!.express!.codeExample).toBeDefined()
+      expect(corsFixes!.fastify!.codeExample).toBeDefined()
+    })
+
+    it('fix steps should be actionable (start with verbs)', () => {
+      for (const [_category, frameworkFixes] of Object.entries(FRAMEWORK_FIX_REGISTRY)) {
+        for (const [_framework, fix] of Object.entries(frameworkFixes || {})) {
+          for (const step of fix.fixSteps) {
+            // Each step should start with a capital letter (typically a verb)
+            expect(step[0]).toBe(step[0].toUpperCase())
+          }
+        }
+      }
+    })
+
+    it('code examples should contain actual code patterns', () => {
+      // Prisma examples should reference prisma client
+      expect(FRAMEWORK_FIX_REGISTRY.sql_injection!.prisma!.codeExample).toMatch(/prisma\./i)
+
+      // React examples should reference JSX or React patterns
+      expect(FRAMEWORK_FIX_REGISTRY.xss!.react!.codeExample).toMatch(/dangerouslySetInnerHTML|<div>|DOMPurify/i)
+
+      // Express examples should reference middleware patterns
+      expect(FRAMEWORK_FIX_REGISTRY.missing_auth!.express!.codeExample).toMatch(/middleware|req|res|next/i)
+    })
+
+    it('fix steps should mention framework-specific concepts', () => {
+      // Prisma fixes should mention Prisma-specific concepts
+      const prismaFix = FRAMEWORK_FIX_REGISTRY.sql_injection!.prisma!
+      const prismaText = prismaFix.fixSteps.join(' ')
+      expect(prismaText).toMatch(/\$queryRaw|findUnique|Prisma/i)
+
+      // Next.js auth fixes should mention middleware.ts
+      const nextAuthFix = FRAMEWORK_FIX_REGISTRY.missing_auth!.nextjs!
+      const nextAuthText = nextAuthFix.fixSteps.join(' ')
+      expect(nextAuthText).toMatch(/middleware\.ts|auth\(\)|getServerSession/i)
+
+      // React XSS fixes should mention JSX auto-escaping
+      const reactXssFix = FRAMEWORK_FIX_REGISTRY.xss!.react!
+      const reactXssText = reactXssFix.fixSteps.join(' ')
+      expect(reactXssText).toMatch(/JSX|auto-escape|dangerouslySetInnerHTML/i)
+    })
+  })
+
+  describe('getFrameworkFix', () => {
+    describe('ORM priority for sql_injection', () => {
+      it('should return Prisma fix when Prisma is detected', () => {
+        const frameworks = createFrameworkContext({ primary: 'nextjs', frontend: 'react' })
+        const dataAccess = createDataAccessContext({ orm: 'prisma' })
+
+        const fix = getFrameworkFix('sql_injection', frameworks, dataAccess)
+
+        expect(fix).toBeDefined()
+        expect(fix!.fixSteps[0]).toContain('Prisma')
+      })
+
+      it('should return Drizzle fix when Drizzle is detected', () => {
+        const frameworks = createFrameworkContext({ primary: 'nextjs' })
+        const dataAccess = createDataAccessContext({ orm: 'drizzle' })
+
+        const fix = getFrameworkFix('sql_injection', frameworks, dataAccess)
+
+        expect(fix).toBeDefined()
+        expect(fix!.fixSteps[0]).toContain('Drizzle')
+      })
+
+      it('should return Supabase fix when Supabase is detected', () => {
+        const frameworks = createFrameworkContext({ primary: 'nextjs' })
+        const dataAccess = createDataAccessContext({ orm: 'supabase', hasRLS: true })
+
+        const fix = getFrameworkFix('sql_injection', frameworks, dataAccess)
+
+        expect(fix).toBeDefined()
+        expect(fix!.fixSteps[0]).toContain('Supabase')
+      })
+
+      it('should return Mongoose fix when Mongoose is detected', () => {
+        const frameworks = createFrameworkContext({ primary: 'express' })
+        const dataAccess = createDataAccessContext({ orm: 'mongoose' })
+
+        const fix = getFrameworkFix('sql_injection', frameworks, dataAccess)
+
+        expect(fix).toBeDefined()
+        expect(fix!.fixSteps[0]).toContain('Mongoose')
+      })
+
+      it('should return Knex fix when Knex is detected', () => {
+        const frameworks = createFrameworkContext({ primary: 'express' })
+        const dataAccess = createDataAccessContext({ orm: 'knex' })
+
+        const fix = getFrameworkFix('sql_injection', frameworks, dataAccess)
+
+        expect(fix).toBeDefined()
+        expect(fix!.fixSteps[0]).toContain('Knex')
+      })
+    })
+
+    describe('frontend framework priority for XSS', () => {
+      it('should return React fix for xss when React is detected', () => {
+        const frameworks = createFrameworkContext({ primary: 'nextjs', frontend: 'react' })
+
+        const fix = getFrameworkFix('xss', frameworks)
+
+        expect(fix).toBeDefined()
+        expect(fix!.fixSteps[0]).toContain('JSX')
+      })
+
+      it('should return Vue fix for xss when Vue is detected', () => {
+        const frameworks = createFrameworkContext({ primary: 'express', frontend: 'vue' })
+
+        const fix = getFrameworkFix('xss', frameworks)
+
+        expect(fix).toBeDefined()
+        expect(fix!.fixSteps[0]).toContain('v-text')
+      })
+
+      it('should return React fix for dangerous_function when React is detected', () => {
+        const frameworks = createFrameworkContext({ frontend: 'react' })
+
+        const fix = getFrameworkFix('dangerous_function', frameworks)
+
+        expect(fix).toBeDefined()
+        expect(fix!.fixSteps[0]).toContain('innerHTML')
+      })
+
+      it('should return Vue fix for dangerous_function when Vue is detected', () => {
+        const frameworks = createFrameworkContext({ frontend: 'vue' })
+
+        const fix = getFrameworkFix('dangerous_function', frameworks)
+
+        expect(fix).toBeDefined()
+        expect(fix!.fixSteps[0]).toContain('Vue')
+      })
+    })
+
+    describe('backend framework fixes', () => {
+      it('should return Next.js fix for missing_auth', () => {
+        const frameworks = createFrameworkContext({ primary: 'nextjs', frontend: 'react' })
+
+        const fix = getFrameworkFix('missing_auth', frameworks)
+
+        expect(fix).toBeDefined()
+        expect(fix!.fixSteps[0]).toContain('middleware.ts')
+      })
+
+      it('should return Express fix for missing_auth', () => {
+        const frameworks = createFrameworkContext({ primary: 'express' })
+
+        const fix = getFrameworkFix('missing_auth', frameworks)
+
+        expect(fix).toBeDefined()
+        expect(fix!.fixSteps[0]).toContain('middleware')
+      })
+
+      it('should return Fastify fix for missing_auth', () => {
+        const frameworks = createFrameworkContext({ primary: 'fastify' })
+
+        const fix = getFrameworkFix('missing_auth', frameworks)
+
+        expect(fix).toBeDefined()
+        expect(fix!.fixSteps[0]).toContain('@fastify')
+      })
+
+      it('should return NestJS fix for missing_auth', () => {
+        const frameworks = createFrameworkContext({ primary: 'nestjs' })
+
+        const fix = getFrameworkFix('missing_auth', frameworks)
+
+        expect(fix).toBeDefined()
+        expect(fix!.fixSteps[0]).toContain('@nestjs')
+      })
+
+      it('should return Next.js fix for hardcoded_secret', () => {
+        const frameworks = createFrameworkContext({ primary: 'nextjs' })
+
+        const fix = getFrameworkFix('hardcoded_secret', frameworks)
+
+        expect(fix).toBeDefined()
+        expect(fix!.fixSteps[0]).toContain('.env.local')
+      })
+
+      it('should return Express fix for hardcoded_secret', () => {
+        const frameworks = createFrameworkContext({ primary: 'express' })
+
+        const fix = getFrameworkFix('hardcoded_secret', frameworks)
+
+        expect(fix).toBeDefined()
+        expect(fix!.fixSteps[0]).toContain('dotenv')
+      })
+
+      it('should return Next.js fix for cors_misconfiguration', () => {
+        const frameworks = createFrameworkContext({ primary: 'nextjs' })
+
+        const fix = getFrameworkFix('cors_misconfiguration', frameworks)
+
+        expect(fix).toBeDefined()
+        expect(fix!.fixSteps[0]).toContain('next.config')
+      })
+
+      it('should return Express fix for cors_misconfiguration', () => {
+        const frameworks = createFrameworkContext({ primary: 'express' })
+
+        const fix = getFrameworkFix('cors_misconfiguration', frameworks)
+
+        expect(fix).toBeDefined()
+        expect(fix!.fixSteps[0]).toContain('cors')
+      })
+
+      it('should return Fastify fix for cors_misconfiguration', () => {
+        const frameworks = createFrameworkContext({ primary: 'fastify' })
+
+        const fix = getFrameworkFix('cors_misconfiguration', frameworks)
+
+        expect(fix).toBeDefined()
+        expect(fix!.fixSteps[0]).toContain('@fastify/cors')
+      })
+    })
+
+    describe('fallback behavior', () => {
+      it('should return undefined for categories without framework fixes', () => {
+        const frameworks = createFrameworkContext({ primary: 'nextjs' })
+
+        // These categories have no framework-specific fixes
+        const categoriesWithoutFixes: VulnerabilityCategory[] = [
+          'suspicious_package',
+          'root_container',
+          'weak_crypto',
+          'command_injection',
+          'security_bypass',
+          'insecure_config',
+          'high_entropy_string',
+          'sensitive_variable',
+          'dangerous_file',
+          'data_exposure',
+          'ai_pattern',
+          'ai_prompt_injection',
+          'ai_unsafe_execution',
+          'ai_overpermissive_tool',
+          'ai_rag_exfiltration',
+          'ai_endpoint_unprotected',
+          'ai_schema_mismatch',
+        ]
+
+        for (const category of categoriesWithoutFixes) {
+          const fix = getFrameworkFix(category, frameworks)
+          expect(fix).toBeUndefined()
+        }
+      })
+
+      it('should return undefined when no framework is detected', () => {
+        const frameworks = createFrameworkContext() // All undefined
+
+        const fix = getFrameworkFix('missing_auth', frameworks)
+
+        expect(fix).toBeUndefined()
+      })
+
+      it('should return undefined when framework has no fix for category', () => {
+        const frameworks = createFrameworkContext({ primary: 'nestjs' })
+
+        // NestJS has missing_auth fix but no hardcoded_secret fix
+        const fix = getFrameworkFix('hardcoded_secret', frameworks)
+
+        expect(fix).toBeUndefined()
+      })
+
+      it('should return undefined for sql_injection when ORM has no fix', () => {
+        const frameworks = createFrameworkContext({ primary: 'express' })
+        const dataAccess = createDataAccessContext({ orm: 'sequelize' }) // Not in registry
+
+        const fix = getFrameworkFix('sql_injection', frameworks, dataAccess)
+
+        expect(fix).toBeUndefined()
+      })
+
+      it('should return undefined for sql_injection when no ORM detected', () => {
+        const frameworks = createFrameworkContext({ primary: 'express' })
+        const dataAccess = createDataAccessContext({ orm: undefined })
+
+        const fix = getFrameworkFix('sql_injection', frameworks, dataAccess)
+
+        expect(fix).toBeUndefined()
+      })
+
+      it('should return undefined for sql_injection when raw_sql is detected', () => {
+        const frameworks = createFrameworkContext({ primary: 'express' })
+        const dataAccess = createDataAccessContext({ orm: 'raw_sql' })
+
+        const fix = getFrameworkFix('sql_injection', frameworks, dataAccess)
+
+        // raw_sql is not in the registry (no framework-specific fix)
+        expect(fix).toBeUndefined()
+      })
+    })
+
+    describe('priority ordering', () => {
+      it('should prioritize ORM over backend framework for sql_injection', () => {
+        const frameworks = createFrameworkContext({ primary: 'express' }) // Express has no sql_injection fix
+        const dataAccess = createDataAccessContext({ orm: 'prisma' }) // Prisma has sql_injection fix
+
+        const fix = getFrameworkFix('sql_injection', frameworks, dataAccess)
+
+        // Should return Prisma fix, not undefined/fallback
+        expect(fix).toBeDefined()
+        expect(fix!.fixSteps[0]).toContain('Prisma')
+      })
+
+      it('should prioritize frontend framework for xss over backend', () => {
+        const frameworks = createFrameworkContext({ primary: 'express', frontend: 'react' })
+
+        const fix = getFrameworkFix('xss', frameworks)
+
+        // Should return React fix since frontend takes priority for XSS
+        expect(fix).toBeDefined()
+        expect(fix!.fixSteps[0]).toContain('JSX')
+      })
+
+      it('should use backend framework when no frontend detected for xss', () => {
+        const frameworks = createFrameworkContext({ primary: 'express', frontend: undefined })
+
+        const fix = getFrameworkFix('xss', frameworks)
+
+        // Express has no XSS fix, so should return undefined
+        expect(fix).toBeUndefined()
+      })
+
+      it('should prioritize frontend for dangerous_function over backend', () => {
+        const frameworks = createFrameworkContext({ primary: 'nextjs', frontend: 'vue' })
+
+        const fix = getFrameworkFix('dangerous_function', frameworks)
+
+        // Should return Vue fix since frontend takes priority
+        expect(fix).toBeDefined()
+        expect(fix!.fixSteps[0]).toContain('Vue')
+      })
+    })
+
+    describe('edge cases', () => {
+      it('should handle empty dataAccess object', () => {
+        const frameworks = createFrameworkContext({ primary: 'nextjs' })
+        const dataAccess = createDataAccessContext()
+
+        const fix = getFrameworkFix('sql_injection', frameworks, dataAccess)
+
+        // No ORM specified, should return undefined
+        expect(fix).toBeUndefined()
+      })
+
+      it('should handle undefined dataAccess', () => {
+        const frameworks = createFrameworkContext({ primary: 'nextjs' })
+
+        const fix = getFrameworkFix('sql_injection', frameworks, undefined)
+
+        // No dataAccess at all, should return undefined
+        expect(fix).toBeUndefined()
+      })
+
+      it('should handle unknown ORM type gracefully', () => {
+        const frameworks = createFrameworkContext({ primary: 'express' })
+        const dataAccess = createDataAccessContext({ orm: 'typeorm' as any }) // Not in registry
+
+        const fix = getFrameworkFix('sql_injection', frameworks, dataAccess)
+
+        expect(fix).toBeUndefined()
+      })
+
+      it('should handle unknown framework type gracefully', () => {
+        const frameworks = createFrameworkContext({ primary: 'django' as any }) // Not in registry
+
+        const fix = getFrameworkFix('missing_auth', frameworks)
+
+        expect(fix).toBeUndefined()
+      })
+
+      it('should handle unknown frontend framework gracefully', () => {
+        const frameworks = createFrameworkContext({ frontend: 'svelte' as any }) // Not in XSS registry
+
+        const fix = getFrameworkFix('xss', frameworks)
+
+        expect(fix).toBeUndefined()
+      })
+
+      it('should work with only frontend defined (no primary)', () => {
+        const frameworks = createFrameworkContext({ frontend: 'react' })
+
+        const fix = getFrameworkFix('xss', frameworks)
+
+        expect(fix).toBeDefined()
+        expect(fix!.fixSteps[0]).toContain('JSX')
+      })
+
+      it('should work with only ORM defined (no frameworks)', () => {
+        const frameworks = createFrameworkContext()
+        const dataAccess = createDataAccessContext({ orm: 'prisma' })
+
+        const fix = getFrameworkFix('sql_injection', frameworks, dataAccess)
+
+        expect(fix).toBeDefined()
+        expect(fix!.fixSteps[0]).toContain('Prisma')
+      })
+
+      it('should not throw on invalid category', () => {
+        const frameworks = createFrameworkContext({ primary: 'nextjs' })
+
+        // @ts-expect-error - testing invalid input
+        const fix = getFrameworkFix('invalid_category', frameworks)
+
+        expect(fix).toBeUndefined()
+      })
+
+      it('should handle category that exists in registry but has no matching framework', () => {
+        // hardcoded_secret has nextjs and express, but not fastify
+        const frameworks = createFrameworkContext({ primary: 'fastify' })
+
+        const fix = getFrameworkFix('hardcoded_secret', frameworks)
+
+        expect(fix).toBeUndefined()
+      })
+    })
+
+    describe('real-world scenarios', () => {
+      it('Next.js + Prisma + React stack', () => {
+        const frameworks = createFrameworkContext({
+          primary: 'nextjs',
+          frontend: 'react',
+          usesTypeScript: true,
+          usesServerComponents: true,
+        })
+        const dataAccess = createDataAccessContext({
+          orm: 'prisma',
+          usesParameterizedQueries: true,
+        })
+
+        // SQL injection should use Prisma fix
+        const sqlFix = getFrameworkFix('sql_injection', frameworks, dataAccess)
+        expect(sqlFix).toBeDefined()
+        expect(sqlFix!.fixSteps[0]).toContain('Prisma')
+
+        // XSS should use React fix
+        const xssFix = getFrameworkFix('xss', frameworks)
+        expect(xssFix).toBeDefined()
+        expect(xssFix!.fixSteps[0]).toContain('JSX')
+
+        // Auth should use Next.js fix
+        const authFix = getFrameworkFix('missing_auth', frameworks)
+        expect(authFix).toBeDefined()
+        expect(authFix!.fixSteps[0]).toContain('middleware.ts')
+
+        // Secrets should use Next.js fix
+        const secretFix = getFrameworkFix('hardcoded_secret', frameworks)
+        expect(secretFix).toBeDefined()
+        expect(secretFix!.fixSteps[0]).toContain('.env.local')
+      })
+
+      it('Express + Mongoose + Vue stack', () => {
+        const frameworks = createFrameworkContext({
+          primary: 'express',
+          frontend: 'vue',
+          usesTypeScript: false,
+        })
+        const dataAccess = createDataAccessContext({
+          orm: 'mongoose',
+          databaseType: 'mongodb',
+        })
+
+        // SQL injection should use Mongoose fix
+        const sqlFix = getFrameworkFix('sql_injection', frameworks, dataAccess)
+        expect(sqlFix).toBeDefined()
+        expect(sqlFix!.fixSteps[0]).toContain('Mongoose')
+
+        // XSS should use Vue fix
+        const xssFix = getFrameworkFix('xss', frameworks)
+        expect(xssFix).toBeDefined()
+        expect(xssFix!.fixSteps[0]).toContain('v-text')
+
+        // Auth should use Express fix
+        const authFix = getFrameworkFix('missing_auth', frameworks)
+        expect(authFix).toBeDefined()
+        expect(authFix!.fixSteps[0]).toContain('middleware')
+
+        // CORS should use Express fix
+        const corsFix = getFrameworkFix('cors_misconfiguration', frameworks)
+        expect(corsFix).toBeDefined()
+        expect(corsFix!.fixSteps[0]).toContain('cors')
+      })
+
+      it('Supabase + Next.js stack with RLS', () => {
+        const frameworks = createFrameworkContext({
+          primary: 'nextjs',
+          frontend: 'react',
+        })
+        const dataAccess = createDataAccessContext({
+          orm: 'supabase',
+          hasRLS: true,
+          databaseType: 'postgres',
+        })
+
+        // SQL injection should use Supabase fix
+        const sqlFix = getFrameworkFix('sql_injection', frameworks, dataAccess)
+        expect(sqlFix).toBeDefined()
+        expect(sqlFix!.fixSteps[0]).toContain('Supabase')
+        // Supabase fix should mention RLS
+        expect(sqlFix!.fixSteps.join(' ')).toContain('Row Level Security')
+      })
+
+      it('NestJS + TypeORM stack (partial coverage)', () => {
+        const frameworks = createFrameworkContext({
+          primary: 'nestjs',
+          usesTypeScript: true,
+        })
+        const dataAccess = createDataAccessContext({
+          orm: 'typeorm', // Not in registry
+        })
+
+        // SQL injection should return undefined (TypeORM not supported)
+        const sqlFix = getFrameworkFix('sql_injection', frameworks, dataAccess)
+        expect(sqlFix).toBeUndefined()
+
+        // Auth should use NestJS fix
+        const authFix = getFrameworkFix('missing_auth', frameworks)
+        expect(authFix).toBeDefined()
+        expect(authFix!.fixSteps[0]).toContain('@nestjs')
+
+        // Secrets should return undefined (NestJS not supported)
+        const secretFix = getFrameworkFix('hardcoded_secret', frameworks)
+        expect(secretFix).toBeUndefined()
+      })
+
+      it('API-only backend (no frontend framework)', () => {
+        const frameworks = createFrameworkContext({
+          primary: 'fastify',
+          frontend: undefined,
+        })
+        const dataAccess = createDataAccessContext({
+          orm: 'drizzle',
+        })
+
+        // SQL injection should use Drizzle fix
+        const sqlFix = getFrameworkFix('sql_injection', frameworks, dataAccess)
+        expect(sqlFix).toBeDefined()
+        expect(sqlFix!.fixSteps[0]).toContain('Drizzle')
+
+        // XSS should return undefined (no frontend)
+        const xssFix = getFrameworkFix('xss', frameworks)
+        expect(xssFix).toBeUndefined()
+
+        // Auth should use Fastify fix
+        const authFix = getFrameworkFix('missing_auth', frameworks)
+        expect(authFix).toBeDefined()
+        expect(authFix!.fixSteps[0]).toContain('@fastify')
+
+        // CORS should use Fastify fix
+        const corsFix = getFrameworkFix('cors_misconfiguration', frameworks)
+        expect(corsFix).toBeDefined()
+        expect(corsFix!.fixSteps[0]).toContain('@fastify/cors')
+      })
+    })
+  })
+})