// Run in DevTools on a survey page after survey.js loads
(function() {
  var origSanitize = SecurityUtils.sanitizeText;
  var callLog = [];
  SecurityUtils.sanitizeText = function(input) {
    callLog.push(input);
    return origSanitize.call(this, input);
  };
  // Trigger question rendering (reload survey or advance to questions)
  // After rendering, check:
  setTimeout(function() {
    console.log('sanitizeText called ' + callLog.length + ' times during render');
    console.log('Calls:', callLog);
    SecurityUtils.sanitizeText = origSanitize; // restore
  }, 3000);
})();

// Run from any page NOT on the survey domain
fetch('https://survey-api-365853907280.us-central1.run.app/submit-survey', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    surveyCode: 'TEST',
    responses: { q1: 'csrf_fetch_test' }
  })
})
.then(r => console.log('Status:', r.status, '— CSRF ' + (r.ok ? 'VULNERABLE' : 'PROTECTED')))
.catch(e => console.log('Blocked by CORS:', e.message));

// Run on the survey page after completing a survey
// Capture a valid submission payload first, then replay it
var payload = {
  surveyCode: 'AIPM8', // use a real code
  responses: { q1: 'replayed_answer' },
  metadata: { timestamp: new Date().toISOString() }
};

// Send the same request 3 times
var results = [];
for (var i = 0; i < 3; i++) {
  fetch('https://survey-api-365853907280.us-central1.run.app/submit-survey', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify(payload)
  })
  .then(r => { results.push(r.status); if (results.length === 3) console.log('Replay results:', results); });
}
// Expected (vulnerable): All three return 200
// Expected (fixed): First returns 200, subsequent return 409 Conflict or 429 Too Many Requests

// Run in DevTools on the survey page after partially completing a survey
(function() {
  var keys = Object.keys(localStorage).filter(k => k.startsWith('survey_state_'));
  if (keys.length === 0) {
    console.log('No survey state found. Start a survey first.');
    return;
  }
  keys.forEach(function(key) {
    var data = JSON.parse(localStorage.getItem(key));
    console.log('Survey state found:', key);
    console.log('Stored responses:', JSON.stringify(data, null, 2));
    console.log('TC-6.1: Data is ' + (typeof data === 'string' && data.match(/^[A-Za-z0-9+/=]+$/) ? 'ENCRYPTED (fixed)' : 'PLAINTEXT (vulnerable)'));
  });
})();

// Run after starting a survey
(function() {
  var keys = Object.keys(localStorage).filter(k => k.startsWith('survey_state_'));
  if (keys.length === 0) { console.log('No survey state found.'); return; }
  var key = keys[0];
  var data = JSON.parse(localStorage.getItem(key));
  
  // Tamper: inject a response
  if (data.responses) {
    data.responses['tampered_q'] = 'injected_value';
  } else {
    data.tampered = true;
  }
  localStorage.setItem(key, JSON.stringify(data));
  console.log('Tampered state saved. Reload the survey page and check if tampered data persists/submits.');
})();

// Run AFTER submitting a survey
(function() {
  var keys = Object.keys(localStorage).filter(k => k.startsWith('survey_state_'));
  console.log('Survey states remaining after submission:', keys.length);
  console.log('TC-6.3:', keys.length === 0 ? 'PASS (cleared)' : 'FAIL (state persists: ' + keys.join(', ') + ')');
})();

// Run in DevTools on any page
(function() {
  var results = [];
  
  // Check all external scripts
  document.querySelectorAll('script[src]').forEach(function(s) {
    var src = s.getAttribute('src');
    if (src && (src.startsWith('http://') || src.startsWith('https://')) && !src.includes(location.hostname)) {
      results.push({
        type: 'script',
        src: src,
        hasIntegrity: !!s.getAttribute('integrity'),
        hasCrossorigin: !!s.getAttribute('crossorigin'),
        integrity: s.getAttribute('integrity') || 'MISSING'
      });
    }
  });
  
  // Check all external stylesheets
  document.querySelectorAll('link[rel="stylesheet"]').forEach(function(l) {
    var href = l.getAttribute('href');
    if (href && (href.startsWith('http://') || href.startsWith('https://')) && !href.includes(location.hostname)) {
      results.push({
        type: 'stylesheet',
        src: href,
        hasIntegrity: !!l.getAttribute('integrity'),
        hasCrossorigin: !!l.getAttribute('crossorigin'),
        integrity: l.getAttribute('integrity') || 'MISSING'
      });
    }
  });
  
  console.table(results);
  var missing = results.filter(r => !r.hasIntegrity);
  console.log('\nTC-7.1:', missing.length === 0 ? 'PASS — All CDN resources have SRI' : 'FAIL — ' + missing.length + ' resources missing SRI:');
  missing.forEach(r => console.log('  -', r.src));
})();

// Run in DevTools
(function() {
  var searchScript = document.querySelector('script[src*="simple-jekyll-search"]');
  if (!searchScript) { console.log('Search script not found on this page.'); return; }
  var src = searchScript.getAttribute('src');
  var usesLatest = src.includes('@latest');
  console.log('Search script src:', src);
  console.log('TC-7.2:', usesLatest ? 'FAIL — uses @latest (unpinned)' : 'PASS — version is pinned');
})();

// Run in DevTools on any page
(function() {
  var cspMeta = document.querySelector('meta[http-equiv="Content-Security-Policy"]');
  if (!cspMeta) {
    console.log('TC-8.1: FAIL — No CSP meta tag found');
    return;
  }
  var policy = cspMeta.getAttribute('content');
  console.log('CSP Policy:', policy);
  
  // Validate key directives exist
  var checks = {
    'default-src': policy.includes('default-src'),
    'script-src': policy.includes('script-src'),
    'style-src': policy.includes('style-src'),
    'connect-src': policy.includes('connect-src'),
    'frame-src': policy.includes('frame-src')
  };
  
  console.table(checks);
  var allPass = Object.values(checks).every(Boolean);
  console.log('TC-8.1:', allPass ? 'PASS — CSP present with required directives' : 'PARTIAL — Some directives missing');
})();

// After CSP is in place, test if inline script injection is blocked
// This should trigger a CSP violation report in the console
(function() {
  var div = document.createElement('div');
  div.innerHTML = '<img src=x onerror="window.__CSP_TEST=true">';
  document.body.appendChild(div);
  
  setTimeout(function() {
    document.body.removeChild(div);
    console.log('TC-8.2:', window.__CSP_TEST ? 'FAIL — inline handler executed despite CSP' : 'PASS — CSP blocked inline handler');
  }, 1000);
})();

// Run in DevTools — check if document.write is used at runtime
(function() {
  var origWrite = document.write;
  var writeCalled = false;
  document.write = function() {
    writeCalled = true;
    console.warn('document.write() was called with:', arguments[0]);
    return origWrite.apply(document, arguments);
  };
  
  // Note: this only catches calls AFTER this script runs
  // For full coverage, inject this before footer-scripts.html loads
  setTimeout(function() {
    console.log('TC-9.2:', writeCalled ? 'FAIL — document.write() was called' : 'PASS — document.write() not detected');
    document.write = origWrite;
  }, 5000);
})();

// Run on the appointments page (Koalendar)
(function() {
  var koalendarScript = document.querySelector('script[src*="koalendar.com"]');
  var koalendarIframe = document.querySelector('iframe[src*="koalendar.com"]');
  
  if (koalendarScript && !koalendarIframe) {
    console.log('TC-10.1a: FAIL — Koalendar loads as inline script with full DOM access (no iframe sandbox)');
  } else if (koalendarIframe) {
    var sandbox = koalendarIframe.getAttribute('sandbox');
    console.log('TC-10.1a:', sandbox ? 'PASS — Koalendar in sandboxed iframe: ' + sandbox : 'PARTIAL — iframe exists but no sandbox attribute');
  } else {
    console.log('TC-10.1a: N/A — Koalendar not found on this page');
  }
})();

// Run on the posts page (SociableKit)
(function() {
  var skScript = document.querySelector('script[src*="sociablekit.com"]');
  var skIframe = document.querySelector('iframe[src*="sociablekit.com"]');
  
  if (skScript && !skIframe) {
    console.log('TC-10.1b: FAIL — SociableKit loads as inline script with full DOM access');
  } else if (skIframe) {
    var sandbox = skIframe.getAttribute('sandbox');
    console.log('TC-10.1b:', sandbox ? 'PASS — SociableKit in sandboxed iframe: ' + sandbox : 'PARTIAL — iframe but no sandbox');
  } else {
    console.log('TC-10.1b: N/A — SociableKit not found on this page');
  }
})();

// Run in DevTools — sends 10 rapid requests to test rate limiting
(function() {
  var endpoint = 'https://survey-api-365853907280.us-central1.run.app/submit-survey';
  var codes = ['AAA', 'BBB', 'CCC', 'DDD', 'EEE', 'FFF', 'GGG', 'HHH', 'III', 'JJJ'];
  var results = [];
  
  var promises = codes.map(function(code) {
    return fetch(endpoint, {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ surveyCode: code, responses: {} })
    })
    .then(function(r) { results.push({ code: code, status: r.status }); })
    .catch(function(e) { results.push({ code: code, error: e.message }); });
  });
  
  Promise.all(promises).then(function() {
    console.table(results);
    var blocked = results.filter(r => r.status === 429);
    console.log('TC-11.1:', blocked.length > 0 ? 'PASS — Rate limiting active (' + blocked.length + '/10 blocked)' : 'FAIL — No rate limiting detected');
  });
})();

// Run on the contact page
(function() {
  var form = document.getElementById('contact-form');
  if (!form) { console.log('Contact form not found.'); return; }
  
  var emailInput = form.querySelector('[name="_replyto"]');
  if (!emailInput) { console.log('_replyto field not found.'); return; }
  
  // Test if the HTML5 validation catches newlines
  emailInput.value = 'attacker@evil.com\r\nBcc: victim@example.com';
  var isValid = emailInput.checkValidity();
  
  console.log('Email with newlines valid?', isValid);
  console.log('TC-12.1:', isValid ? 'FAIL — Newline injection passes client validation' : 'PASS — Client validation rejects newlines');
})();

// Run on the contact page
(function() {
  var honeypot = document.querySelector('[name="_gotcha"]');
  if (!honeypot) { console.log('TC-12.2: FAIL — No honeypot field found'); return; }
  
  var style = window.getComputedStyle(honeypot);
  var isHidden = style.display === 'none' || style.visibility === 'hidden' || 
                 style.opacity === '0' || honeypot.type === 'hidden' ||
                 (style.position === 'absolute' && (parseInt(style.left) < -9000 || parseInt(style.top) < -9000));
  
  console.log('TC-12.2:', isHidden ? 'PASS — Honeypot is hidden' : 'WARNING — Honeypot may be visible to users');
  
  // Check if honeypot has accessible name that bots could detect
  var hasObviousName = honeypot.name.includes('honey') || honeypot.name.includes('gotcha') || 
                       honeypot.name.includes('trap') || honeypot.name.includes('bot');
  console.log('TC-12.2b:', hasObviousName ? 'INFO — Honeypot name ("' + honeypot.name + '") may be detectable by smart bots' : 'PASS — Honeypot name is not obvious');
})();

(function() {
  console.log('=== SECURITY REGRESSION TEST SUITE ===');
  console.log('Date:', new Date().toISOString());
  console.log('Page:', location.href);
  console.log('');
  
  // TC-7.1: SRI Check
  console.group('TC-7.1: Subresource Integrity');
  var sriResults = [];
  document.querySelectorAll('script[src], link[rel="stylesheet"]').forEach(function(el) {
    var src = el.getAttribute('src') || el.getAttribute('href');
    if (src && src.startsWith('http') && !src.includes(location.hostname)) {
      var hasIntegrity = !!el.getAttribute('integrity');
      sriResults.push({ resource: src.split('/').pop(), hasIntegrity: hasIntegrity });
      if (!hasIntegrity) console.warn('Missing SRI:', src);
    }
  });
  var sriMissing = sriResults.filter(r => !r.hasIntegrity).length;
  console.log('Result:', sriMissing === 0 ? 'PASS' : 'FAIL (' + sriMissing + ' missing)');
  console.groupEnd();
  
  // TC-8.1: CSP Check
  console.group('TC-8.1: Content Security Policy');
  var cspMeta = document.querySelector('meta[http-equiv="Content-Security-Policy"]');
  console.log('Result:', cspMeta ? 'PASS — CSP present' : 'FAIL — No CSP');
  if (cspMeta) console.log('Policy:', cspMeta.getAttribute('content').substring(0, 200) + '...');
  console.groupEnd();
  
  // TC-6.1: localStorage Survey State
  console.group('TC-6.1: localStorage Survey State');
  var surveyKeys = Object.keys(localStorage).filter(k => k.startsWith('survey_state_'));
  if (surveyKeys.length > 0) {
    surveyKeys.forEach(function(k) {
      try {
        var data = JSON.parse(localStorage.getItem(k));
        var isPlaintext = typeof data === 'object';
        console.log(k + ':', isPlaintext ? 'FAIL — Plaintext JSON' : 'PASS — Encrypted/opaque');
      } catch(e) {
        console.log(k + ': PASS — Not parseable as JSON (likely encrypted)');
      }
    });
  } else {
    console.log('No survey states in localStorage (N/A)');
  }
  console.groupEnd();
  
  // TC-7.2: Search library version pin
  console.group('TC-7.2: Search Library Version');
  var searchScript = document.querySelector('script[src*="simple-jekyll-search"]');
  if (searchScript) {
    var usesLatest = searchScript.src.includes('@latest');
    console.log('Result:', usesLatest ? 'FAIL — @latest (unpinned)' : 'PASS — Pinned version');
  } else {
    console.log('N/A — Search script not on this page');
  }
  console.groupEnd();
  
  // TC-9.1: document.write check (static)
  console.group('TC-9.1: document.write');
  console.log('Run grep check: grep -n "document.write" _includes/footer-scripts.html');
  console.groupEnd();
  
  // TC-10.1: Widget sandboxing
  console.group('TC-10.1: Widget Sandboxing');
  ['koalendar.com', 'sociablekit.com'].forEach(function(domain) {
    var script = document.querySelector('script[src*="' + domain + '"]');
    var iframe = document.querySelector('iframe[src*="' + domain + '"]');
    if (script && !iframe) {
      console.log(domain + ': FAIL — Inline script, no sandbox');
    } else if (iframe) {
      console.log(domain + ':', iframe.getAttribute('sandbox') ? 'PASS' : 'PARTIAL — No sandbox attr');
    } else {
      console.log(domain + ': N/A — Not on this page');
    }
  });
  console.groupEnd();
  
  // TC-12.2: Honeypot
  console.group('TC-12.2: Contact Form Honeypot');
  var honeypot = document.querySelector('[name="_gotcha"]');
  if (honeypot) {
    var style = window.getComputedStyle(honeypot);
    console.log('Result:', style.display === 'none' ? 'PASS — Hidden' : 'CHECK — Verify visibility');
  } else {
    console.log('N/A — Not on contact page');
  }
  console.groupEnd();
  
  console.log('\n=== SUITE COMPLETE ===');
  console.log('Note: TC-1 through TC-5 require file modifications or cross-origin tests — run manually.');
})();