"""Each rule gets exactly two checks: it must fire once on its true-positive fixture and
never on its false-positive twin. A rule that only matches a naive pattern (no taint
tracking) tends to pass the first and fail the second; a rule with the wrong sink tends
to fail the first. Read the fixture files under fixtures/ before writing a rule."""


def test_deserialization_flags_untrusted_stream(run_semgrep, rules_dir, fixtures_dir):
    findings = run_semgrep(rules_dir / "deserialization.yaml", fixtures_dir / "tp" / "DeserializeUntrusted.java")
    assert len(findings) == 1, f"expected exactly 1 finding on the untrusted-stream fixture, got {len(findings)}"


def test_deserialization_ignores_local_file(run_semgrep, rules_dir, fixtures_dir):
    findings = run_semgrep(rules_dir / "deserialization.yaml", fixtures_dir / "fp" / "DeserializeLocalFile.java")
    assert len(findings) == 0, f"expected 0 findings on the trusted local-file fixture, got {len(findings)}: {findings}"


def test_sqli_flags_concatenated_prepared_statement(run_semgrep, rules_dir, fixtures_dir):
    findings = run_semgrep(rules_dir / "sqli.yaml", fixtures_dir / "tp" / "SqlInjectionConcat.java")
    assert len(findings) == 1, f"expected exactly 1 finding on the concatenated-SQL fixture, got {len(findings)}"


def test_sqli_ignores_parameterized_query(run_semgrep, rules_dir, fixtures_dir):
    findings = run_semgrep(rules_dir / "sqli.yaml", fixtures_dir / "fp" / "SqlParameterized.java")
    assert len(findings) == 0, f"expected 0 findings on the parameterised-query fixture, got {len(findings)}: {findings}"


def test_exec_flags_tainted_command(run_semgrep, rules_dir, fixtures_dir):
    findings = run_semgrep(rules_dir / "exec_taint.yaml", fixtures_dir / "tp" / "ExecTainted.java")
    assert len(findings) == 1, f"expected exactly 1 finding on the tainted-command fixture, got {len(findings)}"


def test_exec_ignores_hardcoded_command(run_semgrep, rules_dir, fixtures_dir):
    findings = run_semgrep(rules_dir / "exec_taint.yaml", fixtures_dir / "fp" / "ExecSafe.java")
    assert len(findings) == 0, f"expected 0 findings on the hardcoded-command fixture, got {len(findings)}: {findings}"