import { Component, signal } from '@angular/core';
import { CommonModule } from '@angular/common';
import { FormsModule } from '@angular/forms';

@Component({
  selector: 'app-root',
  standalone: true,
  imports: [CommonModule, FormsModule],
  template: `
    
{{ titulo() }}
  `
})
export class AppComponent {
  titulo = signal('Angular 20 BDD');
}

import { Routes } from '@angular/router';
import { LoginComponent } from './login/login.component';
import { DashboardComponent } from './dashboard/dashboard.component';

export const routes: Routes = [
  { path: '',          component: LoginComponent },
  { path: 'dashboard', component: DashboardComponent },
];

describe('Login Feature', () => {

  it('Usuario válido inicia sesión', () => {
    cy.visit('http://localhost:4200');

    cy.get('input[type=email]').type('admin@test.com');
    cy.get('input[type=password]').type('1234');
    cy.contains('Ingresar').click();

    cy.contains('Bienvenido al sistema').should('be.visible');
  });

});

import { Injectable, signal } from '@angular/core';

interface User {
  email: string;
  role: 'admin' | 'user';
}

@Injectable({ providedIn: 'root' })
export class AuthService {

  private users: User[] = [
    { email: 'admin@test.com', role: 'admin' },
    { email: 'user@test.com',  role: 'user'  },
  ];

  currentUser = signal<User | null>(null);

  login(email: string, password: string): boolean {
    const user = this.users.find(u => u.email === email);
    if (user && password === '1234') {
      this.currentUser.set(user);
      return true;
    }
    return false;
  }

  logout() { this.currentUser.set(null); }

  isAdmin(): boolean {
    return this.currentUser()?.role === 'admin';
  }
}

import { Component, signal, inject } from '@angular/core';
import { Router } from '@angular/router';
import { FormsModule } from '@angular/forms';
import { AuthService } from '../auth.service';

@Component({
  selector: 'app-login',
  standalone: true,
  imports: [FormsModule],
  template: `
    
    
    Ingresar
    
{{ message() }}
  `
})
export class LoginComponent {
  private auth   = inject(AuthService);
  private router = inject(Router);

  email    = signal('');
  password = signal('');
  message  = signal('');

  login() {
    const ok = this.auth.login(this.email(), this.password());
    if (ok) {
      this.router.navigate(['/dashboard']);
    } else {
      this.message.set('Credenciales inválidas');
    }
  }
}

import { inject } from '@angular/core';
import { CanActivateFn, Router } from '@angular/router';
import { AuthService } from './auth.service';

export const authGuard: CanActivateFn = () => {
  const auth   = inject(AuthService);
  const router = inject(Router);
  if (auth.currentUser()) return true;
  return router.createUrlTree(['/']);
};

export const adminGuard: CanActivateFn = () => {
  const auth   = inject(AuthService);
  const router = inject(Router);
  if (auth.isAdmin()) return true;
  return router.createUrlTree(['/dashboard']);
};

describe('Login con Roles', () => {

  it('admin accede al dashboard', () => {
    cy.visit('/login');
    cy.get('[data-cy=email]').type('admin@test.com');
    cy.get('[data-cy=password]').type('Admin123!');
    cy.get('[data-cy=submit]').click();
    cy.url().should('include', '/dashboard');
    cy.get('[data-cy=admin-menu]').should('be.visible');
  });

  it('credenciales incorrectas muestran error', () => {
    cy.visit('/login');
    cy.get('[data-cy=email]').type('user@test.com');
    cy.get('[data-cy=password]').type('wrong');
    cy.get('[data-cy=submit]').click();
    cy.contains('Credenciales inválidas').should('be.visible');
  });

  it('usuario sin rol admin no ve gestión de usuarios', () => {
    cy.visit('/login');
    cy.get('[data-cy=email]').type('user@test.com');
    cy.get('[data-cy=password]').type('1234');
    cy.get('[data-cy=submit]').click();
    cy.get('[data-cy=admin-menu]').should('not.exist');
  });

});

login() {
  const email = this.email();

  // Patrón de detección de SQL Injection
  const sqlInjectionPattern = /('|--|;|DROP|SELECT|INSERT)/i;

  if (sqlInjectionPattern.test(email)) {
    this.message.set('Entrada inválida detectada');
    return;
  }

  const isValid = this.authService.login(email, this.password());
  this.message.set(isValid ? 'Bienvenido' : 'Acceso denegado');
}

// ❌ INSEGURO — concatenación directa
const query = `SELECT * FROM users WHERE email = '${email}'`;

// ✅ SEGURO — consulta parametrizada
const query = 'SELECT * FROM users WHERE email = ?';
db.execute(query, [email]);

// ✅ SEGURO — con ORM (TypeORM ejemplo)
const user = await userRepository.findOne({
  where: { email }   // ORM maneja la parametrización
});

describe('Seguridad Anti SQL Injection', () => {

  it('Bloquea intento SQL Injection', () => {
    cy.visit('/');
    cy.get('input[type=email]').type("admin' OR 1=1 --");
    cy.contains('Ingresar').click();
    cy.contains('Entrada inválida detectada').should('exist');
  });

  it('Bloquea intento con DROP TABLE', () => {
    cy.visit('/');
    cy.get('input[type=email]').type("'; DROP TABLE users; --");
    cy.contains('Ingresar').click();
    cy.contains('Entrada inválida detectada').should('exist');
  });

});