fix(options): eager startup validation for AuditLog site sub-options — SiteWriter, SiteTelemetry, SiteRetention (plan R2-08 T5, arch-review 08r2 NF4)

2026-07-13 10:36:46 -04:00
parent 8ddcbbd6f4
commit e0dddac0be
7 changed files with 307 additions and 13 deletions
@@ -0,0 +1,53 @@
+using ZB.MOM.WW.ScadaBridge.AuditLog.Site;
+
+namespace ZB.MOM.WW.ScadaBridge.AuditLog.Tests.Site;
+
+/// <summary>
+/// Eager startup validation for <see cref="SiteAuditRetentionOptions"/>
+/// (arch-review 08 round 2 NF4). Although the option class self-clamps at
+/// resolve time, the validator still fails a boot with a plainly-wrong config
+/// (zero retention window, zero/negative purge period, negative initial delay)
+/// so the operator learns at startup rather than trusting a silent clamp.
+/// <c>PurgeIntervalOverride</c> is test-only and left unvalidated.
+/// </summary>
+public class SiteAuditRetentionOptionsValidatorTests
+{
+    [Fact]
+    public void DefaultOptions_AreValid()
+    {
+        var validator = new SiteAuditRetentionOptionsValidator();
+        Assert.True(validator.Validate(null, new SiteAuditRetentionOptions()).Succeeded);
+    }
+
+    [Fact]
+    public void ZeroRetentionDays_Fails()
+    {
+        var validator = new SiteAuditRetentionOptionsValidator();
+        var result = validator.Validate(null, new SiteAuditRetentionOptions { RetentionDays = 0 });
+        Assert.False(result.Succeeded);
+        Assert.Contains(result.Failures!,
+            f => f.Contains(nameof(SiteAuditRetentionOptions.RetentionDays), StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void ZeroPurgeInterval_Fails()
+    {
+        var validator = new SiteAuditRetentionOptionsValidator();
+        var result = validator.Validate(null,
+            new SiteAuditRetentionOptions { PurgeInterval = TimeSpan.Zero });
+        Assert.False(result.Succeeded);
+        Assert.Contains(result.Failures!,
+            f => f.Contains(nameof(SiteAuditRetentionOptions.PurgeInterval), StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void NegativeInitialDelay_Fails()
+    {
+        var validator = new SiteAuditRetentionOptionsValidator();
+        var result = validator.Validate(null,
+            new SiteAuditRetentionOptions { InitialDelay = TimeSpan.FromSeconds(-1) });
+        Assert.False(result.Succeeded);
+        Assert.Contains(result.Failures!,
+            f => f.Contains(nameof(SiteAuditRetentionOptions.InitialDelay), StringComparison.Ordinal));
+    }
+}
@@ -0,0 +1,61 @@
+using ZB.MOM.WW.ScadaBridge.AuditLog.Site.Telemetry;
+
+namespace ZB.MOM.WW.ScadaBridge.AuditLog.Tests.Site;
+
+/// <summary>
+/// Eager startup validation for <see cref="SiteAuditTelemetryOptions"/>
+/// (arch-review 08 round 2 NF4). The drain-loop cadences are used as raw
+/// scheduling delays in <c>SiteAuditTelemetryActor</c>; a zero interval spins
+/// the drain and a zero batch drains nothing. Idle must back off at least as
+/// far as busy (idle &lt; busy inverts the actor's intent).
+/// </summary>
+public class SiteAuditTelemetryOptionsValidatorTests
+{
+    [Fact]
+    public void DefaultOptions_AreValid()
+    {
+        var validator = new SiteAuditTelemetryOptionsValidator();
+        Assert.True(validator.Validate(null, new SiteAuditTelemetryOptions()).Succeeded);
+    }
+
+    [Fact]
+    public void ZeroBatchSize_Fails()
+    {
+        var validator = new SiteAuditTelemetryOptionsValidator();
+        var result = validator.Validate(null, new SiteAuditTelemetryOptions { BatchSize = 0 });
+        Assert.False(result.Succeeded);
+        Assert.Contains(result.Failures!,
+            f => f.Contains(nameof(SiteAuditTelemetryOptions.BatchSize), StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void ZeroBusyInterval_Fails()
+    {
+        var validator = new SiteAuditTelemetryOptionsValidator();
+        var result = validator.Validate(null, new SiteAuditTelemetryOptions { BusyIntervalSeconds = 0 });
+        Assert.False(result.Succeeded);
+        Assert.Contains(result.Failures!,
+            f => f.Contains(nameof(SiteAuditTelemetryOptions.BusyIntervalSeconds), StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void ZeroIdleInterval_Fails()
+    {
+        var validator = new SiteAuditTelemetryOptionsValidator();
+        var result = validator.Validate(null, new SiteAuditTelemetryOptions { IdleIntervalSeconds = 0 });
+        Assert.False(result.Succeeded);
+        Assert.Contains(result.Failures!,
+            f => f.Contains(nameof(SiteAuditTelemetryOptions.IdleIntervalSeconds), StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void IdleShorterThanBusy_Fails()
+    {
+        var validator = new SiteAuditTelemetryOptionsValidator();
+        var result = validator.Validate(null,
+            new SiteAuditTelemetryOptions { BusyIntervalSeconds = 30, IdleIntervalSeconds = 5 });
+        Assert.False(result.Succeeded);
+        Assert.Contains(result.Failures!,
+            f => f.Contains(nameof(SiteAuditTelemetryOptions.IdleIntervalSeconds), StringComparison.Ordinal));
+    }
+}
@@ -0,0 +1,72 @@
+using ZB.MOM.WW.ScadaBridge.AuditLog.Site;
+
+namespace ZB.MOM.WW.ScadaBridge.AuditLog.Tests.Site;
+
+/// <summary>
+/// Eager startup validation for <see cref="SqliteAuditWriterOptions"/>
+/// (arch-review 08 round 2 NF4). The site hot-path writer's channel/batch/flush
+/// knobs must be positive or the background writer task cannot make progress;
+/// an empty <c>DatabasePath</c> would leave the SQLite writer with nowhere to go.
+/// <c>BacklogPollIntervalSeconds</c> is deliberately NOT validated — a
+/// non-positive value has a documented fall-back-to-30s contract.
+/// </summary>
+public class SqliteAuditWriterOptionsValidatorTests
+{
+    [Fact]
+    public void DefaultOptions_AreValid()
+    {
+        var validator = new SqliteAuditWriterOptionsValidator();
+        Assert.True(validator.Validate(null, new SqliteAuditWriterOptions()).Succeeded);
+    }
+
+    [Fact]
+    public void EmptyDatabasePath_Fails()
+    {
+        var validator = new SqliteAuditWriterOptionsValidator();
+        var result = validator.Validate(null, new SqliteAuditWriterOptions { DatabasePath = "" });
+        Assert.False(result.Succeeded);
+        Assert.Contains(result.Failures!,
+            f => f.Contains(nameof(SqliteAuditWriterOptions.DatabasePath), StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void ZeroChannelCapacity_Fails()
+    {
+        var validator = new SqliteAuditWriterOptionsValidator();
+        var result = validator.Validate(null, new SqliteAuditWriterOptions { ChannelCapacity = 0 });
+        Assert.False(result.Succeeded);
+        Assert.Contains(result.Failures!,
+            f => f.Contains(nameof(SqliteAuditWriterOptions.ChannelCapacity), StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void ZeroBatchSize_Fails()
+    {
+        var validator = new SqliteAuditWriterOptionsValidator();
+        var result = validator.Validate(null, new SqliteAuditWriterOptions { BatchSize = 0 });
+        Assert.False(result.Succeeded);
+        Assert.Contains(result.Failures!,
+            f => f.Contains(nameof(SqliteAuditWriterOptions.BatchSize), StringComparison.Ordinal));
+    }
+
+    [Fact]
+    public void ZeroFlushInterval_Fails()
+    {
+        var validator = new SqliteAuditWriterOptionsValidator();
+        var result = validator.Validate(null, new SqliteAuditWriterOptions { FlushIntervalMs = 0 });
+        Assert.False(result.Succeeded);
+        Assert.Contains(result.Failures!,
+            f => f.Contains(nameof(SqliteAuditWriterOptions.FlushIntervalMs), StringComparison.Ordinal));
+    }
+
+    [Theory]
+    [InlineData(0)]
+    [InlineData(-1)]
+    public void NonPositiveBacklogPollInterval_StillValid(int value)
+    {
+        // Documented fall-back-to-30s contract — must NOT be rejected.
+        var validator = new SqliteAuditWriterOptionsValidator();
+        Assert.True(validator.Validate(null,
+            new SqliteAuditWriterOptions { BacklogPollIntervalSeconds = value }).Succeeded);
+    }
+}