ScadaBridge/tests/ZB.MOM.WW.ScadaBridge.TemplateEngine.Tests/Validation/ScriptCompilerTests.cs

using ZB.MOM.WW.ScadaBridge.TemplateEngine.Validation;

namespace ZB.MOM.WW.ScadaBridge.TemplateEngine.Tests.Validation;

/// <summary>
/// The design-time deploy gate now delegates to the shared
/// <c>ZB.MOM.WW.ScadaBridge.ScriptAnalysis</c> analyzer — a real Roslyn semantic
/// forbidden-API verdict plus a real CSharpScript compile against the
/// runtime-mirroring <c>ScriptCompileSurface</c>. These tests assert the
/// authoritative behavior: bypasses the old substring scan missed are now caught,
/// and undefined symbols (which a structural scan could never see) fail compile.
/// </summary>
// Serialised with ScriptCompileVerdictCacheEvictionTests: both drive the
// process-wide ScriptCompileVerdictCache static, and an overflow test running
// concurrently would evict the entries these hit-count assertions depend on.
[Collection("ScriptCompileVerdictCache")]
public class ScriptCompilerTests
{
    private readonly ScriptCompiler _sut = new();

    /// <summary>Verifies that compiling empty code returns a failure.</summary>
    [Fact]
    public void TryCompile_EmptyCode_ReturnsFailure()
    {
        var result = _sut.TryCompile("", "Test");
        Assert.True(result.IsFailure);
        Assert.Contains("empty", result.Error, StringComparison.OrdinalIgnoreCase);
    }

    /// <summary>Verifies that compiling whitespace-only code returns a failure.</summary>
    [Fact]
    public void TryCompile_WhitespaceOnly_ReturnsFailure()
    {
        var result = _sut.TryCompile("   \n\t  ", "Test");
        Assert.True(result.IsFailure);
        Assert.Contains("empty", result.Error, StringComparison.OrdinalIgnoreCase);
    }

    // --- Forbidden-API gate (authoritative) ---

    /// <summary>Verifies that compiling code that uses a forbidden API returns a failure.</summary>
    [Fact]
    public void TryCompile_ForbiddenApi_ReturnsFailure()
    {
        var result = _sut.TryCompile("using System.IO; File.ReadAllText(\"x\");", "Test");
        Assert.True(result.IsFailure);
        Assert.Contains("forbidden", result.Error, StringComparison.OrdinalIgnoreCase);
    }

    /// <summary>Verifies that compiling code that uses several forbidden APIs reports all of them.</summary>
    [Fact]
    public void TryCompile_MultipleForbiddenApis_ReportsAll()
    {
        // The failure message must enumerate EVERY forbidden API, not
        // just the first, so an operator fixing one isn't surprised by the next.
        var result = _sut.TryCompile(
            "System.IO.File.ReadAllText(\"x\"); System.Diagnostics.Process.Start(\"y\");",
            "Test");
        Assert.True(result.IsFailure);
        Assert.Contains("System.IO", result.Error, StringComparison.Ordinal);
        Assert.Contains("Process", result.Error, StringComparison.Ordinal);
    }

    /// <summary>Verifies that adversarial attempts to bypass the forbidden-API check are still rejected.</summary>
    /// <param name="code">The adversarial script source under test.</param>
    [Theory]
    // Namespace alias — the old substring scan never saw "System.IO." spelled out.
    [InlineData("using IO = System.IO; IO.File.ReadAllText(\"x\");")]
    // using static — the call site is a bare ReadAllText(...) with no namespace text.
    [InlineData("using static System.IO.File; ReadAllText(\"x\");")]
    // global::-qualified reference.
    [InlineData("global::System.IO.File.ReadAllText(\"x\");")]
    // Reflection gateway — never spells a forbidden namespace at all.
    [InlineData("typeof(string).Assembly.GetType(\"System.IO.File\");")]
    public void TryCompile_AdversarialForbiddenApiBypass_StillRejected(string code)
    {
        var result = _sut.TryCompile(code, "Test");
        Assert.True(result.IsFailure);
        Assert.Contains("forbidden", result.Error, StringComparison.OrdinalIgnoreCase);
    }

    /// <summary>Verifies that a forbidden type in an otherwise allowed namespace is rejected as forbidden.</summary>
    [Fact]
    public void TryCompile_ForbiddenTypeInAllowedNamespace_RejectedAsForbidden()
    {
        // System.Diagnostics is an ALLOWED namespace (Stopwatch/Debug ok), so the
        // `using` directive can't be flagged; Process is a forbidden TYPE reached
        // as a bare identifier. The validator's full-framework semantic resolution
        // must catch it authoritatively as a forbidden API (not merely as an
        // undefined-symbol compile error).
        var result = _sut.TryCompile(
            "using System.Diagnostics; var p = Process.Start(\"x\");", "Test");
        Assert.True(result.IsFailure);
        Assert.Contains("forbidden", result.Error, StringComparison.OrdinalIgnoreCase);
    }

    /// <summary>Verifies that using the stopwatch from the allowed diagnostics namespace compiles successfully.</summary>
    [Fact]
    public void TryCompile_StopwatchInAllowedDiagnostics_ReturnsSuccess()
    {
        // The companion to the Process case: Stopwatch lives in the same allowed
        // System.Diagnostics namespace and must NOT be flagged.
        var result = _sut.TryCompile(
            "using System.Diagnostics; var sw = Stopwatch.StartNew(); var e = sw.ElapsedMilliseconds;",
            "Test");
        Assert.True(result.IsSuccess, result.IsFailure ? result.Error : null);
    }

    // --- Real-compile gate (the win over the old structural-only scan) ---

    /// <summary>Verifies that compiling code with an undefined symbol returns a failure.</summary>
    [Fact]
    public void TryCompile_UndefinedSymbol_ReturnsFailure()
    {
        // A brace-balanced, forbidden-API-free script that references an undefined
        // symbol. The old substring + brace scan accepted this; the real compile
        // rejects it.
        var result = _sut.TryCompile("var x = NoSuchThing.Foo();", "Test");
        Assert.True(result.IsFailure);
        Assert.Contains("compile", result.Error, StringComparison.OrdinalIgnoreCase);
    }

    /// <summary>Verifies that compiling code with a syntax error returns a failure.</summary>
    [Fact]
    public void TryCompile_SyntaxError_ReturnsFailure()
    {
        // Genuinely malformed — must fail the real compile.
        var result = _sut.TryCompile("if (true) { var x = 1;", "Test");
        Assert.True(result.IsFailure);
    }

    // --- Valid real script against the script API surface ---

    /// <summary>Verifies that a valid script using the API surface compiles successfully.</summary>
    [Fact]
    public void TryCompile_ValidScriptUsingApiSurface_ReturnsSuccess()
    {
        const string code = """
            var t = Attributes["Temperature"];
            Attributes["Setpoint"] = 42;
            var r = await ExternalSystem.Call("erp", "sync");
            await Notify.To("ops").Send("s", "m");
            """;

        var result = _sut.TryCompile(code, "Test");
        Assert.True(result.IsSuccess, result.IsFailure ? result.Error : null);
    }

    // --- Trigger-expression gate via ValidationService.CheckExpressionSyntax ---

    /// <summary>Verifies that checking a valid expression returns null.</summary>
    [Fact]
    public void CheckExpressionSyntax_ValidExpression_ReturnsNull()
    {
        // A bare boolean expression binding against the trigger globals surface.
        var error = ValidationService.CheckExpressionSyntax("Attributes[\"Temp\"] != null");
        Assert.Null(error);
    }

    /// <summary>Verifies that checking an expression that uses a forbidden API returns an error message.</summary>
    [Fact]
    public void CheckExpressionSyntax_ForbiddenApi_ReturnsMessage()
    {
        var error = ValidationService.CheckExpressionSyntax("System.IO.File.Exists(\"x\")");
        Assert.NotNull(error);
        Assert.Contains("forbidden", error, StringComparison.OrdinalIgnoreCase);
    }

    /// <summary>Verifies that checking the same expression twice serves the second call from the cache.</summary>
    [Fact]
    public void CheckExpressionSyntax_SameExpressionTwice_SecondCallIsCacheHit()
    {
        ScriptCompileVerdictCache.Clear();
        ValidationService.CheckExpressionSyntax("Attributes[\"Temp\"] != null");
        var hitsBefore = ScriptCompileVerdictCache.Hits;
        var error = ValidationService.CheckExpressionSyntax("Attributes[\"Temp\"] != null");
        Assert.Null(error);
        Assert.Equal(hitsBefore + 1, ScriptCompileVerdictCache.Hits);   // FAILS today: no cache use
    }

    /// <summary>Verifies that a verdict cached for the script surface is not reused for the trigger surface.</summary>
    [Fact]
    public void CheckExpressionSyntax_ScriptSurfaceVerdict_NotReusedForTriggerSurface()
    {
        // "Notify != null" resolves on ScriptCompileSurface (Notify is a script global,
        // ScriptCompileSurface.cs:53) but NOT on TriggerCompileSurface — a shared
        // code-only cache entry would wrongly report the trigger expression clean.
        ScriptCompileVerdictCache.Clear();
        Assert.True(new ScriptCompiler().TryCompile("Notify != null", "S").IsSuccess); // warms the SCRIPT-surface entry
        var error = ValidationService.CheckExpressionSyntax("Notify != null");
        Assert.NotNull(error);   // green today (no cache), and MUST STAY green after T3 — the T2 key makes it structural
    }

    /// <summary>Verifies that checking an expression with several forbidden APIs reports all of them.</summary>
    [Fact]
    public void CheckExpressionSyntax_MultipleForbiddenApis_ReportsAll()
    {
        var error = ValidationService.CheckExpressionSyntax(
            "System.IO.File.Exists(\"x\") && System.Diagnostics.Process.GetProcesses().Length > 0");
        Assert.NotNull(error);
        Assert.Contains("System.IO", error);      // FAILS today: only violations[0] is surfaced
        Assert.Contains("Process", error);
    }

    /// <summary>Verifies that checking an expression with several compile errors reports all of them.</summary>
    [Fact]
    public void CheckExpressionSyntax_MultipleCompileErrors_ReportsAll()
    {
        var error = ValidationService.CheckExpressionSyntax("NoSuchThingA > 1 && NoSuchThingB < 2");
        Assert.NotNull(error);
        Assert.Contains("NoSuchThingA", error);   // FAILS today: only errors[0] is surfaced
        Assert.Contains("NoSuchThingB", error);
    }

    // --- Compile-verdict cache: unchanged code compiles once per process ---

    /// <summary>Verifies that compiling the same code twice serves the second call from the cache.</summary>
    [Fact]
    public void TryCompile_SameCodeTwice_SecondCallIsCacheHit()
    {
        ScriptCompileVerdictCache.Clear();
        var c = new ScriptCompiler();
        c.TryCompile("return 1;", "A");
        var hitsBefore = ScriptCompileVerdictCache.Hits;
        var r = c.TryCompile("return 1;", "B");   // same code, different name
        Assert.True(r.IsSuccess);
        Assert.Equal(hitsBefore + 1, ScriptCompileVerdictCache.Hits);
    }

    /// <summary>Verifies that the same code on different surfaces computes separate verdicts.</summary>
    [Fact]
    public void GetOrAdd_SameCodeDifferentSurface_ComputesSeparateVerdicts()
    {
        ScriptCompileVerdictCache.Clear();
        var a = ScriptCompileVerdictCache.GetOrAdd("SurfaceA", "return 1;", () => (true, null));
        var hitsAfterA = ScriptCompileVerdictCache.Hits;
        var b = ScriptCompileVerdictCache.GetOrAdd("SurfaceB", "return 1;", () => (false, "err"));

        Assert.True(a.Ok);
        Assert.False(b.Ok);                                     // code-only key would return SurfaceA's verdict
        Assert.Equal(hitsAfterA, ScriptCompileVerdictCache.Hits); // no false cross-surface hit
        Assert.Equal(2, ScriptCompileVerdictCache.Count);
    }

    /// <summary>Verifies that a cached failure formats the script name separately for each caller.</summary>
    [Fact]
    public void TryCompile_CachedFailure_FormatsNameForEachCaller()
    {
        // The stored verdict is name-free; the script name is formatted in at read
        // time, so two callers of the same bad code get their own name in the message.
        ScriptCompileVerdictCache.Clear();
        var c = new ScriptCompiler();
        var first = c.TryCompile("var x = NoSuchThing.Foo();", "Alpha");
        var second = c.TryCompile("var x = NoSuchThing.Foo();", "Beta"); // cache hit

        Assert.True(first.IsFailure);
        Assert.True(second.IsFailure);
        Assert.Contains("'Alpha'", first.Error);
        Assert.Contains("'Beta'", second.Error);
        Assert.Contains("compile", second.Error, StringComparison.OrdinalIgnoreCase);
    }
}