fix(inspect): trim before the framing check; stop advisories swallowing the backstop (#556); pin the MQTT payloadFormat mode contract (#557 item 2)
#556 item 1 — leading whitespace defeated every Inspect's pre-filter. Seven factories (Modbus/S7/AbCip/AbLegacy/TwinCAT/FOCAS/Mqtt) tested `reference[0] != '{'`, so a padded blob returned EMPTY and a tag the driver refuses deployed clean. The check now trims first, matching the idiom Sql/Calculation/MTConnect/OpcUaClient already used. The raw reference is still what is handed to the mapper — the driver reads the stored blob, not a trimmed copy — so the gate keeps mirroring the runtime rather than becoming lenient. Both directions are pinned: a padded blob the mapper accepts still draws nothing, and one that is not object-framed AFTER trimming still draws nothing (it is not an equipment-tag TagConfig at all). Six of the seven mappers hand the blob to a whitespace-tolerant JsonDocument.Parse, so their verdict is unchanged by padding. MQTT is the exception: both its readers carry the same framing gate, so a padded blob is genuinely refused — which is why the untrimmed pre-filter was a real defect there and not a cosmetic mismatch. #556 item 2 — FOCAS and MQTT appended advisories unconditionally and then gated the catch-all rejection message on `warnings.Count == 0`, so an advisory (which fires on ACCEPTED blobs too, and says nothing about a refusal) silently swallowed the only message naming a refusal nothing else can. The two classes now accumulate in SEPARATE lists and the backstop gates on the rejection count alone — structural, not string matching. MQTT's swallow was reachable in production (a padded blob its readers refuse while every describe branch finds the parsed document well-formed); FOCAS's backstop is currently unreachable by audit, so its guard is protective. #557 item 2 — decided and pinned: KEEP the union verdict. Evidence: FromSparkplugTagConfig hard-codes PayloadFormat=Json and never consults the key; only MqttSubscriptionManager (the Plain ingest path) decodes by it; and MqttTagConfigModel.ToJson deliberately omits the key entirely in Sparkplug mode (#513). So a Sparkplug driver genuinely serves the tag and rejecting it would be stricter than the runtime. The cost — served behaviour depends on the driver's MqttMode, which no tag row records — is paid by an ADVISORY naming the key and the mode dependency, not by changing the verdict, so both gates keep agreeing. The same invalid value on a blob the union REFUSES stays a rejection; the class is decided by the accept gate, never by the key. Falsified: reverting Modbus's trim reddens the padded-rejection theory; neutering MQTT's backstop guard to the pre-#556 shape reddens the advisory-plus-unnameable-rejection test; disabling the #557 advisory reddens the contract pin; and for FOCAS, removing a describe branch alone stays green (the backstop covers it) while additionally neutering the guard goes red.
This commit is contained in:
Joseph Doherty
@@ -95,4 +95,105 @@ public sealed class FocasInspectAcceptGateTests
|
||||
[Fact]
|
||||
public void Unparseable_json_names_the_json()
|
||||
=> FocasTagDefinitionFactory.Inspect("{oops").ShouldContain(w => w.Contains("not valid JSON"));
|
||||
|
||||
// ---- Gitea #556 item 2: an advisory can no longer swallow the catch-all rejection ----
|
||||
|
||||
/// <summary>
|
||||
/// The structural invariant the backstop exists to hold: a blob the mapper REFUSES always draws
|
||||
/// strictly more than the advisories that same blob would draw if it were accepted. Before #556 the
|
||||
/// backstop was gated on <c>warnings.Count == 0</c> — and an advisory fires on an ACCEPTED blob
|
||||
/// too, so it says nothing about the refusal while still satisfying that guard. Any refusal no
|
||||
/// <c>DescribeRejection</c> branch can name was therefore dropped whenever an advisory was present.
|
||||
/// Comparing the two counts states the property without string-matching a message to guess its
|
||||
/// class, which is the whole point of keeping the two classes in separate lists.
|
||||
/// <para>
|
||||
/// ⚠️ FOCAS's own backstop is UNREACHABLE today (audited): every <c>return false</c> in
|
||||
/// <see cref="FocasTagDefinitionFactory.FromTagConfig"/> — absent / non-string / blank
|
||||
/// <c>address</c>, invalid <c>dataType</c> — has a matching describe branch, and
|
||||
/// <c>TryReadEnumStrict</c> and <c>DescribeInvalidEnum</c> share one classifier so they cannot
|
||||
/// disagree. So the guard is protective here rather than a live fix; MQTT's is live (a padded
|
||||
/// blob its own mappers refuse and every branch finds well-formed — see
|
||||
/// <c>MqttInspectAcceptGateTests</c>). What this pins is the property that must survive the
|
||||
/// next rejection cause someone adds without a describe branch.
|
||||
/// </para>
|
||||
/// </summary>
|
||||
[Fact]
|
||||
public void A_rejected_config_always_draws_more_than_its_advisories_alone()
|
||||
{
|
||||
// Identical but for the dataType typo, so both carry the SAME two advisories.
|
||||
const string Accepted = """{"address":"not-an-address","dataType":"Int32","writable":true}""";
|
||||
const string Rejected = """{"address":"not-an-address","dataType":"Intt32","writable":true}""";
|
||||
|
||||
FocasTagDefinitionFactory.FromTagConfig(Accepted, RawPath, out _).ShouldBeTrue("control must be accepted");
|
||||
FocasTagDefinitionFactory.FromTagConfig(Rejected, RawPath, out _).ShouldBeFalse("subject must be rejected");
|
||||
|
||||
var advisoriesOnly = FocasTagDefinitionFactory.Inspect(Accepted);
|
||||
var withRejection = FocasTagDefinitionFactory.Inspect(Rejected);
|
||||
|
||||
advisoriesOnly.Count.ShouldBe(2, "the control's warnings are purely advisory");
|
||||
withRejection.Count.ShouldBeGreaterThan(
|
||||
advisoriesOnly.Count,
|
||||
"a refusal must add a rejection-class warning — the backstop supplies one when nothing names it");
|
||||
}
|
||||
|
||||
// ---- Gitea #556 item 1: leading whitespace no longer defeats the framing pre-filter ----
|
||||
|
||||
/// <summary>
|
||||
/// Padding a blob with leading whitespace. A driver is handed whatever authoring persisted, and
|
||||
/// <c>FromTagConfig</c> passes it straight to <c>JsonDocument.Parse</c>, which skips leading
|
||||
/// whitespace — so the MAPPER's verdict is identical padded or not, and the gate's must be too.
|
||||
/// </summary>
|
||||
private const string Pad = " \t\r\n ";
|
||||
|
||||
/// <summary>
|
||||
/// Never stricter, under padding: a padded blob the mapper still accepts draws nothing. (This
|
||||
/// direction already held before #556 — the pre-filter returned empty for everything padded — and
|
||||
/// is kept so a future "just trim everywhere" change cannot start warning about a served tag.)
|
||||
/// </summary>
|
||||
/// <param name="tagConfig">An accepted fixture, padded below.</param>
|
||||
[Theory]
|
||||
[MemberData(nameof(CleanAndAccepted))]
|
||||
public void Leading_whitespace_leaves_an_accepted_config_silent(string tagConfig)
|
||||
{
|
||||
var padded = Pad + tagConfig;
|
||||
FocasTagDefinitionFactory.FromTagConfig(padded, RawPath, out _)
|
||||
.ShouldBeTrue("the mapper's JsonDocument.Parse skips leading whitespace");
|
||||
FocasTagDefinitionFactory.Inspect(padded).ShouldBeEmpty();
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Never silent, under padding — the #556 item 1 defect itself. The pre-filter tested
|
||||
/// <c>reference[0] != '{'</c>, so EVERY padded blob returned empty and a padded config the driver
|
||||
/// refuses deployed clean. Asserting equality with the untrimmed inspection (rather than merely
|
||||
/// "not empty") also pins that padding changes no message.
|
||||
/// </summary>
|
||||
/// <param name="tagConfig">A rejected fixture, padded below.</param>
|
||||
[Theory]
|
||||
[MemberData(nameof(Rejected))]
|
||||
public void Leading_whitespace_draws_exactly_the_warnings_the_untrimmed_blob_draws(string tagConfig)
|
||||
{
|
||||
var padded = Pad + tagConfig;
|
||||
FocasTagDefinitionFactory.FromTagConfig(padded, RawPath, out _)
|
||||
.ShouldBeFalse("the mapper's verdict is unchanged by padding");
|
||||
FocasTagDefinitionFactory.Inspect(padded).ShouldBe(FocasTagDefinitionFactory.Inspect(tagConfig));
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// The other half of the same fix, and the one it would be easy to lose: trimming widens the gate
|
||||
/// ONLY for JSON objects. A reference that is still not object-framed after the trim is not an
|
||||
/// equipment-tag TagConfig at all — the pre-existing convention shared by all eleven inspectors —
|
||||
/// so it keeps drawing nothing even though the mapper refuses it.
|
||||
/// </summary>
|
||||
/// <param name="reference">A padded, non-object reference.</param>
|
||||
[Theory]
|
||||
[InlineData(" just a string")]
|
||||
[InlineData(" [1,2,3]")]
|
||||
[InlineData(" \t\r\n 42")]
|
||||
[InlineData(" \"a\"")]
|
||||
[InlineData(" ")]
|
||||
public void A_non_object_reference_still_draws_nothing_after_trimming(string reference)
|
||||
{
|
||||
FocasTagDefinitionFactory.FromTagConfig(reference, RawPath, out _).ShouldBeFalse();
|
||||
FocasTagDefinitionFactory.Inspect(reference).ShouldBeEmpty();
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user