lmxopcua/tests/Server/ZB.MOM.WW.OtOpcUa.Host.IntegrationTests/LdapAuthResilienceTests.cs

using System.Diagnostics;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Logging.Abstractions;
using Microsoft.Extensions.Options;
using Shouldly;
using Xunit;
using ZB.MOM.WW.Auth.Abstractions.Roles;
using ZB.MOM.WW.OtOpcUa.Host.OpcUa;
using ZB.MOM.WW.OtOpcUa.Security.Ldap;

namespace ZB.MOM.WW.OtOpcUa.Host.IntegrationTests;

/// <summary>
/// Resilience guard for <see cref="LdapOpcUaUserAuthenticator"/> (arch-review 03/S2). The OPC UA SDK
/// raises the impersonation callback synchronously under a <c>SessionManager</c>-wide event lock, so a
/// slow / hung LDAP bind inside it does not merely stall one SDK thread — it serializes EVERY session
/// activation server-wide. These tests prove the authenticator enforces a hard wall-clock bound,
/// bounded in-flight concurrency, and a directory-outage circuit at its own boundary (the SDK callback
/// being irreducibly synchronous), all fail-closed. No real LDAP server is used — a delaying fake
/// reproduces the outage shape offline.
/// </summary>
public sealed class LdapAuthResilienceTests
{
    /// <summary>
    /// RED repro (03/S2): a backend that takes 5 s must NOT hold the caller for 5 s — the authenticator's
    /// wall-clock bound denies (fail-closed) well before then. On current code (no bound) this fails: the
    /// call returns Allow after the full 5 s.
    /// </summary>
    [Fact]
    public async Task Authenticate_slow_backend_denies_within_AuthTimeout()
    {
        var ldap = new DelayingFakeLdap(
            TimeSpan.FromSeconds(5),
            new LdapAuthResult(true, "Alice", "alice", new[] { "configeditor" }, Array.Empty<string>(), null));
        var mapper = new FakeMapper(g => g.ToArray());
        var sut = Build(ldap, mapper, new LdapOptions { AuthTimeoutMs = 200 });

        var sw = Stopwatch.StartNew();
        var result = await sut
            .AuthenticateUserNameAsync("alice", "secret", CancellationToken.None)
            .WaitAsync(TimeSpan.FromSeconds(10), CancellationToken.None);
        sw.Stop();

        result.Success.ShouldBeFalse();
        result.Error.ShouldNotBeNull();
        result.Error!.ShouldContain("timed out");
        sw.Elapsed.ShouldBeLessThan(TimeSpan.FromSeconds(1.5));
    }

    /// <summary>A fast, healthy backend is unaffected by the resilience wrapping — success + roles pass
    /// through untouched (03/S2).</summary>
    [Fact]
    public async Task Authenticate_fast_success_unaffected()
    {
        var ldap = new DelayingFakeLdap(
            TimeSpan.Zero,
            new LdapAuthResult(true, "Alice", "alice", new[] { "configeditor" }, Array.Empty<string>(), null));
        var mapper = new FakeMapper(g => g.Select(x => x == "configeditor" ? "Designer" : x).ToArray());
        var sut = Build(ldap, mapper, new LdapOptions());

        var result = await sut
            .AuthenticateUserNameAsync("alice", "secret", CancellationToken.None)
            .WaitAsync(TimeSpan.FromSeconds(10), CancellationToken.None);

        result.Success.ShouldBeTrue();
        result.DisplayName.ShouldBe("Alice");
        result.Roles.ShouldBe(new[] { "Designer" });
    }

    /// <summary>With the concurrency cap saturated (a parked in-flight bind holding the only slot), a
    /// second call is denied "backend busy" within its own budget — it never waits behind the parked
    /// bind indefinitely (03/S2).</summary>
    [Fact]
    public async Task Authenticate_saturated_concurrency_denies_busy()
    {
        var ldap = new GatedFakeLdap(
            new LdapAuthResult(true, "Alice", "alice", new[] { "configeditor" }, Array.Empty<string>(), null));
        var mapper = new FakeMapper(g => g.ToArray());
        // MaxConcurrentAuthentications = 1 → the second call cannot get a slot; small AuthTimeoutMs so the
        // "busy" denial is quick and the first call's boundary also trips fast (its core stays parked,
        // holding the slot).
        var sut = Build(ldap, mapper, new LdapOptions { MaxConcurrentAuthentications = 1, AuthTimeoutMs = 300 });

        // First call: acquires the only slot; its core parks in the gated fake.
        var first = sut.AuthenticateUserNameAsync("alice", "secret", CancellationToken.None);

        // Wait until the fake has actually been entered (slot acquired, core parked).
        var spin = Stopwatch.StartNew();
        while (ldap.Entered == 0 && spin.Elapsed < TimeSpan.FromSeconds(5))
            await Task.Delay(10, TestContext.Current.CancellationToken);
        ldap.Entered.ShouldBe(1);

        // Second concurrent call: the slot is held by the parked core, so acquisition times out → busy.
        var second = await sut
            .AuthenticateUserNameAsync("bob", "secret", CancellationToken.None)
            .WaitAsync(TimeSpan.FromSeconds(10), CancellationToken.None);

        second.Success.ShouldBeFalse();
        second.Error.ShouldNotBeNull();
        second.Error!.ShouldContain("busy");
        ldap.Entered.ShouldBe(1, "the second call must be denied without ever reaching the backend");

        // Release the parked bind so the first call's core completes cleanly (no orphaned resources).
        ldap.Release();
        await first.WaitAsync(TimeSpan.FromSeconds(10), CancellationToken.None);
    }

    private static LdapOpcUaUserAuthenticator Build(
        ILdapAuthService ldap, IGroupRoleMapper<string> mapper, LdapOptions options) =>
        new(ldap, ScopeFactoryWith(mapper), Options.Create(options),
            NullLogger<LdapOpcUaUserAuthenticator>.Instance);

    /// <summary>Builds an IServiceScopeFactory whose scopes resolve the supplied mapper.</summary>
    private static IServiceScopeFactory ScopeFactoryWith(IGroupRoleMapper<string> mapper)
    {
        var services = new ServiceCollection();
        services.AddScoped(_ => mapper);
        return services.BuildServiceProvider().GetRequiredService<IServiceScopeFactory>();
    }

    /// <summary>
    /// A fake <see cref="ILdapAuthService"/> that awaits a configurable delay (observing the token) before
    /// returning a fixed result — the offline stand-in for a slow / hung directory. Counts invocations so
    /// tests can assert the outage circuit denies WITHOUT reaching the backend.
    /// </summary>
    private sealed class DelayingFakeLdap : ILdapAuthService
    {
        private readonly TimeSpan _delay;
        private readonly LdapAuthResult _then;
        private int _calls;

        /// <summary>Initializes the fake with a per-call delay and the result to return afterwards.</summary>
        /// <param name="delay">How long each authenticate call blocks before returning.</param>
        /// <param name="then">The result returned once the delay elapses.</param>
        public DelayingFakeLdap(TimeSpan delay, LdapAuthResult then)
        {
            _delay = delay;
            _then = then;
        }

        /// <summary>The number of times the backend was actually invoked.</summary>
        public int Calls => Volatile.Read(ref _calls);

        /// <summary>Awaits the configured delay, then returns the canned result.</summary>
        /// <param name="username">The username (ignored).</param>
        /// <param name="password">The password (ignored).</param>
        /// <param name="ct">Cancellation token, observed by the delay.</param>
        public async Task<LdapAuthResult> AuthenticateAsync(string username, string password, CancellationToken ct = default)
        {
            Interlocked.Increment(ref _calls);
            await Task.Delay(_delay, ct).ConfigureAwait(false);
            return _then;
        }
    }

    /// <summary>
    /// A fake <see cref="ILdapAuthService"/> that parks ASYNCHRONOUSLY (awaits a
    /// <see cref="TaskCompletionSource"/>) until the test calls <see cref="Release"/> — used to hold an
    /// in-flight bind so the concurrency cap is deterministically saturated WITHOUT blocking a thread.
    /// Records how many calls have entered (past the slot acquire).
    /// </summary>
    private sealed class GatedFakeLdap : ILdapAuthService
    {
        private readonly TaskCompletionSource _park = new(TaskCreationOptions.RunContinuationsAsynchronously);
        private readonly LdapAuthResult _then;
        private int _entered;

        /// <summary>Initializes the fake with the result to return once released.</summary>
        /// <param name="then">The result returned once <see cref="Release"/> is called.</param>
        public GatedFakeLdap(LdapAuthResult then) => _then = then;

        /// <summary>Number of authenticate calls that reached the backend body.</summary>
        public int Entered => Volatile.Read(ref _entered);

        /// <summary>Releases the parked bind so its awaiting call can complete.</summary>
        public void Release() => _park.TrySetResult();

        /// <summary>Marks entry, awaits the parking gate, then returns the canned result.</summary>
        /// <param name="username">The username (ignored).</param>
        /// <param name="password">The password (ignored).</param>
        /// <param name="ct">Cancellation token, observed while parked.</param>
        public async Task<LdapAuthResult> AuthenticateAsync(string username, string password, CancellationToken ct = default)
        {
            Interlocked.Increment(ref _entered);
            await _park.Task.WaitAsync(ct).ConfigureAwait(false);
            return _then;
        }
    }

    /// <summary>Test group→role mapper driven by a delegate over the supplied groups.</summary>
    private sealed class FakeMapper(Func<IReadOnlyList<string>, IReadOnlyList<string>> map) : IGroupRoleMapper<string>
    {
        /// <summary>Maps groups to roles via the configured delegate; Scope is always null.</summary>
        /// <param name="groups">The LDAP groups to map.</param>
        /// <param name="ct">The cancellation token.</param>
        public Task<GroupRoleMapping<string>> MapAsync(IReadOnlyList<string> groups, CancellationToken ct)
            => Task.FromResult(new GroupRoleMapping<string>(map(groups), Scope: null));
    }
}