lmxopcua/tests/Core/ZB.MOM.WW.OtOpcUa.Core.Scripting.Tests/TimedScriptEvaluatorTests.cs

using Shouldly;
using Xunit;
using ZB.MOM.WW.OtOpcUa.Core.Scripting;

namespace ZB.MOM.WW.OtOpcUa.Core.Scripting.Tests;

/// <summary>
///     Verifies the per-evaluation timeout wrapper. Fast scripts complete normally;
///     CPU-bound or hung scripts throw <see cref="ScriptTimeoutException"/> instead of
///     starving the engine. Caller-supplied cancellation tokens take precedence over the
///     timeout so driver-shutdown paths see a clean cancel rather than a timeout.
/// </summary>
[Trait("Category", "Unit")]
public sealed class TimedScriptEvaluatorTests
{
    /// <summary>
    ///     A CPU-bound script that outlives every timeout in this file but still ENDS.
    /// </summary>
    /// <remarks>
    ///     A timed-out script is abandoned, not stopped — its pool thread keeps running (the documented
    ///     <see cref="TimedScriptEvaluator{TContext, TResult}"/> leak). The previous body,
    ///     <c>long acc = 0; while (true) { acc++; if (acc &lt; 0) break; }</c>, needs 2^63 increments to
    ///     overflow, so each of the three tests using it pinned one core at 100 % for the rest of the test
    ///     process — CPU the parallel suites on a small CI runner were starving for (#606). A 5 s wall-clock
    ///     spin is still one to two orders of magnitude past the 30–80 ms timeouts/cancels asserted here, so
    ///     the script cannot finish first even under heavy load, and the abandoned thread exits on its own.
    ///     <c>System.DateTime</c> is outside the sandbox deny-list; Thread/Environment/Diagnostics are not.
    /// </remarks>
    private const string BoundedSpinScript =
        """
        var end = System.DateTime.UtcNow.AddSeconds(5);
        while (System.DateTime.UtcNow < end) { }
        return 1;
        """;

    /// <summary>Verifies that fast scripts complete under timeout and return value.</summary>
    [Fact]
    public async Task Fast_script_completes_under_timeout_and_returns_value()
    {
        var inner = ScriptEvaluator<FakeScriptContext, double>.Compile(
            """return (double)ctx.GetTag("In").Value + 1.0;""");
        var timed = new TimedScriptEvaluator<FakeScriptContext, double>(
            inner, TimeSpan.FromSeconds(1));

        var ctx = new FakeScriptContext().Seed("In", 41.0);
        var result = await timed.RunAsync(ctx, TestContext.Current.CancellationToken);
        result.ShouldBe(42.0);
    }

    /// <summary>Verifies that scripts longer than timeout throw ScriptTimeoutException.</summary>
    [Fact]
    public async Task Script_longer_than_timeout_throws_ScriptTimeoutException()
    {
        // Scripts can't reach the sandbox-denied process surface (System.Threading.Thread
        // and System.Environment are both denied — Core.Scripting-001). A tight CPU loop
        // that outlives the timeout exceeds it without touching a forbidden type.
        var inner = ScriptEvaluator<FakeScriptContext, int>.Compile(BoundedSpinScript);
        var timed = new TimedScriptEvaluator<FakeScriptContext, int>(
            inner, TimeSpan.FromMilliseconds(50));

        var ex = await Should.ThrowAsync<ScriptTimeoutException>(async () =>
            await timed.RunAsync(new FakeScriptContext(), TestContext.Current.CancellationToken));
        ex.Timeout.ShouldBe(TimeSpan.FromMilliseconds(50));
        ex.Message.ShouldContain("50.0");
    }

    /// <summary>Verifies that caller cancellation takes precedence over timeout.</summary>
    [Fact]
    public async Task Caller_cancellation_takes_precedence_over_timeout()
    {
        // A CPU-bound script that would otherwise timeout; external ct fires first.
        // Expected: OperationCanceledException (not ScriptTimeoutException) so shutdown
        // paths aren't misclassified as timeouts.
        var inner = ScriptEvaluator<FakeScriptContext, int>.Compile(BoundedSpinScript);
        var timed = new TimedScriptEvaluator<FakeScriptContext, int>(
            inner, TimeSpan.FromSeconds(5));

        using var cts = new CancellationTokenSource(TimeSpan.FromMilliseconds(80));
        await Should.ThrowAsync<OperationCanceledException>(async () =>
            await timed.RunAsync(new FakeScriptContext(), cts.Token));
    }

    /// <summary>Verifies that default timeout is 250ms per plan.</summary>
    [Fact]
    public void Default_timeout_is_250ms_per_plan()
    {
        TimedScriptEvaluator<FakeScriptContext, int>.DefaultTimeout
            .ShouldBe(TimeSpan.FromMilliseconds(250));
    }

    /// <summary>Verifies that zero or negative timeout is rejected at construction.</summary>
    [Fact]
    public void Zero_or_negative_timeout_is_rejected_at_construction()
    {
        var inner = ScriptEvaluator<FakeScriptContext, int>.Compile("""return 1;""");
        Should.Throw<ArgumentOutOfRangeException>(() =>
            new TimedScriptEvaluator<FakeScriptContext, int>(inner, TimeSpan.Zero));
        Should.Throw<ArgumentOutOfRangeException>(() =>
            new TimedScriptEvaluator<FakeScriptContext, int>(inner, TimeSpan.FromMilliseconds(-1)));
    }

    /// <summary>Verifies that null inner evaluator is rejected.</summary>
    [Fact]
    public void Null_inner_is_rejected()
    {
        Should.Throw<ArgumentNullException>(() =>
            new TimedScriptEvaluator<FakeScriptContext, int>(null!));
    }

    /// <summary>Verifies that null context is rejected.</summary>
    [Fact]
    public void Null_context_is_rejected()
    {
        var inner = ScriptEvaluator<FakeScriptContext, int>.Compile("""return 1;""");
        var timed = new TimedScriptEvaluator<FakeScriptContext, int>(inner);
        Should.ThrowAsync<ArgumentNullException>(async () =>
            await timed.RunAsync(null!, TestContext.Current.CancellationToken));
    }

    /// <summary>Verifies that script exceptions propagate unwrapped.</summary>
    [Fact]
    public async Task Script_exception_propagates_unwrapped()
    {
        // User-thrown exceptions must come through as-is — NOT wrapped in
        // ScriptTimeoutException. The virtual-tag engine catches them per-tag and
        // maps to BadInternalError; conflating with timeout would lose that info.
        var inner = ScriptEvaluator<FakeScriptContext, int>.Compile(
            """throw new InvalidOperationException("script boom");""");
        var timed = new TimedScriptEvaluator<FakeScriptContext, int>(inner, TimeSpan.FromSeconds(1));

        var ex = await Should.ThrowAsync<InvalidOperationException>(async () =>
            await timed.RunAsync(new FakeScriptContext(), TestContext.Current.CancellationToken));
        ex.Message.ShouldBe("script boom");
    }

    /// <summary>Verifies that ScriptTimeoutException message points at diagnostic path.</summary>
    [Fact]
    public async Task ScriptTimeoutException_message_points_at_diagnostic_path()
    {
        var inner = ScriptEvaluator<FakeScriptContext, int>.Compile(BoundedSpinScript);
        var timed = new TimedScriptEvaluator<FakeScriptContext, int>(
            inner, TimeSpan.FromMilliseconds(30));

        var ex = await Should.ThrowAsync<ScriptTimeoutException>(async () =>
            await timed.RunAsync(new FakeScriptContext(), TestContext.Current.CancellationToken));
        ex.Message.ShouldContain("ctx.Logger");
        ex.Message.ShouldContain("widening the timeout");
    }

    /// <summary>Verifies that caller cancellation wins even when timeout fires first.</summary>
    [Fact]
    public async Task Caller_cancellation_wins_even_when_timeout_fires_first()
    {
        // Regression for Core.Scripting-007: when the caller's CancellationToken is
        // already signalled at the moment WaitAsync returns TimeoutException (a tight
        // race), the implementation must re-check ct.IsCancellationRequested and throw
        // OperationCanceledException rather than ScriptTimeoutException. Here we use a
        // token that is cancelled before the evaluator starts — the tightest possible
        // race — to verify the re-check path deterministically.
        var inner = ScriptEvaluator<FakeScriptContext, int>.Compile("""return 1;""");
        var timed = new TimedScriptEvaluator<FakeScriptContext, int>(
            inner, TimeSpan.FromMilliseconds(1));

        using var cts = new CancellationTokenSource();
        cts.Cancel(); // already cancelled before RunAsync is even called

        // WaitAsync sees an already-cancelled token and may surface as either
        // TimeoutException or OperationCanceledException depending on ordering.
        // Either way, the caller must see OperationCanceledException, not ScriptTimeoutException.
        await Should.ThrowAsync<OperationCanceledException>(async () =>
            await timed.RunAsync(new FakeScriptContext(), cts.Token));
    }
}