lmxopcua/tests/Core/ZB.MOM.WW.OtOpcUa.Core.Scripting.Tests/TimedScriptEvaluatorTests.cs

using Shouldly;
using Xunit;
using ZB.MOM.WW.OtOpcUa.Core.Scripting;

namespace ZB.MOM.WW.OtOpcUa.Core.Scripting.Tests;

/// <summary>
///     Verifies the per-evaluation timeout wrapper. Fast scripts complete normally;
///     CPU-bound or hung scripts throw <see cref="ScriptTimeoutException"/> instead of
///     starving the engine. Caller-supplied cancellation tokens take precedence over the
///     timeout so driver-shutdown paths see a clean cancel rather than a timeout.
/// </summary>
[Trait("Category", "Unit")]
public sealed class TimedScriptEvaluatorTests
{
    [Fact]
    public async Task Fast_script_completes_under_timeout_and_returns_value()
    {
        var inner = ScriptEvaluator<FakeScriptContext, double>.Compile(
            """return (double)ctx.GetTag("In").Value + 1.0;""");
        var timed = new TimedScriptEvaluator<FakeScriptContext, double>(
            inner, TimeSpan.FromSeconds(1));

        var ctx = new FakeScriptContext().Seed("In", 41.0);
        var result = await timed.RunAsync(ctx, TestContext.Current.CancellationToken);
        result.ShouldBe(42.0);
    }

    [Fact]
    public async Task Script_longer_than_timeout_throws_ScriptTimeoutException()
    {
        // Scripts can't reach the sandbox-denied process surface (System.Threading.Thread
        // and System.Environment are both denied — Core.Scripting-001). A tight CPU loop
        // that never returns exceeds any short timeout without touching a forbidden type.
        var inner = ScriptEvaluator<FakeScriptContext, int>.Compile(
            """
            long acc = 0;
            while (true) { acc++; if (acc < 0) break; }
            return 1;
            """);
        var timed = new TimedScriptEvaluator<FakeScriptContext, int>(
            inner, TimeSpan.FromMilliseconds(50));

        var ex = await Should.ThrowAsync<ScriptTimeoutException>(async () =>
            await timed.RunAsync(new FakeScriptContext(), TestContext.Current.CancellationToken));
        ex.Timeout.ShouldBe(TimeSpan.FromMilliseconds(50));
        ex.Message.ShouldContain("50.0");
    }

    [Fact]
    public async Task Caller_cancellation_takes_precedence_over_timeout()
    {
        // A CPU-bound script that would otherwise timeout; external ct fires first.
        // Expected: OperationCanceledException (not ScriptTimeoutException) so shutdown
        // paths aren't misclassified as timeouts.
        var inner = ScriptEvaluator<FakeScriptContext, int>.Compile(
            """
            long acc = 0;
            while (true) { acc++; if (acc < 0) break; }
            return 1;
            """);
        var timed = new TimedScriptEvaluator<FakeScriptContext, int>(
            inner, TimeSpan.FromSeconds(5));

        using var cts = new CancellationTokenSource(TimeSpan.FromMilliseconds(80));
        await Should.ThrowAsync<OperationCanceledException>(async () =>
            await timed.RunAsync(new FakeScriptContext(), cts.Token));
    }

    [Fact]
    public void Default_timeout_is_250ms_per_plan()
    {
        TimedScriptEvaluator<FakeScriptContext, int>.DefaultTimeout
            .ShouldBe(TimeSpan.FromMilliseconds(250));
    }

    [Fact]
    public void Zero_or_negative_timeout_is_rejected_at_construction()
    {
        var inner = ScriptEvaluator<FakeScriptContext, int>.Compile("""return 1;""");
        Should.Throw<ArgumentOutOfRangeException>(() =>
            new TimedScriptEvaluator<FakeScriptContext, int>(inner, TimeSpan.Zero));
        Should.Throw<ArgumentOutOfRangeException>(() =>
            new TimedScriptEvaluator<FakeScriptContext, int>(inner, TimeSpan.FromMilliseconds(-1)));
    }

    [Fact]
    public void Null_inner_is_rejected()
    {
        Should.Throw<ArgumentNullException>(() =>
            new TimedScriptEvaluator<FakeScriptContext, int>(null!));
    }

    [Fact]
    public void Null_context_is_rejected()
    {
        var inner = ScriptEvaluator<FakeScriptContext, int>.Compile("""return 1;""");
        var timed = new TimedScriptEvaluator<FakeScriptContext, int>(inner);
        Should.ThrowAsync<ArgumentNullException>(async () =>
            await timed.RunAsync(null!, TestContext.Current.CancellationToken));
    }

    [Fact]
    public async Task Script_exception_propagates_unwrapped()
    {
        // User-thrown exceptions must come through as-is — NOT wrapped in
        // ScriptTimeoutException. The virtual-tag engine catches them per-tag and
        // maps to BadInternalError; conflating with timeout would lose that info.
        var inner = ScriptEvaluator<FakeScriptContext, int>.Compile(
            """throw new InvalidOperationException("script boom");""");
        var timed = new TimedScriptEvaluator<FakeScriptContext, int>(inner, TimeSpan.FromSeconds(1));

        var ex = await Should.ThrowAsync<InvalidOperationException>(async () =>
            await timed.RunAsync(new FakeScriptContext(), TestContext.Current.CancellationToken));
        ex.Message.ShouldBe("script boom");
    }

    [Fact]
    public async Task ScriptTimeoutException_message_points_at_diagnostic_path()
    {
        var inner = ScriptEvaluator<FakeScriptContext, int>.Compile(
            """
            long acc = 0;
            while (true) { acc++; if (acc < 0) break; }
            return 1;
            """);
        var timed = new TimedScriptEvaluator<FakeScriptContext, int>(
            inner, TimeSpan.FromMilliseconds(30));

        var ex = await Should.ThrowAsync<ScriptTimeoutException>(async () =>
            await timed.RunAsync(new FakeScriptContext(), TestContext.Current.CancellationToken));
        ex.Message.ShouldContain("ctx.Logger");
        ex.Message.ShouldContain("widening the timeout");
    }

    [Fact]
    public async Task Caller_cancellation_wins_even_when_timeout_fires_first()
    {
        // Regression for Core.Scripting-007: when the caller's CancellationToken is
        // already signalled at the moment WaitAsync returns TimeoutException (a tight
        // race), the implementation must re-check ct.IsCancellationRequested and throw
        // OperationCanceledException rather than ScriptTimeoutException. Here we use a
        // token that is cancelled before the evaluator starts — the tightest possible
        // race — to verify the re-check path deterministically.
        var inner = ScriptEvaluator<FakeScriptContext, int>.Compile("""return 1;""");
        var timed = new TimedScriptEvaluator<FakeScriptContext, int>(
            inner, TimeSpan.FromMilliseconds(1));

        using var cts = new CancellationTokenSource();
        cts.Cancel(); // already cancelled before RunAsync is even called

        // WaitAsync sees an already-cancelled token and may surface as either
        // TimeoutException or OperationCanceledException depending on ordering.
        // Either way, the caller must see OperationCanceledException, not ScriptTimeoutException.
        await Should.ThrowAsync<OperationCanceledException>(async () =>
            await timed.RunAsync(new FakeScriptContext(), cts.Token));
    }
}