lmxopcua/tests/Server/ZB.MOM.WW.OtOpcUa.Host.IntegrationTests/MeshGrpcAnonymousMetadataTests.cs

using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Routing;
using Microsoft.Extensions.DependencyInjection;
using Shouldly;
using Xunit;
using ZB.MOM.WW.OtOpcUa.Host.Configuration;

namespace ZB.MOM.WW.OtOpcUa.Host.IntegrationTests;

/// <summary>
///     R3-01 (T1-T3) — an endpoint-metadata census over <c>MapOtOpcUaMeshGrpcServices</c>, driven in
///     all three role shapes a node can actually carry (admin-only, driver-only, fused).
/// </summary>
/// <remarks>
///     <para>
///         <b>Why this drives the PRODUCTION mapper, not a hand-copied shape.</b> The Critical this
///         plan fixes (archreview 03/S14) survived seven phases of live gates precisely because every
///         prior test built its own pipeline by hand — <c>MeshGrpcBoundaryTests</c>,
///         <c>ConfigServeListenerTests</c> and <c>LocalDbSyncListenerTests</c> all reproduce the
///         author's mental model of the mapping rather than the host's actual composition. This
///         census calls <see cref="MeshGrpcEndpoints.MapOtOpcUaMeshGrpcServices"/> — the SAME method
///         <c>Program.cs</c> calls — so it is structurally impossible for the guard to assert a shape
///         production no longer has.
///     </para>
///     <para>
///         <b>Filters out grpc-dotnet's own catch-all infrastructure.</b> Every <c>MapGrpcService</c>
///         call also registers a per-service "Unimplemented method for X" fallback, and the FIRST
///         such call in an app additionally registers one shared "Unimplemented service" catch-all —
///         neither carries a route pattern beginning with <c>/</c>, and neither ever reaches real
///         logic (they always answer <c>Unimplemented</c> regardless of caller identity), so their
///         authorization metadata carries no security meaning. <see cref="RealMethodEndpoints"/>
///         keeps only the five real, callable RPC methods.
///     </para>
///     <para>
///         <b>Guard-of-the-guard.</b> Every assertion below pins an EXACT expected count and the
///         exact set of route patterns, never just "not empty" — a census that silently found zero
///         endpoints (a typo'd role gate, a helper that never got called) would pass a bare
///         non-empty check trivially. It cannot pass an exact-count-and-set check by accident.
///     </para>
/// </remarks>
public sealed class MeshGrpcAnonymousMetadataTests
{
    private const string ArtifactFetch = "/deployment_artifact.v1.DeploymentArtifactService/Fetch";
    private const string CentralReportApply = "/mesh_transport.v1.CentralCommandService/ReportApply";
    private const string TelemetrySubscribe = "/telemetry.v1.TelemetryStreamService/Subscribe";
    private const string NodeExecute = "/mesh_transport.v1.NodeCommandService/Execute";
    private const string LocalDbSyncSync = "/localdb_sync.v1.LocalDbSync/Sync";

    /// <summary>The five known mesh gRPC method prefixes — the ONLY endpoints this map may anonymise.</summary>
    private static readonly string[] AllFivePrefixes =
        [LocalDbSyncSync, ArtifactFetch, CentralReportApply, TelemetrySubscribe, NodeExecute];

    [Fact]
    public void AdminOnly_MapsExactlyTheConfigServeEndpoints()
    {
        // Admin-only: no driver role, so neither LocalDbSync nor the telemetry/node-command pair are
        // mapped even though a port is configured for them below (0 here, but the shape is the point).
        var endpoints = RealMethodEndpoints(BuildApp(
            hasAdmin: true, hasDriver: false,
            syncListenPort: 0, configServeGrpcPort: 4055, telemetryListenPort: 0));

        endpoints.Count.ShouldBe(2);
        endpoints.Select(RoutePatternOf).ShouldBe([ArtifactFetch, CentralReportApply], ignoreOrder: true);
    }

    [Fact]
    public void DriverOnly_WithNoSyncPort_MapsExactlyTheTelemetryAndNodeCommandEndpoints()
    {
        var endpoints = RealMethodEndpoints(BuildApp(
            hasAdmin: false, hasDriver: true,
            syncListenPort: 0, configServeGrpcPort: 0, telemetryListenPort: 4056));

        endpoints.Count.ShouldBe(2);
        endpoints.Select(RoutePatternOf).ShouldBe([TelemetrySubscribe, NodeExecute], ignoreOrder: true);
    }

    [Fact]
    public void DriverOnly_WithASyncPort_AlsoMapsTheLocalDbSyncEndpoint()
    {
        var endpoints = RealMethodEndpoints(BuildApp(
            hasAdmin: false, hasDriver: true,
            syncListenPort: 4054, configServeGrpcPort: 0, telemetryListenPort: 4056));

        endpoints.Count.ShouldBe(3);
        endpoints.Select(RoutePatternOf).ShouldBe(
            [LocalDbSyncSync, TelemetrySubscribe, NodeExecute], ignoreOrder: true);
    }

    [Fact]
    public void Fused_WithAllThreePorts_MapsAllFiveEndpoints()
    {
        // The docker-dev central pair's shape (admin,driver,cluster-MAIN) once all three dedicated
        // h2c ports are configured — the shape 03/S14 called out as breaking the deploy plane for
        // the whole fleet, not only the four sites.
        var endpoints = RealMethodEndpoints(BuildApp(
            hasAdmin: true, hasDriver: true,
            syncListenPort: 4054, configServeGrpcPort: 4055, telemetryListenPort: 4056));

        endpoints.Count.ShouldBe(5);
        endpoints.Select(RoutePatternOf).ShouldBe(AllFivePrefixes, ignoreOrder: true);
    }

    [Fact]
    public void NeitherRoleNorAnyPort_MapsNothing()
    {
        // The default-OFF shape: every dedicated port is 0. Nothing about the mesh gRPC surface
        // should exist on a node that configured none of it.
        var endpoints = RealMethodEndpoints(BuildApp(
            hasAdmin: false, hasDriver: false,
            syncListenPort: 0, configServeGrpcPort: 0, telemetryListenPort: 0));

        endpoints.ShouldBeEmpty();
    }

    // ---------------------------------------------------------------------------------------
    // harness
    // ---------------------------------------------------------------------------------------

    private static WebApplication BuildApp(
        bool hasAdmin,
        bool hasDriver,
        int syncListenPort,
        int configServeGrpcPort,
        int telemetryListenPort)
    {
        var builder = WebApplication.CreateBuilder();
        builder.Environment.ApplicationName = typeof(MeshGrpcAnonymousMetadataTests).Assembly.GetName().Name!;
        builder.Services.AddGrpc();

        var app = builder.Build();
        app.MapOtOpcUaMeshGrpcServices(
            hasAdmin, hasDriver, syncListenPort, configServeGrpcPort, telemetryListenPort);
        return app;
    }

    /// <summary>
    ///     The real, callable RPC method endpoints — excludes grpc-dotnet's per-app "Unimplemented
    ///     service" catch-all and per-service "Unimplemented method for X" fallback (see class
    ///     remarks). Both carry a route pattern that never starts with <c>/</c>, which is what this
    ///     filters on.
    /// </summary>
    private static List<RouteEndpoint> RealMethodEndpoints(WebApplication app) =>
        ((IEndpointRouteBuilder)app).DataSources
            .SelectMany(d => d.Endpoints)
            .OfType<RouteEndpoint>()
            .Where(e => e.RoutePattern.RawText?.StartsWith('/') == true)
            .ToList();

    private static string RoutePatternOf(RouteEndpoint e) => e.RoutePattern.RawText!;
}