lmxopcua/tests/Server/ZB.MOM.WW.OtOpcUa.Host.IntegrationTests/PrimaryGateFailoverTests.cs

using Akka.Actor;
using Akka.Hosting;
using Microsoft.Extensions.DependencyInjection;
using Shouldly;
using ZB.MOM.WW.OtOpcUa.Commons.OpcUa;
using Xunit;
using ZB.MOM.WW.OtOpcUa.Runtime;
using ZB.MOM.WW.OtOpcUa.Runtime.Drivers;

namespace ZB.MOM.WW.OtOpcUa.Host.IntegrationTests;

/// <summary>
///     archreview 03/S4 delivery-path guard — the "unit tests can't catch delivery" half. Proves that the
///     REAL DistributedPubSub-delivered redundancy snapshot (not a test-injected <c>RedundancyStateChanged</c>)
///     actually drives the Primary write gate end-to-end across a live 2-node Akka cluster: after both nodes
///     join and the snapshot converges, exactly ONE node's <see cref="DriverHostActor"/> rejects a
///     <see cref="DriverHostActor.RouteNodeWrite"/> with <c>"not primary"</c> (the Secondary) while the other
///     passes the gate (the Primary — its rejection, if any, is about node MAPPING, never the gate).
///
///     <para>Before the snapshot delivers, BOTH nodes have an unknown role on a 2-driver cluster and so both
///     default-DENY with <c>"not primary (role unknown)"</c> (archreview 03/S4). The poll below therefore
///     waits for the delivered snapshot to promote exactly one node to Primary — a broken redundancy-topic
///     subscribe (the historical double-break) would leave both stuck "role unknown" and time this out, which
///     is exactly the negative control this test provides over the pure-TestKit guards.</para>
/// </summary>
[Trait("Category", "Failover")]
public sealed class PrimaryGateFailoverTests
{
    private static CancellationToken Ct => TestContext.Current.CancellationToken;

    // A NodeId that is guaranteed to have no driver mapping — so a node that PASSES the primary gate
    // rejects it with a MAPPING reason ("no driver mapping for node …"), never a gate reason.
    private const string UnmappedProbeNode = "__pgate_delivery_probe__";

    [Fact]
    public async Task Delivered_redundancy_snapshot_drives_the_primary_write_gate_across_the_cluster()
    {
        await using var harness = await TwoNodeClusterHarness.StartAsync();

        var driverHostA = harness.NodeA.Services.GetRequiredService<ActorRegistry>().Get<DriverHostActorKey>();
        var driverHostB = harness.NodeB.Services.GetRequiredService<ActorRegistry>().Get<DriverHostActorKey>();

        // Poll until the DELIVERED snapshot has promoted exactly one node to Primary: one host passes the
        // gate (reason not "not primary*") and the other is gated ("not primary"). Deadline covers the
        // ~250ms-debounced initial publish plus cluster convergence margin.
        var deadline = DateTime.UtcNow + TimeSpan.FromSeconds(45);
        (bool aGated, bool bGated, string? aReason, string? bReason) last = default;
        while (DateTime.UtcNow < deadline)
        {
            var a = await RouteProbeWriteAsync(driverHostA);
            var b = await RouteProbeWriteAsync(driverHostB);
            last = (IsGateReject(a), IsGateReject(b), a.Reason, b.Reason);

            // Exactly one node gated ⇒ the snapshot converged (one Primary, one Secondary).
            if (last.aGated ^ last.bGated) break;
            await Task.Delay(500, Ct);
        }

        // Exactly one node is the Secondary (gate-rejected); the other is the Primary (passed the gate —
        // its reject, if any, is a MAPPING reason). This proves the delivered snapshot drives the gate.
        (last.aGated ^ last.bGated).ShouldBeTrue(
            $"exactly one node should be gated once the redundancy snapshot converges (A gated={last.aGated} reason='{last.aReason}', B gated={last.bGated} reason='{last.bReason}')");

        var primaryReason = last.aGated ? last.bReason : last.aReason;
        primaryReason.ShouldNotBeNull();
        primaryReason!.StartsWith("not primary", StringComparison.Ordinal).ShouldBeFalse(
            $"the Primary must PASS the gate — its reject reason should be a mapping reason, not '{primaryReason}'");
    }

    private static async Task<DriverHostActor.NodeWriteResult> RouteProbeWriteAsync(IActorRef driverHost)
        => await driverHost.Ask<DriverHostActor.NodeWriteResult>(
            new DriverHostActor.RouteNodeWrite(UnmappedProbeNode, 0.0, AddressSpaceRealm.Uns), TimeSpan.FromSeconds(10));

    private static bool IsGateReject(DriverHostActor.NodeWriteResult r)
        => !r.Success && r.Reason is not null && r.Reason.StartsWith("not primary", StringComparison.Ordinal);
}