lmxopcua/tests/Server/ZB.MOM.WW.OtOpcUa.ControlPlane.Tests/ConfigComposerTests.cs

using System.IO.Compression;
using System.Security.Cryptography;
using System.Text;
using Shouldly;
using Xunit;
using ZB.MOM.WW.OtOpcUa.Configuration.Entities;
using ZB.MOM.WW.OtOpcUa.Configuration.Enums;
using ZB.MOM.WW.OtOpcUa.ControlPlane.AdminOperations;
using ZB.MOM.WW.OtOpcUa.ControlPlane.Tests.Harness;
using ZB.MOM.WW.OtOpcUa.Runtime.Drivers;

namespace ZB.MOM.WW.OtOpcUa.ControlPlane.Tests;

public sealed class ConfigComposerTests : ControlPlaneActorTestBase
{
    /// <summary>Verifies that an empty database produces a stable, reproducible hash.</summary>
    [Fact]
    public async Task Empty_database_produces_stable_hash()
    {
        var f = NewInMemoryDbFactory();

        await using var db1 = f.CreateDbContext();
        var a1 = await ConfigComposer.SnapshotAndFlattenAsync(db1);

        await using var db2 = f.CreateDbContext();
        var a2 = await ConfigComposer.SnapshotAndFlattenAsync(db2);

        a1.RevisionHash.ShouldBe(a2.RevisionHash);
        a1.Blob.ShouldBe(a2.Blob);
    }

    /// <summary>Verifies that insertion order does not affect the configuration hash.</summary>
    [Fact]
    public async Task Same_rows_in_different_insert_orders_produce_same_hash()
    {
        var name = Guid.NewGuid().ToString("N");
        var f = NewInMemoryDbFactory(name);

        await using (var db = f.CreateDbContext())
        {
            db.ServerClusters.Add(NewCluster("cluster-a"));
            db.ServerClusters.Add(NewCluster("cluster-b"));
            await db.SaveChangesAsync();
        }
        var hashAB = (await ConfigComposer.SnapshotAndFlattenAsync(f.CreateDbContext())).RevisionHash;

        // Fresh DB, same rows in reverse insertion order.
        var f2 = NewInMemoryDbFactory();
        await using (var db = f2.CreateDbContext())
        {
            db.ServerClusters.Add(NewCluster("cluster-b"));
            db.ServerClusters.Add(NewCluster("cluster-a"));
            await db.SaveChangesAsync();
        }
        var hashBA = (await ConfigComposer.SnapshotAndFlattenAsync(f2.CreateDbContext())).RevisionHash;

        hashAB.ShouldBe(hashBA);
    }

    /// <summary>Verifies that different database configurations produce different hashes.</summary>
    [Fact]
    public async Task Different_data_produces_different_hash()
    {
        var f = NewInMemoryDbFactory();
        await using (var db = f.CreateDbContext())
        {
            db.ServerClusters.Add(NewCluster("cluster-a"));
            await db.SaveChangesAsync();
        }
        var hashA = (await ConfigComposer.SnapshotAndFlattenAsync(f.CreateDbContext())).RevisionHash;

        await using (var db = f.CreateDbContext())
        {
            db.ServerClusters.Add(NewCluster("cluster-b"));
            await db.SaveChangesAsync();
        }
        var hashAB = (await ConfigComposer.SnapshotAndFlattenAsync(f.CreateDbContext())).RevisionHash;

        hashAB.ShouldNotBe(hashA);
    }

    /// <summary>Verifies that the revision hash is a 64-character lowercase hexadecimal string.</summary>
    [Fact]
    public async Task Hash_is_64_lowercase_hex_chars()
    {
        var f = NewInMemoryDbFactory();
        var artifact = await ConfigComposer.SnapshotAndFlattenAsync(f.CreateDbContext());
        artifact.RevisionHash.Length.ShouldBe(64);
        artifact.RevisionHash.ShouldMatch("^[0-9a-f]{64}$");
    }

    /// <summary>
    ///     Task 8: the emitted blob is gzip AND the revision hash is the SHA-256 of THOSE bytes. The second
    ///     half is the load-bearing one — a <c>FetchAndCache</c> node verifies the bytes it fetched against
    ///     the <c>RevisionHash</c> its dispatch carried, so hashing the uncompressed JSON instead would fail
    ///     every fetch in the fleet while every hash-shape test above stayed green.
    /// </summary>
    [Fact]
    public async Task Blob_is_gzip_and_the_revision_hash_is_over_the_compressed_bytes()
    {
        var f = NewInMemoryDbFactory();
        await using (var db = f.CreateDbContext())
        {
            db.ServerClusters.Add(NewCluster("c1"));
            await db.SaveChangesAsync();
        }

        var artifact = await ConfigComposer.SnapshotAndFlattenAsync(f.CreateDbContext());

        artifact.Blob[0].ShouldBe((byte)0x1F);
        artifact.Blob[1].ShouldBe((byte)0x8B);
        artifact.RevisionHash.ShouldBe(Convert.ToHexStringLower(SHA256.HashData(artifact.Blob)));
        // …which is exactly what ConfigComposer.HashOf (the fetcher's derivation) computes over the same bytes.
        artifact.RevisionHash.ShouldBe(ConfigComposer.HashOf(artifact.Blob));

        // Falsifiability control: the hash is NOT over the JSON. Decompress and hash that — it must differ,
        // or "hash of the compressed bytes" would be an untested claim on a blob that happened to round-trip.
        using var inflated = new MemoryStream();
        await using (var gz = new GZipStream(new MemoryStream(artifact.Blob), CompressionMode.Decompress))
        {
            await gz.CopyToAsync(inflated);
        }
        var json = inflated.ToArray();
        Encoding.UTF8.GetString(json).ShouldStartWith("{");
        Convert.ToHexStringLower(SHA256.HashData(json)).ShouldNotBe(artifact.RevisionHash);
        artifact.Blob.Length.ShouldBeLessThan(json.Length);
    }

    /// <summary>
    ///     v3: verifies that <see cref="ConfigComposer.SnapshotAndFlattenAsync"/> serialises a
    ///     <see cref="Device"/>'s endpoint into the artifact blob and that
    ///     <see cref="DeploymentArtifact.ParseDriverInstances(ReadOnlySpan{byte})"/> folds the sole
    ///     device's <c>DeviceConfig</c> up into the driver's merged <c>DriverConfig</c> (single-endpoint
    ///     driver). Guards the real serialize→decode seam: if ConfigComposer's Device serialisation ever
    ///     drifted, the endpoint would silently vanish from the driver config in production (the driver
    ///     wouldn't bind) while hand-rolled artifact tests stayed green. (Pre-v3 this rode
    ///     <c>EquipmentNode.DeviceHost</c>; v3 retired that binding — equipment references raw tags via
    ///     UnsTagReference, and the endpoint reaches the driver via the RawPath device merge.)
    /// </summary>
    [Fact]
    public async Task Device_endpoint_survives_ConfigComposer_to_ParseDriverInstances_round_trip()
    {
        var f = NewInMemoryDbFactory();
        await using (var db = f.CreateDbContext())
        {
            db.ServerClusters.Add(NewCluster("c1"));
            db.RawFolders.Add(new RawFolder { RawFolderId = "f1", ClusterId = "c1", Name = "Plant" });
            db.DriverInstances.Add(new DriverInstance
            {
                DriverInstanceId = "drv-1", ClusterId = "c1", RawFolderId = "f1",
                Name = "Focas", DriverType = "Focas", DriverConfig = "{}",
            });
            db.Devices.Add(new Device
            {
                DeviceId = "dev-1", DriverInstanceId = "drv-1",
                Name = "dev-1", DeviceConfig = "{\"HostAddress\":\"10.9.9.9:8193\"}",
            });
            await db.SaveChangesAsync();
        }

        await using var readDb = f.CreateDbContext();
        var artifact = await ConfigComposer.SnapshotAndFlattenAsync(readDb);
        var specs = DeploymentArtifact.ParseDriverInstances(artifact.Blob);

        var spec = specs.ShouldHaveSingleItem();
        spec.DriverInstanceId.ShouldBe("drv-1");

        // The sole device's DeviceConfig endpoint is folded up to the top level of the merged DriverConfig.
        using var doc = System.Text.Json.JsonDocument.Parse(spec.DriverConfig);
        doc.RootElement.GetProperty("HostAddress").GetString().ShouldBe("10.9.9.9:8193");

        // And the device is still discoverable by its routing-key name in the reconstructed Devices array.
        var devices = doc.RootElement.GetProperty("Devices").EnumerateArray().ToList();
        devices.ShouldHaveSingleItem().GetProperty("DeviceName").GetString().ShouldBe("dev-1");
    }

    /// <summary>
    ///     Verifies that a <see cref="DriverInstance"/>'s per-instance <c>ResilienceConfig</c> override
    ///     survives the real <see cref="ConfigComposer.SnapshotAndFlattenAsync"/> →
    ///     <see cref="DeploymentArtifact.ParseDriverInstances(ReadOnlySpan{byte})"/> seam (arch-review
    ///     follow-up #10 sub-gap). The composer serialises the whole entity, so the override rides the
    ///     artifact into <c>DriverInstanceSpec.ResilienceConfig</c> — which <c>DriverHostActor</c> layers
    ///     onto the driver's Polly pipeline. Guards the one leg the hand-rolled
    ///     <c>DeploymentArtifactTests.ParseDriverInstances_carries_ResilienceConfig_onto_the_spec</c>
    ///     cannot: if the composer ever stopped emitting the column (a projection, a <c>[JsonIgnore]</c>),
    ///     authored resilience policy would silently revert to tier defaults in production while the
    ///     hand-built artifact tests stayed green.
    /// </summary>
    [Fact]
    public async Task ResilienceConfig_survives_ConfigComposer_to_ParseDriverInstances_round_trip()
    {
        const string resilienceJson =
            "{\"capabilityPolicies\":{\"Read\":{\"timeoutSeconds\":5,\"retryCount\":7,\"breakerFailureThreshold\":3}}}";

        var f = NewInMemoryDbFactory();
        await using (var db = f.CreateDbContext())
        {
            db.ServerClusters.Add(NewCluster("c1"));
            db.DriverInstances.Add(new DriverInstance
            {
                DriverInstanceId = "drv-1", ClusterId = "c1",
                Name = "Modbus", DriverType = "Modbus", DriverConfig = "{}",
                ResilienceConfig = resilienceJson,
            });
            // A second instance with no override proves the null case rides the same real composer path.
            db.DriverInstances.Add(new DriverInstance
            {
                DriverInstanceId = "drv-2", ClusterId = "c1",
                Name = "Modbus2", DriverType = "Modbus", DriverConfig = "{}",
            });
            await db.SaveChangesAsync();
        }

        await using var readDb = f.CreateDbContext();
        var artifact = await ConfigComposer.SnapshotAndFlattenAsync(readDb);
        var specs = DeploymentArtifact.ParseDriverInstances(artifact.Blob);

        var withOverride = specs.Single(s => s.DriverInstanceId == "drv-1");
        withOverride.ResilienceConfig.ShouldBe(resilienceJson, "the authored override must ride the artifact byte-for-byte");

        var withoutOverride = specs.Single(s => s.DriverInstanceId == "drv-2");
        withoutOverride.ResilienceConfig.ShouldBeNull("an unset override stays null ⇒ tier defaults at spawn");
    }

    private static readonly DateTime FixedTimestamp = new(2026, 1, 1, 0, 0, 0, DateTimeKind.Utc);

    private static ServerCluster NewCluster(string id) => new()
    {
        ClusterId = id,
        Name = id,
        Enterprise = "ent",
        Site = "site",
        RedundancyMode = RedundancyMode.None,
        CreatedBy = "test",
        // Pin every timestamp so two harnesses produce byte-identical snapshots when the logical
        // content matches. Production rows get real DateTime.UtcNow — divergence there is correct.
        CreatedAt = FixedTimestamp,
    };
}