fix(external-system-gateway): resolve ExternalSystemGateway-002/003 — apply HTTP call timeout, confirm CachedCall no double-dispatch

src/ScadaLink.ExternalSystemGateway/ExternalSystemClient.cs

@@ -3,6 +3,7 @@ using System.Net.Http.Headers;
 using System.Text;
 using System.Text.Json;
 using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
 using ScadaLink.Commons.Entities.ExternalSystems;
 using ScadaLink.Commons.Interfaces.Repositories;
 using ScadaLink.Commons.Interfaces.Services;
@@ -22,17 +23,20 @@ public class ExternalSystemClient : IExternalSystemClient
     private readonly IExternalSystemRepository _repository;
     private readonly StoreAndForwardService? _storeAndForward;
     private readonly ILogger<ExternalSystemClient> _logger;
+    private readonly ExternalSystemGatewayOptions _options;
 
     public ExternalSystemClient(
         IHttpClientFactory httpClientFactory,
         IExternalSystemRepository repository,
         ILogger<ExternalSystemClient> logger,
-        StoreAndForwardService? storeAndForward = null)
+        StoreAndForwardService? storeAndForward = null,
+        IOptions<ExternalSystemGatewayOptions>? options = null)
     {
         _httpClientFactory = httpClientFactory;
         _repository = repository;
         _logger = logger;
         _storeAndForward = storeAndForward;
+        _options = options?.Value ?? new ExternalSystemGatewayOptions();
     }
 
     /// <summary>
@@ -198,22 +202,59 @@ public class ExternalSystemClient : IExternalSystemClient
             }
         }
 
+        // Enforce the per-call timeout. ExternalSystemDefinition has no per-system
+        // Timeout field yet, so the configured DefaultHttpTimeout is the effective
+        // round-trip limit (the design's "timeout applies to the HTTP request
+        // round-trip" guarantee). A linked CTS lets us distinguish a timeout from a
+        // caller-initiated cancellation: only the timeout is reclassified as transient.
+        using var timeoutCts = new CancellationTokenSource(_options.DefaultHttpTimeout);
+        using var linkedCts = CancellationTokenSource.CreateLinkedTokenSource(
+            cancellationToken, timeoutCts.Token);
+
         HttpResponseMessage response;
         try
         {
-            response = await client.SendAsync(request, cancellationToken);
+            response = await client.SendAsync(request, linkedCts.Token);
+        }
+        catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
+        {
+            // The caller asked to abandon the work — do not reclassify as transient.
+            throw;
+        }
+        catch (OperationCanceledException ex) when (timeoutCts.IsCancellationRequested)
+        {
+            // Our own timeout elapsed — a transient failure per the design.
+            throw ErrorClassifier.AsTransient(
+                $"Timeout calling {system.Name} after {_options.DefaultHttpTimeout.TotalSeconds:0.##}s", ex);
         }
         catch (Exception ex) when (ErrorClassifier.IsTransient(ex))
         {
             throw ErrorClassifier.AsTransient($"Connection error to {system.Name}: {ex.Message}", ex);
         }
 
-        if (response.IsSuccessStatusCode)
+        // The timeout also covers reading the response body (the design's
+        // "round-trip" guarantee), so the linked token is used for the read too.
+        string body;
+        try
         {
-            return await response.Content.ReadAsStringAsync(cancellationToken);
+            body = await response.Content.ReadAsStringAsync(linkedCts.Token);
+        }
+        catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
+        {
+            throw;
+        }
+        catch (OperationCanceledException ex) when (timeoutCts.IsCancellationRequested)
+        {
+            throw ErrorClassifier.AsTransient(
+                $"Timeout reading response from {system.Name} after {_options.DefaultHttpTimeout.TotalSeconds:0.##}s", ex);
         }
 
-        var errorBody = await response.Content.ReadAsStringAsync(cancellationToken);
+        if (response.IsSuccessStatusCode)
+        {
+            return body;
+        }
+
+        var errorBody = body;
 
         if (ErrorClassifier.IsTransient(response.StatusCode))
         {