Files
UA-.NETStandard/tests/Opc.Ua.Server.Tests/StateMachines/StateMachineBuilderCauseExecutableTests.cs
romanett 3543d7cf6c Report Executable/UserExecutable for state machine causes (#4368)
# Description

A Part 16 cause is a Method, and whether it may fire depends on the
state the machine is in. Part 3 defines `Executable` / `UserExecutable`
as exactly that question, and Part 4 has `Call` refuse a non-executable
Method with `Bad_NotExecutable`. `FiniteStateMachineState` already knows
the answer — `IsCausePermitted(context, causeId, checkUserAccessRights)`
— but nothing outside alarm shelving connected the two. Across the
library, `OnReadExecutable` was assigned in exactly three places, all in
`AlarmConditionState`. Everywhere else a cause method kept the `true`
its node was constructed with, so a client could not tell which causes
currently apply and found out only by calling one and being refused with
`Bad_NotSupported` from `DoCause`.

## What changed

**`StateMachineBuilder.WithCause`** now answers both attributes from
`IsCausePermitted` alongside installing the call handler — on the
unified builder (via the dispatcher's `InstallCauseMethod`) and on the
`Opc.Ua.Server.Fluent` surface reached through
`INodeBuilder.AsStateMachine()`, which had the identical gap.
`Executable` ignores user rights; `UserExecutable` also runs the
machine's `OnCheckUserPermission` callback.

Per the issue's note about servers that deliberately keep methods
executable and answer at call time, both overloads take
`reportExecutable: false` to opt out.

**`ProgramStateMachineState`** wires its own `Start` / `Suspend` /
`Resume` / `Halt` / `Reset` in `OnAfterCreate`, so a Program server no
longer repeats the boilerplate the class already shipped handlers for.
The Boiler quickstart's copy of it is deleted rather than left as an
example.

**Generator-emitted `*StateMachineState` subclasses** are left alone.
The generator emits no Part 16 `StateTable` / `TransitionTable` /
`CauseMappings` overrides — the same gap that makes the DI
software-update dispatcher write `CurrentState` directly instead of
going through `SetState` (see `docs/SoftwareUpdate.md`) — so there is
nothing to derive executability from. A vendor machine from a NodeSet
gets its causes through `StateMachineBuilder.For(...).WithCause(...)`,
which the first change covers. Worth revisiting if the generator gains
table emission.

## Notes for reviewers

Two details behind the `ProgramStateMachineState` change:

- The five methods are `OptionalPlaceholder` on
`ProgramStateMachineType`, so the generated class has no typed
properties for them. They are matched on browse name **without** the
namespace index, because a subtype that redeclares them puts them in its
own namespace — the Boiler model uses `1:Start`, not `0:Start`.
- `NodeState.Create` rebuilds the child list from the type template, so
a method added by hand before it is gone by the time `OnAfterCreate`
runs. `WireCauseMethods(ISystemContext)` is public for that case.

**Behaviour change worth flagging:** a `WithCause` against a machine
whose `CauseMappings` lack that cause now reports the method
non-executable where it previously reported executable. Such a call was
already failing with `Bad_NotSupported` inside `DoCause`, so it fails
earlier with the code Part 4 specifies rather than newly failing — but
it is visible to clients that read the attribute.

## Related Issues

- Fixes #4363

## Checklist

- [x] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [x] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [x] I have added all necessary documentation.
- [x] I have verified that my changes do not introduce (new) build or
analyzer warnings.
- [ ] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed.
- [ ] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [ ] I have addressed **all** PR feedback received.

### Tests

New: `StateMachineBuilderCauseExecutableTests` (definition mode, the
opt-out, `OnCheckUserPermission` affecting `UserExecutable` only,
suspended machines) and `ProgramStateMachineStateTests`, plus two cases
added to the existing fluent-builder fixture. All read through
`MethodState.ReadAttribute`, so a handler that is installed but never
consulted fails the test.

Run locally on **net10.0**: `Opc.Ua.Server.Tests` (4797),
`Opc.Ua.Core.Tests` (4374), `Opc.Ua.Di.Tests`, `Opc.Ua.Features.Tests`,
`Opc.Ua.Robotics.Intent.Tests` and the Boiler AOT tests all pass;
`UA.slnx` builds with no new warnings. The .NET Framework legs were not
run locally — leaving that checklist box to CI.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
2026-09-01 18:31:36 +02:00

211 lines
8.0 KiB
C#

/* ========================================================================
* Copyright (c) 2005-2026 The OPC Foundation, Inc. All rights reserved.
*
* OPC Foundation MIT License 1.00
*
* Permission is hereby granted, free of charge, to any person
* obtaining a copy of this software and associated documentation
* files (the "Software"), to deal in the Software without
* restriction, including without limitation the rights to use,
* copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the
* Software is furnished to do so, subject to the following
* conditions:
*
* The above copyright notice and this permission notice shall be
* included in all copies or substantial portions of the Software.
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
* OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
* HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
* WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
* FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
* OTHER DEALINGS IN THE SOFTWARE.
*
* The complete license agreement can be found here:
* http://opcfoundation.org/License/MIT/1.00/
* ======================================================================*/
using NUnit.Framework;
using Opc.Ua.Server.StateMachines;
namespace Opc.Ua.Server.Tests.StateMachines
{
/// <summary>
/// Unit tests for the <c>Executable</c> / <c>UserExecutable</c>
/// attributes of a cause method wired by
/// <see cref="StateMachineBuilder{TState}.WithCause"/>. Part 3 §5.7
/// defines the attributes as "may this Method be called right now",
/// which for a Part 16 cause is
/// <see cref="FiniteStateMachineState.IsCausePermitted"/>; Part 4
/// §5.11.2 then has <c>Call</c> refuse a non-executable method with
/// <c>Bad_NotExecutable</c> rather than letting the state machine
/// answer <c>Bad_NotSupported</c> at call time.
/// </summary>
[TestFixture]
[Category("Server")]
[Category("StateMachines")]
[Parallelizable]
public sealed class StateMachineBuilderCauseExecutableTests
{
private const uint kStartCauseId = 7001;
private const uint kOff = 1;
private const uint kOn = 2;
private const uint kOffToOn = 10;
private ServerSystemContext m_context = null!;
[SetUp]
public void SetUp()
{
m_context = StateMachineTestFixtures.CreateContext();
}
[Test]
public void WithCauseReportsExecutableOnlyWhereTheCauseApplies()
{
StateMachineBuilder<FluentFiniteStateMachineState> builder = Build();
FluentFiniteStateMachineState sm = builder.StateMachine;
MethodState start = AddCauseMethod(sm);
builder.WithCause(start.NodeId);
// Off is the initial state and the only from-state of the
// cause, so the method is executable there ...
Assert.Multiple(() =>
{
Assert.That(ReadExecutable(start), Is.True);
Assert.That(ReadUserExecutable(start), Is.True);
});
sm.SetState(m_context, kOn);
// ... and not once the machine has left it.
Assert.Multiple(() =>
{
Assert.That(ReadExecutable(start), Is.False);
Assert.That(ReadUserExecutable(start), Is.False);
});
}
[Test]
public void WithCauseLeavesTheAttributesAloneWhenOptedOut()
{
StateMachineBuilder<FluentFiniteStateMachineState> builder = Build();
FluentFiniteStateMachineState sm = builder.StateMachine;
MethodState start = AddCauseMethod(sm);
builder.WithCause(start.NodeId, reportExecutable: false);
sm.SetState(m_context, kOn);
Assert.Multiple(() =>
{
Assert.That(start.OnReadExecutable, Is.Null);
Assert.That(start.OnReadUserExecutable, Is.Null);
// The node keeps the value it was constructed with, and
// the refusal happens at call time instead.
Assert.That(ReadExecutable(start), Is.True);
Assert.That(ReadUserExecutable(start), Is.True);
});
}
[Test]
public void UserExecutableAlsoHonoursTheUserPermissionCallback()
{
StateMachineBuilder<FluentFiniteStateMachineState> builder = Build();
FluentFiniteStateMachineState sm = builder.StateMachine;
MethodState start = AddCauseMethod(sm);
builder.WithCause(start.NodeId);
sm.OnCheckUserPermission = (ctx, machine, transitionId, causeId, inputs, outputs)
=> StatusCodes.BadUserAccessDenied;
Assert.Multiple(() =>
{
// Executable ignores user rights, UserExecutable does not.
Assert.That(ReadExecutable(start), Is.True);
Assert.That(ReadUserExecutable(start), Is.False);
});
}
[Test]
public void ASuspendedMachineReportsNoneOfItsCausesAsExecutable()
{
StateMachineBuilder<FluentFiniteStateMachineState> builder = Build();
FluentFiniteStateMachineState sm = builder.StateMachine;
MethodState start = AddCauseMethod(sm);
builder.WithCause(start.NodeId);
sm.SetSuspended(m_context, true);
Assert.Multiple(() =>
{
Assert.That(ReadExecutable(start), Is.False);
Assert.That(ReadUserExecutable(start), Is.False);
});
}
private StateMachineBuilder<FluentFiniteStateMachineState> Build()
{
return StateMachineTestFixtures.NewBuilder(m_context)
.AddState(kOff, "Off", isInitial: true)
.AddState(kOn, "On")
.AddTransition(kOffToOn, "OffToOn", from: kOff, to: kOn)
.AddTransition(20, "OnToOff", from: kOn, to: kOff)
.OnCause(kStartCauseId, from: kOff, transition: kOffToOn);
}
/// <summary>
/// A cause method has to be a child of the machine before
/// <c>WithCause</c> can resolve it. Constructed executable, the
/// way the node builders and the model generator leave it.
/// </summary>
private static MethodState AddCauseMethod(FluentFiniteStateMachineState sm)
{
var start = new MethodState(sm)
{
ReferenceTypeId = ReferenceTypeIds.HasComponent,
NodeId = new NodeId(kStartCauseId, 1),
BrowseName = new QualifiedName("Start", 1),
DisplayName = new LocalizedText("Start"),
Executable = true,
UserExecutable = true
};
sm.AddChild(start);
return start;
}
private bool ReadExecutable(MethodState method)
{
return ReadAttribute(method, Attributes.Executable);
}
private bool ReadUserExecutable(MethodState method)
{
return ReadAttribute(method, Attributes.UserExecutable);
}
/// <summary>
/// Reads through the real attribute path, so the test fails if
/// the handler is installed but never consulted.
/// </summary>
private bool ReadAttribute(MethodState method, uint attributeId)
{
var value = new DataValue();
ServiceResult result = method.ReadAttribute(
m_context, attributeId, default, default, ref value);
Assert.That(ServiceResult.IsGood(result), Is.True,
$"read of {Attributes.GetBrowseName(attributeId)} failed: {result}");
Assert.That(value.WrappedValue.TryGetValue(out bool flag), Is.True,
$"{Attributes.GetBrowseName(attributeId)} must read as a Boolean.");
return flag;
}
}
}