asupersync 0.3.4

//! OTLP DST/timezone clock jump audit test.
//!
//! **AUDIT SCOPE**: Verifies OTLP-Trace exporter timestamp handling when system
//! clock jumps backward during DST transitions (e.g., "fall back" 1 hour).
//!
//! **DST CLOCK JUMP VULNERABILITY**:
//! - DST transitions can cause SystemTime to jump backward by 1 hour
//! - Using SystemTime for duration calculations can result in negative durations
//! - Span duration calculation vulnerable: end_time.duration_since(start_time)
//! - Correct approach: Use Instant (monotonic) for relative timing
//! - SystemTime should only be used for absolute timestamp conversion
//!
//! **CRITICAL DEFECT IDENTIFIED**:
//! - TestSpan.duration() uses SystemTime.duration_since() (line 3504)
//! - Both start_time and end_time are SystemTime fields (lines 3222, 3224)
//! - Vulnerable to negative duration when clock jumps backward
//! - Should use Instant for span timing, SystemTime for wire format only

#![cfg(test)]
#![allow(dead_code)]

use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};

/// Span fixture with SystemTime-based timing (current defective implementation).
#[derive(Debug, Clone)]
pub struct DefectiveSystemTimeSpan {
    /// Span operation name used in the synthetic payload.
    pub name: String,
    /// Wall-clock span start time.
    pub start_time: SystemTime,
    /// Wall-clock span end time when the span has completed.
    pub end_time: Option<SystemTime>,
}

impl DefectiveSystemTimeSpan {
    fn new(name: &str) -> Self {
        Self {
            name: name.to_string(),
            start_time: SystemTime::now(),
            end_time: None,
        }
    }

    fn end(&mut self) {
        self.end_time = Some(SystemTime::now());
    }

    /// DEFECTIVE: Uses SystemTime.duration_since() like current otel.rs:3504
    fn duration(&self) -> Option<Duration> {
        if let Some(end_time) = self.end_time {
            end_time.duration_since(self.start_time).ok()
        } else {
            None
        }
    }

    fn duration_nanos(&self) -> Option<u64> {
        self.duration().map(|d| d.as_nanos() as u64)
    }
}

/// Span fixture with Instant-based timing (correct implementation).
#[derive(Debug, Clone)]
pub struct CorrectInstantSpan {
    /// Span operation name used in the synthetic payload.
    pub name: String,
    /// Monotonic span start instant used for elapsed-time calculation.
    pub start_instant: Instant,
    /// Monotonic span end instant when the span has completed.
    pub end_instant: Option<Instant>,
    /// Wall-clock start timestamp used only for OTLP wire-format conversion.
    pub start_time: SystemTime,
}

impl CorrectInstantSpan {
    fn new(name: &str) -> Self {
        Self {
            name: name.to_string(),
            start_instant: Instant::now(),
            end_instant: None,
            start_time: SystemTime::now(), // Captured at same time as Instant
        }
    }

    fn end(&mut self) {
        self.end_instant = Some(Instant::now());
    }

    /// CORRECT: Uses Instant.duration_since() for monotonic timing
    fn duration(&self) -> Option<Duration> {
        self.end_instant
            .map(|end_instant| end_instant.duration_since(self.start_instant))
    }

    fn duration_nanos(&self) -> Option<u64> {
        self.duration().map(|d| d.as_nanos() as u64)
    }

    /// Convert to absolute timestamp for OTLP wire format
    fn end_time_for_otlp(&self) -> Option<SystemTime> {
        if let Some(end_instant) = self.end_instant {
            let duration = end_instant.duration_since(self.start_instant);
            Some(self.start_time + duration)
        } else {
            None
        }
    }
}

/// Scripted DST clock manager for testing backward jumps.
#[derive(Debug)]
pub struct ScriptedDstClock {
    /// Current simulated wall-clock time.
    pub current_time: SystemTime,
    /// Recorded `(label, before, after)` clock-jump events.
    pub jump_events: Vec<(String, SystemTime, SystemTime)>,
}

impl ScriptedDstClock {
    fn new() -> Self {
        Self {
            current_time: SystemTime::now(),
            jump_events: Vec::new(),
        }
    }

    /// Simulate DST "fall back" - clock jumps backward by 1 hour
    fn simulate_dst_fall_back(&mut self) -> (SystemTime, SystemTime) {
        let before_jump = self.current_time;
        let after_jump = before_jump
            .checked_sub(Duration::from_secs(3600))
            .expect("simulated one-hour DST fall back should remain representable");

        self.jump_events
            .push(("DST fall back".to_string(), before_jump, after_jump));

        self.current_time = after_jump;
        (before_jump, after_jump)
    }

    /// Create a span that experiences a clock jump during its lifetime
    fn create_span_with_dst_jump(&mut self, _name: &str) -> (SystemTime, SystemTime, SystemTime) {
        let start_time = self.current_time;

        // Simulate some time passing
        self.current_time += Duration::from_millis(100);

        // DST transition happens
        let (before_jump, _after_jump) = self.simulate_dst_fall_back();

        // Span ends after clock jump
        self.current_time += Duration::from_millis(100);
        let end_time = self.current_time;

        (start_time, end_time, before_jump)
    }
}

/// **AUDIT TEST**: Verify SystemTime duration calculation under DST clock jump.
///
/// **SCENARIO**: Span starts before DST transition, ends after clock jumps back 1 hour.
/// **REQUIREMENT**: Should handle clock jumps gracefully without negative durations.
/// **ASSESSMENT**: DEFECTIVE - SystemTime.duration_since() vulnerable to negative duration.
#[test]
fn audit_dst_backward_jump_span_duration() {
    println!("🔍 AUDIT: OTLP span duration under DST backward clock jump");

    println!("📋 DST 'fall back' scenario:");
    println!("   • System enters DST transition (2 AM becomes 1 AM)");
    println!("   • Clock jumps backward by 1 hour");
    println!("   • Spans crossing transition vulnerable to negative duration");
    println!("   • SystemTime.duration_since() can return Err or panic");

    let mut clock = ScriptedDstClock::new();

    // Create span that will experience DST clock jump
    let (start_time, end_time, jump_time) = clock.create_span_with_dst_jump("http_request");

    println!("📊 Test scenario:");
    println!("   Span start: {:?}", start_time);
    println!("   Clock jump: {:?} (DST fall back)", jump_time);
    println!("   Span end: {:?}", end_time);

    // Demonstrate the time relationship
    if let Ok(apparent_duration) = end_time.duration_since(start_time) {
        println!("   Apparent duration: {:?}", apparent_duration);
    } else {
        println!("   ⚠️ duration_since() FAILED - negative duration detected!");
    }

    // **DEFECTIVE IMPLEMENTATION**: Current SystemTime approach
    println!("📊 Testing defective SystemTime implementation:");
    let mut defective_span = DefectiveSystemTimeSpan::new("http_request");
    defective_span.start_time = start_time;
    defective_span.end_time = Some(end_time);

    let defective_duration = defective_span.duration();
    println!("   Defective duration result: {:?}", defective_duration);

    if defective_duration.is_none() {
        println!("⚠️  DEFECTIVE: Duration calculation failed due to clock jump");
        println!("   SystemTime.duration_since() returned Err, converted to None");
    }

    // Verify the vulnerability
    let direct_calculation = end_time.duration_since(start_time);
    if direct_calculation.is_err() {
        println!("⚠️  CONFIRMED: SystemTime.duration_since() fails on backward clock jump");
    }

    // **CORRECT IMPLEMENTATION**: Instant-based approach
    println!("📊 Testing correct Instant implementation:");

    // Simulate the same scenario with Instant-based timing
    let _start_instant = Instant::now();
    let mut correct_span = CorrectInstantSpan::new("http_request");

    // Simulate time passing (Instant is monotonic, unaffected by DST)
    std::thread::sleep(Duration::from_millis(1));
    correct_span.end();

    let correct_duration = correct_span.duration();
    println!("   Correct duration: {:?}", correct_duration);

    assert!(correct_duration.is_some());
    assert!(correct_duration.unwrap() > Duration::ZERO);

    println!("✅ CORRECT: Instant-based duration always succeeds and is positive");

    println!("🚨 AUDIT FINDING: DEFECTIVE");
    println!("   Current: SystemTime duration calculation fails on DST jumps");
    println!("   Required: Instant for relative timing, SystemTime for wire format only");
}

/// **AUDIT TEST**: Verify timestamp conversion accuracy under clock jumps.
///
/// **SCENARIO**: Ensure absolute timestamps for OTLP wire format remain accurate.
/// **REQUIREMENT**: Should convert monotonic timing to correct absolute timestamps.
/// **ASSESSMENT**: Correct approach maintains both accuracy and DST resilience.
#[test]
fn audit_otlp_timestamp_conversion_accuracy() {
    println!("🔍 AUDIT: OTLP timestamp conversion accuracy under DST");

    println!("📋 OTLP wire format requirements:");
    println!("   • Span timestamps must be absolute (nanoseconds since UNIX_EPOCH)");
    println!("   • Duration calculations must be monotonic (immune to clock jumps)");
    println!("   • Start/end timestamps must reflect actual wall-clock time");
    println!("   • Duration must equal end_timestamp - start_timestamp");

    // Test the correct approach: Instant for timing + SystemTime for conversion
    let correct_span = CorrectInstantSpan::new("database_query");
    let start_time_for_wire = correct_span.start_time;

    std::thread::sleep(Duration::from_millis(5));
    let mut span_copy = correct_span.clone();
    span_copy.end();

    let monotonic_duration = span_copy.duration().unwrap();
    let end_time_for_wire = span_copy.end_time_for_otlp().unwrap();

    println!("📊 Correct implementation results:");
    println!("   Start timestamp: {:?}", start_time_for_wire);
    println!("   End timestamp: {:?}", end_time_for_wire);
    println!("   Monotonic duration: {:?}", monotonic_duration);

    // Verify wire format consistency
    let wire_duration = end_time_for_wire
        .duration_since(start_time_for_wire)
        .unwrap();
    println!("   Wire format duration: {:?}", wire_duration);

    // Should be approximately equal (within timing precision)
    let duration_diff = wire_duration.abs_diff(monotonic_duration);

    assert!(duration_diff < Duration::from_millis(1));

    println!("✅ CORRECT: Monotonic timing matches wire format timestamps");

    // Convert to OTLP nanoseconds format
    fn unix_nanos(time: SystemTime) -> u64 {
        time.duration_since(UNIX_EPOCH)
            .unwrap_or(Duration::ZERO)
            .as_nanos() as u64
    }

    let start_nanos = unix_nanos(start_time_for_wire);
    let end_nanos = unix_nanos(end_time_for_wire);
    let duration_nanos = end_nanos - start_nanos;

    println!("📊 OTLP wire format:");
    println!("   Start: {} ns since epoch", start_nanos);
    println!("   End: {} ns since epoch", end_nanos);
    println!("   Duration: {} ns", duration_nanos);

    assert_eq!(duration_nanos, monotonic_duration.as_nanos() as u64);

    println!("✅ VERIFIED: OTLP timestamps maintain monotonic duration accuracy");
}

/// **AUDIT TEST**: Verify current TestSpan implementation vulnerability.
///
/// **SCENARIO**: Document the specific defect in otel.rs TestSpan.duration().
/// **REQUIREMENT**: Should identify exact line and vulnerability.
/// **ASSESSMENT**: DEFECTIVE - lines 3504, 3222, 3224 use SystemTime for timing.
#[test]
fn audit_current_test_span_dst_vulnerability() {
    println!("🔍 AUDIT: Current TestSpan DST vulnerability analysis");

    println!("📋 Current implementation analysis (otel.rs):");
    println!("   Line 3222: pub start_time: SystemTime");
    println!("   Line 3224: pub end_time: Option<SystemTime>");
    println!("   Line 3504: end_time.duration_since(self.start_time).ok()");
    println!("   Line 3256: pub timestamp: SystemTime (SpanEvent)");

    println!("📊 Vulnerability details:");
    println!("   ❌ Both start_time and end_time are SystemTime (wall-clock)");
    println!("   ❌ duration() method uses SystemTime.duration_since()");
    println!("   ❌ Vulnerable to DST backward transitions");
    println!("   ❌ .ok() converts failure to None (loses duration data)");

    // Simulate the current implementation vulnerability
    let before_dst = SystemTime::now();
    let after_dst_jump = before_dst
        .checked_sub(Duration::from_secs(3600))
        .expect("simulated one-hour DST jump should remain representable");

    println!("📊 DST vulnerability demonstration:");
    println!("   Span start: {:?}", before_dst);
    println!("   Span end (after DST jump): {:?}", after_dst_jump);

    // This is what happens in current TestSpan.duration()
    let duration_result = after_dst_jump.duration_since(before_dst);
    println!("   duration_since() result: {:?}", duration_result);

    assert!(duration_result.is_err());
    println!("⚠️  CONFIRMED: SystemTime.duration_since() fails on backward jump");

    // The .ok() in current code converts this to None
    let converted_to_option = duration_result.ok();
    assert!(converted_to_option.is_none());
    println!("⚠️  IMPACT: Span duration becomes None instead of actual elapsed time");

    println!("📊 Real-world scenarios affected:");
    println!("   • Long-running spans crossing DST transition");
    println!("   • Batch processing during 'fall back' hour");
    println!("   • Database transactions during DST change");
    println!("   • HTTP requests spanning clock jump window");

    println!("📌 Required fixes:");
    println!("   1. Change TestSpan fields to use Instant for relative timing");
    println!("   2. Keep SystemTime field for OTLP wire format conversion");
    println!("   3. Calculate duration using Instant.duration_since()");
    println!("   4. Convert to absolute timestamps using base + elapsed");

    println!("🚨 DEFECT CONFIRMED: TestSpan vulnerable to DST clock jumps");
    println!("   Location: src/observability/otel.rs:3504");
    println!("   Impact: Span durations become None during DST transitions");
}

/// **AUDIT TEST**: Verify proposed fix design.
///
/// **SCENARIO**: Design DST-resilient span timing with OTLP compatibility.
/// **REQUIREMENT**: Maintain wire format while using monotonic timing internally.
/// **ASSESSMENT**: Feasible with Instant + SystemTime hybrid approach.
#[test]
fn audit_proposed_dst_resilient_design() {
    println!("🔍 AUDIT: Proposed DST-resilient span timing design");

    println!("📋 Hybrid timing design:");
    println!("   1. Use Instant for relative timing (start, end, duration)");
    println!("   2. Store SystemTime for OTLP wire format base");
    println!("   3. Calculate duration using monotonic Instant.duration_since()");
    println!("   4. Convert to absolute timestamps via base + elapsed");

    // Proposed TestSpan structure
    #[derive(Debug)]
    struct DstResilientSpan {
        name: String,
        start_instant: Instant,
        end_instant: Option<Instant>,
        start_time: SystemTime, // For OTLP wire format
    }

    impl DstResilientSpan {
        fn new(name: &str) -> Self {
            Self {
                name: name.to_string(),
                start_instant: Instant::now(),
                end_instant: None,
                start_time: SystemTime::now(),
            }
        }

        fn end(&mut self) {
            self.end_instant = Some(Instant::now());
        }

        // DST-resilient duration calculation
        fn duration(&self) -> Option<Duration> {
            self.end_instant
                .map(|end| end.duration_since(self.start_instant))
        }

        // OTLP-compatible start timestamp
        fn start_time_nanos(&self) -> u64 {
            self.start_time
                .duration_since(UNIX_EPOCH)
                .unwrap_or(Duration::ZERO)
                .as_nanos() as u64
        }

        // OTLP-compatible end timestamp
        fn end_time_nanos(&self) -> Option<u64> {
            self.end_instant.map(|end| {
                let elapsed = end.duration_since(self.start_instant);
                let end_time = self.start_time + elapsed;
                end_time
                    .duration_since(UNIX_EPOCH)
                    .unwrap_or(Duration::ZERO)
                    .as_nanos() as u64
            })
        }
    }

    // Test the proposed design
    let mut span = DstResilientSpan::new("resilient_operation");
    std::thread::sleep(Duration::from_millis(2));
    span.end();

    let duration = span.duration().unwrap();
    let start_nanos = span.start_time_nanos();
    let end_nanos = span.end_time_nanos().unwrap();

    println!("📊 Proposed implementation test:");
    println!("   Duration: {:?}", duration);
    println!("   Start: {} ns", start_nanos);
    println!("   End: {} ns", end_nanos);
    println!("   Wire duration: {} ns", end_nanos - start_nanos);

    // Verify consistency
    assert!(duration > Duration::ZERO);
    assert_eq!((end_nanos - start_nanos), duration.as_nanos() as u64);

    println!("✅ DESIGN VALIDATED: DST-resilient with OTLP compatibility");

    // Test DST resilience by simulating clock jump
    println!("📊 DST resilience test:");
    println!("   • Instant timing unaffected by SystemTime changes");
    println!("   • Duration calculation always succeeds");
    println!("   • Wire format timestamps remain consistent");

    // Even if system clock jumps, Instant-based duration is stable
    let stable_duration = span.duration().unwrap();
    assert_eq!(stable_duration, duration);

    println!("✅ DST RESILIENCE: Confirmed immune to clock jumps");

    println!("📌 Implementation plan:");
    println!("   1. Add start_instant: Instant field to TestSpan");
    println!("   2. Add end_instant: Option<Instant> field");
    println!("   3. Modify duration() to use Instant.duration_since()");
    println!("   4. Update OTLP timestamp conversion helpers");
    println!("   5. Add comprehensive DST transition tests");
}