oxirs_shacl/custom_components/

js_wasm.rs

//! JavaScript and WASM Constraint Validators
//!
//! This module provides support for custom constraint validators written in JavaScript
//! or compiled to WebAssembly (WASM). This enables users to write custom validation
//! logic in familiar languages while maintaining security through sandboxing.
//!
//! # Features
//!
//! - JavaScript constraint validators with QuickJS runtime
//! - WebAssembly constraint validators with Wasmer/Wasmtime
//! - Sandboxed execution with resource limits
//! - Performance monitoring and statistics
//! - Error handling and recovery
//! - Type conversion between RDF terms and JS/WASM values
//!
//! # Security
//!
//! All external code execution is sandboxed with:
//! - Memory limits
//! - Execution time limits
//! - No network access
//! - No file system access
//! - Limited computational resources

use crate::{
    constraints::ConstraintEvaluationResult,
    custom_components::{
        ComponentExecutionResult, ComponentMetadata, CustomConstraint, CustomConstraintComponent,
        ExecutionMetrics, ResourceQuotas, SandboxingLevel, SecurityPolicy,
    },
    ConstraintComponentId, Result, ShaclError,
};
use oxirs_core::model::Term;
use serde::{Deserialize, Serialize};
use std::collections::HashMap;
use std::time::{Duration, Instant};
use wasmi::{Config, Engine, Linker, Module, Store, Val};

/// JavaScript/WASM runtime configuration
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct RuntimeConfig {
    /// Maximum memory allowed (bytes)
    pub max_memory: usize,
    /// Maximum execution time (milliseconds)
    pub max_execution_time_ms: u64,
    /// Maximum stack depth
    pub max_stack_depth: usize,
    /// Enable debugging features
    pub enable_debugging: bool,
    /// Resource quotas
    pub quotas: ResourceQuotas,
}

impl Default for RuntimeConfig {
    fn default() -> Self {
        Self {
            max_memory: 10 * 1024 * 1024, // 10 MB
            max_execution_time_ms: 5000,  // 5 seconds
            max_stack_depth: 100,
            enable_debugging: false,
            quotas: ResourceQuotas {
                max_cpu_time: Some(Duration::from_secs(5)),
                max_sparql_queries: Some(10),
                max_result_size: Some(10000),
                max_recursion_depth: Some(100),
            },
        }
    }
}

/// JavaScript constraint validator
///
/// Executes JavaScript code for constraint validation using a sandboxed runtime.
/// The JavaScript code should define a function `validate(value, parameters)` that
/// returns a boolean or an object with `valid: boolean` and optional `message: string`.
#[derive(Debug, Clone)]
pub struct JavaScriptValidator {
    /// Component ID
    component_id: ConstraintComponentId,
    /// Component metadata
    metadata: ComponentMetadata,
    /// JavaScript validation code
    code: String,
    /// Runtime configuration
    config: RuntimeConfig,
    /// Security policy
    security_policy: SecurityPolicy,
}

impl JavaScriptValidator {
    /// Create a new JavaScript validator
    pub fn new(
        component_id: ConstraintComponentId,
        metadata: ComponentMetadata,
        code: String,
    ) -> Self {
        Self {
            component_id,
            metadata,
            code,
            config: RuntimeConfig::default(),
            security_policy: SecurityPolicy {
                allow_arbitrary_sparql: false,
                allow_external_access: false,
                max_execution_time: Some(Duration::from_secs(5)),
                max_memory_usage: Some(10 * 1024 * 1024),
                allowed_sparql_operations: std::collections::HashSet::new(),
                trusted: false,
                sandboxing_level: SandboxingLevel::Strict,
                resource_quotas: ResourceQuotas {
                    max_cpu_time: Some(Duration::from_secs(5)),
                    max_sparql_queries: Some(0), // No SPARQL in JS validators
                    max_result_size: Some(1000),
                    max_recursion_depth: Some(100),
                },
            },
        }
    }

    /// Create with custom configuration
    pub fn with_config(mut self, config: RuntimeConfig) -> Self {
        self.config = config;
        self
    }

    /// Create with custom security policy
    pub fn with_security_policy(mut self, policy: SecurityPolicy) -> Self {
        self.security_policy = policy;
        self
    }

    /// Execute JavaScript validation.
    ///
    /// No sandboxed JavaScript runtime is wired into this build, so a configured
    /// JavaScript validator MUST NOT silently report conformance (which would
    /// pass every focus node regardless of the actual validation logic).
    /// Instead this fails loud with [`ShaclError::UnsupportedOperation`], in line
    /// with the project's fail-loud contract. Wiring a real sandboxed engine
    /// (e.g. QuickJS via `rquickjs`, or Boa) would replace this method body.
    pub fn execute(
        &self,
        _value: &Term,
        _parameters: &HashMap<String, Term>,
    ) -> Result<ComponentExecutionResult> {
        Err(ShaclError::UnsupportedOperation(format!(
            "JavaScript constraint validator '{}' cannot be executed: no sandboxed \
             JavaScript runtime is available in this build. Configure a WASM validator \
             or a built-in/SPARQL constraint instead.",
            self.component_id.as_str()
        )))
    }

    /// Validate the JavaScript code syntax
    pub fn validate_code(&self) -> Result<()> {
        // TODO: Implement syntax validation
        // For now, just check if code is not empty
        if self.code.trim().is_empty() {
            return Err(ShaclError::Configuration(
                "JavaScript code cannot be empty".to_string(),
            ));
        }
        Ok(())
    }
}

impl CustomConstraintComponent for JavaScriptValidator {
    fn component_id(&self) -> &ConstraintComponentId {
        &self.component_id
    }

    fn metadata(&self) -> &ComponentMetadata {
        &self.metadata
    }

    fn validate_configuration(&self, _parameters: &HashMap<String, Term>) -> Result<()> {
        self.validate_code()
    }

    fn create_constraint(&self, parameters: HashMap<String, Term>) -> Result<CustomConstraint> {
        Ok(CustomConstraint {
            component_id: self.component_id.clone(),
            parameters,
            sparql_query: None,
            validation_function: Some("javascript".to_string()),
            message_template: Some("JavaScript validation failed".to_string()),
        })
    }
}

/// WebAssembly constraint validator
///
/// Executes WebAssembly modules for constraint validation using a sandboxed runtime.
/// The WASM module should export a function `validate(value_ptr, params_ptr) -> i32`
/// that returns 1 for valid, 0 for invalid.
#[derive(Debug, Clone)]
pub struct WasmValidator {
    /// Component ID
    component_id: ConstraintComponentId,
    /// Component metadata
    metadata: ComponentMetadata,
    /// WASM module bytes
    wasm_bytes: Vec<u8>,
    /// Runtime configuration
    config: RuntimeConfig,
    /// Security policy
    security_policy: SecurityPolicy,
    /// Function name to call
    function_name: String,
}

impl WasmValidator {
    /// Create a new WASM validator
    pub fn new(
        component_id: ConstraintComponentId,
        metadata: ComponentMetadata,
        wasm_bytes: Vec<u8>,
    ) -> Self {
        Self {
            component_id,
            metadata,
            wasm_bytes,
            config: RuntimeConfig::default(),
            security_policy: SecurityPolicy {
                allow_arbitrary_sparql: false,
                allow_external_access: false,
                max_execution_time: Some(Duration::from_secs(5)),
                max_memory_usage: Some(10 * 1024 * 1024),
                allowed_sparql_operations: std::collections::HashSet::new(),
                trusted: false,
                sandboxing_level: SandboxingLevel::Strict,
                resource_quotas: ResourceQuotas {
                    max_cpu_time: Some(Duration::from_secs(5)),
                    max_sparql_queries: Some(0), // No SPARQL in WASM validators
                    max_result_size: Some(1000),
                    max_recursion_depth: Some(100),
                },
            },
            function_name: "validate".to_string(),
        }
    }

    /// Create with custom configuration
    pub fn with_config(mut self, config: RuntimeConfig) -> Self {
        self.config = config;
        self
    }

    /// Create with custom security policy
    pub fn with_security_policy(mut self, policy: SecurityPolicy) -> Self {
        self.security_policy = policy;
        self
    }

    /// Set the function name to call
    pub fn with_function_name(mut self, name: String) -> Self {
        self.function_name = name;
        self
    }

    /// Execute WASM validation
    ///
    /// Executes the WASM module using wasmi with proper sandboxing and resource limits.
    /// The WASM module must export a function with the configured name (default: "validate")
    /// that takes an i32 input and returns an i32 (1 for valid, 0 for invalid).
    pub fn execute(
        &self,
        value: &Term,
        parameters: &HashMap<String, Term>,
    ) -> Result<ComponentExecutionResult> {
        let start = Instant::now();

        // Execute WASM with timeout
        let result = self.execute_wasm_with_timeout(value, parameters)?;

        let execution_time = start.elapsed();

        // Check execution time limit
        if execution_time.as_millis() > self.config.max_execution_time_ms as u128 {
            return Err(ShaclError::Timeout(format!(
                "WASM execution exceeded time limit: {:?}",
                execution_time
            )));
        }

        Ok(result)
    }

    /// Execute WASM module with resource limits and timeout
    fn execute_wasm_with_timeout(
        &self,
        value: &Term,
        _parameters: &HashMap<String, Term>,
    ) -> Result<ComponentExecutionResult> {
        let start = Instant::now();

        // Configure wasmi with fuel metering enabled so that a hung or malicious
        // module (e.g. an infinite loop) is preempted deterministically after a
        // bounded number of instructions, rather than blocking the calling
        // thread indefinitely and only being noticed by a post-hoc wall-clock
        // check. The fuel budget is derived from the configured time limit.
        let mut config = Config::default();
        config.consume_fuel(true);
        let engine = Engine::new(&config);

        // Compile WASM module
        let module = Module::new(&engine, &self.wasm_bytes[..]).map_err(|e| {
            ShaclError::Configuration(format!("Failed to compile WASM module: {}", e))
        })?;

        // Create linker with no host functions (fully sandboxed)
        let linker = Linker::new(&engine);

        // Create store and load a finite fuel budget. ~5M fuel units per allowed
        // millisecond bounds runaway execution while leaving ample headroom for
        // legitimate validators; the minimum ensures very small time limits
        // still allow non-trivial modules to run.
        let mut store = Store::new(&engine, ());
        let fuel_budget = self
            .config
            .max_execution_time_ms
            .saturating_mul(5_000_000)
            .max(1_000_000);
        store.set_fuel(fuel_budget).map_err(|e| {
            ShaclError::Configuration(format!("Failed to set WASM fuel budget: {e}"))
        })?;

        // Instantiate and start module (wasmi 1.0 API)
        let instance = linker
            .instantiate_and_start(&mut store, &module)
            .map_err(|e| {
                ShaclError::Configuration(format!(
                    "Failed to instantiate and start WASM module: {}",
                    e
                ))
            })?;

        // Get the validation function
        let validate_func = instance
            .get_func(&store, &self.function_name)
            .ok_or_else(|| {
                ShaclError::Configuration(format!(
                    "WASM module does not export function '{}'",
                    self.function_name
                ))
            })?;

        // Convert term to simple hash for WASM input (simplified)
        let value_hash = self.term_to_simple_hash(value);

        // Call WASM function with input value
        let mut results = [Val::I32(0)];
        validate_func
            .call(&mut store, &[Val::I32(value_hash)], &mut results)
            .map_err(|e| {
                let msg = e.to_string();
                if msg.to_lowercase().contains("fuel") {
                    ShaclError::Timeout(format!(
                        "WASM validator exhausted its instruction budget \
                         (fuel) and was preempted: {msg}"
                    ))
                } else {
                    ShaclError::Configuration(format!("WASM function execution failed: {msg}"))
                }
            })?;

        // Extract result (1 = valid, 0 = invalid)
        let is_valid = match results[0] {
            Val::I32(v) => v != 0,
            _ => {
                return Err(ShaclError::Configuration(
                    "WASM function returned unexpected type".to_string(),
                ))
            }
        };

        let execution_time = start.elapsed();

        Ok(ComponentExecutionResult {
            constraint_result: if is_valid {
                ConstraintEvaluationResult::Satisfied
            } else {
                ConstraintEvaluationResult::Violated {
                    violating_value: Some(value.clone()),
                    message: Some("WASM validation failed".to_string()),
                    details: HashMap::new(),
                }
            },
            metrics: ExecutionMetrics {
                execution_time,
                memory_used: 0, // Memory tracking not available in wasmi 0.40
                sparql_queries: 0,
                success: true,
                error: None,
            },
            security_violations: Vec::new(),
        })
    }

    /// Convert RDF term to simple hash for WASM input
    /// This is a simplified conversion - production code would use more sophisticated serialization
    fn term_to_simple_hash(&self, term: &Term) -> i32 {
        use std::collections::hash_map::DefaultHasher;
        use std::hash::{Hash, Hasher};

        let mut hasher = DefaultHasher::new();

        match term {
            Term::NamedNode(node) => {
                "NamedNode".hash(&mut hasher);
                node.as_str().hash(&mut hasher);
            }
            Term::BlankNode(node) => {
                "BlankNode".hash(&mut hasher);
                node.as_str().hash(&mut hasher);
            }
            Term::Literal(lit) => {
                "Literal".hash(&mut hasher);
                lit.value().hash(&mut hasher);
            }
            Term::Variable(var) => {
                "Variable".hash(&mut hasher);
                var.as_str().hash(&mut hasher);
            }
            Term::QuotedTriple(_) => {
                "QuotedTriple".hash(&mut hasher);
            }
        }

        hasher.finish() as i32
    }

    /// Validate the WASM module
    pub fn validate_module(&self) -> Result<()> {
        // TODO: Implement WASM module validation
        // For now, just check if bytes are not empty
        if self.wasm_bytes.is_empty() {
            return Err(ShaclError::Configuration(
                "WASM module cannot be empty".to_string(),
            ));
        }

        // Check WASM magic number (0x00 0x61 0x73 0x6D)
        if self.wasm_bytes.len() < 4
            || self.wasm_bytes[0] != 0x00
            || self.wasm_bytes[1] != 0x61
            || self.wasm_bytes[2] != 0x73
            || self.wasm_bytes[3] != 0x6D
        {
            return Err(ShaclError::Configuration(
                "Invalid WASM module: missing magic number".to_string(),
            ));
        }

        Ok(())
    }
}

impl CustomConstraintComponent for WasmValidator {
    fn component_id(&self) -> &ConstraintComponentId {
        &self.component_id
    }

    fn metadata(&self) -> &ComponentMetadata {
        &self.metadata
    }

    fn validate_configuration(&self, _parameters: &HashMap<String, Term>) -> Result<()> {
        self.validate_module()
    }

    fn create_constraint(&self, parameters: HashMap<String, Term>) -> Result<CustomConstraint> {
        Ok(CustomConstraint {
            component_id: self.component_id.clone(),
            parameters,
            sparql_query: None,
            validation_function: Some("wasm".to_string()),
            message_template: Some("WASM validation failed".to_string()),
        })
    }
}

/// Type conversion utilities for JavaScript/WASM interop
pub mod interop {
    use super::*;
    use oxirs_core::model::{BlankNode, Literal, NamedNode};

    /// Convert RDF term to JSON-compatible value for JavaScript
    pub fn term_to_json(term: &Term) -> serde_json::Value {
        match term {
            Term::NamedNode(node) => {
                serde_json::json!({
                    "type": "NamedNode",
                    "value": node.as_str()
                })
            }
            Term::BlankNode(node) => {
                serde_json::json!({
                    "type": "BlankNode",
                    "value": node.as_str()
                })
            }
            Term::Literal(lit) => {
                serde_json::json!({
                    "type": "Literal",
                    "value": lit.value(),
                    "language": lit.language(),
                    "datatype": lit.datatype().as_str()
                })
            }
            Term::Variable(var) => {
                serde_json::json!({
                    "type": "Variable",
                    "value": var.as_str()
                })
            }
            Term::QuotedTriple(_triple) => {
                serde_json::json!({
                    "type": "QuotedTriple",
                    "value": "quoted-triple"
                })
            }
        }
    }

    /// Convert JSON value back to RDF term
    pub fn json_to_term(value: &serde_json::Value) -> Result<Term> {
        let obj = value
            .as_object()
            .ok_or_else(|| ShaclError::Configuration("Expected JSON object".to_string()))?;

        let term_type = obj
            .get("type")
            .and_then(|v| v.as_str())
            .ok_or_else(|| ShaclError::Configuration("Missing 'type' field".to_string()))?;

        let term_value = obj
            .get("value")
            .and_then(|v| v.as_str())
            .ok_or_else(|| ShaclError::Configuration("Missing 'value' field".to_string()))?;

        match term_type {
            "NamedNode" => Ok(Term::NamedNode(NamedNode::new(term_value)?)),
            "BlankNode" => Ok(Term::BlankNode(BlankNode::new(term_value)?)),
            "Literal" => {
                // Handle language tag and datatype
                let language = obj.get("language").and_then(|v| v.as_str());
                let datatype = obj.get("datatype").and_then(|v| v.as_str());

                let literal = match (language, datatype) {
                    // Literal with language tag (language takes precedence)
                    (Some(lang), _) if !lang.is_empty() => {
                        Literal::new_language_tagged_literal(term_value, lang).map_err(|e| {
                            ShaclError::Configuration(format!(
                                "Invalid language tag '{}': {}",
                                lang, e
                            ))
                        })?
                    }
                    // Literal with explicit datatype
                    (_, Some(dt)) if !dt.is_empty() => {
                        let datatype_node = NamedNode::new(dt).map_err(|e| {
                            ShaclError::Configuration(format!(
                                "Invalid datatype IRI '{}': {}",
                                dt, e
                            ))
                        })?;
                        Literal::new_typed_literal(term_value, datatype_node)
                    }
                    // Plain literal (defaults to xsd:string)
                    _ => Literal::new(term_value),
                };

                Ok(Term::Literal(literal))
            }
            _ => Err(ShaclError::Configuration(format!(
                "Unknown term type: {}",
                term_type
            ))),
        }
    }
}

/// Builder for creating JavaScript/WASM validators
pub struct ExternalValidatorBuilder {
    component_id: Option<ConstraintComponentId>,
    metadata: Option<ComponentMetadata>,
    runtime_config: RuntimeConfig,
    security_policy: SecurityPolicy,
}

impl ExternalValidatorBuilder {
    /// Create a new builder
    pub fn new() -> Self {
        Self {
            component_id: None,
            metadata: None,
            runtime_config: RuntimeConfig::default(),
            security_policy: SecurityPolicy {
                allow_arbitrary_sparql: false,
                allow_external_access: false,
                max_execution_time: Some(Duration::from_secs(5)),
                max_memory_usage: Some(10 * 1024 * 1024),
                allowed_sparql_operations: std::collections::HashSet::new(),
                trusted: false,
                sandboxing_level: SandboxingLevel::Strict,
                resource_quotas: ResourceQuotas {
                    max_cpu_time: Some(Duration::from_secs(5)),
                    max_sparql_queries: Some(0),
                    max_result_size: Some(1000),
                    max_recursion_depth: Some(100),
                },
            },
        }
    }

    /// Set component ID
    pub fn component_id(mut self, id: ConstraintComponentId) -> Self {
        self.component_id = Some(id);
        self
    }

    /// Set metadata
    pub fn metadata(mut self, metadata: ComponentMetadata) -> Self {
        self.metadata = Some(metadata);
        self
    }

    /// Set runtime configuration
    pub fn runtime_config(mut self, config: RuntimeConfig) -> Self {
        self.runtime_config = config;
        self
    }

    /// Set security policy
    pub fn security_policy(mut self, policy: SecurityPolicy) -> Self {
        self.security_policy = policy;
        self
    }

    /// Build a JavaScript validator
    pub fn build_js(self, code: String) -> Result<JavaScriptValidator> {
        let component_id = self
            .component_id
            .ok_or_else(|| ShaclError::Configuration("Missing component ID".to_string()))?;
        let metadata = self
            .metadata
            .ok_or_else(|| ShaclError::Configuration("Missing metadata".to_string()))?;

        Ok(JavaScriptValidator {
            component_id,
            metadata,
            code,
            config: self.runtime_config,
            security_policy: self.security_policy,
        })
    }

    /// Build a WASM validator
    pub fn build_wasm(self, wasm_bytes: Vec<u8>) -> Result<WasmValidator> {
        let component_id = self
            .component_id
            .ok_or_else(|| ShaclError::Configuration("Missing component ID".to_string()))?;
        let metadata = self
            .metadata
            .ok_or_else(|| ShaclError::Configuration("Missing metadata".to_string()))?;

        Ok(WasmValidator {
            component_id,
            metadata,
            wasm_bytes,
            config: self.runtime_config,
            security_policy: self.security_policy,
            function_name: "validate".to_string(),
        })
    }
}

impl Default for ExternalValidatorBuilder {
    fn default() -> Self {
        Self::new()
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_js_validator_creation() {
        let metadata = ComponentMetadata {
            name: "TestJS".to_string(),
            description: Some("Test JavaScript validator".to_string()),
            version: Some("1.0.0".to_string()),
            author: None,
            parameters: vec![],
            applicable_to_node_shapes: true,
            applicable_to_property_shapes: true,
            example: None,
        };

        let validator = JavaScriptValidator::new(
            ConstraintComponentId("test:js".to_string()),
            metadata,
            "function validate(value, params) { return true; }".to_string(),
        );

        assert_eq!(validator.component_id.as_str(), "test:js");
        assert!(validator.validate_code().is_ok());
    }

    #[test]
    fn test_js_validator_empty_code() {
        let metadata = ComponentMetadata {
            name: "TestJS".to_string(),
            description: Some("Test JavaScript validator".to_string()),
            version: Some("1.0.0".to_string()),
            author: None,
            parameters: vec![],
            applicable_to_node_shapes: true,
            applicable_to_property_shapes: true,
            example: None,
        };

        let validator = JavaScriptValidator::new(
            ConstraintComponentId("test:js".to_string()),
            metadata,
            "".to_string(),
        );

        assert!(validator.validate_code().is_err());
    }

    #[test]
    fn regression_js_validator_execute_is_fail_loud() {
        use oxirs_core::model::NamedNode;
        let metadata = ComponentMetadata {
            name: "TestJS".to_string(),
            description: None,
            version: Some("1.0.0".to_string()),
            author: None,
            parameters: vec![],
            applicable_to_node_shapes: true,
            applicable_to_property_shapes: true,
            example: None,
        };
        let validator = JavaScriptValidator::new(
            ConstraintComponentId("test:js".to_string()),
            metadata,
            "function validate(v, p) { return false; }".to_string(),
        );
        let value = Term::NamedNode(NamedNode::new("http://example.org/x").expect("iri"));
        let res = validator.execute(&value, &HashMap::new());
        // Must NOT silently report Satisfied; must fail loud.
        assert!(
            matches!(res, Err(ShaclError::UnsupportedOperation(_))),
            "JS validator must fail loud, got {res:?}"
        );
    }

    #[test]
    fn regression_wasm_infinite_loop_is_preempted_by_fuel() {
        use oxirs_core::model::NamedNode;
        // Hand-encoded WASM module exporting `validate` (i32)->(i32) whose body
        // is an infinite loop `(loop (br 0))`. Without fuel metering this would
        // hang the thread forever; with fuel it must be preempted (Timeout).
        let wasm_bytes: Vec<u8> = vec![
            0x00, 0x61, 0x73, 0x6D, 0x01, 0x00, 0x00, 0x00, // header
            0x01, 0x06, 0x01, 0x60, 0x01, 0x7F, 0x01, 0x7F, // type: (i32)->(i32)
            0x03, 0x02, 0x01, 0x00, // func section: 1 func, type 0
            0x07, 0x0C, 0x01, 0x08, 0x76, 0x61, 0x6C, 0x69, 0x64, 0x61, 0x74, 0x65, 0x00,
            0x00, // export "validate" func 0
            0x0A, 0x0B, 0x01, 0x09, 0x00, 0x03, 0x40, 0x0C, 0x00, 0x0B, 0x41, 0x00,
            0x0B, // code: loop { br 0 } i32.const 0
        ];
        let metadata = ComponentMetadata {
            name: "LoopWasm".to_string(),
            description: None,
            version: Some("1.0.0".to_string()),
            author: None,
            parameters: vec![],
            applicable_to_node_shapes: true,
            applicable_to_property_shapes: true,
            example: None,
        };
        let mut validator = WasmValidator::new(
            ConstraintComponentId("test:loop".to_string()),
            metadata,
            wasm_bytes,
        );
        // Small time budget -> small (but finite) fuel budget.
        validator.config.max_execution_time_ms = 1;
        let value = Term::NamedNode(NamedNode::new("http://example.org/x").expect("iri"));
        let res = validator.execute(&value, &HashMap::new());
        assert!(
            matches!(res, Err(ShaclError::Timeout(_))),
            "infinite-loop WASM must be preempted by fuel (Timeout), got {res:?}"
        );
    }

    #[test]
    fn test_wasm_validator_creation() {
        let metadata = ComponentMetadata {
            name: "TestWASM".to_string(),
            description: Some("Test WASM validator".to_string()),
            version: Some("1.0.0".to_string()),
            author: None,
            parameters: vec![],
            applicable_to_node_shapes: true,
            applicable_to_property_shapes: true,
            example: None,
        };

        // Valid WASM magic number
        let wasm_bytes = vec![0x00, 0x61, 0x73, 0x6D, 0x01, 0x00, 0x00, 0x00];

        let validator = WasmValidator::new(
            ConstraintComponentId("test:wasm".to_string()),
            metadata,
            wasm_bytes,
        );

        assert_eq!(validator.component_id.as_str(), "test:wasm");
        assert!(validator.validate_module().is_ok());
    }

    #[test]
    fn test_wasm_validator_invalid_magic() {
        let metadata = ComponentMetadata {
            name: "TestWASM".to_string(),
            description: Some("Test WASM validator".to_string()),
            version: Some("1.0.0".to_string()),
            author: None,
            parameters: vec![],
            applicable_to_node_shapes: true,
            applicable_to_property_shapes: true,
            example: None,
        };

        // Invalid WASM magic number
        let wasm_bytes = vec![0x00, 0x00, 0x00, 0x00];

        let validator = WasmValidator::new(
            ConstraintComponentId("test:wasm".to_string()),
            metadata,
            wasm_bytes,
        );

        assert!(validator.validate_module().is_err());
    }

    #[test]
    fn test_term_to_json_conversion() {
        use oxirs_core::model::NamedNode;

        let term = Term::NamedNode(NamedNode::new("http://example.org/test").expect("valid IRI"));
        let json = interop::term_to_json(&term);

        assert_eq!(json["type"], "NamedNode");
        assert_eq!(json["value"], "http://example.org/test");
    }

    #[test]
    fn test_builder_js() {
        let metadata = ComponentMetadata {
            name: "TestJS".to_string(),
            description: Some("Test".to_string()),
            version: Some("1.0.0".to_string()),
            author: None,
            parameters: vec![],
            applicable_to_node_shapes: true,
            applicable_to_property_shapes: true,
            example: None,
        };

        let validator = ExternalValidatorBuilder::new()
            .component_id(ConstraintComponentId("test:js".to_string()))
            .metadata(metadata)
            .build_js("function validate() { return true; }".to_string())
            .expect("validation should succeed");

        assert_eq!(validator.component_id.as_str(), "test:js");
    }

    #[test]
    fn test_builder_wasm() {
        let metadata = ComponentMetadata {
            name: "TestWASM".to_string(),
            description: Some("Test".to_string()),
            version: Some("1.0.0".to_string()),
            author: None,
            parameters: vec![],
            applicable_to_node_shapes: true,
            applicable_to_property_shapes: true,
            example: None,
        };

        let wasm_bytes = vec![0x00, 0x61, 0x73, 0x6D, 0x01, 0x00, 0x00, 0x00];

        let validator = ExternalValidatorBuilder::new()
            .component_id(ConstraintComponentId("test:wasm".to_string()))
            .metadata(metadata)
            .build_wasm(wasm_bytes)
            .expect("operation should succeed");

        assert_eq!(validator.component_id.as_str(), "test:wasm");
    }
}