Files
ersatztv/ErsatzTV.Infrastructure.Tests/Streaming/Graphics/WatermarkElementRemoteImageTests.cs
T
timothy d4e112f1e9
Build ErsatzTV Image / CI image pin matches docker/ci (pull_request) Successful in 15s
Build ErsatzTV Image / Docs update reminder (pull_request) Successful in 13s
Build ErsatzTV Image / decisions.md append-only (pull_request) Successful in 16s
Build ErsatzTV Image / API docs in sync (OpenAPI + endpoint index) (pull_request) Successful in 17s
Build ErsatzTV Image / Formatting (changed .cs conform to .editorconfig) (pull_request) Successful in 20s
Build ErsatzTV Image / Build & test (.NET) (pull_request) Successful in 7m34s
Build ErsatzTV Image / Functional E2E (curl contracts) (pull_request) Successful in 14m15s
Build ErsatzTV Image / EF migration integrity (SQLite + MySql) (pull_request) Successful in 18m39s
Build ErsatzTV Image / Build & push image (amd64) (pull_request) Has been skipped
fix(511): bound the DECODER, not the header's frame count
Second adversarial re-review defeated the product budget too, and the
mechanism generalizes: the budget was enforced on a number the decoder
does not honor.

Measured on ImageSharp 3.1.12 (reproduced independently before fixing):

  600-frame APNG  ->  Identify: FrameMetadataCollection.Count = 0
                      Load:     Frames.Count = 600

So EnsureDecodeAffordable(w, h, 0) charged Math.Max(0,1) = 1 frame —
the most permissive possible reading. A 4000x4000 x600 APNG is ~134 KiB
on the wire, is charged 16 MP, and decodes to ~36 GiB: 2.5x worse than
the GIF the previous commit exists to stop, at half the wire size. The
retention budget could not backstop it — that runs after LoadAsync, so
the process OOMs first, killing every concurrent stream.

GIF, WebP and TIFF report honestly; PNG/APNG is the sole divergence,
which is the point: you cannot audit every format, so the header cannot
be the source of truth.

DecodeRemoteImage now:
- checks header DIMENSIONS only (trustworthy; a GIF image descriptor
  exceeding its logical screen is clamped by the decoder, verified)
- derives how many frames of that size the budget affords
- passes that to DecoderOptions.MaxFrames, which the DECODER enforces
  whatever the header claimed. Measured: MaxFrames = N yields N-1
  frames, so it asks for affordable + 2 — decoding one more than allowed
  is what distinguishes "at the limit" from "over it" without silently
  truncating a legitimate animation
- re-verifies the real image.Frames.Count after decoding, disposing and
  rejecting if over

Also adds wiring coverage for the retention budget (M4): deleting its
call site now fails a test — negative-controlled, build verified before
trusting the result.

docs/decisions.md records both failed attempts, because the lesson is
the generalizable part: independent caps do not compose into a budget,
and a limit the decoder does not enforce is not a limit.
2026-07-21 01:04:25 +02:00

184 lines
6.7 KiB
C#

using ErsatzTV.Core.Domain;
using ErsatzTV.Core.FFmpeg;
using ErsatzTV.Core.Interfaces.Streaming;
using ErsatzTV.FFmpeg;
using ErsatzTV.FFmpeg.State;
using ErsatzTV.Infrastructure.Streaming.Graphics;
using LanguageExt;
using SixLabors.ImageSharp;
using SixLabors.ImageSharp.Formats.Png;
using SixLabors.ImageSharp.PixelFormats;
using Microsoft.Extensions.Logging;
using NSubstitute;
using NUnit.Framework;
using Shouldly;
namespace ErsatzTV.Infrastructure.Tests.Streaming.Graphics;
/// <summary>
/// The degradation contract for a remote watermark image: whatever the fetcher throws, the
/// element disables itself and the stream survives. (ersatztv#511)
/// </summary>
[TestFixture]
public class WatermarkElementRemoteImageTests
{
private const string RemoteLogo = "https://example.com/logo.png";
private static readonly Exception[] FetchFailures =
[
new TimeoutException("timed out fetching remote image"),
new InvalidOperationException("remote image exceeds the byte limit"),
new HttpRequestException("no route to host")
];
[TestCaseSource(nameof(FetchFailures))]
public async Task Should_Disable_The_Watermark_When_The_Fetch_Fails(Exception failure)
{
var fetcher = Substitute.For<IRemoteImageFetcher>();
fetcher.Fetch(Arg.Any<Uri>(), Arg.Any<CancellationToken>()).Returns<Task<Stream>>(_ => throw failure);
var element = new WatermarkElement(
RemoteWatermarkOptions(),
fetcher,
Substitute.For<ILogger>());
// must not throw -- a killed graphics element must never propagate into the stream
await element.InitializeAsync(Context(), CancellationToken.None);
element.IsFinished.ShouldBeTrue();
}
// the counterpart: caller cancellation is not a fetch failure, but it must still not escape
// into the streaming pipeline as an unhandled exception
[Test]
public async Task Should_Disable_The_Watermark_When_The_Caller_Cancels()
{
var fetcher = Substitute.For<IRemoteImageFetcher>();
fetcher.Fetch(Arg.Any<Uri>(), Arg.Any<CancellationToken>())
.Returns<Task<Stream>>(_ => throw new OperationCanceledException());
var element = new WatermarkElement(RemoteWatermarkOptions(), fetcher, Substitute.For<ILogger>());
await element.InitializeAsync(Context(), CancellationToken.None);
element.IsFinished.ShouldBeTrue();
}
// a remote path really does route to the fetcher -- without this the tests above would pass
// even if LoadImage stopped recognising http(s) urls
[Test]
public async Task Should_Route_A_Remote_Path_Through_The_Fetcher()
{
var fetcher = Substitute.For<IRemoteImageFetcher>();
fetcher.Fetch(Arg.Any<Uri>(), Arg.Any<CancellationToken>())
.Returns<Task<Stream>>(_ => throw new TimeoutException());
var element = new WatermarkElement(RemoteWatermarkOptions(), fetcher, Substitute.For<ILogger>());
await element.InitializeAsync(Context(), CancellationToken.None);
await fetcher.Received(1).Fetch(new Uri(RemoteLogo), Arg.Any<CancellationToken>());
}
// ...and a local path must not touch the network at all
[Test]
public async Task Should_Not_Use_The_Fetcher_For_A_Local_Path()
{
var fetcher = Substitute.For<IRemoteImageFetcher>();
var options = new WatermarkOptions(Watermark(), "/no/such/logo.png", Option<int>.None);
var element = new WatermarkElement(options, fetcher, Substitute.For<ILogger>());
await element.InitializeAsync(Context(), CancellationToken.None);
await fetcher.DidNotReceive().Fetch(Arg.Any<Uri>(), Arg.Any<CancellationToken>());
element.IsFinished.ShouldBeTrue();
}
// --- the RETENTION budget is wired in, and is remote-only (M4 from re-review) ---
//
// These two differ ONLY in the scale percent, so together they detect deletion of the
// `if (isRemoteUri) EnsureScaledFramesAffordable(...)` call site: without it the first case
// would succeed. The source is trivial to decode (300 x 64x64 = 1.2 MP, well inside the decode
// budget) but retains ~2.5 GB of SKBitmap once every frame is scaled to 1080p.
[Test]
public async Task Should_Disable_The_Watermark_When_Scaled_Frames_Blow_The_Retention_Budget()
{
var element = new WatermarkElement(
RemoteWatermarkOptions(widthPercent: 100),
FetcherReturning(Apng(64, 64, 300)),
Substitute.For<ILogger>());
await element.InitializeAsync(Context(), CancellationToken.None);
element.IsFinished.ShouldBeTrue();
}
[Test]
public async Task Should_Keep_The_Watermark_When_The_Same_Animation_Is_Scaled_Small()
{
var element = new WatermarkElement(
RemoteWatermarkOptions(widthPercent: 10),
FetcherReturning(Apng(64, 64, 300)),
Substitute.For<ILogger>());
await element.InitializeAsync(Context(), CancellationToken.None);
element.IsFinished.ShouldBeFalse();
}
private static IRemoteImageFetcher FetcherReturning(Stream stream)
{
var fetcher = Substitute.For<IRemoteImageFetcher>();
fetcher.Fetch(Arg.Any<Uri>(), Arg.Any<CancellationToken>()).Returns(stream);
return fetcher;
}
private static MemoryStream Apng(int width, int height, int frames)
{
using var image = new Image<Rgba32>(width, height);
for (var i = 1; i < frames; i++)
{
image.Frames.CreateFrame();
}
var stream = new MemoryStream();
image.Save(stream, new PngEncoder { ColorType = PngColorType.RgbWithAlpha });
stream.Position = 0;
return stream;
}
private static WatermarkOptions RemoteWatermarkOptions(double widthPercent = 10) =>
new(Watermark(widthPercent), RemoteLogo, Option<int>.None);
private static ChannelWatermark Watermark(double widthPercent = 10) =>
new()
{
Name = "test",
Mode = ChannelWatermarkMode.Permanent,
Location = WatermarkLocation.BottomRight,
Size = WatermarkSize.Scaled,
WidthPercent = widthPercent,
HorizontalMarginPercent = 5,
VerticalMarginPercent = 5,
Opacity = 100
};
private static GraphicsEngineContext Context() =>
new(
"1",
null,
[],
[],
new Resolution { Width = 1920, Height = 1080 },
new Resolution { Width = 1920, Height = 1080 },
new FrameRate("30"),
DateTimeOffset.UnixEpoch,
DateTimeOffset.UnixEpoch,
TimeSpan.Zero,
TimeSpan.FromMinutes(1),
TimeSpan.FromMinutes(1));
}