test(project): Add tests for cross project source file modifications

Author: RandomByte

packages/project/test/fixtures/application.a/dependency-race-condition-task.js

@@ -0,0 +1,61 @@
+const {readFile, writeFile} = require("fs/promises");
+const path = require("path");
+
+/**
+ * Custom task that verifies the frozen CAS reader protects against
+ * cross-project dependency source race conditions.
+ *
+ * Uses data.json — an untransformed source file (no placeholders, not processed by
+ * minify/replaceCopyright/replaceVersion). This is critical because transformed files
+ * are written to stage writers which have higher priority than both the frozen reader
+ * and the filesystem reader, making disk modifications invisible regardless.
+ *
+ * Flow:
+ * 1. Read library.d's data.json via the dependency reader (CAS-backed)
+ * 2. Overwrite the file on disk with different content
+ * 3. Re-read via the dependency reader
+ * 4. Assert the content is still the original (CAS-served)
+ * 5. Restore the original file on disk
+ */
+module.exports = async function ({taskUtil}) {
+	const libDProject = taskUtil.getProject("library.d");
+	const libDReader = libDProject.getReader();
+
+	// Step 1: Read the original content via the dependency reader (CAS-backed)
+	// data.json is untransformed (no placeholders, not a .js file subject to minification)
+	// so it is only served by the frozen CAS reader or the filesystem reader
+	const resourcePath = "/resources/library/d/data.json";
+	const originalResource = await libDReader.byPath(resourcePath);
+	if (!originalResource) {
+		throw new Error(`Resource ${resourcePath} not found via dependency reader`);
+	}
+	const originalContent = await originalResource.getString();
+
+	// Step 2: Overwrite the file on disk
+	const sourcePath = libDProject.getSourcePath();
+	const diskFilePath = path.join(sourcePath, "library", "d", "data.json");
+	const diskOriginalContent = await readFile(diskFilePath, {encoding: "utf8"});
+	await writeFile(diskFilePath, JSON.stringify({key: "modified-by-race-condition"}));
+
+	try {
+		// Step 3: Re-read via the dependency reader — should still return CAS-frozen content
+		// Without the frozen reader, this would read the modified disk content
+		const reReadResource = await libDReader.byPath(resourcePath);
+		if (!reReadResource) {
+			throw new Error(`Resource ${resourcePath} not found on re-read via dependency reader`);
+		}
+		const reReadContent = await reReadResource.getString();
+
+		// Step 4: Assert the content is still the original (not modified disk content)
+		if (reReadContent !== originalContent) {
+			throw new Error(
+				"Frozen source reader protection failed: dependency reader returned modified disk content " +
+				"instead of the original CAS-frozen content. " +
+				`Expected: ${JSON.stringify(originalContent)}, Got: ${JSON.stringify(reReadContent)}`
+			);
+		}
+	} finally {
+		// Step 5: Always restore the original file on disk
+		await writeFile(diskFilePath, diskOriginalContent);
+	}
+};

packages/project/test/fixtures/application.a/node_modules/library.d/main/src/library/d/data.json

@@ -0,0 +1,17 @@
+---
+specVersion: "5.0"
+type: application
+metadata:
+  name: application.a
+builder:
+  customTasks:
+    - name: dependency-race-condition-task
+      afterTask: escapeNonAsciiCharacters
+---
+specVersion: "5.0"
+kind: extension
+type: task
+metadata:
+  name: dependency-race-condition-task
+task:
+  path: dependency-race-condition-task.js

packages/project/test/fixtures/application.a/ui5-dependency-race-condition.yaml

@@ -0,0 +1 @@
+{"key": "original-value"}

packages/project/test/fixtures/library.d/main/src/library/d/data.json

@@ -2349,6 +2349,39 @@ test.serial("Build race condition: file modified during active build", async (t)
 	);
 });
 
+test.serial("Build dependency race condition: frozen source reader protects against filesystem changes",
+	async (t) => {
+		const fixtureTester = new FixtureTester(t, "application.a");
+		const destPath = fixtureTester.destPath;
+
+		// Build with dependency-race-condition custom task and all dependencies included.
+		// library.d is built first → its sources are frozen in CAS.
+		// Then application.a builds, running the custom task that:
+		//   1. Reads library.d's some.js via the dependency reader (CAS-backed)
+		//   2. Modifies some.js on disk
+		//   3. Re-reads via the dependency reader
+		//   4. Asserts the content is still the original CAS-frozen content (not modified disk)
+		//   5. Restores the file on disk
+		// If the frozen reader is not working, the custom task throws and the build fails.
+		await fixtureTester.buildProject({
+			graphConfig: {rootConfigPath: "ui5-dependency-race-condition.yaml"},
+			config: {destPath, cleanDest: true, dependencyIncludes: {includeAllDependencies: true}},
+			assertions: {
+				projects: {
+					"library.d": {},
+					"library.a": {},
+					"library.b": {},
+					"library.c": {},
+					"application.a": {}
+				}
+			}
+		});
+
+		// Sanity check: verify library.d's some.js exists in build output
+		const builtContent = await fs.readFile(`${destPath}/resources/library/d/some.js`, {encoding: "utf8"});
+		t.truthy(builtContent, "library.d some.js exists in build output");
+	});
+
 test.serial("Build with dependencies: Verify sap-ui-version.json generation and regeneration", async (t) => {
 	const fixtureTester = new FixtureTester(t, "application.a");
 	const destPath = fixtureTester.destPath;

packages/project/test/lib/build/ProjectBuilder.integration.js

@@ -1,5 +1,6 @@
 import test from "ava";
 import sinon from "sinon";
+import {createProxy, createResource} from "@ui5/fs/resourceFactory";
 import ProjectResources from "../../../lib/resources/ProjectResources.js";
 
 function createProjectResources({frozenSourceReader} = {}) {
@@ -108,3 +109,57 @@ test("initStages clears frozen source reader", (t) => {
 	t.truthy(reader2, "Reader returned after initStages");
 	t.not(reader1, reader2, "Reader was recreated after initStages");
 });
+
+test("Frozen source reader takes priority over filesystem source reader", async (t) => {
+	const resourcePath = "/resources/test/some.js";
+	const filesystemContent = "filesystem content";
+	const frozenCASContent = "frozen CAS content";
+
+	// Create a source reader that simulates the filesystem
+	const filesystemResource = createResource({path: resourcePath, string: filesystemContent});
+	const sourceReader = createProxy({
+		name: "Filesystem source reader",
+		listResourcePaths: () => [resourcePath],
+		getResource: async (virPath) => {
+			if (virPath === resourcePath) {
+				return filesystemResource;
+			}
+			return null;
+		}
+	});
+
+	// Create a frozen CAS reader with different content
+	const frozenResource = createResource({path: resourcePath, string: frozenCASContent});
+	const frozenReader = createProxy({
+		name: "Frozen CAS reader",
+		listResourcePaths: () => [resourcePath],
+		getResource: async (virPath) => {
+			if (virPath === resourcePath) {
+				return frozenResource;
+			}
+			return null;
+		}
+	});
+
+	const writer = {
+		byGlob: sinon.stub().resolves([]),
+		write: sinon.stub().resolves(),
+	};
+
+	const pr = new ProjectResources({
+		getName: () => "test.project",
+		getStyledReader: sinon.stub().returns(sourceReader),
+		createWriter: sinon.stub().returns(writer),
+		addReadersForWriter: sinon.stub(),
+		buildManifest: null,
+	});
+
+	pr.setFrozenSourceReader(frozenReader);
+
+	const reader = pr.getReader();
+	const result = await reader.byPath(resourcePath);
+	t.truthy(result, "Resource found via reader");
+	const content = await result.getString();
+	t.is(content, frozenCASContent,
+		"Frozen CAS reader takes priority over filesystem source reader");
+});