TASK-039-007: Split TurboHttp.Tests/Security/

Author: st0o0

.maggus/COMMIT.md

@@ -1,17 +1,23 @@
-# TASK-038-001: Fix RedirectBidiStage — Transaction Guard + _inFlightCount Decrement
+# TASK-039-007: Split TurboHttp.Tests/Security/ — All Files ≤500 Lines
 
-Added `_redirectTransactionActive` guard to `RedirectBidiStage` and corrected `_inFlightCount`
-decrement ordering across redirect hops so that `TryCompleteIfDone` Case 2 fires reliably.
+Split 5 oversized Security test files into companion files so every file in
+`src/TurboHttp.Tests/Security/` is ≤500 lines. No `NN_` prefix added (Security/
+folder convention unchanged).
 
-- Added `_redirectTransactionActive` bool field to `Logic` (mirrors `RetryBidiStage` pattern)
-- Redirect path in `onPush(InResponse)` now uses atomic transaction:
-  enqueue → TryEmitRedirect → `_inFlightCount--` → TryPullResponse → guard off → TryCompleteIfDone
-- `TryCompleteIfDone()` returns early when `_redirectTransactionActive == true`, preventing
-  premature Out1 completion mid-redirect transaction
-- Catch blocks for `ProtocolDowngrade` and `MaxRedirects` do NOT set the guard (non-redirect paths)
-- Added `BidiFlowFeedbackRaceTests.cs` with 4 regression tests (BidiLoop-001 through BidiLoop-004)
+**Trimmed originals:**
+- `HpackBombTests.cs` 852 → 500 lines (QPACK + cross-cutting section extracted)
+- `Http11FuzzTests.cs` 669 → 410 lines (Categories 6–9 extracted)
+- `Http2FrameFuzzTests.cs` 593 → 378 lines (Categories 7–10 extracted)
+- `TlsSecurityTests.cs` 526 → 275 lines (sensitive header + TLS options section extracted)
+- `UriSecurityTests.cs` 514 → 359 lines (Sections 7–11 extracted)
+
+**New companion files:**
+- `QpackSecurityTests.cs` (374 lines) — SEC-QPACK-001..013 + SEC-HPACK-019..022
+- `Http11FuzzBodyTests.cs` (369 lines) — RFC9112-FUZZ-MIX-001, LCL-001, CCL-001, FRG-001
+- `Http2FrameFuzzTests2.cs` (280 lines) — RFC9113-FUZZ-OVS-001, ALT-001, SET-001, WUZ-001
+- `TlsOptionsTests.cs` (273 lines) — SEC-TLS-018..032
+- `UriRedirectTests.cs` (195 lines) — SEC-URI-019..026
 
 Verified:
 - Build: 0 errors, 0 warnings
-- Stream tests: 835/835 pass (BidiLoop-001..004 all green)
-- Roslyn get_diagnostics on RedirectBidiStage.cs: 0 errors
+- Security tests: 325/325 pass

.maggus/features/feature_039.md

@@ -347,11 +347,11 @@ rmdir src/TurboHttp.Tests/Configuration
 Note: Security/ has NO `NN_` prefix convention. New file names use descriptive names only.
 
 **Acceptance Criteria:**
-- [ ] All files in `src/TurboHttp.Tests/Security/` are ≤ 500 lines
-- [ ] No `NN_` prefix added (Security/ folder convention unchanged)
-- [ ] `dotnet build --configuration Release ./src/TurboHttp.sln` succeeds
-- [ ] `dotnet test --project src/TurboHttp.Tests/TurboHttp.Tests.csproj -- --filter-namespace "TurboHttp.Tests.Security"` passes
-- [ ] Unit tests are written and successful
+- [x] All files in `src/TurboHttp.Tests/Security/` are ≤ 500 lines
+- [x] No `NN_` prefix added (Security/ folder convention unchanged)
+- [x] `dotnet build --configuration Release ./src/TurboHttp.sln` succeeds
+- [x] `dotnet test --project src/TurboHttp.Tests/TurboHttp.Tests.csproj -- --filter-namespace "TurboHttp.Tests.Security"` passes
+- [x] Unit tests are written and successful
 
 ---
 

src/TurboHttp.Benchmarks/HttpClientComparativeBenchmarks.cs

@@ -1,4 +1,5 @@
 using BenchmarkDotNet.Attributes;
+using TurboHttp.Benchmarks.Internal;
 
 namespace TurboHttp.Benchmarks;
 

…rboHttp.Benchmarks/BenchmarkBaseClass.cs …enchmarks/Internal/BenchmarkBaseClass.cssrc/TurboHttp.Benchmarks/BenchmarkBaseClass.cs renamed to src/TurboHttp.Benchmarks/Internal/BenchmarkBaseClass.cs src/TurboHttp.Benchmarks/BenchmarkBaseClass.cs renamed to src/TurboHttp.Benchmarks/Internal/BenchmarkBaseClass.cs

@@ -1,6 +1,6 @@
 using BenchmarkDotNet.Attributes;
 
-namespace TurboHttp.Benchmarks;
+namespace TurboHttp.Benchmarks.Internal;
 
 /// <summary>
 /// Shared base class for all comparative benchmarks. Provides common
@@ -13,7 +13,7 @@ public abstract class BenchmarkBaseClass
 {
     /// <summary>Static shared Kestrel server instance, initialized once per test run.</summary>
     private static BenchmarkServer? _sharedServer;
-    private static readonly object _serverLock = new();
+    private static readonly Lock _serverLock = new();
     private static int _serverRefCount;
 
     /// <summary>Number of concurrent requests to issue per benchmark iteration.</summary>

….Benchmarks/BenchmarkComparisonReport.cs …ks/Internal/BenchmarkComparisonReport.cssrc/TurboHttp.Benchmarks/BenchmarkComparisonReport.cs renamed to src/TurboHttp.Benchmarks/Internal/BenchmarkComparisonReport.cs src/TurboHttp.Benchmarks/BenchmarkComparisonReport.cs renamed to src/TurboHttp.Benchmarks/Internal/BenchmarkComparisonReport.cs

@@ -1,6 +1,6 @@
 using System.Text;
 
-namespace TurboHttp.Benchmarks;
+namespace TurboHttp.Benchmarks.Internal;
 
 /// <summary>
 /// Represents the measured result of a single benchmark scenario.

…/TurboHttp.Benchmarks/BenchmarkServer.cs …p.Benchmarks/Internal/BenchmarkServer.cssrc/TurboHttp.Benchmarks/BenchmarkServer.cs renamed to src/TurboHttp.Benchmarks/Internal/BenchmarkServer.cs src/TurboHttp.Benchmarks/BenchmarkServer.cs renamed to src/TurboHttp.Benchmarks/Internal/BenchmarkServer.cs

@@ -7,7 +7,7 @@
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Logging;
 
-namespace TurboHttp.Benchmarks;
+namespace TurboHttp.Benchmarks.Internal;
 
 /// <summary>
 /// Minimal Kestrel test server for benchmarking both HttpClient and TurboHttp.

src/TurboHttp.Benchmarks/Config.cs …/TurboHttp.Benchmarks/Internal/Config.cssrc/TurboHttp.Benchmarks/Config.cs renamed to src/TurboHttp.Benchmarks/Internal/Config.cs src/TurboHttp.Benchmarks/Config.cs renamed to src/TurboHttp.Benchmarks/Internal/Config.cs

@@ -5,7 +5,7 @@
 using BenchmarkDotNet.Reports;
 using BenchmarkDotNet.Running;
 
-namespace TurboHttp.Benchmarks;
+namespace TurboHttp.Benchmarks.Internal;
 
 public class RequestsPerSecondColumn : IColumn
 {

src/TurboHttp.Benchmarks/Internal/SummaryExtractor.cs

@@ -0,0 +1,75 @@
+using BenchmarkDotNet.Reports;
+using BenchmarkDotNet.Running;
+
+namespace TurboHttp.Benchmarks.Internal;
+
+/// <summary>
+/// Extracts <see cref="BenchmarkResult"/> instances directly from a BenchmarkDotNet
+/// <see cref="Summary"/>, bypassing the CSV artifact round-trip.
+/// </summary>
+public static class SummaryExtractor
+{
+    /// <summary>
+    /// Converts all completed reports in <paramref name="summary"/> to
+    /// <see cref="BenchmarkResult"/> instances. Reports with missing statistics
+    /// (cancelled or errored runs) are silently skipped.
+    /// </summary>
+    public static IReadOnlyList<BenchmarkResult> Extract(Summary summary)
+    {
+        var results = new List<BenchmarkResult>(summary.Reports.Length);
+
+        foreach (var report in summary.Reports)
+        {
+            var statistics = report.ResultStatistics;
+            if (statistics is null)
+            {
+                continue;
+            }
+
+            var name = BuildName(report.BenchmarkCase);
+            var allocBytes = report.GcStats.GetBytesAllocatedPerOperation(report.BenchmarkCase) ?? 0L;
+
+            results.Add(new BenchmarkResult(
+                name,
+                statistics.Mean,
+                statistics.Percentiles.P50,
+                statistics.Percentiles.P95,
+                statistics.Percentiles.Percentile(99),
+                allocBytes));
+        }
+
+        return results;
+    }
+
+    /// <summary>
+    /// Builds a scenario name matching the format used by the CSV-based pipeline:
+    /// <c>{Method} / CL={ConcurrencyLevel} / {PayloadType} / HTTP {HttpVersion}</c>.
+    /// </summary>
+    private static string BuildName(BenchmarkCase benchmarkCase)
+    {
+        var method = benchmarkCase.Descriptor.WorkloadMethod.Name;
+        var concurrency = GetParam(benchmarkCase, "ConcurrencyLevel") ?? "1";
+        var payload = GetParam(benchmarkCase, "PayloadType") ?? "light";
+        var version = GetParam(benchmarkCase, "HttpVersion") ?? "1.1";
+
+        return $"{method} / CL={concurrency} / {payload} / HTTP {version}";
+    }
+
+    private static string? GetParam(BenchmarkCase benchmarkCase, string paramName)
+        => benchmarkCase.Parameters.Items
+            .FirstOrDefault(p => p.Name == paramName)
+            ?.Value?.ToString();
+}
+
+/// <summary>
+/// Extension helpers for <see cref="Summary"/>.
+/// </summary>
+public static class SummaryExtensions
+{
+    /// <summary>
+    /// Returns <see langword="true"/> when <paramref name="summary"/> contains at least
+    /// one benchmark case belonging to <typeparamref name="T"/>.
+    /// </summary>
+    public static bool HasBenchmarksOf<T>(this Summary summary)
+        => summary.BenchmarksCases.Any(c => c.Descriptor.Type == typeof(T));
+}