Updated CTS flow and added a rotating cache for NTStatus and HResults

Author: jschick04

src/EventLogExpert.Eventing.Tests/EventResolvers/EventResolverBaseTests.cs

@@ -1137,19 +1137,34 @@ public void ResolveEvent_WithNormalMismatch_ShouldStillReject()
     public void ResolveEvent_WithNtStatusOutType_ShouldFallbackToHexForUnknownCodes()
     {
         // Arrange - Unknown NTStatus should show hex
+        const uint unknownCode = 0xDEADBEEF;
+
         var (details, eventRecord) = EventUtils.CreateModernEvent(
             description: "Status: %1",
             template: """<template><data name="Status" inType="win:UInt32" outType="win:NTStatus"/></template>""",
-            properties: [(uint)0xDEADBEEF]);
+            properties: [unknownCode]);
 
         var resolver = new TestEventResolver([details]);
 
         // Act
         var displayEvent = resolver.ResolveEvent(eventRecord);
 
-        // Assert
+        // Assert — if the OS resolves this code to a message, the description
+        // won't contain the hex fallback. Only assert hex when the system has
+        // no message for this code (avoids environment-dependent failures).
         Assert.NotNull(displayEvent);
-        Assert.Contains("0xDEADBEEF", displayEvent.Description);
+
+        var ntStatusMessage = NativeMethods.FormatNtStatusMessage(unknownCode);
+        var systemMessage = NativeMethods.FormatSystemMessage(unknownCode);
+
+        if (ntStatusMessage is null && systemMessage is null)
+        {
+            Assert.Contains("0xDEADBEEF", displayEvent.Description);
+        }
+        else
+        {
+            Assert.NotNull(displayEvent.Description);
+        }
     }
 
     [Fact]

src/EventLogExpert.Eventing.Tests/Helpers/ResolverMethodsTests.cs

@@ -0,0 +1,72 @@
+// // Copyright (c) Microsoft Corporation.
+// // Licensed under the MIT License.
+
+using EventLogExpert.Eventing.Helpers;
+
+namespace EventLogExpert.Eventing.Tests.Helpers;
+
+public sealed class ResolverMethodsTests
+{
+    [Fact]
+    public void GetErrorMessage_ShouldReturnConsistentResults()
+    {
+        // Arrange — use a well-known HRESULT (ERROR_SUCCESS = 0)
+        const uint errorSuccess = 0;
+
+        // Act
+        var result1 = ResolverMethods.GetErrorMessage(errorSuccess);
+        var result2 = ResolverMethods.GetErrorMessage(errorSuccess);
+
+        // Assert — same string returned (cached)
+        Assert.NotNull(result1);
+        Assert.Equal(result1, result2);
+    }
+
+    [Fact]
+    public void GetErrorMessage_WhenUnknownCode_ShouldReturnHexFallback()
+    {
+        // Arrange — use a code unlikely to have a system message
+        const uint unknownCode = 0xDEADBEEF;
+
+        // Act
+        var result = ResolverMethods.GetErrorMessage(unknownCode);
+
+        // Assert — if the OS doesn't resolve this code, we get the hex fallback.
+        // On some OS versions/locales FormatMessage may resolve it, so only assert
+        // the hex representation when the system has no message for this code.
+        var systemMessage = NativeMethods.FormatSystemMessage(unknownCode);
+        var ntStatusMessage = NativeMethods.FormatNtStatusMessage(unknownCode);
+
+        if (systemMessage is null && ntStatusMessage is null)
+        {
+            Assert.Equal("0xDEADBEEF", result);
+        }
+        else
+        {
+            Assert.NotNull(result);
+            Assert.NotEqual(string.Empty, result);
+        }
+    }
+
+    [Fact]
+    public void GetNtStatusMessage_ShouldReturnConsistentResults()
+    {
+        // Arrange — STATUS_SUCCESS = 0
+        const uint statusSuccess = 0;
+
+        // Act
+        var result1 = ResolverMethods.GetNtStatusMessage(statusSuccess);
+        var result2 = ResolverMethods.GetNtStatusMessage(statusSuccess);
+
+        // Assert
+        Assert.NotNull(result1);
+        Assert.Equal(result1, result2);
+    }
+
+    [Fact]
+    public void MaxCacheSize_ShouldBeReasonableBound()
+    {
+        // Assert — the cache limit is the expected constant
+        Assert.Equal(4096, ResolverMethods.MaxCacheSize);
+    }
+}

src/EventLogExpert.Eventing/Helpers/ResolverMethods.cs

@@ -7,8 +7,10 @@ namespace EventLogExpert.Eventing.Helpers;
 
 internal static class ResolverMethods
 {
-    private static readonly ConcurrentDictionary<uint, string> s_hResultCache = [];
-    private static readonly ConcurrentDictionary<uint, string> s_ntStatusCache = [];
+    internal const int MaxCacheSize = 4096;
+
+    private static ConcurrentDictionary<uint, string> s_hResultCache = new();
+    private static ConcurrentDictionary<uint, string> s_ntStatusCache = new();
 
     /// <summary>
     ///     Resolves an HRESULT or Win32 error code to a human-readable string.
@@ -17,15 +19,44 @@ internal static class ResolverMethods
     ///     Results are cached to avoid repeated P/Invoke calls.
     /// </summary>
     internal static string GetErrorMessage(uint hResult) =>
-        s_hResultCache.GetOrAdd(hResult, static code =>
+        GetOrAddBounded(ref s_hResultCache, hResult, static code =>
             NativeMethods.FormatSystemMessage(code) ??
             NativeMethods.FormatNtStatusMessage(code) ??
             $"0x{code:X8}");
 
     /// <summary>Resolves an NTSTATUS code to a human-readable string.</summary>
     internal static string GetNtStatusMessage(uint ntStatus) =>
-        s_ntStatusCache.GetOrAdd(ntStatus, static status =>
+        GetOrAddBounded(ref s_ntStatusCache, ntStatus, static status =>
             NativeMethods.FormatNtStatusMessage(status) ??
             NativeMethods.FormatSystemMessage(status) ??
             $"0x{status:X8}");
+
+    /// <summary>
+    ///     Bounded cache lookup with atomic swap eviction. On a cache hit the entry is returned
+    ///     immediately regardless of cache size. On a miss, if the cache has reached
+    ///     <see cref="MaxCacheSize"/> the entire dictionary is atomically swapped with a fresh
+    ///     instance (only one thread performs the swap) before inserting the new entry.
+    /// </summary>
+    private static string GetOrAddBounded(
+        ref ConcurrentDictionary<uint, string> cache,
+        uint key,
+        Func<uint, string> factory)
+    {
+        var snapshot = Volatile.Read(ref cache);
+
+        if (snapshot.TryGetValue(key, out var cached))
+        {
+            return cached;
+        }
+
+        if (snapshot.Count < MaxCacheSize)
+        {
+            return Volatile.Read(ref cache).GetOrAdd(key, factory);
+        }
+
+        var replacement = new ConcurrentDictionary<uint, string>();
+        Interlocked.CompareExchange(ref cache, replacement, snapshot);
+
+        return Volatile.Read(ref cache).GetOrAdd(key, factory);
+    }
 }

src/EventLogExpert.UI.Tests/Store/EventLog/EventLogEffectsTests.cs

@@ -138,6 +138,40 @@ public async Task HandleCloseLog_ShouldRemoveLogAndDispatchCloseAction()
             a.LogId == logId));
     }
 
+    [Fact]
+    public async Task HandleCloseLog_WhenLastLog_ShouldClearResolverCache()
+    {
+        // Arrange — state has no active logs (reducer already removed the last one)
+        var logId = EventLogId.Create();
+        var (effects, mockDispatcher, mockLogWatcher, mockResolverCache, _) = CreateEffectsWithServices();
+        var action = new EventLogAction.CloseLog(logId, Constants.LogNameTestLog);
+
+        // Act
+        await effects.HandleCloseLog(action, mockDispatcher);
+
+        // Assert
+        mockResolverCache.Received(1).ClearAll();
+    }
+
+    [Fact]
+    public async Task HandleCloseLog_WhenOtherLogsRemain_ShouldNotClearResolverCache()
+    {
+        // Arrange — state still has another active log
+        var logData = new EventLogData(Constants.LogNameLog1, PathType.LogName, []);
+        var activeLogs = ImmutableDictionary<string, EventLogData>.Empty
+            .Add(Constants.LogNameLog1, logData);
+
+        var (effects, mockDispatcher, _, mockResolverCache, _) = CreateEffectsWithServices(activeLogs: activeLogs);
+        var closingLogId = EventLogId.Create();
+        var action = new EventLogAction.CloseLog(closingLogId, Constants.LogNameTestLog);
+
+        // Act
+        await effects.HandleCloseLog(action, mockDispatcher);
+
+        // Assert
+        mockResolverCache.DidNotReceive().ClearAll();
+    }
+
     [Fact]
     public async Task HandleLoadEvents_ShouldFilterAndDispatchUpdateTable()
     {

src/EventLogExpert.UI.Tests/Store/EventLog/EventLogStoreTests.cs

@@ -559,7 +559,7 @@ public void ReduceCloseLog_ShouldRemoveSpecifiedLog()
     }
 
     [Fact]
-    public void ReduceLoadEvents_ShouldUpdateLogWithEvents()
+    public void ReduceLoadEvents_ShouldIsolateStateFromOriginalList()
     {
         // Arrange
         var logData = new EventLogData(Constants.LogNameTestLog, PathType.LogName, []);
@@ -576,12 +576,16 @@ public void ReduceLoadEvents_ShouldUpdateLogWithEvents()
         // Act
         var newState = EventLogReducers.ReduceLoadEvents(state, action);
 
-        // Assert
+        // ImmutableArray is inherently isolated — creating a new one doesn't affect the state
+        var extendedEvents = events.Add(EventUtils.CreateTestEvent(300));
+
+        // Assert - state should not reflect the extension
         Assert.Equal(2, newState.ActiveLogs[Constants.LogNameTestLog].Events.Count);
+        Assert.Equal(3, extendedEvents.Length);
     }
 
     [Fact]
-    public void ReduceLoadEvents_ShouldIsolateStateFromOriginalList()
+    public void ReduceLoadEvents_ShouldUpdateLogWithEvents()
     {
         // Arrange
         var logData = new EventLogData(Constants.LogNameTestLog, PathType.LogName, []);
@@ -598,12 +602,105 @@ public void ReduceLoadEvents_ShouldIsolateStateFromOriginalList()
         // Act
         var newState = EventLogReducers.ReduceLoadEvents(state, action);
 
-        // ImmutableArray is inherently isolated — creating a new one doesn't affect the state
-        var extendedEvents = events.Add(EventUtils.CreateTestEvent(300));
-
-        // Assert - state should not reflect the extension
+        // Assert
         Assert.Equal(2, newState.ActiveLogs[Constants.LogNameTestLog].Events.Count);
-        Assert.Equal(3, extendedEvents.Length);
+    }
+
+    [Fact]
+    public void ReduceLoadEvents_WhenLogIdDoesNotMatch_ShouldReturnStateUnchanged()
+    {
+        // Arrange — open a log, then create stale logData with a different ID
+        var state = new EventLogState();
+
+        state = EventLogReducers.ReduceOpenLog(state,
+            new EventLogAction.OpenLog(Constants.LogNameTestLog, PathType.LogName));
+
+        // Create stale logData with a new ID (simulating a previous load instance)
+        var staleLogData = new EventLogData(Constants.LogNameTestLog, PathType.LogName, []);
+        var events = ImmutableArray.Create(EventUtils.CreateTestEvent(100));
+
+        // Act — stale LoadEvents with mismatched ID
+        var newState = EventLogReducers.ReduceLoadEvents(state, new EventLogAction.LoadEvents(staleLogData, events));
+
+        // Assert — state unchanged, original log preserved with its ID and empty events
+        var originalId = state.ActiveLogs[Constants.LogNameTestLog].Id;
+        Assert.NotEqual(originalId, staleLogData.Id);
+        Assert.Equal(originalId, newState.ActiveLogs[Constants.LogNameTestLog].Id);
+        Assert.Empty(newState.ActiveLogs[Constants.LogNameTestLog].Events);
+    }
+
+    [Fact]
+    public void ReduceLoadEvents_WhenLogIdMatches_ShouldUpdateLog()
+    {
+        // Arrange
+        var state = new EventLogState();
+
+        state = EventLogReducers.ReduceOpenLog(state,
+            new EventLogAction.OpenLog(Constants.LogNameTestLog, PathType.LogName));
+
+        var logData = state.ActiveLogs[Constants.LogNameTestLog];
+        var events = ImmutableArray.Create(EventUtils.CreateTestEvent(100));
+
+        // Act — LoadEvents with matching ID
+        var newState = EventLogReducers.ReduceLoadEvents(state, new EventLogAction.LoadEvents(logData, events));
+
+        // Assert — events applied
+        Assert.Single(newState.ActiveLogs[Constants.LogNameTestLog].Events);
+    }
+
+    [Fact]
+    public void ReduceLoadEvents_WhenLogNotInActiveLogs_ShouldReturnStateUnchanged()
+    {
+        // Arrange — no logs open
+        var state = new EventLogState();
+        var logData = new EventLogData(Constants.LogNameTestLog, PathType.LogName, []);
+        var events = ImmutableArray.Create(EventUtils.CreateTestEvent(100));
+
+        // Act — stale LoadEvents arrives for a closed log
+        var newState = EventLogReducers.ReduceLoadEvents(state, new EventLogAction.LoadEvents(logData, events));
+
+        // Assert — state unchanged, log NOT resurrected
+        Assert.Same(state, newState);
+        Assert.Empty(newState.ActiveLogs);
+    }
+
+    [Fact]
+    public void ReduceLoadEventsPartial_WhenLogIdDoesNotMatch_ShouldReturnStateUnchanged()
+    {
+        // Arrange
+        var state = new EventLogState();
+
+        state = EventLogReducers.ReduceOpenLog(state,
+            new EventLogAction.OpenLog(Constants.LogNameTestLog, PathType.LogName));
+
+        var staleLogData = new EventLogData(Constants.LogNameTestLog, PathType.LogName, []);
+        var events = ImmutableArray.Create(EventUtils.CreateTestEvent(100));
+
+        // Act — stale partial with mismatched ID
+        var newState = EventLogReducers.ReduceLoadEventsPartial(state,
+            new EventLogAction.LoadEventsPartial(staleLogData, events));
+
+        // Assert — state unchanged, original log preserved with its ID
+        var originalId = state.ActiveLogs[Constants.LogNameTestLog].Id;
+        Assert.NotEqual(originalId, staleLogData.Id);
+        Assert.Equal(originalId, newState.ActiveLogs[Constants.LogNameTestLog].Id);
+        Assert.Empty(newState.ActiveLogs[Constants.LogNameTestLog].Events);
+    }
+
+    [Fact]
+    public void ReduceLoadEventsPartial_WhenLogNotInActiveLogs_ShouldReturnStateUnchanged()
+    {
+        // Arrange — no logs open
+        var state = new EventLogState();
+        var logData = new EventLogData(Constants.LogNameTestLog, PathType.LogName, []);
+        var events = ImmutableArray.Create(EventUtils.CreateTestEvent(100));
+
+        // Act
+        var newState = EventLogReducers.ReduceLoadEventsPartial(state,
+            new EventLogAction.LoadEventsPartial(logData, events));
+
+        // Assert
+        Assert.Same(state, newState);
     }
 
     [Fact]