*** Settings ***
Documentation     Integration tests for SEC1 security hardening: eval()/exec() removal
...               from stream_router.py, named operation and transform registries.
...               Covers commit 548a09f stage SEC1.1-SEC1.3.
Resource          ${CURDIR}/common.resource
Suite Setup       Setup Test Environment
Suite Teardown    Cleanup Test Environment

*** Variables ***
${HELPER_SCRIPT}    robot/helper_security_eval.py

*** Test Cases ***
Named Operations Execute Correctly
    [Documentation]    Verify built-in named operations (uppercase, strip, lowercase) work
    [Tags]    security    stream    operations
    ${result}=    Run Process    ${PYTHON}    ${HELPER_SCRIPT}    named-operations    cwd=${WORKSPACE}
    Should Be Equal As Integers    ${result.rc}    0
    Should Contain    ${result.stdout}    named-operations-ok

Code Blocks Are Rejected With StreamRoutingError
    [Documentation]    Verify code blocks with arbitrary Python are rejected (no eval/exec)
    [Tags]    security    stream    injection
    ${result}=    Run Process    ${PYTHON}    ${HELPER_SCRIPT}    code-blocks-rejected    cwd=${WORKSPACE}
    Should Be Equal As Integers    ${result.rc}    0
    Should Contain    ${result.stdout}    code-blocks-rejected-ok

Custom Operation Registration And Execution
    [Documentation]    Verify custom operations can be registered and executed safely
    [Tags]    security    stream    registration
    ${result}=    Run Process    ${PYTHON}    ${HELPER_SCRIPT}    custom-operation    cwd=${WORKSPACE}
    Should Be Equal As Integers    ${result.rc}    0
    Should Contain    ${result.stdout}    custom-operation-ok

Unregistered Transform Expression Rejected
    [Documentation]    Verify unregistered lambda/fn transform expressions are rejected
    [Tags]    security    stream    transform
    ${result}=    Run Process    ${PYTHON}    ${HELPER_SCRIPT}    unregistered-transform    cwd=${WORKSPACE}
    Should Be Equal As Integers    ${result.rc}    0
    Should Contain    ${result.stdout}    unregistered-transform-rejected-ok

Registered Transform Works After Registration
    [Documentation]    Verify named transforms can be registered and execute correctly
    [Tags]    security    stream    transform    registration
    ${result}=    Run Process    ${PYTHON}    ${HELPER_SCRIPT}    registered-transform    cwd=${WORKSPACE}
    Should Be Equal As Integers    ${result.rc}    0
    Should Contain    ${result.stdout}    registered-transform-ok

Identity Is Default Operation
    [Documentation]    Verify identity operation is default when none specified
    [Tags]    security    stream    identity
    ${result}=    Run Process    ${PYTHON}    ${HELPER_SCRIPT}    identity-default    cwd=${WORKSPACE}
    Should Be Equal As Integers    ${result.rc}    0
    Should Contain    ${result.stdout}    identity-default-ok