mirror of
https://github.com/OPCFoundation/UA-.NETStandard.git
synced 2026-10-20 00:31:32 +08:00
ecc-testing-fixes
27 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Marc Schier
|
0000513cde |
Pluggable user-identity provider model (#3807)
# Description Introduces a pluggable user-identity provider model covering all OPC UA Part 6 §6.5 mechanisms (Anonymous, UserName, X509, IssuedToken/JWT) on both client and server, with full `Microsoft.Extensions.DependencyInjection` integration, plus the Part 12 §9 `AuthorizationService` two-phase token-request flow **including refresh-token rotation**, the Part 12 §8 KeyCredential Push model, and a clean provider model for OPC 10000-12 §7.2 `ApplicationSelfAdmin`. The work is split across phase-by-phase commits so it can be reviewed independently; nothing here changes wire-level behaviour or forces existing applications to migrate. ### Documentation All under `Docs/`: - `IdentityProviders.md` — full developer guide: three-layer model, recipes, configuration reference, "what gets auto-wired" matrix, JWS algorithm table, identity-augmenters section, **"Implementing your own provider"** how-to subsections for Entra / OIDC / Windows / AspNetCore (sibling files merged in per review feedback). - `DependencyInjection.md` — `Identity` sections with `appsettings.json` examples, identity-extension matrix, `WithAuthorizationService` + `WithKeyCredentialPush` + `AddIdentityAugmenter` extensions documented. - `RoleBasedUserManagement.md` — claim-criteria callout describing `IIdentityClaims` probe surface. - `AuthorizationService.md` — Architecture diagram + `IAccessTokenProvider` conceptual narrative restored from master; modern `StartRequestToken` / `FinishRequestToken` flow leads; refresh-token recipe added. - `KeyCredentialService.md` — Push model + Pull vs Push vs Bridge decision matrix + Hybrid (Push + Pull) section; explicit experimental warning for the bridge. - `GDS.md` — KeyCredential Push, `StartRequestToken`, `GdsApplicationSelfAdminProvider`, **shipped Refresh-token support with rotation policy and audit semantics** all documented. - `MigrationGuide.md` — User Identity Providers section listing `[Obsolete]` markers + mechanical recipes; SelfAdmin migration via `IIdentityAugmenter`; `EnableRefreshTokens` default note. - `README.md` index entries. ## Checklist - [x] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [x] I ran **all** tests locally using the **UA.slnx** solution against at least .net **framework** and .net **10**, and all passed. - [x] I fixed **all** failing and flaky tests in the CI pipelines and **all** CodeQL warnings. - [x] I have addressed **all** PR feedback received. |
||
|
Marc Schier
|
eb40a59566 |
More format and diagnostic fixes (#3780)
Drive the solution to zero warnings / zero errors with analyzers on, promote the consistently-fixed rules to error, and lock in coverage on the only line of new logic. |
||
|
Marc Schier
|
889572472f |
Convert DataValue from class to readonly struct for further GC relief (#3796)
Convert `DataValue` from a mutable reference type (`class`) to a `readonly struct` to eliminate per-allocation GC pressure on every attribute read, subscription publish, and history sample. ### Key API changes (user-visible) | Before | After | Pattern | |---|---|---| | `class DataValue` | `readonly struct DataValue : INullable` | Foundation | | `Equals(DataValue?)` / `operator ==(DataValue?, DataValue?)` | `Equals(DataValue)` / `operator ==(DataValue, DataValue)` | Value semantics | | `IEncoder.WriteDataValue(string?, DataValue?)` | `IEncoder.WriteDataValue(string?, DataValue)` | Non-nullable wire API | | `IDecoder.ReadDataValue(...) -> DataValue?` | `IDecoder.ReadDataValue(...) -> DataValue` | Same | | `IDataChangeMonitoredItemQueue.PeekLast/Oldest()` | `TryPeekLastValue/Oldest(out DataValue)` | TryGet pattern | | `IAggregateCalculator.GetProcessedValue(bool)` | `TryGetProcessedValue(bool, out DataValue)` | Same | | `IUaPubSubDataStore.ReadPublishedDataItem(...)` | `TryReadPublishedDataItem(NodeId, uint, out DataValue)` | Same | | `Dictionary<uint, DataValue?>` (NodeCacheContext) | `Dictionary<uint, DataValue>` | Default + IsNull | | `IHistoryDataSource.FirstRaw/NextRaw` | `TryFirstRaw/TryNextRaw(out DataValue)` | TryGet pattern | | `NodeState.ReadAttribute(... DataValue)` | `NodeState.ReadAttribute(... ref DataValue)` | Sync mutation via ref | | `NodeState.ReadAttributeAsync(... DataValue)` | `NodeState.ReadAttributeAsync(...) -> ValueTask<(ServiceResult, DataValue)>` | Async return tuple | | `obj as DataValue` (heterogeneous Dictionary<string, object>) | `obj is DataValue dv ? dv : default(DataValue)` | Safe struct cast | | `Assert.That(dv, Is.Not.Null)` (tests) | `Assert.That(dv.IsNull, Is.False)` | Struct test pattern | | `[Obsolete] Value` setter, all property setters | Removed; use ctor or `With*()` | Immutability | | `[DataContract]` + `[DataMember]` | Removed; surrogate via `SerializableDataValue` + `DataValueSurrogateProvider` | Serialization | ### Wire format Wire format is **byte-identical** to the previous class-based implementation across binary / JSON / XML encoders. Default DataValue (`.IsNull == true`) is treated as the equivalent of the old null reference (writes JSON `null`, binary `byte 0`, XML omitted element). ### Why TryGet pattern (instead of leaving `DataValue?`) For methods that previously returned `DataValue?` to signal "no value available" (queue peek, aggregate result, data store lookup, history navigation), the conversion to `bool TryGet(out DataValue)` matches BCL conventions (`Dictionary.TryGetValue`, `Queue.TryPeek`, `Int32.TryParse`) and gives the caller an explicit "may be absent" affordance without `Nullable<DataValue>` overhead. ### Breaking changes summary - `DataValue` is now a `readonly struct` - boxing/unboxing semantics change for callers using `object`-typed APIs. - `IEncoder.WriteDataValue` / `IDecoder.ReadDataValue` / `ReadDataValueArray` interface signatures lose the `Nullable` wrapper. - `IDataChangeMonitoredItemQueue.PeekLastValue` / `PeekOldestValue` -> `TryPeekLastValue` / `TryPeekOldestValue` (out parameter). - `IAggregateCalculator.GetProcessedValue` -> `TryGetProcessedValue` (out parameter). - `IUaPubSubDataStore.ReadPublishedDataItem` -> `TryReadPublishedDataItem` (out parameter). - `NodeState.ReadAttribute` takes `ref DataValue`; `ReadAttributeAsync` returns `ValueTask<(ServiceResult, DataValue)>`. - `DataValue` property setters removed (use constructor + `With*` mutators). |
||
|
romanett
|
5edb512ab7 |
Stricter validation and error handling in GDS server & Server Method Call validation (#3746)
* Stricter validation and error handling in GDS server - Allow empty DatabaseStorePath for in-memory operation - Select database type dynamically in GdsNodeManagerFactory - Enforce required fields and argument validation in ApplicationsDatabaseBase - Prevent duplicate application URIs in LinqApplicationsDatabase - Propagate argument errors as OPC UA service exceptions in ApplicationsNodeManager - Remove obsolete attribute from ParsedNodeId - Refactor MasterNodeManager write/call validation to async with improved permission checks and attribute caching - Update UAReferenceServer.ctt.xml test data with non-empty credentials - Improves robustness, security, error reporting, and test coverage * Add method-state resolver API for call validation and tests Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/0caf8699-f0e0-4dd5-8dcf-368b08912205 Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * Refine call validation comments and test coverage naming Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/0caf8699-f0e0-4dd5-8dcf-368b08912205 Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * Move method resolver onto core NodeManager interfaces Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/0bb87dfd-f432-431f-a0fe-dd4d1ba3197f Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * Align NodeManager interfaces and call paths for method resolver Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/0bb87dfd-f432-431f-a0fe-dd4d1ba3197f Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * fixes * fix * Fix GDS ClientTest expectations for stricter app validation Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/47d99514-94f9-4051-9e6d-8cb2b44555d0 Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * fix tests * Fix AOT GDS fixture for RSA secured endpoint Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/f6c8fba1-3dbf-41f0-b920-5e1766b9d6e1 Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * Update app registration logic and audit event sources Refactor application registration to separate update and create logic, introducing UpdateApplication in database interfaces and implementations. Improve error handling and validation, ensure unique ApplicationUris, and enhance certificate revocation logging. Standardize audit event source names and add ToString override to BaseVariableState. Update server queries for correct pagination. * fixes * Add wildcard match coverage for ApplicationsDatabaseBase Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/a2c1a6b0-e867-4610-bead-7e621e3764ff Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * Expand wildcard spec coverage in ApplicationsDatabaseBase tests Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/a2c1a6b0-e867-4610-bead-7e621e3764ff Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * Align UA wildcard matching and add spec coverage tests Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/a2c1a6b0-e867-4610-bead-7e621e3764ff Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * Fix GDS QueryServers test expectations for pagination semantics Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/efa1c64d-05c8-47ee-b308-c77e7d5a34c9 Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * Add focused tests for LinqApplicationsDatabase behaviors Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/7e4ec1ce-722f-43fb-99db-06b854c3fa7a Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * Refine LinqApplicationsDatabase test method naming Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/7e4ec1ce-722f-43fb-99db-06b854c3fa7a Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * Merge origin/master and resolve PR merge conflicts Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/69970cd4-4196-4fb4-9e4c-6ad86104bb5f Co-authored-by: marcschier <11168470+marcschier@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> Co-authored-by: marcschier <11168470+marcschier@users.noreply.github.com> |
||
|
Marc Schier
|
3e5f129c6f | Enable nullable in Stack, Libraries (9), and Applications projects (#3732) | ||
|
Marc Schier
|
5795e50b58 |
Source-generated, NativeAOT-clean fluent server API with event-source publish (#3765)
* Add async read/write hooks to BaseVariableState and AsyncCustomNodeManager
Introduces an end-to-end async path for variable Value-attribute reads
and writes that does not require holding lock(this) while the user
callback executes:
* New AttributeReadResult, AttributeSimpleReadResult and AttributeWriteResult
readonly record structs in NodeState carry the typed result of an async
Value-attribute hook (no ref/out params across await).
* Four new async delegates (NodeValueEventHandlerAsync,
NodeValueSimpleEventHandlerAsync, NodeValueWriteEventHandlerAsync,
NodeValueSimpleWriteEventHandlerAsync) sit alongside the existing sync
hooks.
* NodeState gains virtual ReadAttributeAsync / WriteAttributeAsync methods.
The default implementation wraps the synchronous call in lock(this) so
callers that have not opted into async hooks see bit-identical behaviour.
* BaseVariableState exposes OnReadValueAsync, OnSimpleReadValueAsync,
OnWriteValueAsync and OnSimpleWriteValueAsync slots and overrides the new
virtuals to dispatch to them WITHOUT holding the lock during the await.
On simple-read the framework still applies index range, data encoding and
copy policy; on simple-write the cached value/status/timestamp are
updated under lock after the hook completes.
* AsyncCustomNodeManager.ReadAsync and WriteAsync now await the new
ReadAttributeAsync / WriteAttributeAsync entry points instead of taking
lock(source) around the synchronous call. Existing per-source locking
semantics are preserved by the default async wrappers.
* The fluent INodeBuilder surface gains four new async OnRead/OnWrite
overloads that wire to the new BaseVariableState slots, with the same
ThrowIfSlotOccupied + null-check pattern as the sync overloads.
* Add typed IVariableBuilder<T> fluent surface
Adds typed sub-interfaces and impls so the existing fluent surface
can expose simple Func<T> / Action<T> / Func<CancellationToken,
ValueTask<T>> overloads for variables — without losing the lower-level
Variant-based overloads on INodeBuilder.
* IVariableBuilder<TValue> + VariableBuilder<TValue> derive from
INodeBuilder<BaseVariableState> / NodeBuilder<BaseVariableState>
(NodeBuilder<TState> unsealed).
* Marshalling uses Variant.AsBoxedObject(BoxingBehavior.Legacy) for
reads and Variant(object) for writes; the AOT-unsafe write path is
scoped-suppressed with a TODO pointing at the planned per-type
generated walker.
* INodeManagerBuilder gains Variable<T>(string),
Variable<T>(NodeId), VariableFromTypeId<T>(NodeId),
VariableFromTypeId<T>(NodeId, QualifiedName).
Server library builds clean across all 6 TFMs.
* Add relative-child traversal API on INodeBuilder
Adds INodeBuilder.Child(QualifiedName), Child<TState>(QualifiedName)
and Variable<TValue>(QualifiedName) so source-generated typed
wrappers can walk one segment at a time without re-resolving from
the manager root. Resolution uses NodeState.FindChild and reuses
NodeManagerBuilder.ToVariableBuilder to keep the typed-variable
marshalling story consistent.
Adds 7 NUnit cases (Fluent category) covering the happy path,
type-mismatch, null/missing browse-name, and non-variable
rejection. All 66 fluent tests pass.
* Mix old + new fluent APIs in MinimalBoilerServer demo
BoilerNodeManager.Configure now exercises five wiring styles:
(1) browse-path with the legacy ref-Variant callback
(2) absolute NodeId with the legacy ref-Variant callback
(3) typed Variable<double>(NodeId) + simple Func<double> sync getter
(4) typed Variable<double>(NodeId) + Func<CancellationToken, ValueTask<double>>
async getter — exercises the BaseVariableState.OnReadValueAsync
slot end-to-end through AsyncCustomNodeManager.ReadAsync
(5) NodeFromTypeId with OnNodeAdded lifecycle hook
All five styles compose against the same INodeManagerBuilder, with
the typed and async callbacks pulling in the new IVariableBuilder<T>
surface (committed at
|
||
|
Marc Schier
|
70b4498db8 |
Certificate manager and ref counted certificate type (#3688)
* New certificate and secrete abstraction with certificate infrastructure and certificate/secret stores. * leak testing for certificate resources to validate new ref counting in every test assembly * Migration guide updated and documentation added for all * Remove IDisposable from Nodestate and UserIdentity. * UserCertificateTokenHandler now just points into certificate registry/stores, no dispose required * Fix CA2000 warnings and cleanup of other diagnostics, increase warning levels in .editorconfig |
||
|
Copilot
|
54cc3d88b1 | Prepare for C# 15 union types: UnionAttribute polyfill, TryGetValue rename, HasValue (#3727) | ||
|
Marc Schier
|
94bc03b9f6 |
fix address space issues (#3705)
* fix missing mandatory children * Source generator: fix encoding nodes, EventNotifier, and type RBAC - Emit DataType encoding nodes (Default Binary/XML/JSON) into the generated address space. CollectEncodingNodes() discovers DataTypeEncodingType instances and builds synthetic hierarchies with their HasEncoding/HasDescription references. - Auto-set EventNotifier=SubscribeToEvents on Object nodes that have forward HasEventSource or HasNotifier references. The fix works at two levels: ModelDesignValidator infers SupportsEvents on types with event references in design XML, and NodeStateGenerator checks the resolved reference set for merged instances that inherit references from their type definitions. - Wrap AccessRestrictions/RolePermissions in if(forInstance) guards for ObjectType, VariableType, DataType, and ReferenceType templates so type definition nodes remain accessible to all users. - Allow ModellingRule=None Object children on type definitions to be emitted (e.g. state machine states/transitions). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Update missing nodes analysis after source generator fixes Retest with admin credentials against ConsoleReferenceServer v1.05.07. Categorize 794 truly missing nodes (after filtering optional/placeholder): - 384 encoding nodes (NodeSet2.xml-only, not in design XML) - 172 role instance children - 84 other nodes - Remaining: trust list, PubSub, diagnostics, etc. RBAC and EventNotifier fixes confirmed working. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * update * plans: detailed analysis of 292 remaining missing nodes Replaced the two previous analysis files with a single consolidated validation report. Each of the 292 nodes is classified with a reason: - 212 type-level children (ObjectType definitions not instantiated) - 48 instance-level children (diagnostics, HA, FileSystem, PubSub) - 32 orphan property templates (design-time canonical definitions) Only 1 fix recommended: Server.Auditing (i=2994) should be exposed as false per Part 5 section 6.3.3. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * feat: add GDS node manager to ConsoleReferenceServer Add Global Discovery Server functionality to the reference server: - Add Opc.Ua.Gds.Server.Common project reference - Add GdsNodeManagerFactory that creates ApplicationsNodeManager with JsonApplicationsDatabase and CertificateGroup (auto-approve) - Add GlobalDiscoveryServerConfiguration extension to config XML - Add GDS to ServerCapabilities - Registration is opt-in: only when config extension is present Also fix pre-existing source generator test failures: - Add missing CreateOrReplaceTransitionNumber stub method to StateMachineTransitionState in CompilerUtils.cs (8 tests fixed) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * plans: update missing nodes report with GDS retest results Retested after adding GDS node manager to ConsoleReferenceServer. Total missing reduced from 1325 to 1243 (82 fewer). 335 remaining 'other' nodes fully classified with per-node reasons. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * plans: Server.Auditing is present (access-restricted, not missing) Live validation confirmed i=2994 exists with value=true, visible to admin users. Returns BadUserAccessDenied for anonymous. No fixes needed. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix CttTestRunner build errors for v1.6 API and Jint 4.8.0 - Update System.CommandLine 2.0.7 API: SetHandler->SetAction, InvokeAsync->Parse().InvokeAsync() - Remove ObjectInstance inheritance from CttAssert, CttServiceRegister, CttIdentifierConstants, CttMonitoredItemHelper; use ToJsObject() factory methods instead - Replace Jint.Native.JsValueType with .IsObject()/.IsNumber()/.IsString() etc. - Add missing using directives (Jint.Runtime, Microsoft.Extensions.Logging, etc.) - Fix NodeId.Identifier obsolete -> TryGetIdentifier<uint> - Fix DataValue.Value obsolete -> WrappedValue.AsBoxedObject() - Fix ApplicationInstance() obsolete -> ApplicationInstance(ITelemetryContext) - Fix LoadApplicationConfiguration -> LoadApplicationConfigurationAsync - Fix CheckApplicationInstanceCertificate -> CheckApplicationInstanceCertificatesAsync - Fix CoreClientUtils.SelectEndpointAsync signature (requires telemetry param) - Fix DefaultSessionFactory() obsolete -> DefaultSessionFactory(ITelemetryContext) - Fix DiscoveryClient.Create -> DiscoveryClient.CreateAsync - Fix FindServers/GetEndpoints -> FindServersAsync/GetEndpointsAsync - Fix StatusCode to uint conversions - Fix ArrayOf<T> iteration (use foreach instead of LINQ on IConvertableToArray) - Fix XmlNodeList null coalescing in CttProjectSettings - Fix JsValue.False -> JsValue.FromObject(engine, false) - Add --json option to Program.cs for machine-readable output Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: emit type-level children with ModellingRule=None for all node classes The source generator's GetChildren method only included ModellingRule=None children when they were ObjectDesign instances (state machine states/transitions). This excluded Variables and Methods that are explicitly defined on types without a modelling rule, such as: - ConditionType.ConditionRefresh (Method) - ConditionType.ConditionRefresh2 (Method) - ConditionType.SupportsFilteredRetain (Variable) - ProgramStateMachineType.Creatable (Variable) - Various TrueState/FalseState display-hint properties Remove the ObjectDesign restriction so all explicitly defined type-level children with ModellingRule=None are included in the generated address space. This adds ~52 previously missing nodes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * plans: update report after ModellingRule=None generator fix Type-level children dropped from 261 to 203 (-58) after fixing the source generator to emit Variables and Methods with ModellingRule=None. Total 'other' reduced from 335 to 283. No fixes needed for any remaining nodes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * plans: all 203 type-level children confirmed present via Read Verified all 203 'type-level children' exist in the server (none return BadNodeIdUnknown). They return Good, BadUserAccessDenied, or BadSecurityModeInsufficient -- all confirming the node exists but is access-restricted for anonymous users. All 1,316 export-missing nodes are now accounted for. Zero nodes are actually missing from the server address space. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix CttTestRunner session service methods for CTT JS script compatibility - Implement ServiceCreateSession with real Session.CreateAsync connection - Implement ServiceActivateSession with proper response fields - Implement ServiceCloseSession with session cleanup - Fix UaSession constructor to provide service methods via CreateServiceObject - Convert all type constructors from ClrFunction to JS functions for 'new' support (Jint 4.x ClrFunction does not support [[Construct]]) - Add UaChannel.connect/disconnect stubs for OpenSecureChannel flow - Add UaDiscovery with getEndpoints/findServers from discovery session - Add missing types: UaSubscriptionDiagnosticsDataType, UaHistoryUpdateResult, etc. - Add missing enums: IdentifierType, Constants (DateTime/numeric limits) - Add UaPkiCertificate.fromDER, UaByteString.fromStringData, PkiType, UaPkiUtility - Add UaDateTime.Now constructor, equals/msecsTo methods - Add UaStatusCode with isGood/isBad/isUncertain as JS constructor - Fix response headers with Timestamp (UaDateTime), ServiceDiagnostics, StringTable - Fix endpoint descriptions with Server, UserIdentityTokens, ServerCertificate - Add CreateResponseHeader helper for consistent response header construction - Override warnOnce.js loggers to avoid Function.caller incompatibility - Add stopTest, checkResourceError (lowercase) global functions - Add UaOpcServer constructor with all method stubs - Handle JS parse errors in include() for malformed CTT files - Test.Connect() now calls InstanciateHelpers with DiscoverySession Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Add CttTestRunner: .NET replacement for CTT JavaScript host environment Implements a Jint-based JavaScript engine that can execute the OPC Foundation's Compliance Test Tool .js test scripts using the OPC UA .NET Standard stack. Features: - Parses CTT .ctt.xml project files (Qt AbstractItemModelData format) - Loads and resolves CTT include() dependency chains (~100 library files) - Registers ~250 Ua* type constructors for JavaScript - Implements session.read/write/browse/getEndpoints/findServers - Provides all OPC UA enumerations, NodeId constants, Assert methods - CLI with --list, --file, --conformance-unit, --result, --json flags - Headless operation for agent/CI integration Current status: Framework connects to OPC UA server and loads CTT test infrastructure. Session establishment flow needs additional property compatibility for CreateSession/ActivateSession request objects. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: do not apply DefaultAccessRestrictions/DefaultRolePermissions to type definitions ObjectType and VariableType nodes should never have access restrictions or role permissions from DefaultAccessRestrictions/ DefaultRolePermissions. These defaults are meant to apply to instances of the type, not to the type definition node itself. Previously, CertificateGroupType, TrustListType, SecurityGroupType and other types were incorrectly emitted with AccessRestrictions inherited from their DefaultAccessRestrictions, making them unreadable without encryption even though the spec defines no restrictions on these type definitions. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * CttTestRunner: fix session establishment flow - Fix constructor patterns (new/no-new dual call support) - Fix ResponseHeader with ServiceDiagnostics/StringTable - Populate ServerNonce, ServerCertificate, ServerEndpoints in CreateSession response - Add UaVariant setter methods (setNodeId/setString/setBoolean/etc.) - Add UaCreateSessionRequest/ActivateSessionRequest with proper nested structures - Fix UaPkiUtility/UaPkiCertificate with Thumbprint/toDERFile/loadCertificateFromFile - Add missing enums: PerformUpdateType, SecurityPolicy, StructureType, etc. - Add HostInfo, Bit helper, KeyPairCollection, ExpectedAndAcceptedResults - Add _error.store(), MessageSecurityMode.toString() Status: Session creates successfully, CreateSession validation runs, hits validateCertificate in PKI chain (next to implement). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * plans: update report after DefaultAccessRestrictions type definition fix ObjectTypes no longer have incorrect access restrictions. Type children reduced from 203 to 164 (39 now visible). Total export- missing reduced from 1316 to 1146. Remaining 164 type children are individual methods/variables with spec-correct access restrictions. Two source generator fixes applied: - ModellingRule=None children for Variables/Methods - DefaultAccessRestrictions not applied to ObjectType/VariableType Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * CttTestRunner: fix PKI, cert validation, warnOnce, session response - Intercept warnOnce.js with Jint-compatible replacement (no Function.caller) - Add _log.store() global helper - Add HOSTNAMES/HostnameFromUrl helpers for cert hostname validation - Add UaPkiCertificate properties: PublicKey, Issuer, Subject, KeyUsage, Hostnames - Add UaPkiUtility.validateCertificate stub - Add UaByteString static helpers: FromByteArray, ToByteArray, fromHexString - Use JS UaNodeId constructor for proper equals() support - Fill AuthenticationToken and 32-byte ServerNonce in CreateSession response - Add clone/append to ByteString objects Session flow: CreateSession validates, ActivateSession reached, hits Channel.ServerCertificate.clone() (IsSecure check — next to fix). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * CttTestRunner: complete session establishment, crypto stubs, ByteString helpers - Add _makeByteString() helper for consistent ByteString objects with clone/append/isEmpty - Add UaCryptoProvider with asymmetricSign/Verify stubs - Add UaExtensionObject setter methods (setAnonymousIdentityToken, etc.) - Fix UaChannel with full properties (RequestedSecurityPolicyUri, IsSecure, etc.) - Fix duplicate type registrations overriding custom constructors - Fix ActivateSession response header with ServiceDiagnostics - Remove UaCreateSessionResponse/ActivateSessionRequest/CloseSessionRequest duplicates Status: Full session lifecycle works (GetEndpoints → OpenSecureChannel → CreateSession → ActivateSession). Test scripts execute and hit server capabilities initialization (MonitoredItem NodeId settings configuration). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * update * plans: add spec references for access restriction reasoning Added links to Part 3 sections 5.2.9, 5.2.11, and 6.3.3 explaining why DefaultRolePermissions are applied to instance children but not to type definitions. The NodeSet2.xml has no explicit RolePermissions on these 164 nodes -- restrictions come from model design defaults. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: add GDS project references to ConsoleReferenceServer Dockerfile Add Opc.Ua.Gds.Common and Opc.Ua.Gds.Server.Common csproj COPY lines to the Docker restore layer, required since the GDS node manager was added to the ConsoleReferenceServer. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * update * feat: add IsPartOfTypeHierarchy flag to bypass access restrictions on types Type hierarchy nodes (ObjectType/VariableType definitions and their children) should be universally accessible regardless of AccessRestrictions and RolePermissions. Changes: - Add IsPartOfTypeHierarchy property to NodeState - Set flag on ObjectType/VariableType in generated code (!forInstance) - Propagate flag from parent to children in AddPredefinedNode - Add flag to NodeMetadata, propagate in GetPermissionMetadata - Bypass ValidateRolePermissions and ValidateAccessRestrictions when IsPartOfTypeHierarchy is true - Revert isTypeDefinition guard: AccessRestrictions and RolePermissions are now emitted on all nodes as metadata, but enforcement is skipped for type hierarchy nodes - Fix forInstance propagation in type factories: use forInstance: forInstance for type children so deep children (TrueState/FalseState etc.) are included when !forInstance Type-level missing nodes reduced from 201 to 99. Remaining 99 are in the server but not reachable by the export tool's browse path. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * plans: update report with final IsPartOfTypeHierarchy results Missing from export reduced to 998 (from 1325 original). Type children: 201 -> 99 (forInstance propagation fix). All nodes verified present via OPC UA Read. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: propagate IsPartOfTypeHierarchy in GetNodeMetadataAsync The Browse service's per-reference ValidateRolePermissionsAsync calls GetNodeMetadataAsync (not GetPermissionMetadataAsync). The IsPartOfTypeHierarchy flag was only set in GetPermissionMetadataAsync, causing type hierarchy nodes to be filtered out of Browse results. This fixes 99 ObjectType children that were previously invisible in Browse from their parent types. Type-level missing: 99 -> 0. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * plans: final report -- 0 type-level children missing (694 total) Type-level missing: 99 -> 0 after fixing IsPartOfTypeHierarchy propagation in GetNodeMetadataAsync. Total export-missing: 694 (384 encoding + 236 access-restricted + 74 instance/orphan). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * update --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> |
||
|
Marc Schier
|
39fa3030fa |
Add a fluent api for server, a sample and generate node managers to use with it. (#3684)
* Add source-generated NodeManagers and fluent wiring API Adds a fluent INodeManagerBuilder API for wiring per-node callbacks and a model-aware source generator that emits a partial CustomNodeManager2 plus an INodeManagerFactory for each design file. Opt-in is per class via [Opc.Ua.Server.Fluent.NodeManager] on a partial class (recommended) or project-wide via the ModelSourceGeneratorGenerateNodeManager MSBuild property (legacy). The attribute supports NamespaceUri / Design selectors for multi-design projects and a GenerateFactory toggle. Diagnostics MODELGEN010 / MODELGEN011 surface unmatched bindings and non-partial classes. Adds the ConsoleBoilerServer NativeAOT sample driving the new pipeline end-to-end with Microsoft.Extensions.Logging.Console and updated docs in Docs/SourceGeneratedNodeManagers.md. * Add BoilerServer AOT smoke test Verifies the source-generated Boiler.BoilerNodeManagerFactory loads the boiler address space, registers its namespace, and dispatches the fluent OnRead callbacks wired in BoilerNodeManager.Configure.cs. All 3 new tests pass in JIT mode and against the NativeAOT-published binary; total Aot.Tests suite: 71/71 pass. |
||
|
Marc Schier
|
6c8c1a6d29 | Enable dispose analyzers CA2000 and CA2213 and fix all issues (#3670) | ||
|
Marc Schier
|
abc813f56c | Support UANodeset export / import under AOT (#3667) | ||
|
Marc Schier
|
64ca85fce3 |
Increase code coverage across solution (#3662)
Add additional tests to increase code coverage across the solution |
||
|
Marc Schier
|
fd41681f4b |
Add support to publish OPC UA applications as Native AOT (#3633)
* make most ptojects aot compatible * Remove newtonsoft * Migrate all projects from Mono.Options to System.CommandLine 2.0.5 * Fix array clone * Replace serializers for storage using new attribute driven type geberator * Add new AOT integration tests covering all functional areas * Documentation updates |
||
|
Marc Schier
|
03777ecb09 |
New Json decoder/encoders, array/matrix abstractions, ByteString, and more. (#3619)
- **Collections overhaul** — new/rewritten collection types (`ArrayOf`, `Collections` commits)
- **`Variant` builder/accessor** — new APIs for constructing and accessing Variants
- **`NodeId` operators made explicit** — breaking change for implicit conversions
- **Version bumped to 1.6** with preview build support
- **NumericRange** uses Variant
- **object** type accessors and general usage removed.
### 🏗️ Infrastructure
- Build config updated; `.NET 10` targeting
- InternalsVisibleTo moved to `.csproj`
- Pipeline/CI adjustments
|
||
|
Copilot
|
588b7e9237 |
[Server] Implement event-driven RolePermissionsValidation caching in MonitoredNode2 (#3583)
* Initial plan * Implement event-driven RolePermissionsValidation with permission caching in MonitoredNode2 Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * Add DefaultPermissionsChanged event to IConfigurationNodeManager to handle namespace-level default permission changes Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * Add test & make validation functional * cover case when DefaultRolePermissions are aded after the node exists * cleanup --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> Co-authored-by: Roman Ettlinger <romanett98@gmail.com> |
||
|
romanett
|
0a4c87cef8 |
[Server] Implement smaller Performance improvements found when profiling (#3584)
* Add namespace index lookup for NamespaceMetadataState Added GetNamespaceMetadataState(ushort) to ConfigurationNodeManager and interface for efficient lookup by namespace index. Switched to ConcurrentDictionary for thread safety. Updated AsyncCustomNodeManager to use index-based lookup. Cleared index cache in Clear method. * Refactor Variant and ServiceResult handling for speed - Use WrappedValue assignment for DataValue in MonitoredNode and NodeState to align with updated Variant usage. - Return ServiceResult objects instead of raw StatusCodes for bad attribute IDs. - Update ServiceResult exception handling: include stack trace only in DEBUG, message only in release. - Optimize StatusCode to ServiceResult conversion by returning static Good/Bad instances. * Add Read Limited load test * Optimize MonitoredItem.IsReadToPublish * Add Subscription unit tests and improve triggering logic Added SubscriptionTests to verify PublishTimerExpired behavior, including timer expiry, monitored item readiness, keep-alive, and triggering scenarios. Updated Subscription.cs only process triggering if triggered items are configured, improving correctness and efficiency. * CR feedback |
||
|
romanett
|
a0e1e9f42e |
[Server] Optimize NodeState.ReadAttributes & base ReferenceNodeManager on AsyncCustomNodeManager (#3574)
* Use Interfaces Introduced with 1.5.378 Refactor to use interfaces for node managers and server Replaced concrete types with interfaces (e.g., IMasterNodeManager, ICoreNodeManager, IDiagnosticsNodeManager, IConfigurationNodeManager, IServerBase) across method signatures, properties, and internal structures to improve abstraction and flexibility. * Refactor CoreNodeManager to be Based on CustomNodeManager2 * Add Test * Add INodeManager3 with role permission validation Introduce INodeManager3 interface extending INodeManager2, adding synchronous role permission validation methods. Update all node manager interfaces and classes to use INodeManager3. Extend IAsyncNodeManager with async permission validation methods and update adapters for sync/async bridging. Deprecate FindNodeInAddressSpace in favor of new async FindNodeInAddressSpaceAsync. Refactor MonitoredNode2 to use thread-safe collections and locking for monitored items. Enhance event reporting with security and permission checks. Update constructors and documentation to reflect new interfaces and best practices. * Implement AsyncCustomNodeManager * fix comment * fix * Add tests * fix * Implement better locking strategy * fix * Add more tests * Add tests * Add tests * Add Tests * cleanup * cleanup * Add tests that verifies for AnalogItemState the instrument range is checked brefore writing * only assign new NodeID in default factory if NodeId isNull * Run all tests also with sampling groups * Add Docs * cleanup * Add chaos test * fix test * Use AsyncCustomNodeManager for ReferenceNodeManger & imrpove ReadAttributes method of NodeState * fixes * fixes and code review comments |
||
|
Marc Schier
|
601cabf86f | Replace all use of object in code and API with Variant (#3550) | ||
|
Marc Schier
|
f66ceffd75 |
Immutable built in types and code generation (#3534)
Generate stack and application code using source generators Change built in types to readonly structs Update localized text implementation to use JSON text serializer Status code with symbolic names Immutable node ids No boxing for all built in types <= 8 bytes in Variant. Split user identity token and token handling via token handler Add migration guide for breaking changes |
||
|
Marc Schier
|
43ce7ed229 |
Code clean up and improvements (#3532)
This pull request modernizes the OPC UA .NET codebase and tests, removes .NET Standard 2.0 support from certificate/security code, and updates test code to use C# 12 and .NET 8+ features for clarity and maintainability. - Certificate and BouncyCastle interop files (e.g., CertificateBuilder.cs, X509Extensions.cs, X509SignatureFactory.cs) are refactored to drop NETSTANDARD2_0 support and use modern .NET APIs and conditional compilation. - Test code across the codebase is updated to use default, strongly-typed Parse methods, collection expressions, and improved async/await patterns. - Exception handling and assertions in tests are modernized, and test method naming is made consistent with Async suffixes. - The project and build files are updated to clarify Roslynator analyzer usage and remove obsolete netstandard tags. - General code and test cleanup includes improved null safety, type safety, and removal of deprecated or unused code. |
||
|
Copilot
|
e314cf53f7 |
Fix SourceTimestamp for variables without explicit timestamps in BaseVariableState (#3451)
* Initial plan * Add OnReadValue callback to update timestamps on variable reads Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * Add test to verify timestamp updates on variable reads Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * fix timestamp for scalar values set loglevel in session publish when no subscriptions ignore more keepalive errors in Client Fixture * Fix timestamp updates for all variables (scalars and arrays) Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * create a proper fix * Add Order parameter to test to check the timestamp before an explicit write was done --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> Co-authored-by: Roman Ettlinger <romanett98@gmail.com> |
||
|
Copilot
|
7cd5ae34ec |
Fix ExtractValueFromVariant method call condition (#3382)
* Initial plan * Changes before error encountered Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * Fix ExtractValueFromVariant condition and add comprehensive tests Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> |
||
|
Copilot
|
3f660af97d |
Fix BaseVariableState to return correct BuiltInType for Byte arrays vs ByteString (#3384)
* Initial plan * Fix ByteString vs Byte array distinction in WrappedValue Modified BaseVariableState.WrappedValue to use DataType and ValueRank when creating Variant to correctly distinguish between byte[] (Byte array) and ByteString. Added tests to verify the fix. Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * Address code review feedback - Remove redundant null check for NodeId (NodeId.IsNull handles null) - Update comment in test to be more specific about ByteString testing Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> |
||
|
Marc Schier
|
2960388560 |
Update headers and license files (#3388)
Update license headers to copy right year 2025, replace RCL/GPL headers with MIT, replace the nuget license with MIT (via license expression). |
||
|
Marc Schier
|
35db52a7a6 | Move from .net 9 to .net 10 SDK and build new target framework .net 10 (#3333) | ||
|
Marc Schier
|
712e770fbe |
Restructure core and built in types into base assembly and nuget (#3326)
This change adds a **new Opc.Ua.Types** nuget that contains core types that do not rely on generated code. Why the name? Because almost all code that was in the Types subfolder is part of it, and because we do not want to change the name of the Opc.Ua.Core nuget/assembly because code relies on it. Any other name like base or bootstrap felt out of place due to the current structure already defining the name "types". Key design is to depend on only a small set of libraries with limited transitive dependencies, that includes hashcode, logging.abstraction, and for non standard20 builds System.Text.Json (needed for localizedText mul parsing). Also, key is to support .netstd 2.0 to support source generators and to allow removal of EEC_SUPPORT defines by removing std2.0 from core and all libraries. The changes are mostly restructuring, and thus small but contain some key changes: - **Status code** struct now comes with a Symbol field, which is used to carry symbols in case the code is not generated. Currently (until generated) the status code struct must be manually created with a symbol or the ToSymbolicId extension must be called in the core project. Future will generate Status code constants just like NodeId that contain the symbol which also removes the reflection-based lookup. Several tests needed to be adjusted as they checked the status code symbol strings instead of the code. - **Core identifiers** are copied as they were needed for code to compile, that includes attributes, a subset of status codes and node identifiers. These will never change so no need to generate them. - The types folder now contains **encoders**, except for json which is still in core. Once the json encoder is ported to system.text.json it will also be included and Newtonsoft.Json dropped as dependency (-> #3329). - Since types relies on **IOperationContext** and **ISystemContext**, and these export IUserIdentity which relies on crypto, these were split and extended in core with ISessionOperationContext and ISessionSystemContext, which mean changes to ServerSystemContext and introduction of SessionOperationContext and SessionSystemContext classes that extend OperationContext and SystemContext. Some runtime checks in the server are therefore needed to get at the session and auth info, however, those are anyway optional fields and are not on the critical paths, and thus a type check is in order (and was done in the past already, but against OperationContext class). - **Manifest resources** are now split between Core (nodeset zip, some generated resoures) and Types (built in bsd/xsds). This needs to be revisited later if the bsd/xsd need to be regenerated during type generation. Note that the embedded resource names changed as a result. Since these are only used internally and do not constitute public API this feels reasonable vs duplication of resources in 2 assemblies. - Reflection however now needs to load not just the built in **encodeables** from Opc.Ua.Types assembly, but also the generated encodeables from Opc.Ua.Core assembly. For this a new helper Utils method was added to get the Core assembly when linked against Opc.Ua.Core otherwise null. - Whatever utils methods needed to be split out into the new Opc.Ua.Types assembly, they are now in **CoreUtils** static class in Opc.Ua.Types, and Utils.xxxx forwards to them to ensure minimal changes. Later we would want to obsolete them in favor of CoreUtils, although it might make sense to split them again into domain specific utilities, such as networking, files, etc |