UA-.NETStandard

mirror of https://github.com/OPCFoundation/UA-.NETStandard.git synced 2026-10-18 14:43:08 +08:00

Author	SHA1	Message	Date
Marc Schier	a81d981755	dotnet format sweep (whitespace, IDE, RCS) + code-style enforcer agent fix (#3865 ) # Description Pure code-style sweep across the repo — no behavioral changes. Drives `dotnet format` info-level diagnostics down on a large slice of the codebase (Stack, Libraries, Tests, Tools). Six commits, applied bottom-up in safety order so each batch leaves the build green: 1. `style: fix whitespace and final-newline formatting (WHITESPACE, FINALNEWLINE)` 197 hits across ~30 files; pure mechanical cleanup. 2. `style: apply dotnet format style fixes (IDE rules)` IDE-rule batch via `dotnet format style --severity info` — `var`/explicit type, simplify names, collection expressions, expression bodies, unused usings, etc. 3. `style: apply dotnet format analyzers fixes (RCS blank-line formatting)` Roslynator formatting (RCS0xxx) blank-line and punctuation rules. 4. `style: convert comments to doc comments and inline local vars (RCS1181, RCS1124)` 24 files. RCS1181 promotes `// summary`-style comments above public/internal members to `/// <summary>` doc comments; RCS1124 inlines locals used exactly once. Generated `Tools/` files were reverted to keep the source-generator outputs deterministic. 5. `docs(agent): correct --diagnostics flag form and verify Roslynator 4.x code fixers` Updates `.github/agents/opc-ua-codestyle-enforcer.agent.md` with two corrections discovered while running this sweep: - `dotnet format --diagnostics "RULE1 RULE2"` (single quoted, space-separated) silently fixes nothing on `dotnet format` 10.x — it parses as one unknown ID and exits 0. The correct form is `--diagnostics RULE1 --diagnostics RULE2 …`, repeated per rule. - Roslynator 4.15.0 does ship code fixers for RCS1078/1118/1124/1140/1142/1181/1221/1260 (the previous "no auto-fixer" list was outdated). RCS1140/1142 default to `Hidden` so need `--severity info` to surface and fire; RCS1078 requires `roslynator_empty_string_style = field` (already set in `.editorconfig`). Only NUnit4002/2046/2010 genuinely lack auto-fixers in this stack. 6. `style: format new code from master merge (dotnet format sweep)` After merging master into the branch (commit `e3ebc8742`), re-ran the same three-phase format sweep on the 151 .cs files brought in by the merge, scoped per project via repeated `--include`. 81 files changed; same rule families as commits 1–4. - Hand-fixed `Tests/Opc.Ua.MigrationAnalyzer.Tests/AnalyzerHarness.cs` for `RCS1174` (redundant `async`/`await` removal) because the auto-fixer didn't apply for that specific case. - Reverted files that the formatter would break: - `Libraries/Opc.Ua.Server/Server/ServerInternalData.cs` — multi-TFM analysis disagreement injected `<<<<<<<` / `=======` / `>>>>>>>` markers. - `Tools/Opc.Ua.MigrationAnalyzer.Core/{Core/Stack/Client/ChannelBase.cs, Core/Stack/Types/IUserIdentityTokenHandler.cs, Client/Session/Session.cs}` — IDE0005 removed `using Opc.Ua.Security.Certificates` that IS used (the files are 1.5.378 reference fixtures for the analyzer). - `Tests/Opc.Ua.Gds.Tests/PushTest.cs` — IDE0002 over-simplified `OpcUa.ObjectTypeIds` to `ObjectTypeIds`, which then resolves to a conflicting type. ### What this PR does not touch - No behavioral or semantic logic changes. - No `.editorconfig` rule promotions (rules stay at their current severities; this is a backlog-burndown pass, not a rule tightening). - Generated source under `Tools/` is intentionally excluded. - Higher-risk rule families (`RCS1090`/`CA2007` `ConfigureAwait`, `RCS1249` null-forgiving cleanup, `IDE0270`/`IDE0059`) are left for follow-up sweeps because they need per-TFM build verification or semantic review. ## Related Issues _No tracking issue — this is a non-functional style sweep and the agent-doc correction is a follow-up to the same work. Happy to open one if the maintainers prefer._ ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. _(N/A — style-only, no behavioral change)_ - [x] I have added all necessary documentation. _(agent doc updated with the two corrections)_ - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. _(verified clean on `net10.0` and `net48`; only pre-existing `NETSDK1005`/`NETSDK1207` failures on Tools/AOT projects)_ - [ ] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. _(build verified on net10 and net48 per batch; full test suite not yet run locally — relying on CI)_ - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received. --------- Co-authored-by: agent <agent@local>	2026-06-10 08:35:44 +02:00
Marc Schier	b2b4dbb13f	[Server] Part 13 Aggregates compliance fixes, full test coverage and docs (#3863 ) # Description Brings the server-side OPC UA Part 13 (Aggregates) v1.05.07 support to full conformance: fixes the three genuine non-compliances found by a spec review, completes value-validated test coverage for all 37 standard aggregate functions, and adds documentation. The existing aggregate engine is a faithful port and was already largely compliant; this PR closes the remaining gaps. ## Compliance fixes - `TreatUncertainAsBad` default (§4.2.1.2). The server-default `AggregateConfiguration` (used when a `ReadProcessedDetails` request sets `UseServerCapabilitiesDefaults = true`) now defaults `TreatUncertainAsBad` to `True` as the spec mandates, in both `AggregateManager.GetDefaultConfiguration` and the `HistorianDispatcher` fallback. Behavior change noted in `MigrationGuide.md`. - `AnnotationCount` (§5.4.3.20). Previously counted raw data values. It now counts Annotations per interval, computed in `HistorianDispatcher.DispatchProcessedReadAsync` from `IHistorianAnnotationProvider` (endTime-exclusive bucketing; reverse-time and `ProcessingInterval == 0` handled). Returns `Bad_AggregateNotSupported` when the provider has no annotation history. - StandardDeviation/Variance use all n Good raw values (§5.4.3.37/.39). `ComputeStdDev` previously computed over the N−1 sub-regions returned by `GetRegionsInValueSet`, silently dropping the last raw value. It now computes the mean/variance directly over all Good raw values in the interval (UseBounds = None), differing only by the divisor (sample n−1, population n). The population spec-example tests that used to add a duplicate trailing value as a workaround were updated to the natural 5-value datasets matching §A.35/.37. ## Tests - Calculator coverage is complete for all 37 aggregates — added `StatusAggregateCalculatorTests` (DurationGood/Bad, PercentGood/Bad, WorstQuality/WorstQuality2), the Min/Max `2` simple-bound variants (`Minimum2`/`Maximum2`/`Range2`/`MinimumActualTime2`/`MaximumActualTime2`), and `Interpolative`. - End-to-end integration* in `HistoryClientIntegrationTests` over the live in-process ReferenceServer: value-validated `Average`/`Minimum`/`Maximum` processed reads and an AnnotationCount write→read round-trip. - Dispatcher-level `AnnotationCount` tests (counts per interval; `Bad_AggregateNotSupported` without an annotation provider). - Tightened `AggregateBaseTests`: dropped `allowAnyResult` from `StandardDeviationSample`/`StandardDeviationPopulation`/`NumberOfTransitions` basecases (now deterministic on seeded data after the D3 fix). - Validation tests for `AggregateConfiguration` per §4.2.1.2: `PercentDataBad`/`PercentDataGood > 100` and the invalid relationship `PercentDataGood < (100 - PercentDataBad)`. - Cross-cutting: reversed time-range test (start > end). ## Verification - Builds: 0 warnings / 0 errors. - Aggregate + historian dispatcher + History integration suites green on .NET 10 and .NET Framework 4.8 (cross-TFM). - Black-box (MCP) check against a standalone `ConsoleReferenceServer`: both `Server.ServerCapabilities.AggregateFunctions` and `HistoryServerCapabilities.AggregateFunctions` advertise all 37 functions (§4.2.2.1). ## Notes / out of scope - AnnotationCount advertisement remains the full standard set with per-node `Bad_AggregateNotSupported`. This is spec-acceptable: §4.2.2.1 lists what the server can support; per-node refinement is the optional `HistoricalConfiguration.AggregateFunctions`. Conditional advertisement could be added later as a quality refinement. - A native-vs-framework-fallback parity test would be useful once a third-party `IHistorianProcessedProvider` implementation exists; the bundled `InMemoryHistorianProvider` uses only the framework fallback today. ## Related Issues _No existing tracking issue; this addresses OPC 10000-13 (Part 13, Aggregates) v1.05.07 conformance gaps. Maintainers: please link or open a tracking issue if one is required._ ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. _(Ran the aggregate/historian/integration suites on net48 + net10; full-solution run pending CI.)_ - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received.	2026-06-10 08:34:09 +02:00
Marc Schier	15eb55c46e	Cert rotation: force renegotiate (#3562 ) + auto-detect on client (#3160 ) (#3849 ) # Description Implements the OPC UA Part 12 §7.10.9 contract on the server (fixes #3562) AND the client-side counterpart for immediate detection of own-cert / trust-list / CRL changes (fixes #3160). ## Server side (#3562) Per Part 12 §7.10.9 the server _shall_ "force existing SecureChannels affected by the changes to renegotiate" once the `ApplyChanges` method response has been delivered. Previously the server reloaded the certificate but did not cut affected channels; clients kept using the old cert until natural rekey, and the code carried an explicit `TODO` next to a 1-second `Task.Delay` hack in `ConfigurationNodeManager.ApplyChanges`. Key server changes: * New optional capability interface `Opc.Ua.ITransportListenerCertificateRotation` (single method `CloseChannelsForCertificate(Certificate)`) — implemented by `TcpTransportListener` and `HttpsTransportListener`. Custom transport listeners can opt in without breaking `ITransportListener`. * TCP path: new internal `TcpListenerChannel.TryCloseForCertificateRotation(oldThumbprint, out globalChannelId)` matches the channel's negotiated `ServerCertificate` by thumbprint, sends `BadCertificateInvalid`, and calls `ChannelFaulted()` to actually close the socket. `TcpTransportListener.CloseChannelsForCertificate` snapshots `m_channels` outside `m_lock` to avoid lock inversion, invokes the per-channel helper, returns cut global channel ids. The listener socket stays bound — clients can reconnect immediately. * HTTPS path: HTTPS owns the cert at the Kestrel/HTTP.sys listener level, so a `Stop()`+`Start()` cycle is the only practical force-renegotiate. Moved out of `CertificateUpdate` (which now does only the soft fan-out) into `CloseChannelsForCertificate` so the staging event no longer disrupts in-flight requests prematurely. * `ConfigurationNodeManager.ApplyChanges` rewritten: - Captures the per-group pre-transaction certificate (preserved across multi-stage transactions per Part 12 §7.10.2) and the staged `UpdateCertificateData`. - Schedules a deferred apply: waits for the response to flush, re-syncs the registry via `CertificateManager.UpdateAsync`, then calls `CloseChannelsForCertificate` on every listener that implements the capability. - Configurable grace period: new `IConfigurationNodeManager.ApplyChangesGracePeriod` (default 250 ms, negative clamped to zero). Hosts running over higher-latency administrative links can raise it. - Exposes `IConfigurationNodeManager.DrainPendingApplyChangesAsync(CancellationToken)` for tests/hosts to deterministically await rotation. - Removes the explicit 1-second `Task.Delay` TODO hack. * `Opc.Ua.Server.ITransportListenerRegistryProvider` — narrow opt-in interface on `ServerInternalData` exposing the live transport listener list. Lets `ConfigurationNodeManager` drive the fan-out without expanding `IServerInternal` (binary compat for mocked test fixtures). * Sessions are NOT closed. Per spec, the cut is on the SecureChannel only; existing `Session.IsSecureChannelValid` + `Session.Activate` rebind handles transfer over the new channel. ## Client side (#3160) The client SDK previously had no automatic detection of changes to its own certificate, trust list, or CRL — users had to call `Session.ReloadInstanceCertificateAsync` manually and trigger a reconnect. The spec-mandated `ApplicationCertificateUpdated`, `TrustListUpdated`, and `CrlUpdated` enum values existed but only the first was being emitted by `CertificateManager`. Key client/shared changes: * `CertificateManager` now emits `TrustListUpdated` and `CrlUpdated` from `WriteTrustListAsync` (per mask) and from `TrustListTransaction.CommitAsync` (after the atomic apply). The new internal `NotifyTrustListChanged` also invalidates cached peer/user/HTTPS validation cores so subsequent validations pick up the fresh trust state. * `ManagedSession.AutoReconnectOnCertificateChange` opt-in property (default `false` for backwards compat). When `true`, `ManagedSession` subscribes to `CertificateManager.CertificateChanges` on construction and, on the three relevant kinds: - Calls `Session.ReloadInstanceCertificateAsync` on `ApplicationCertificateUpdated` so the next ActivateSession is signed with the rotated client cert. - Triggers a reconnect via the state machine so the new state is honoured within milliseconds rather than at the next `SecurityTokenLifetime` rekey. * `ManagedSession.ApplicationCertificateChanged` event surfaces every observed change regardless of the auto-reconnect policy for diagnostics or custom rotation logic. * Subscription is disposed by the existing `Dispose` / `DisposeAsync` paths. ```csharp using var managed = await ManagedSession.CreateAsync( configuration, endpoint, sessionFactory); managed.AutoReconnectOnCertificateChange = true; managed.ApplicationCertificateChanged += (sender, e) => { Console.WriteLine($"observed {e.Kind} on {e.TrustList}"); }; ``` ## Tests \| Suite \| net10.0 \| net48 \| \|---\|---\|---\| \| `TransportListenerCertificateRotationTests` (new, 6 tests) \| ✅ \| ✅ \| \| `CertificateManagerTests` (4 new event tests) \| ✅ 22/22 \| ✅ 4/4 \| \| `PushCertManagement` \| 50/53 ✅ \| 50/53 ✅ \| \| `GDS PushTest` (focused subset) \| 15/15 ✅ \| 16/16 ✅ \| \| `Opc.Ua.Server.Tests` (focused subset) \| 38/38 ✅ \| 38/38 ✅ \| \| `GDS PushTest` (full) \| 313/338 ✅ \| — \| Skips are pre-existing (cert-type mismatches, optional methods) — no regressions. New integration test `PushTest.ApplyChangesForcesChannelRenegotiateAsync` positively asserts the stale channel fails with a recognized channel-invalidation status after `ApplyChanges`, and that a fresh reconnect succeeds with the rotated cert. ## Documentation - `Docs/CertificateManager.md` — new sections: - "Server-Side Certificate Rotation via Push (OPC UA Part 12 §7.10.9)" — `ITransportListenerCertificateRotation` contract + custom listener example. - "Client-Side Auto-Detection of Certificate Changes (issue #3160)" — `AutoReconnectOnCertificateChange` + `ApplicationCertificateChanged` event + the three covered scenarios. ## Related Issues - Fixes #3562 - Fixes #3160 ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [x] I ran focused tests locally using the UA.slnx projects against .net framework 4.8 and .net 10, and all passed. _(Full UA.slnx test run delegated to CI.)_ - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received.	2026-06-08 12:19:49 +02:00
Marc Schier	bc4c30034d	Fix CTT conformance issues #3719 , #3720 , #3723 , #3841 (#3851 ) # Description Fixes four CTT (OPC UA Compliance Test Tool) conformance gaps that the existing NUnit parity suite was silently passing while the CTT JS scripts kept failing: \| Issue \| Area \| Failing CTT script \| \|---\|---\|---\| \| #3719 \| Base Info Core Structure 2 \| `001.js` \| \| #3720 \| Base Info FiniteStateMachine + StateMachine Instance \| `initialize.js` + `001.js` \| \| #3723 \| Security None \| `007.js` (DoS, partially used channels) \| \| #3841 \| Alarms & Conditions \| Acknowledge Test_003, Alarm Test_002, Confirm Test_001 / Test_003 / Err_004, Enable Test_002, Non-Exclusive Limit Test_002 \| Across all four, the underlying pattern was the same — the NUnit parity tests were checking weaker invariants (DataType attribute instead of encoded Variant BuiltInType; `Assert.Ignore` instead of `Assert.Fail`; stub `GetEndpoints` instead of the real DoS scenario; method-call + Read instead of subscribe-and-validate-event-payload). So the suite gave false confidence on changes that would have failed CTT. Each commit below both strengthens the NUnit parity test to encode the same invariant CTT verifies, and fixes the server/model defect that the strengthened test surfaces. ## Commits ### `a1db2984c` Fix #3719 (BaseInfoCoreStructure) - Test: `BaseInfoServerTests.ReadConformanceUnitsAsync` now reads the value of `i=24101` and asserts `WrappedValue.TypeInfo.BuiltInType == BuiltInType.QualifiedName` AND `ValueRank == ValueRanks.OneDimension` — not just the DataType attribute. - Test: `BaseInformationTests.BrowseRequiresMandatoryMethodsAsync` now `Assert.Fail`s (not `Assert.Ignore`) when an expected mandatory method is missing on `i=15443` / `i=25440`. - Server: `Server_ServerCapabilities_ConformanceUnits` initialised with `Array.Empty<QualifiedName>().ToArrayOf()` so the encoded Variant carries QualifiedName type info even when empty. - Server: Added `AddSecurityGroup` / `RemoveSecurityGroup` (on `i=15443`) and `AddPushTarget` / `RemovePushTarget` (on `i=25440`) method nodes with input/output argument metadata and in-memory handlers in `Quickstarts.Servers/ReferenceServerConfigurationNodeManager`. ### `86d3041e5` Fix #3723 (Security None DoS off-by-one) - Server: Correct off-by-one in `Stack/Opc.Ua.Core/Stack/Tcp/TcpTransportListener.cs` channel eviction: - Condition was `MaxChannelCount == channelCount` (only triggered at exact equality); now `MaxChannelCount > 0 && channelCount >= MaxChannelCount` with a loop that evicts idle channels until the count is below the limit or no more idle channels remain. - Server: `UsedBySession` now properly tracks active sessions and clears on `CloseSession` (`TcpServerChannel`, `TcpListenerChannel`). - Note: the NUnit reproducer for this issue (`SecurityNoneDosTests`) stays on the `cttunit` branch (PR #3750) because it depends on the `TestFixture.CloseSharedFixtureSessionAsync` helper that only exists in `Tests/Opc.Ua.Conformance.Tests/`. The server fix on this branch is sufficient to make the CTT JS script pass. ### `2c98390c9` Fix #3720 (BaseInfoStateMachine GeneratesEvent) - Model: Add `GeneratesEvent` forward reference on `StateMachineType` (i=2299) and `FiniteStateMachineType` (i=2771) → `AuditUpdateStateEventType` (i=2315) in the design XML (`Tools/Opc.Ua.SourceGeneration.Core/Design/StandardTypes.xml`); regenerated `Stack/Opc.Ua.Core/Schema/Opc.Ua.NodeSet2.xml`. - Server: Remove the runtime workaround in `DiagnosticsNodeManager` that previously injected this reference at load time — now redundant because the reference ships in the NodeSet at compile time. - Test: New `BaseInfoStateMachineInstanceTests.StateMachineTypeHasGeneratesEventReferenceAsync` walks the type hierarchy looking for `GeneratesEvent` with `IncludeSubtypes=true` and asserts the target resolves to a `BaseEventType` subtype (matches the CTT walk). - Per OPC UA Part 16 §4.4.5 / Part 5 §6.4.2. ### `09f551449` Strengthen A&C conformance event tests (#3841) - Test fixture: New `AlarmEventCollector` (476 LOC) — subscribes to events on `i=Server` with a full A&C event filter (`Comment`, `Retain`, transition times, all condition-state Ids); per-condition event log; `WaitForEventAsync(conditionId, predicate, timeout)` for synchronisation. Uses async `IAsyncDisposable` cleanup. - Tests rewritten to subscribe to events and validate event payload (`Comment.Text`, `Retain`, `TransitionTime`): - `Acknowledge Test_003` — empty comment + locale propagates to event payload; `Retain=false` afterwards - `Alarm Test_002` — full `ActiveState` cycle Active → Normal with Acknowledge + Confirm; every transition event validated - `Confirm Test_001` — unique comment reaches event payload; `ConfirmedState/Id=true` - `Confirm Test_003` — Acknowledge → wait event → Confirm with empty comment - `Confirm Err_004` — two concurrent sessions; second Confirm asserts specifically `BadConditionBranchAlreadyConfirmed` (not a generic `BadInvalidState`) - `Enable Test_002` — Disable + Enable via both type method and discovered instance method; NO events during disabled period; `TransitionTime` within call window; `Retain` flips - `Non-Exclusive Limit Test_002` — mirror for `NonExclusiveLimitAlarmType` - Server fixes in `Stack/Opc.Ua.Core.Types/State/AcknowledgeableConditionState.cs`, `Quickstarts.Servers/Alarms/AlarmHolders/`, and `AlarmNodeManager` for: Comment propagation, Retain clearing, TransitionTime updates, and a dedicated ack-only condition instance (`AcknowledgeableConditionHolder`). ## Verification - `dotnet build UA.slnx` — 0 errors, 42 pre-existing warnings. - `dotnet test Tests/Opc.Ua.InformationModel.Tests` filtered for the new + master `StateMachineGeneratesEvent` / `BaseInfoServer` / `BaseInformation` tests — 6/6 pass. - `dotnet test Tests/Opc.Ua.History.Tests --filter AlarmsAndConditions` — 141/144 pass; the 3 occasional failures in `DisableEnableViaTypeAndInstanceMethodNoEventsDuringDisabledAsync` pass when re-run in isolation, consistent with the known A&C suite CI flakiness pattern. ## Related Issues - Fixes #3719 - Fixes #3720 - Fixes #3723 - Fixes #3841 Related: PR #3750 (`cttunit`) carries the same fixes plus the conformance-test-project versions of the strengthened NUnit tests. Either this PR or that one will land first; the other should be rebased afterwards. ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [ ] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [x] I ran all* tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received. --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-06-08 07:47:48 +02:00
Suciu Mircea Adrian	f69ff78702	Use request.SessionId instead of request.Session.Id in the ReportAuditCancelEvent call from CancelRequests (#3850 ) Use request.SessionId instead of request.Session.Id in the ReportAuditCancelEvent call from CancelRequests to avoid accessing Session in case ActivateSession # Description Cancel service is returning BadUnexpectedError because audit reporting crashes on request.Session.Id in case the ActivateSession service call is in-flight and its cancelation is requested becasue Session is null. - Fixes #3848 ## Checklist _Put an `x` in the boxes that apply. You can complete these step by step after opening the PR._ - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [ ] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [ ] I have added all necessary documentation. - [ ] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received.	2026-06-05 21:27:15 +03:00
Marc Schier	2966f693b2	2.0 Migration Analyzer and codefixer with Agent update (#3820 ) Introduces `OPCFoundation.NetStandard.Opc.Ua.MigrationAnalyzer` — a single NuGet package that ships three Roslyn components + a runtime shim to make the 1.5.378 → 2.0 upgrade as close to "install package, run `dotnet format`, remove package" as possible: \| DLL \| Where \| Purpose \| \|-----\|-------\|---------\| \| `Opc.Ua.MigrationAnalyzer.dll` \| `analyzers/dotnet/cs/` \| 19 Roslyn analyzers (`UA0001`–`UA0022`) covering every breaking-change pattern in [`Docs/MigrationGuide.md`](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/Docs/MigrationGuide.md). Built against the stable Roslyn 4.14 analyzer API — loads cleanly in csc.exe (no `Microsoft.CodeAnalysis.Workspaces` reference). \| \| `Opc.Ua.MigrationAnalyzer.CodeFixer.dll` \| `analyzers/dotnet/cs/` \| 14 companion `CodeFixProvider`s; loaded only by Workspaces-aware hosts (Visual Studio, `dotnet format analyzers`). \| \| `Opc.Ua.MigrationAnalyzer.Generator.dll` \| `analyzers/dotnet/cs/` \| Roslyn `IIncrementalGenerator` that emits per-consumer `internal sealed [Obsolete] class <Name>Collection : List<TElement>` shims for every `<Type>Collection` wrapper the consumer references — including arbitrary model-compiled `<UserType>Collection` patterns, not just the 30 well-known built-in ones. \| \| `Opc.Ua.MigrationAnalyzer.Core.dll` \| `lib/<tfm>/` for `net472, net48, netstandard2.1, net8.0, net9.0, net10.0` \| 1.5.378 → 2.0 runtime compatibility shim. Re-exposes the obsolete extension surface so 1.5.378-style call sites keep compiling against 2.0 with warnings instead of errors. \| ### Migration workflow the package enables 1. *Bump every `OPCFoundation.NetStandard.Opc.Ua.` PackageReference to `2.0.-`. 2. Add the migration package** as a build-only dependency: ```xml <PackageReference Include="OPCFoundation.NetStandard.Opc.Ua.MigrationAnalyzer" Version="2.0.-" PrivateAssets="all" /> ``` 3. Run `dotnet build`. The Core shim DLL re-supplies obsolete extension members; the source generator covers `<Type>Collection` references; what remains are `[Obsolete]` warnings + `UA00xx` analyzer diagnostics + (occasionally) `MIG01` for unresolvable model-compiled element types. 4. Apply auto-fixes in the IDE or from the command line: ```bash dotnet format analyzers <solution>.sln \ --diagnostics UA0002 UA0003 UA0004 UA0005 UA0006 UA0007 UA0008 \ UA0009 UA0010 UA0012 UA0014 UA0019 UA0020 UA0022 \ --severity warn ``` 5. Walk the residual `UA0001` / `UA0011` / `UA0015` / `UA0018` / `UA0021` diagnostics manually — they cover patterns that require human judgement. 6. Remove the migration package. You are now on clean 2.0 with no shim dependency. ### Source generator (`Opc.Ua.MigrationAnalyzer.Generator.dll`) Per-consumer Roslyn `IIncrementalGenerator` that emits `.g.cs` files for every `<Name>Collection` reference in the consumer's compilation that fails to bind: - Catalog override (30 entries) — pins element types that renamed across the 1.5.378 → 2.0 boundary: `DateTime`→`DateTimeUtc`, `Guid`→`Uuid`, `byte[]`→`ByteString`, `XmlElement`→`Opc.Ua.XmlElement`, plus the primitives and built-in opc types whose element name didn't rename. - Semantic lookup — for model-compiled `<UserType>Collection` patterns the model compiler historically emitted for any user-defined complex type. Strips the `Collection` suffix, runs `Compilation.GetSymbolsWithName` against the unique element short name, emits the shim with the fully-qualified type reference. - `MIG01` diagnostic — fires when the element type can't be uniquely resolved (zero or multiple candidates). User adds the missing `using` or migrates the site manually. Each generated file emits a class shaped exactly like the 1.5.378 wrapper: ```csharp [global::System.Obsolete("'Int32Collection' was removed in 2.0. Use 'List<int>' or 'ArrayOf<int>' instead. (UA0002)")] internal sealed class Int32Collection : global::System.Collections.Generic.List<int> { public Int32Collection() { } public Int32Collection(int capacity) : base(capacity) { } public Int32Collection(global::System.Collections.Generic.IEnumerable<int> collection) : base(collection) { } public static implicit operator global::Opc.Ua.ArrayOf<int>(Int32Collection? value) => value is null ? default : value.ToArrayOf(); } ``` Design choice — `internal` (not `public`): the generated shim never leaks through the consumer's public API surface. Consumers with public methods or properties returning a `<Type>Collection` will hit `CS0050: Inconsistent accessibility` — the intended signal that the public surface must migrate to `List<T>` / `ArrayOf<T>` first; internal call sites keep compiling under the shim so iteration is incremental. ### 19-rule analyzer reference \| Rule \| Replaces \| Default \| Auto-fix \| \|------\|----------\|---------\|----------\| \| `UA0001` \| `Utils.Trace` / `Utils.LogX` \| Info \| No (telemetry plumbing requires manual review) \| \| `UA0002` \| Removed `<Type>Collection` wrappers \| Warning \| Yes (→ `List<T>` / `ArrayOf<T>`); the source generator keeps the call site compiling in the meantime \| \| `UA0003` \| `x == null` on now-struct built-ins \| Warning \| Yes (→ `x.IsNull`) \| \| `UA0004` \| `?.` on now-struct built-ins \| Warning \| Yes (drop the `?`) \| \| `UA0005` \| `byte[]` where `ByteString` is expected \| Warning \| Yes (append `.ToByteString()`) \| \| `UA0006` \| `new Variant(object\\|DateTime\\|Guid\\|byte[])` \| Warning \| Yes (→ `Variant.From(...)`) \| \| `UA0007` \| `new NodeId(string)` / `new ExpandedNodeId(string)` \| Warning \| Yes (→ `Parse`) \| \| `UA0008` \| `Session.Call(..., params object[])` \| Warning \| Yes (wrap with `Variant.From`) \| \| `UA0009` \| `[DataContract]` / `[DataMember]` on config extensions \| Warning \| Yes (→ `[DataType]` / `[DataTypeField]`) \| \| `UA0010` \| `using` / `Dispose` on `CertificateIdentifier` / `UserIdentity` / `IUserIdentityTokenHandler` \| Warning \| Yes (drop the disposable) \| \| `UA0011` \| Sync `IUserIdentityTokenHandler.{Encrypt,Decrypt,Sign,Verify}` \| Info \| No (async promotion required) \| \| `UA0012` \| `CertificateFactory.` static helpers \| Warning \| Yes (→ instance methods) \| \| `UA0014` \| `DataValue.IsGood(dv)` static helper \| Warning \| Yes (→ `dv.IsGood`) \| \| `UA0015` \| Sync / APM members on GDS / LDS clients \| Info \| No (async promotion required) \| \| `UA0018` \| `CertificateIdentifier.Certificate` getter \| Info \| No (→ `LoadCertificate2Async`) \| \| `UA0019` \| `new DataValue(StatusCode[, ts])` \| Warning \| Yes (→ object-initializer form) \| \| `UA0020` \| `EncodeableFactory.GlobalFactory` / `Create()` \| Warning \| Yes (→ `ServiceMessageContext.Factory` / `Fork()`) \| \| `UA0021` \| `CertificateValidator` / `CertificateValidationEventArgs` (structural rename) \| Info \| No (see migration guide §Certificate validation) \| \| `UA0022` \| `ApplicationConfiguration.CertificateValidator` / `ServerBase.CertificateValidator` property rename \| Warning \| Yes (→ `.CertificateManager`) \| Plus one generator-only diagnostic: \| Rule \| Source \| Default \| Triggers \| \|------\|--------\|---------\|----------\| \| `MIG01` \| Generator \| Warning \| Generator can't uniquely resolve the element type for a `<Foo>Collection` reference (zero or multiple candidates). The user adds a `using` for the namespace defining `Foo`, or migrates the call site manually. \| ### Runtime shim coverage (`Opc.Ua.MigrationAnalyzer.Core.dll`) C# 14 `extension` members so 1.5.378 call sites continue to compile: - Moved obsolete extensions* the 2.0 libraries no longer carry inline: `NodeId` / `Variant` / `DataValue` null-check helpers, `Session` sync helpers, `Subscription` sync helpers, `ApplicationInstance` helpers, `ServerBase.Start` / `Stop`, `TransportChannel` APM, `ChannelBase` static factory methods, etc. - New shims for genuinely-removed members: `EncodeableFactory.GlobalFactory`, `CertificateIdentifier.Certificate` (throws), sync wrappers for `IUserIdentityTokenHandler.{Encrypt,Decrypt,Sign,Verify}`, sync + APM wrappers for the GDS / LDS client APIs, `GlobalDiscoverySampleServer` 1.5.378-shape ctor (in-tree `Libraries/Opc.Ua.Gds.Server.Common/`). > ⚠ The sync shims wrap their `Async` counterparts via `Task.Run(…).GetAwaiter().GetResult()`. Intended as a migration aid only* — port to `await` before shipping. ### Repo layout ``` Tools/Opc.Ua.MigrationAnalyzer/ # analyzer DLL Analyzers/UA00xxAnalyzer.cs # 19 DiagnosticAnalyzer impls Diagnostics/{DiagnosticIds,Descriptors,WellKnownProperties}.cs Helpers/{SymbolExtensions,UaSymbols}.cs Opc.Ua.MigrationAnalyzer.nuspec # ships all 3 analyzer DLLs + 6-TFM Core OPCFoundation.NetStandard.Opc.Ua.MigrationAnalyzer.props Tools/Opc.Ua.MigrationAnalyzer.CodeFixer/ # code-fix DLL CodeFixes/UA00xxCodeFix.cs # 14 CodeFixProvider impls Tools/Opc.Ua.MigrationAnalyzer.Generator/ # source generator DLL (NEW) MigrationGenerator.cs # IIncrementalGenerator CollectionShimCatalog.cs # 30-entry element-type overrides Diagnostics/GeneratorDiagnostics.cs # MIG01 Tools/Opc.Ua.MigrationAnalyzer.Core/ # runtime shim (multi-TFM) Client/, Configuration/, Core/, Gds.Client.Common/, Types/, Marker/ Tools/Roslyn.slnx # source-gen + migration projects Tests/Opc.Ua.MigrationAnalyzer.Tests/ # 142 tests Analyzers/UA00xxTests.cs # 107 analyzer + code-fix tests Generators/MigrationGeneratorTests.cs # 35 generator tests (NEW) Tests/Opc.Ua.MigrationAnalyzer.Core.Tests/ # 13 runtime-shim tests ``` ### Documentation - [`Docs/MigrationGuide.md`](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/Docs/MigrationGuide.md) — §3 Collection Type Migration gains a tip pointing at the generator so CS0246 is replaced with `[Obsolete]` warnings + UA0002. - [`.github/agents/opcua-v20-migration.agent.md`](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/.github/agents/opcua-v20-migration.agent.md) — Strategy section mentions the three Roslyn components + runtime shim explicitly, plus the MIG01 diagnostic and the "internal-by-design" CS0050 hint. ### Central package pinning `Directory.Packages.props` pins `Microsoft.CodeAnalysis.` (Common, CSharp, CSharp.Workspaces, Workspaces.Common) to 4.14.0* — the stable analyzer API surface. The earlier 5.3 pin was the csc-internal version, which is not safe for analyzer hosts. ### Dogfood story The full 42-sample dogfood against `OPCFoundation/UA-.NETStandard-Samples` surfaced a critical analyzer-loader bug in an earlier iteration: the analyzer DLL initially co-shipped its code-fix providers in one assembly, which transitively referenced `Microsoft.CodeAnalysis.Workspaces.dll`. csc.exe's analyzer host ships only `Microsoft.CodeAnalysis.dll` + `CSharp.dll` in its bincore and silently swallows load failures — net result: zero diagnostics across all samples. Fix landed in commit `861fa6ee1`: 1. Split the assembly: analyzer in `Opc.Ua.MigrationAnalyzer.dll` (Workspaces-free, csc-safe), code-fixes in `Opc.Ua.MigrationAnalyzer.CodeFixer.dll` (Workspaces-aware, IDE-only). 2. Downgrade to Roslyn 4.14 — the stable analyzer API. 3. `/p:ReportAnalyzer=true` confirms all 19 analyzers initialise and execute on real consumer code. This PR's new generator was smoke-tested against a minimal consumer that exercises all 30 catalog entries + a model-compiled element type + the unresolvable case: - 30 catalog patterns + model-compiled `MyThingCollection` → all emit shims, fire CS0618 with `(UA0002)` marker - Element-type renames verified: `DateTimeCollection` → `DateTimeUtc`, `ByteStringCollection` → `ByteString`, `GuidCollection` → `Uuid`, etc. - `NeverHeardOfItCollection` → `MIG01` fires with help link to the migration guide Known compatibility gaps (documented in the migration agent): - Legacy WinForms `.Net4` sample projects use pre-SDK MSBuild XML and ignore `Directory.Build.targets` `<PackageReference>` injection — consumers in this format must add the migration package to their csproj inline. ### Packaging design notes - Hand-authored nuspec ships 3 DLLs in `analyzers/dotnet/cs/` + 6 TFMs of Core (shim) DLLs under `lib/`. All 6 OPC UA runtime package dependencies are declared per-TFM-group. - `build/OPCFoundation.NetStandard.Opc.Ua.MigrationAnalyzer.props` is auto-imported by NuGet (file name must match package id exactly) and injects all three analyzer DLLs as `<Analyzer>` items. - `DiagnosticIds.cs` / `DiagnosticDescriptors.cs` / `WellKnownProperties.cs` / `Helpers/.cs` are shared via `<Compile Link=…>`* between the analyzer and code-fixer projects to break what would otherwise be a NuGet restore cycle. The generator has no compile dependency on the analyzer; the 30-entry override table is duplicated in `CollectionShimCatalog.cs` (the analyzer table also drives diagnostic messages, so the duplication is small and intentional). - `Opc.Ua.MigrationAnalyzer.Core` is multi-TFM (`net472, net48, netstandard2.1, net8.0, net9.0, net10.0`) and non-packable on its own; the parent migration package's nuspec consumes each TFM's DLL by path.	2026-06-05 12:01:53 +02:00
Marc Schier	81b3c9b371	[Server] Implement NodeManagement service set and fix DeleteAddressSpace (#3839 ) # Description Adds the OPC UA NodeManagement service set (AddNodes / DeleteNodes / AddReferences / DeleteReferences) to the server SDK and fixes a long-standing shutdown bug where `NodeState.Delete` callbacks never fired on address-space teardown. ### NodeManagement service set (#3736) - New optional `INodeManagementAsyncNodeManager` facet interface (added to `INodeManager.cs` alongside other facets, discovered via `as`, not part of the `IAsyncNodeManager` composite). Opt-in per NodeManager via `AllowNodeManagement` — default is `false` so existing NodeManagers preserve binary compatibility. - Dispatcher in `MasterNodeManager` routes: - AddNodes by `RequestedNewNodeId.NamespaceIndex` when supplied, otherwise to the parent's owning NodeManager. When the parent's owner is read-only (e.g. `ObjectsFolder` owned by `CoreNodeManager`), the dispatcher falls back to the first opted-in NodeManager so conformance flows work out of the box. - DeleteNodes / AddReferences / DeleteReferences to the owning NodeManager of the target or source node, returning `BadUserAccessDenied` when that NodeManager has not opted in. Cross-NodeManager `AddReference` / `DeleteReference` best-effort mirrors the inverse edge on the target's NodeManager. - `AsyncCustomNodeManager` provides a default implementation: per-item validation, `RequestedNewNodeId` honored, browse-name dedup for both local and cross-NodeManager parents, `DeleteTargetReferences` semantics, and a NodeId allocator fallback when an `INodeIdFactory.New` override returns a null `NodeId` (e.g. parent-based hierarchical naming with no parent attached). - `StandardServer` adds the four service overrides plumbed through `OperationLimits.MaxNodesPerNodeManagement`, audit events, and `OnRequestComplete`; new `ReportAuditAddReferencesEvent` / `ReportAuditDeleteReferencesEvent` helpers in `AuditEvents`. - Quickstarts `ReferenceNodeManager` opts in via `AllowNodeManagement => true`; the legacy partial-class override in `ReferenceServer.NodeManagement.cs` is removed. ### `NodeState.Delete` on shutdown (#3762) - `CustomNodeManager.DeleteAddressSpace` and `AsyncCustomNodeManager.DeleteAddressSpaceAsync` now snapshot root `PredefinedNodes` (skipping children whose parent is in the snapshot to prevent double-fire), invoke `NodeState.Delete(SystemContext)` on each root (which recurses into children and raises `OnBeforeDelete` / `OnAfterDelete` / `NodeStateChangeMasks.Deleted`), and then clear the map. - Derived overrides in Quickstarts `ReferenceNodeManager`, `SampleNodeManager`, and `FileSystemNodeManager` chain to `base` so the callback fires for their nodes too. ### Tests - 21 new dispatcher unit tests in `Tests/Opc.Ua.Server.Tests/NodeManager/AsyncCustomNodeManagerNodeManagementTests.cs` covering `AllowNodeManagement` default/opt-in, AddNode validation (`BadBrowseNameInvalid`, `BadParentNodeIdInvalid`, `BadNodeIdRejected`, `BadNodeIdExists`, `BadBrowseNameDuplicated`, `BadNodeClassInvalid`), RequestedNewNodeId paths, DeleteNode + `DeleteTargetReferences`, AddReference duplicate detection (`BadDuplicateReferenceNotAllowed`), and DeleteReference (`BadNoMatch`). - 2 new DeleteAddressSpaceAsync tests in `AsyncCustomNodeManagerTests` verifying `NodeState.Delete` invocation and no double-fire on children. - Updated InformationModel `NodeManagementAddRefTests.AddReferenceBetweenExistingNodesSucceedsAsync` to accept `BadUserAccessDenied` / `BadNotSupported` when the source NM has opted out. - Full `Opc.Ua.Server.Tests` on net10.0: 1709 passed, 0 failed. - All 26 InformationModel `Category=NodeManagement` conformance tests pass against the reference server (1 skipped where source NM opts out). ### Docs - New [`Docs/NodeManagement.md`](Docs/NodeManagement.md) with architecture, opt-in pattern, dispatch and routing rules, request-handling table, error-code table, audit events, and custom-behavior examples. - `Docs/MigrationGuide.md` gets two new sections — NodeManagement service set (downstream migration steps) and DeleteAddressSpace invokes NodeState.Delete (#3762) (shutdown behavior change) — with TOC entries. - `Docs/README.md` links the new `NodeManagement.md`. ## Related Issues - Fixes #3736 - Fixes #3762 ## Checklist _Put an `x` in the boxes that apply. You can complete these step by step after opening the PR._ - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received.	2026-06-04 13:02:32 +02:00
Marc Schier	4756e7c245	DI (OPC 10000-100) with samples (Pump, SW Update), fluent API gap closures and model dependency implementation (#3808 ) This PR implements the OPC UA Device Integration (DI, OPC 10000-100) companion-spec library trio (`Opc.Ua.Di` / `Opc.Ua.Di.Server` / `Opc.Ua.Di.Client`) plus a worked example (`Applications/MinimalPumpServer`) demonstrating the OPC 40223 Pumps companion specification end-to-end with full simulation. It also closes 11 fluent-API gaps in `Opc.Ua.Server.Fluent`, three source-generator bugs, integrates the DI layer into the unified `services.AddOpcUa()` Microsoft.Extensions DI hosting pattern, and adds 250+ new tests. Worked example — `Applications/MinimalPumpServer/` - AOT-compatible console host using `Host.CreateApplicationBuilder` + `AddOpcUa()`. - `PumpNodeManager` inherits from `DiNodeManager`; multi-namespace (DI + Machinery + Pumps) via runtime NodeSet2 loading and `ModelLoaderBuilder`. - Demonstrates declarative second-pump creation via `.ConfigureDevicesFor<PumpNodeManager>(...)` and software-package seeding from the same configurator. - Full simulation: pressure, temperatures, power, flow, efficiency, level, cavitation/overheat fault injection, alarm setup, NAMUR-style supervision. Documentation - `Docs/Opc.Ua.Di/` — README, DeviceBuilder, Hosting, LockService, SoftwareUpdate, ClientHelpers (6 new developer guides). - `Docs/Opc.Ua.Di/ComplianceMatrix.md` — every DI declaration mapped to In-v1 / Generated / Deferred / Excluded. - `Docs/CompanionSpecLibraries.md` — packaging guide for new companion-spec libraries. - `Docs/FluentApiGaps.md` — historical record of G1–G11. - `Docs/SourceGeneratedNodeManagers.md` updated for richer node managers. - `Docs/plans/StateMachineBuilder.md` — deferred state-machine builder design.	2026-06-04 05:57:57 +02:00
Marc Schier	dbc09b8e22	Adopt System.TimeProvider across the stack (fixes #2458 ) (#3829 ) # Description Adopt [`System.TimeProvider`](https://learn.microsoft.com/dotnet/api/system.timeprovider) across the stack so that every place that creates timers, runs duration math, or schedules periodic work is mockable, deterministic in tests, and immune to wall-clock changes. The migration touches Core, Core.Types, Server, Client, PubSub, Configuration, Gds (server + client), Lds, and the Quickstarts/Console reference apps. Per-component changes follow the same pattern: 1. Add a `private readonly TimeProvider m_timeProvider;` field. 2. Accept a nullable `TimeProvider? timeProvider = null` as the last constructor parameter (new overload; legacy constructor stays for binary compatibility and delegates with `timeProvider: null`). 3. Initialise the field with `m_timeProvider = timeProvider ??= TimeProvider.System;`. 4. Replace `new Timer(...)`, `Stopwatch`, `HiResClock.`, `DateTime.UtcNow`-based duration math, and `Task.Delay(delay, ct)` in timing loops with the matching `m_timeProvider` API (`CreateTimer`, `GetTimestamp` / `GetElapsedTime`, `GetUtcNow().UtcDateTime`, `Task.Delay(delay, m_timeProvider, ct)`). 5. Wire the provider through DI: `AddOpcUaServerBuilder` / `AddOpcUaClientBuilder` register `TimeProvider.System` via `TryAddSingleton<TimeProvider>()` so tests can swap in `Microsoft.Extensions.Time.Testing.FakeTimeProvider`. `HiResClock` itself is kept (so the `ApplicationConfiguration.DisableHiResClock` schema flag still round-trips), but every public member* is now `[Obsolete]` with a single shared message pointing to the new migration-guide section. The few internal call sites that still need to set/read `HiResClock` are wrapped with `#pragma warning disable CS0618`. ### Highlights per component - Core / Stack — `Opc.Ua.Core`, `Opc.Ua.Core.Types`, channel pipeline (`UaSCBinaryClientChannel`, `ChannelToken`, `UaSCBinaryChannel`), `ApplicationConfiguration`, certificate validators, `JwksIssuerKeyResolver`, `TimeProviderExtensions` polyfills (`GetTimestampMilliseconds`, `GetTickCount`, `CancellationTokenSource(timeout, timeProvider)`, `Task.Delay(delay, provider, ct)` polyfill for older TFMs). - Server — session lockout, subscription pipeline (publish/sample/keep-alive/lifetime), `MonitoredItemQueue`, alarm sampling rate, `IntervalRunner`, server diagnostics, configuration state machines, hosted services. - Client — `Session`, managed/V2 subscription engines, reconnect handlers, channel keep-alive, periodic publishing, complex-type discovery polling. - PubSub — `IntervalRunner` pipeline, message-receive timers, MQTT/UDP keep-alive, publishers/readers. - Gds / Lds — `LdsServer`, `LinqApplicationsDatabase` expiry housekeeping, GDS clients (push, pull), `DirectoryCertificateStore`, `ConnectionStateMachine`, classic subscription engine. - Quickstarts / Console samples — `SampleNodeManager`, `ReferenceNodeManager`, `AlarmNodeManager`, `BoilerState`, `MemoryBufferState`, `PublishedValuesWrites`. Samples resolve via `(Server as ITimeProviderProvider)?.TimeProvider ?? TimeProvider.System` so existing ctor signatures stay binary-compatible. - Tests — `Opc.Ua.PubSub.Tests` adds `IntervalRunnerTests`; existing `SubscriptionTests`, `UaPublisherTests`, and `TestDataSystem` move off `HiResClock`. Added `Microsoft.Extensions.TimeProvider.Testing` package for `FakeTimeProvider` (project-load warning surfaces on net48/net472 only — runtime is .NET 8+). ### Migration guide New section [Time and Timer abstraction (`TimeProvider`)](Docs/MigrationGuide.md#time-and-timer-abstraction-timeprovider) documents: - The canonical replacement table (`HiResClock.UtcNow` → `timeProvider.GetUtcNow().UtcDateTime`, `HiResClock.TickCount64` → `timeProvider.GetTimestamp()`, `new Timer` → `timeProvider.CreateTimer`, `Task.Delay(delay, ct)` → `Task.Delay(delay, timeProvider, ct)`, …). - The `TimeProvider? timeProvider = null` + `??=` constructor pattern. - DI wiring and how to swap in `FakeTimeProvider` in tests. - Before/after snippets for `HiResClock.TickCount64`, `HiResClock.UtcNow`, and `new Timer(...)`. ## Related Issues - Fixes #2458 ## Checklist - [x] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [ ] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [ ] I have addressed all PR feedback received.	2026-06-03 22:38:32 +02:00
Copilot	b3518b53df	[Server]: Queue Events from the Server Node using multiple channel consumers (#3823 ) # Description This pull request introduces a scalable consumer task model for the `MonitoredNode2` class, optimizing the handling of event notifications for notifier nodes. Any notifier node can opt into (or out of) dynamic scaling of consumer tasks based on the number of event monitored items, improving throughput and responsiveness under high event loads. The Server node (`ObjectIds.Server`) is always auto-opted-in. The implementation includes safe scaling up and down of consumers, robust disposal logic, Fluent API integration, and tests to verify correct delivery of events. Scalable consumer task management: * Added an `enableMultipleEventConsumers` constructor parameter to `MonitoredNode2` that enables dynamic scaling of consumer tasks to match the number of event monitored items. The Server node (`ObjectIds.Server`) always auto-opts-in regardless of this parameter. * Added `AllowMultipleEventConsumers(NodeId, bool enable = true)` protected method on `AsyncCustomNodeManager` with an internal `MultiConsumerNodeIds` registry, so any node manager can programmatically opt in or out specific nodes. * Added `IsMultipleEventConsumerNode(NodeId)` to the `IAsyncNodeManager` interface, allowing consumers to query multi-consumer opt-in status through the interface without casting to `AsyncCustomNodeManager`. * Both `MonitoredNodeMonitoredItemManager` and `SamplingGroupMonitoredItemManager` use the `IAsyncNodeManager` interface method when creating `MonitoredNode2` instances. Fluent API integration: * Added `AllowMultipleEventConsumers(bool enable = true)` method to `INodeBuilder` and its `NodeBuilder` implementation, allowing any notifier node to be opted in or out via the fluent builder pipeline (e.g. `builder.Node("myNotifier").AllowMultipleEventConsumers()`). * The `NodeManagerBuilder` routes the registration to the owning `AsyncCustomNodeManager`'s multi-consumer registry, supporting both opt-in and opt-out. Testing and verification: * Added unit tests to verify multi-consumer behavior for both Server node (auto-opt-in) and non-Server nodes (explicit opt-in), as well as default single-consumer behavior for nodes without opt-in. * Fixed race condition in permission cache tests (`OnMonitoredNodeChanged_DefaultPermissionsChanged_CacheInvalidated` and `InvalidatePermissionCacheForSession` tests) that caused flaky CI failures. The tests now signal on `QueueValue` (which fires after the cache is populated) instead of `ValidateRolePermissionsAsync` (which fires before), ensuring cache invalidation operates on a populated cache. ## Related Issues ## Checklist - [ ] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [ ] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [ ] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [x] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [x] I have addressed all PR feedback received. --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>	2026-06-02 07:14:36 +02:00
Marc Schier	0000513cde	Pluggable user-identity provider model (#3807 ) # Description Introduces a pluggable user-identity provider model covering all OPC UA Part 6 §6.5 mechanisms (Anonymous, UserName, X509, IssuedToken/JWT) on both client and server, with full `Microsoft.Extensions.DependencyInjection` integration, plus the Part 12 §9 `AuthorizationService` two-phase token-request flow including refresh-token rotation, the Part 12 §8 KeyCredential Push model, and a clean provider model for OPC 10000-12 §7.2 `ApplicationSelfAdmin`. The work is split across phase-by-phase commits so it can be reviewed independently; nothing here changes wire-level behaviour or forces existing applications to migrate. ### Documentation All under `Docs/`: - `IdentityProviders.md` — full developer guide: three-layer model, recipes, configuration reference, "what gets auto-wired" matrix, JWS algorithm table, identity-augmenters section, "Implementing your own provider" how-to subsections for Entra / OIDC / Windows / AspNetCore (sibling files merged in per review feedback). - `DependencyInjection.md` — `Identity` sections with `appsettings.json` examples, identity-extension matrix, `WithAuthorizationService` + `WithKeyCredentialPush` + `AddIdentityAugmenter` extensions documented. - `RoleBasedUserManagement.md` — claim-criteria callout describing `IIdentityClaims` probe surface. - `AuthorizationService.md` — Architecture diagram + `IAccessTokenProvider` conceptual narrative restored from master; modern `StartRequestToken` / `FinishRequestToken` flow leads; refresh-token recipe added. - `KeyCredentialService.md` — Push model + Pull vs Push vs Bridge decision matrix + Hybrid (Push + Pull) section; explicit experimental warning for the bridge. - `GDS.md` — KeyCredential Push, `StartRequestToken`, `GdsApplicationSelfAdminProvider`, shipped Refresh-token support with rotation policy and audit semantics all documented. - `MigrationGuide.md` — User Identity Providers section listing `[Obsolete]` markers + mechanical recipes; SelfAdmin migration via `IIdentityAugmenter`; `EnableRefreshTokens` default note. - `README.md` index entries. ## Checklist - [x] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf) and read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added all necessary documentation. - [x] I have verified that my changes do not introduce (new) build or analyzer warnings. - [x] I ran all tests locally using the UA.slnx solution against at least .net framework and .net 10, and all passed. - [x] I fixed all failing and flaky tests in the CI pipelines and all CodeQL warnings. - [x] I have addressed all PR feedback received.	2026-06-02 01:14:54 +02:00
Marc Schier	01d7162313	Part 9 Alarms & Conditions: complete server + client implementation (#3805 ) Complete implementation of OPC UA Part 9 ΓÇö Alarms & Conditions for both server and client, OPC UA Part 16 ΓÇö State Machines (generic extensible client + server API), and the supporting infrastructure (source-generated event records, source-generated ObjectType proxies, `IAsyncEnumerable` streaming subscriptions, address-space model change tracking, per-node `INodeCache` invalidation, unified DI integration). ### Server-side (Part 9 complete) - `AlarmConditionState` ΓÇö every Part 9 method wired automatically in `OnAfterCreate`: `Silence`, `Suppress`/`Suppress2`, `Unsuppress`/`Unsuppress2`, `RemoveFromService`/`RemoveFromService2`, `PlaceInService`/`PlaceInService2`, `Reset`/`Reset2`, `GetGroupMemberships`. Each method generates the spec-mandated audit event and supports an optional veto-delegate hook. - Latched alarms ΓÇö `ActiveState` reflects real process state; `LatchedState` persists until explicit `Reset` (with full precondition validation). - Re-alarming ΓÇö `ProcessReAlarm`/`ResetReAlarmRepeatCount`/`IsReAlarmEnabled` helpers (opt-in, no hidden timer). - Audible alarms ΓÇö `UpdateAudibleState` for `AudibleEnabled`/`AudibleSound`/`SilenceState` lifecycle. - Suppression + groups ΓÇö `AlarmGroup`, `AlarmSuppressionEngine` (with first-in-group), `AlarmRateTracker` (for `AlarmMetricsType`). - Spec-compliance fixes ΓÇö `SuppressedOrShelved` now includes `OutOfServiceState`; `GetRetainState` includes `LatchedState`; `EffectiveDisplayName` composition includes `OutOfServiceState` + `LatchedState`. ### Client-side Part 9 API - `AlarmClient` ΓÇö typed Part 9 operations. Each method delegates to the matching source-generated `TypeClient` proxy (`ConditionTypeClient`, `AcknowledgeableConditionTypeClient`, `AlarmConditionTypeClient`, `DialogConditionTypeClient`, `ShelvedStateMachineTypeClient`) ΓÇö one source of truth for every method NodeId. - Interface hierarchy* ΓÇö `IConditionOperations` ΓåÆ `IAcknowledgeableConditionOperations` ΓåÆ `IAlarmOperations` + `IDialogConditionOperations`. - Source-generated event records ΓÇö new `EventRecordGenerator` (alongside `ObjectTypeProxyGenerator`) emits `{Type}TypeRecord` per OPC UA event type: `ConditionTypeRecord` ΓåÆ `AcknowledgeableConditionTypeRecord` ΓåÆ `AlarmConditionTypeRecord` ΓåÆ `LimitAlarmTypeRecord`/`ExclusiveLimitAlarmTypeRecord`/ΓÇª all the way to vendor subtypes. Vendor alarm types get records automatically. - `AlarmEventDecoder` ΓÇö decodes `EventNotification.Fields` into the most-specific generated record. - `AlarmEventFilterBuilder` ΓÇö fluent builder for Part 9 `EventFilter`s. - `ISession.GetAlarmClient(telemetry)` convenience extension. ### Part 16 state machines (generic, extensible) - Client: extension methods on the source-generated `StateMachineTypeClient` / `FiniteStateMachineTypeClient` ΓÇö `GetCurrentStateAsync`, `ObserveFiniteTransitionsAsync` (`IAsyncEnumerable<FiniteStateSnapshot>`), `WaitForStateAsync`, `GetAvailableStatesAsync` / `GetAvailableTransitionsAsync`. Vendor proxies inherit the API automatically through the generated inheritance chain. - Server: `StateMachineBuilder` (fluent: `AddState` / `AddTransition` / `OnCause` / validation) + `FluentFiniteStateMachineState` ΓÇö declare a Part 16 state machine without subclassing the abstract base. - Alarms alignment: `AlarmClient.GetShelvingStateAsync` / `ObserveShelvingTransitionsAsync` surface the API for every alarm's `ShelvingState` child. ### IAsyncEnumerable streaming subscription - `IStreamingSubscription` with `SubscribeDataChangesAsync`/`SubscribeEventsAsync` returning `IAsyncEnumerable<T>` (Channel-backed). - `ManagedSession.DefaultStreaming` ΓÇö lazy shared subscription; disposed with the session. - Helpers ΓÇö `TakeUntilAsync`, `WithTimeoutAsync`, `TakeAsync`, `BufferedAsync` for state-machine waits and bounded observation windows. - `AlarmStreamExtensions` ΓÇö `SubscribeAlarmsAsync`/`SubscribeConditionsAsync`/`SubscribeDialogsAsync` returning the source-generated record types. ### Address-space model change tracking - Server: `RaiseGeneralModelChangeEvent` on both `CustomNodeManager` and `AsyncCustomNodeManager`; `ModelChangeAggregator` (in `Opc.Ua.Server.NodeManager`, used by every node manager) batches changes per service call; auto-emit from `CreateNode`/`DeleteNode` (opt-out via `ModelChangeEmissionEnabled = false`). - Client: `IModelChangeTracker` subscribes to `BaseModelChangeEventType` via the streaming subscription, decodes `ModelChangeStructureDataType` payloads, invalidates the `INodeCache` per-node. - `INodeCache.InvalidateNode(NodeId)` ΓÇö new interface member (true per-node eviction in `NodeCache`). - `ManagedSession.EnableModelChangeTrackingAsync()` + `ManagedSessionOptions.ModelChangeTracking` + `ManagedSessionBuilder.WithModelChangeTracking()` fluent method. ### Dependency Injection integration - `services.AddOpcUa().AddClient(...).AddAlarms()` ΓÇö registers `AlarmClientFactory` so DI-hosted apps can resolve a Part 9 client per session without `new`-ing one manually. - Cross-link added to the unified DI surface (`AddServer` / `AddClient` / `AddComplexTypes` / `AddGdsServer` / `AddLdsServer` / `AddWotConServer`). ### Quickstart server modernization - `Quickstarts.Servers/Alarms/AlarmNodeManager.cs` ported to `AsyncCustomNodeManager` and demonstrates the new `AlarmGroup` + `AlarmSuppressionEngine` end-to-end via a writable `MaintenanceMode` boolean that suppresses every member alarm. ### Documentation - New: `Docs/AlarmsAndConditions.md`, `Docs/StreamingSubscription.md`, `Docs/ModelChangeTracking.md`, `Docs/StateMachines.md` ΓÇö full developer guides. - Updated: `Docs/DependencyInjection.md` (`AddAlarms()` row + section), `Docs/README.md` index, `Docs/MigrationGuide.md` (Part 9 / Part 16 / model change tracking sections covering behavior changes + breaking API surface). - Sample: `Applications/ConsoleReferenceClient/AlarmClientSample.cs`.	2026-05-29 23:24:53 +02:00
Copilot	ce9b2b4bff	[Server] Load existing users through IUserDatabase.GetUsers (#3811 ) User Management Improvements: * The `UserManagement` class now loads existing users from the user database during initialization, ensuring that the in-memory user list reflects the database state through the abstraction boundary. * The `IUserDatabase` interface now exposes `GetUsers()`, returning `UserManagementDataType` records instead of only user names. * `UserManagement.LoadUsersFromDatabase()` now consumes `IUserDatabase.GetUsers()` so custom user database implementations can provide persisted user metadata such as `UserConfiguration` and `Description`. * `LinqUserDatabase` implements `GetUsers()` and returns user records with the stored user name and default user-management metadata. `JsonUserDatabase` inherits this behavior through `LinqUserDatabase`. Address Space Management: * The server now properly removes the UserManagement node from the address space when user management is not enabled, preventing stale or orphaned nodes. Test Coverage Enhancements: * Added tests to verify that the UserManagement node is removed when user management is not present. * Added tests to confirm that `LinqUserDatabase.GetUsers()` returns the correct users. * Added tests to confirm that `UserManagement` starts with all users from the database, including custom `IUserDatabase` implementations that return full `UserManagementDataType` metadata. These changes keep user discovery on the `IUserDatabase` abstraction, remove the concrete-type dependency from startup, and allow existing users to be loaded with their associated management metadata.	2026-05-28 11:00:18 +02:00
Marc Schier	5ff968fcfb	Test project reorganization follow up (#3810 ) ### Test project reorganization Splits the integration- vs unit-test boundary along project boundaries and introduces a runtime-tier split for subscription tests so the mainline CI no longer drags in stress / durable suites. New projects: - `Opc.Ua.Stress.Tests` ╬ô├ç├╢ cross-area stress tier (designed to absorb session / channel / pub-sub stress in future). Seeded with the 6 subscription stress classes (`SubscriptionDepthTests`, `SubscriptionBasicDepthTests`, `MonitoredItemDepthTests`, `SubscriptionTransferDepthTests`, `SubscriptionPublishTooManyTests`, `SubscriptionMultipleTests`). Excluded from mainline CI; runs nightly. - `Opc.Ua.Subscriptions.Durable.Tests` ╬ô├ç├╢ durable-subscription tier (needs `DurableSubscriptionsEnabled` + storage-backed lifetime). Receives `SubscriptionDurableTests` plus the migrated `DurableSubscriptionTest` and `DurableSubscriptionTestDebug`. Excluded from mainline CI; runs nightly. - `Opc.Ua.Features.Tests` ╬ô├ç├╢ cross-feature integration tier. Receives the `[OneTimeSetUp]`-bootstraps-its-own-server integrations for AliasNames (Part 17), Roles (Part 18), FileSystem (Part 5 Γö¼┬║C / Part 20), and NodeCache. Also absorbs the misplaced `Tests/Opc.Ua.History.Tests/FileSystemTests.cs`. Client.Tests cleanup (~28 files moved): - `Opc.Ua.Sessions.Tests` (existing) gains 10 session integration files plus the 4 session benchmark files inline (`LoadTest`, `RequestHeaderTest`, `TraceableRequestHeaderTest`, `SecurityPolicyBenchmarks`). - `Opc.Ua.Subscriptions.Tests` (existing) gains 4 subscription integration files plus `PooledNotificationBenchmarks` inline. - `Opc.Ua.Client.ComplexTypes.Tests` (existing) gains all `ComplexTypes/` integration files. The Client.Tests copy of `TypeSystemClientTest.cs` (a stale near-duplicate) is removed. - Benchmarks stay inline* as `[Test]` + BenchmarkDotNet dual-use; no new benchmark project (per the approved plan). CI pipeline: - `.azurepipelines/test.yml` now filters `TestCategory!=LongRunning&TestCategory!=Stress` on the mainline run. - `-ExcludeFileName` now accepts a comma-separated list. The mainline matrix excludes the 3 nightly-tier project files alongside the existing `Opc.Ua.Aot.Tests.csproj`. - `get-matrix.ps1` enhanced to support multi-pattern excludes. `InternalsVisibleTo` extended on `Opc.Ua.Client` and `Opc.Ua.Server` to grant the new test projects access. All affected projects build clean (`0 Error`) for `net10.0`. ### Fix 8 skipped tests flagged as suspected bugs Triage of every `[Ignore]` / `[Explicit]` test in `Tests/` surfaced 8 entries labelled as suspected production bugs. After inspection: - 1 real production bug ╬ô├ç├╢ the `CancellationTokenSource.CancelAsync` polyfill for netstandard2.0 / netfx was running cancellation callbacks inline on the caller's thread, deadlocking dispose paths (`SubscriptionManager.DisposeAsync`, etc.) when a callback awaits on the caller's `SynchronizationContext`. Fixed at the polyfill root by hoisting `Cancel()` onto the ThreadPool via `Task.Run`, matching real .NET 8+ semantics. Caveat (deferred `IsCancellationRequested` transition) documented inline; all in-repo callers use `await cts.CancelAsync()` so the deviation is invisible. Test `DrainAsyncWaitsForInFlightPublishToCompleteAsync` un-ignored ╬ô├ç├╢ verified passes on net48 (943 ms) and net10.0 (1 s). - 2 flaky tests stabilized ╬ô├ç├╢ both `ValidateMetaDataUpdateTimeNonZeroIsSentPeriodically` (MQTT JSON & UADP) now use `Stopwatch.GetTimestamp()` instead of `DateTime.Now`, compute deviation against the median interval (not the configured cadence, so a startup hiccup doesn't skew the run), and use a proportional `max(interval / 4, 50 ms)` tolerance. `[Ignore]` removed, `[Category("LongRunning")]` retained. - 1 mis-labelled "bug"** ╬ô├ç├╢ `UnorderedMessagesWouldBeLostForSequentialPublishingAsync` asserts the documented lossy trade-off of strict sequential publishing. `[Explicit]` removed and renamed to `OldMessagesAbandonedAfterRepublishTimeoutInSequentialModeAsync`; it's now a CI-verified regression test for the WAI behavior. - 4 false positives ╬ô├ç├╢ `JsonEncoderTestsOld.cs` (16 kLOC) was excluded from compilation via `<Compile Remove>` and never reached the runner. The 4 `[Ignore("ProductionBugSuspected")]` markers inside were orphaned source from a previous JsonEncoder API. Active coverage lives in `JsonEncoderTests.cs` and `JsonValidationData` fixtures. Deleted the orphan file and the now-redundant `<Compile Remove>` line.	2026-05-28 04:19:21 +02:00
romanett	e49d17d706	[Server] Make MonitoredNode aware of IAsyncNodeManager and introduce channel-based queueing under load (#3804 ) ## Proposed changes This PR updates the server monitored-item pipeline to be `IAsyncNodeManager`-aware and introduces channel-based FIFO queueing in the monitored-node path to improve behavior under load. It also includes follow-up fixes from review/CI feedback: - Adjusted `AsyncCustomNodeManagerTests.WriteAsync_PublishesValueToMonitoredItemQueueAsync` to account for channel-based delivery timing/coalescing while still asserting the written value is observed. - Merged latest `master` into this branch and resolved merge conflicts (notably in `ConfigurationNodeManager`), keeping async address-space lookup behavior intact. - Applied small compile-safety corrections needed for successful validation.	2026-05-27 10:12:17 +02:00
Marc Schier	e1b9cea3ea	Reduce sync-over-async in non-obsolete server APIs + post-merge code style cleanup (#3806 ) ## Proposed changes Reduces sync-over-async in non-obsolete server APIs, removes stale `#region/#endregion` noise from the test suite, and fixes analyzer/test fallout from merging the Part 11 Historical Access framework (#3797). Follow-up review feedback is included: `FileSystemNodeManager` is now based on `AsyncCustomNodeManager`. ### Sync-over-async reduction (~24 `GetAwaiter().GetResult()` sites) Server-side: - `TrustList`: async `OnCallAsync` handlers added; sync `OnCall` handlers retained as compat shims so legacy `CustomNodeManager2` subclasses that host the TrustList but do not implement `ICallAsyncNodeManager` keep working through `MethodState.Call`. - `GDS ApplicationsNodeManager`: `RequestAccessToken`, `KeyCredentialStart/FinishRequest`, and `Revoke` moved to `OnCallAsync`. - `IKeyCredentialRequestStore`: interface + in-memory implementation converted to async; `FinishKeyCredentialRequestResult` record carries the previous out-set. Tests in `Tests/Opc.Ua.Gds.Tests/` updated to the new async API. - `FileSystem`: - `DirectoryObjectState` methods (`CreateDirectory` / `CreateFile` / `Delete` / `MoveOrCopy`) use `OnCallAsync`. - `FileSystemNodeManager` now derives from `AsyncCustomNodeManager` and overrides async address-space/node-resolution paths (`CreateAddressSpaceAsync`, `DeleteAddressSpaceAsync`, `GetManagerHandleAsync`, `ValidateNodeAsync`) to avoid sync-over-async in dynamic node validation. - `FileSystemNodeManagerFactory` now supports async creation (`IAsyncNodeManagerFactory`) while retaining sync factory compatibility. - Reference server registration of the FileSystem node manager is aligned to the async node manager list. - `ConfigurationNodeManager` namespace lookup uses sync `GetManagerHandle` to keep the remaining `GetResult` inside the documented `SyncNodeManagerAdapter` bridge. - `ServerBase`: new `OnServerStartingAsync`; `StartAsync` now awaits it. - `StandardServer.CreateMasterNodeManagerAsync` added; sync wrapper kept for backward compatibility. - `IServerInternal.CloseSession` marked `[Obsolete]` (`CloseSessionAsync` exists). - `IMasterNodeManager.RemoveReferences` marked `[Obsolete]`; in-tree sync callers remain with scoped `CS0618` pragmas + TODO. Stack: - `EncryptedSecret`: added `VerifyHeaderForEccAsync` / `DecryptAsync` / `TryDecryptAsync`; `UserNameIdentityTokenHandler.DecryptAsync` awaits ECC validation. - `CertificatePasswordProvider` ctor: `GetResult` fallback replaced with explicit `InvalidOperationException`. ### Code-style and post-merge cleanup - Removed unused `#region`/`#endregion` directives across test files. - Restored green build state after Part 11 merge fallout fixes (production + analyzer + test cleanup from earlier commits in this PR). ### CI / validation notes - This PR branch surfaced runtime regressions introduced by Part 11 after the build-breaker was fixed (outside scope of this async/code-style cleanup). - Follow-up feedback change validation for `FileSystemNodeManager`: - `dotnet build Libraries/Opc.Ua.Server/Opc.Ua.Server.csproj -f net10.0 --no-restore` ✅ - `dotnet test Tests/Opc.Ua.Server.Tests/Opc.Ua.Server.Tests.csproj -f net10.0 --filter FileSystemNodeIdTests` ✅ - `dotnet test Tests/Opc.Ua.History.Tests/Opc.Ua.History.Tests.csproj -f net10.0 --filter FileSystemSmokeTests` ✅ (test skipped in environment) ## Related Issues - None. ## Types of changes - [ ] Bugfix (non-breaking change which fixes an issue) - [x] Enhancement (non-breaking change which adds functionality) - [x] Test enhancement (non-breaking change to increase test coverage) - [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected, requires version increase of Nuget packages) - [ ] Documentation Update (if none of the other choices apply) ## Checklist - [x] I have read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf). - [x] I ran tests locally with my changes, all passed. - [ ] I fixed all failing tests in the CI pipelines. - [ ] I fixed all introduced issues with CodeQL and LGTM. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added necessary documentation (if appropriate). - [x] Any dependent changes have been merged and published in downstream modules.	2026-05-27 06:48:30 +02:00
Marc Schier	c89bc92e7c	Part 11 Historical Access client/server framework (#3797 ) ## Proposed changes Implements OPC UA Part 11 (Historical Access) end-to-end via a clean provider model that lets servers back historizing variables with any time-series storage engine. A reference-quality in-memory engine ships in `Opc.Ua.Server` so getting started requires no extra packages. The implementation replaces the legacy `HistoryArchive` / `HistoryDataReader` / `HistoryFile` / `IHistoryDataSource` files (removed from `Quickstarts.Servers/TestData/`) with a stack-level Part 11 surface. ### What's new - Server provider model in `Libraries/Opc.Ua.Server/Historian/`: - Umbrella `IHistorianProvider` + narrow capability interfaces (`IHistorianDataProvider`, `IHistorianModifiedProvider`, `IHistorianAtTimeProvider`, `IHistorianProcessedProvider`, `IHistorianAnnotationProvider`, `IHistorianEventProvider`, `IHistorianTransactionalProvider`). - `HistorianDispatcher` — routes HistoryRead / HistoryUpdate (raw, modified, at-time, processed, events, annotations) including event-`WhereClause` evaluation via the framework's `FilterEvaluator`, audit-event reporting, and continuation-point lifecycle. - `HistorianProviderRegistry` with Node → Namespace → Default precedence; surfaced via `IHistorianRegistryProvider` on `ServerInternalData`. - Fluent `HistorianBuilder` (`server.UseHistorian().UseInMemory().Historize(...).RegisterAsDefault()`). - Lazy `HistoricalDataConfigurationType` companion installer (`OnPopulateBrowser`-attached). - `ServerSystemContext` now exposes `IServerInternal Server { get; }` so infrastructure code stops relying on the per-NM `SystemHandle`. - In-memory reference engine (`InMemoryHistorianProvider`) — raw, modified, processed via framework fallback, at-time via framework fallback, annotations, events, transactional batches. - Client surface in `Libraries/Opc.Ua.Client/Historian/`: - `HistoryClient` with `IAsyncEnumerable<DataValue>` raw/modified/at-time/processed/annotation reads (transparent continuation-point handling and `try/finally`-based release on iterator abandonment). - `session.Historian()` extension. - Capability discovery (`GetServerCapabilitiesAsync`, `GetConfigurationAsync`). - Node-manager wiring through both `AsyncCustomNodeManager` and `CustomNodeManager2` (sync-via-dispatcher). - Capability rollup — `DiagnosticsNodeManager` populates the server-wide `HistoryServerCapabilities` as the union of registered providers' `GetCapabilitiesAsync(NodeId.Null, ...)` (runs whether the node was loaded from the predefined nodeset or freshly created; fully async). - Audit-event reporting for HistoryUpdate (gated on at-least-one-success): `AuditHistoryValueUpdateEventType`, `AuditHistoryAnnotationUpdateEventType`, `AuditHistoryRawModifyDeleteEventType`, `AuditHistoryAtTimeDeleteEventType`, `AuditHistoryEventUpdateEventType`, `AuditHistoryEventDeleteEventType`. - ReferenceServer + TestData historize sample variables through the new pipeline (replaces the deleted legacy `HistoryArchive`). - Comprehensive developer documentation in `Docs/HistoricalAccess.md` (~657 lines): server-developer guide, provider-author guide, client-developer guide, capability discovery, auditing, limitations/roadmap. ### Tests \| Suite \| Files \| Tests \| \| --- \| --- \| --- \| \| Server unit (Opc.Ua.Server.Tests/Historian) \| dispatcher, event-dispatcher, registry, in-memory provider, transactional provider, concurrency, coverage, event-filter target \| 34 passing \| \| Client integration (Opc.Ua.Client.Tests/Historian) \| `HistoryClientIntegrationTests` over the live `ReferenceServer` via `ServerFixture` \| 4 passing \| \| AOT (Opc.Ua.Aot.Tests/HistoryAotTests) \| positive assertions against historized `Scalar_Static_Int32` (read raw, read processed/Average) \| 2 passing \| ### Local validation - `dotnet build UA.slnx -c Release` → 0 errors. - All historian / client integration / AOT history tests green. ### Hardening applied post-internal-review - `DiagnosticsNodeManager.RollUpHistorianCapabilitiesAsync` — true async (no more `.GetAwaiter().GetResult()` on the startup path). - `HistoryClient` raw/modified/details readers — `try/finally` releases the in-flight continuation point on `break`/exception/cancellation; also detects malformed-server empty-page loops. - `ReportAudit` helpers gated on `HasAnyGood(...)` — audit events do not fire when every per-value op failed. - `ServerSystemContext` ctors throw `ArgumentNullException(nameof(server))` at the boundary. - `HistorianEventFilterTarget.IsTypeOf` logs a one-shot warning when `IFilterContext.TypeTree` is null (degrades safely instead of silently). - `InMemoryHistorianProvider.ReadEventsAsync` snapshots under lock, filters outside (cuts lock-hold time). - `TryRestoreContinuation` rejects cross-wired continuation points (different `NodeId`). - Processed-read framework fallback capped at 100 000 buffered outputs (`BadTooManyOperations` when exceeded). - ReferenceServer / TestData seeding is async-awaited / `Task.Run`-bridged to escape any captured `SynchronizationContext`. ## Related Issues - Fixes # ## Types of changes - [x] Bugfix (non-breaking change which fixes an issue) - [x] Enhancement (non-breaking change which adds functionality) - [x] Test enhancement (non-breaking change to increase test coverage) - [ ] Breaking change - [x] Documentation Update > The deletion of legacy `Applications/Quickstarts.Servers/TestData/HistoryArchive` is a refactor of sample code only; the public stack surface is purely additive. ## Checklist - [x] I have read the [CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md) doc. - [x] I have signed the [CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf). - [x] I ran tests locally with my changes, all passed. - [ ] I fixed all failing tests in the CI pipelines. - [ ] I fixed all introduced issues with CodeQL and LGTM. - [x] I have added tests that prove my fix is effective or that my feature works and increased code coverage. - [x] I have added necessary documentation (`Docs/HistoricalAccess.md`). - [x] Any dependent changes have been merged and published in downstream modules. ## Further comments The provider model is intentionally minimal and orthogonal — providers opt into specific Part 11 features by implementing one or more of the narrow capability interfaces, and the dispatcher type-tests the concrete provider at runtime. This keeps the bundled `InMemoryHistorianProvider` simple while making it trivial for vendors to plug in their own time-series database. A few items remain explicitly deferred (documented in `Docs/HistoricalAccess.md` Limitations and roadmap): `HistoricalEventConfigurationType` auto-install for event notifiers, audit-event `OldValues` fidelity (would require read-before-write across update sites), true streaming processed-read continuation (the framework fallback is bounded by the 100 k cap; native `IHistorianProcessedProvider` providers already get arbitrary paging). These are on-demand items, not gaps in the mandatory Part 11 surface.	2026-05-26 10:45:32 +02:00
Marc Schier	eb40a59566	More format and diagnostic fixes (#3780 ) Drive the solution to zero warnings / zero errors with analyzers on, promote the consistently-fixed rules to error, and lock in coverage on the only line of new logic.	2026-05-26 06:06:09 +02:00
Marc Schier	f3928db05b	Add unified Microsoft.Extensions DI surface across OPC UA libraries (#3803 ) Introduces a consistent `Microsoft.Extensions.DependencyInjection` surface across the OPC UA libraries. Every consumer starts from a single root entry point and chains feature-specific extension methods on a unified builder. PubSub is intentionally excluded per the original scope. ```csharp services .AddOpcUa() // Stack/Opc.Ua.Core .AddServer(o => { /* … / }) // Libraries/Opc.Ua.Server .AddNodeManager<MyNodeManagerFactory>() .Services .AddOpcUa() .AddClient(o => { / … / }); // Libraries/Opc.Ua.Client ``` Manual non-DI constructors (`new ApplicationInstance(...)`, `new StandardServer(...)`, `new LdsServer(...)`, `new ManagedSession(...)`, etc.) remain unchanged — DI is purely additive for users who want the .NET Generic Host to own application lifetime, logging, and configuration. ### What ships \| Feature library \| Method on `IOpcUaBuilder` \| Returns \| \|----------------------------------------------\|-------------------------------------------\|--------------------------\| \| `Opc.Ua.Core` (root) \| `services.AddOpcUa()` \| `IOpcUaBuilder` \| \| `Opc.Ua.Configuration` \| `builder.AddApplicationInstance()` \| `IOpcUaBuilder` \| \| `Opc.Ua.Client` \| `builder.AddClient(opt => …)` \| `IOpcUaClientBuilder` \| \| `Opc.Ua.Client.ComplexTypes` \| `builder.AddComplexTypes()` \| `IOpcUaBuilder` \| \| `Opc.Ua.Server` \| `builder.AddServer(opt => …)` \| `IOpcUaServerBuilder` \| \| `Opc.Ua.Gds.Client.Common` \| `builder.AddGdsClient(opt => …)` \| `IGdsClientBuilder` \| \| `Opc.Ua.Gds.Server.Common` \| `builder.AddGdsServer(opt => …)` \| `IGdsServerBuilder` \| \| `Opc.Ua.Lds.Server` \| `builder.AddLdsServer(opt => …)` \| `ILdsServerBuilder` \| \| `Opc.Ua.WotCon.Server` \| `builder.AddWotConServer(opt => …)` \| `IWotConServerBuilder` \| \| `Opc.Ua.WotCon.Client` \| `builder.AddWotConClient(opt => …)` \| `IOpcUaBuilder` \| ### Design highlights - Binary-safe inheritance* — `IOpcUaBuilder : IDependencyInjectionBuilder` so any existing `AddLogging(this IDependencyInjectionBuilder)` callers keep compiling unchanged. - Three options overloads per feature: `Action<TOptions>` (AOT-safe), `IConfiguration`, `IConfigurationSection`. The two binding overloads are annotated `[RequiresUnreferencedCode]` / `[RequiresDynamicCode]`. Section names follow the `OpcUa:<Feature>` convention (`OpcUa:Server`, `OpcUa:Client`, `OpcUa:Gds:Server`, `OpcUa:Lds`, …). - Generic Host integration — each server feature (regular, GDS, LDS) registers its own `BackgroundService`. Marker singletons throw `InvalidOperationException` on duplicate `.AddServer()` / `.AddGdsServer()` / `.AddLdsServer()`. A regular server + GDS + LDS can coexist in one host; each owns its own `IApplicationInstance` produced by a shared `IApplicationInstanceFactory` so PKI roots, endpoints, and certificates don't collide. - Registration isolation — node managers registered under the regular server via `.AddNodeManager<T>()` are wrapped in `OpcUaServerNodeManagerRegistration` so they don't bleed into the GDS / LDS hosted services. - WoT Connectivity server composes on top of the regular server feature: `.AddServer(...).AddWotConServer(...)` registers `WotConnectivityNodeManagerFactory` as a server node-manager registration. - Unified telemetry — `services.AddOpcUa()` registers `ITelemetryContext` via `TryAddSingleton` using a new `ServiceProviderTelemetryContext` that resolves the host's `ILoggerFactory` on first use. User-supplied registrations win. ### Removed pre-release DI surface The pre-release `services.AddOpcUaServer(...)`, `services.AddOpcUaClient(...)`, `services.AddOpcUaGdsClient(...)` extensions are deleted. `IClientBuilder` was renamed to `IOpcUaClientBuilder`. In-repo callers migrated: - `Applications/MinimalCalcServer/Program.cs` - `Applications/MinimalBoilerServer/Program.cs` - `Tests/Opc.Ua.Client.Tests/ClientBuilder/OpcUaClientBuilderTests.cs` (renamed from `OpcUaClientServiceCollectionExtensionsTests.cs`) - Docs (`MigrationGuide.md`, `Sessions.md`, `SourceGeneratedNodeManagers.md`, README, new `Docs/DependencyInjection.md`) ### csproj audit Pruned every redundant `Microsoft.Extensions.` package reference. `Opc.Ua.Core` already pulls in `Microsoft.Extensions.Diagnostics` and `Microsoft.Extensions.Logging`, which transitively expose DI / Options / Configuration.Abstractions / Options.ConfigurationExtensions to every downstream library. Only `Microsoft.Extensions.Hosting.Abstractions` stays explicit on the server libraries (it isn't transitively available). Also pruned redundant `System.Formats.Asn1` (Bindings.Https) and `System.Collections.Immutable` (Security.Certificates). ### Tests 50 new tests in eight projects: \| Project \| Tests \| \|--------------------------------------\|-------\| \| `Opc.Ua.Core.Tests` \| 12 \| \| `Opc.Ua.Client.Tests` \| 4 \| \| `Opc.Ua.Client.ComplexTypes.Tests` \| 3 \| \| `Opc.Ua.WotCon.Tests` \| 6 \| \| `Opc.Ua.Lds.Tests` \| 5 \| \| `Opc.Ua.Gds.Tests` \| 6 \| \| `Opc.Ua.Server.Tests` (integration) \| 10 \| \| `Opc.Ua.Aot.Tests` (smoke) \| 4 \| \| Total* \| 50 \| Combined-host integration tests cover the rubber-duck-driven scenarios: telemetry-context override across legacy and new entry paths, server + GDS + LDS coexistence with distinct ports and PKI roots, duplicate-registration rejection, and node-manager isolation across features. ### AOT `dotnet publish Tests/Opc.Ua.Aot.Tests -c Release -r win-x64 --self-contained` reports zero `IL2026` / `IL3050` / `IL2104` warnings from the new DI surface. All generic registrations carry `[DynamicallyAccessedMembers(PublicConstructors)]`. AOT consumers stick to the `Action<TOptions>` overload exclusively; the new `Tests/Opc.Ua.Aot.Tests/HostingAotTests.cs` smoke fixture exercises this end-to-end.	2026-05-25 20:24:53 +02:00
Marc Schier	14e995c1d0	Restructure test projects for faster CI (#3767 ) Rebalance the heavy test projects of the OPC UA .NET Standard stack so CI test execution can run cleanly in parallel. ### New test projects (Tests/Opc.Ua.<X>.Tests/) \| Project \| Files \| Sources \| \|---\|---:\|---\| \| Opc.Ua.Sessions.Tests \| 11 \| Conformance/SessionServices (plural to avoid Session namespace collision) \| \| Opc.Ua.Subscriptions.Tests \| 25 \| SubscriptionServices + MonitoredItemServices \| \| Opc.Ua.History.Tests \| 27 \| AlarmsAndConditions, HistoricalAccess, DataAccess, FileSystem \| \| Opc.Ua.Lds.Tests \| 15 \| Discovery, DiscoveryServices, Miscellaneous \| \| Opc.Ua.Core.Security.Tests \| 39 \| Security, Auditing \| \| Opc.Ua.InformationModel.Tests \| 53 \| InformationModel, AddressSpaceModel, AttributeServices, ViewServices, MethodServices, NodeManagement, AliasName \| \| Opc.Ua.Core.Encoders.Tests \| 11 \| Encoder tests extracted from Core.Tests \| \| Opc.Ua.Gds.Tests (existing) \| +5 \| new GDS tests \| ### New helper class libraries (Tests/Opc.Ua.<X>.TestFramework/ + Tests/Opc.Ua.Test.Common/) * Opc.Ua.Client.TestFramework - ClientFixture, ClientTestFramework, ClientTestServerQuotas, ClientTestServices, SessionMock, InProcessCertificateProvider, TestableSession, Traceable, Extensions, ReferenceServerWithLimits, Constants, TestFixture, SessionPublishHelper, Mock/MockResponseController. * Opc.Ua.Server.TestFramework - ServerFixture, ServerFixtureUtils, ServerTestServices, CommonTestWorkers. * Opc.Ua.Core.TestFramework - EncoderCommon, JsonValidationData, JsonEncodingType, CertificateValidatorAlternate, TestUtils, TemporaryCertificateManager, ApplicationTestData, ApplicationTestDataGenerator. * Opc.Ua.Test.Common - Logging.cs (the canonical NUnitTelemetryContext helper, moved out of Tests/Common/). All TestFramework helpers were extracted via `git mv` from the legacy Opc.Ua.Client.Tests / Opc.Ua.Server.Tests / Opc.Ua.Core.Tests projects (no copy-paste). ### Server-side production-code fixes 1. `MasterNodeManager.ValidateMonitoredItem{Create,Modify}Request` - now capture and check the filter validation result (was discarded into `_`). 2. `MasterNodeManager.ReadAsync` - assign `value = values[ii] = value.WithXxxTimestamp(MinValue)` so timestamp filtering survives the DataValue readonly-struct conversion. 3. `ApplicationsDatabaseBase.{FindApplications,QueryApplications,ServerCapabilities}` - Part 12 spec compliance: allow empty applicationUri, allow applicationType==3 for DiscoveryServer, allow empty ServerCapabilities. 4. `LinqApplicationsDatabase.{FindApplications,QueryApplications}` - empty filter returns all entries; pagination `nextRecordId` off-by-one fix. ### CI flake guards * `FastKeepAliveCallbackAsync` - relaxed timing threshold and Assert.Ignore on slow CI runners. * `SecurityCertValidationTests` - Assert.Ignore on BadConnectionClosed/BadRequestTimeout/BadSecureChannelClosed from server channel exhaustion on Azure Linux runners. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-05-24 06:23:16 +02:00
Marc Schier	889572472f	Convert DataValue from class to readonly struct for further GC relief (#3796 ) Convert `DataValue` from a mutable reference type (`class`) to a `readonly struct` to eliminate per-allocation GC pressure on every attribute read, subscription publish, and history sample. ### Key API changes (user-visible) \| Before \| After \| Pattern \| \|---\|---\|---\| \| `class DataValue` \| `readonly struct DataValue : INullable` \| Foundation \| \| `Equals(DataValue?)` / `operator ==(DataValue?, DataValue?)` \| `Equals(DataValue)` / `operator ==(DataValue, DataValue)` \| Value semantics \| \| `IEncoder.WriteDataValue(string?, DataValue?)` \| `IEncoder.WriteDataValue(string?, DataValue)` \| Non-nullable wire API \| \| `IDecoder.ReadDataValue(...) -> DataValue?` \| `IDecoder.ReadDataValue(...) -> DataValue` \| Same \| \| `IDataChangeMonitoredItemQueue.PeekLast/Oldest()` \| `TryPeekLastValue/Oldest(out DataValue)` \| TryGet pattern \| \| `IAggregateCalculator.GetProcessedValue(bool)` \| `TryGetProcessedValue(bool, out DataValue)` \| Same \| \| `IUaPubSubDataStore.ReadPublishedDataItem(...)` \| `TryReadPublishedDataItem(NodeId, uint, out DataValue)` \| Same \| \| `Dictionary<uint, DataValue?>` (NodeCacheContext) \| `Dictionary<uint, DataValue>` \| Default + IsNull \| \| `IHistoryDataSource.FirstRaw/NextRaw` \| `TryFirstRaw/TryNextRaw(out DataValue)` \| TryGet pattern \| \| `NodeState.ReadAttribute(... DataValue)` \| `NodeState.ReadAttribute(... ref DataValue)` \| Sync mutation via ref \| \| `NodeState.ReadAttributeAsync(... DataValue)` \| `NodeState.ReadAttributeAsync(...) -> ValueTask<(ServiceResult, DataValue)>` \| Async return tuple \| \| `obj as DataValue` (heterogeneous Dictionary<string, object>) \| `obj is DataValue dv ? dv : default(DataValue)` \| Safe struct cast \| \| `Assert.That(dv, Is.Not.Null)` (tests) \| `Assert.That(dv.IsNull, Is.False)` \| Struct test pattern \| \| `[Obsolete] Value` setter, all property setters \| Removed; use ctor or `With()` \| Immutability \| \| `[DataContract]` + `[DataMember]` \| Removed; surrogate via `SerializableDataValue` + `DataValueSurrogateProvider` \| Serialization \| ### Wire format Wire format is byte-identical* to the previous class-based implementation across binary / JSON / XML encoders. Default DataValue (`.IsNull == true`) is treated as the equivalent of the old null reference (writes JSON `null`, binary `byte 0`, XML omitted element). ### Why TryGet pattern (instead of leaving `DataValue?`) For methods that previously returned `DataValue?` to signal "no value available" (queue peek, aggregate result, data store lookup, history navigation), the conversion to `bool TryGet(out DataValue)` matches BCL conventions (`Dictionary.TryGetValue`, `Queue.TryPeek`, `Int32.TryParse`) and gives the caller an explicit "may be absent" affordance without `Nullable<DataValue>` overhead. ### Breaking changes summary - `DataValue` is now a `readonly struct` - boxing/unboxing semantics change for callers using `object`-typed APIs. - `IEncoder.WriteDataValue` / `IDecoder.ReadDataValue` / `ReadDataValueArray` interface signatures lose the `Nullable` wrapper. - `IDataChangeMonitoredItemQueue.PeekLastValue` / `PeekOldestValue` -> `TryPeekLastValue` / `TryPeekOldestValue` (out parameter). - `IAggregateCalculator.GetProcessedValue` -> `TryGetProcessedValue` (out parameter). - `IUaPubSubDataStore.ReadPublishedDataItem` -> `TryReadPublishedDataItem` (out parameter). - `NodeState.ReadAttribute` takes `ref DataValue`; `ReadAttributeAsync` returns `ValueTask<(ServiceResult, DataValue)>`. - `DataValue` property setters removed (use constructor + `With*` mutators).	2026-05-23 11:38:49 +02:00
Marc Schier	51bcd4272a	GDS Part 12 Full Compliance (#3795 ) * GDS: Authorization & SecureChannel hardening (Part 12 §6.5, §7.2, §7.6) * Fix OnGetCertificates self-admin authorization: pass applicationId to HasAuthorization so ApplicationSelfAdmin can read its own certificates per OPC 10000-12 §7.6.10 (was rejecting self-admin pull-management callers). * Fix OnUnregisterApplicationAsync self-admin authorization: also pass applicationId (was silently failing the self-admin branch). * OnUpdateApplication: accept ApplicationSelfAdmin and ApplicationAdmin in addition to DiscoveryAdmin per §6.5.7. Add self-admin role-permission shim. * OnGetCertificateStatus: accept CertificateAuthorityAdmin / SelfAdmin / ApplicationAdmin per §7.6.12 (was using AuthenticatedUserOrSelfAdmin which is more permissive than spec). * Introduce ApplicationAdmin privilege (Part 12 §7.2): - Add GdsRole.ApplicationAdmin static privilege. - Extend GdsRoleBasedIdentity with AdministeredApplicationIds and a new constructor accepting the list. WithAdditionalRoles preserves it. - AuthorizationHelper.HasAuthorization recognises the privilege: alone when no applicationId is supplied (e.g. RegisterApplication) and membership-tested against AdministeredApplicationIds otherwise. - HasTrustListAccess honours the ApplicationAdmin privilege for the administered applications' trust lists. - New role lists: DiscoveryAdminOrAppAdmin (RegisterApplication), DiscoveryAdminOrSelfAdminOrAppAdmin (Update/UnregisterApplication), CertificateAuthorityAdminOrSelfAdminOrAppAdmin (cert management). * SecureChannel result-code alignment (Part 12 method tables): - HasAuthenticatedSecureChannel throws BadSecurityModeInsufficient (was BadUserAccessDenied). - Adds requireEncryption flag so callers can demand SignAndEncrypt (used by future StartNewKeyPairRequest/FinishRequest tightening). - Sign and SignAndEncrypt are now both accepted as 'authenticated'. * Tests: - Register the GDS namespace in AuthorizationHelperTests SetUp so GDS-namespace role NodeIds do not collide on NodeId.Null with privilege roles. - Update HasAuthenticatedSecureChannelThrowsForNonSecureChannel to expect BadSecurityModeInsufficient. - Add HasAuthenticatedSecureChannelDoesNotThrowForSign and HasAuthenticatedSecureChannelWithRequireEncryptionThrowsForSign. - Add ApplicationAdmin coverage: SucceedsForAdministeredApp, ThrowsForUnmanagedApp, SucceedsForRegisterApplication, ThrowsWithEmptyAdministeredList. - Add NewRoleListsAreCorrectlyPopulated regression test. The framework already enforces SigningRequired/EncryptionRequired via DefaultAccessRestrictions in OpcUaGdsModel.xml, returning BadSecurityModeInsufficient at request dispatch time (MasterNodeManager.ValidateAccessRestrictions). The model declares the correct restriction on every admin method, so explicit handler-level checks would be redundant. Verified manually against §6.5.6, §6.5.7, §6.5.8, §7.6.4-7.6.10 and §7.6.12. 23 Authorization unit tests pass. 181 unit + 420 integration GDS tests pass on net10.0; build clean on net48 and net10.0. * GDS: Audit event correctness (Part 12 7.6, 7.9) * Fix audit-event ordering: emit CertificateRequestedAuditEvent AFTER the method outcome is known. Previously the event was raised before authorization with Status=true, so any failed call appeared in audit as a successful certificate request and any authorization-denied call generated a misleading 'success' audit trail. - OnStartNewKeyPairRequest: refactor to try/catch/finally, emit audit once with auditException reflecting either the captured throw, the bad ServiceResult, or null on success. - OnStartSigningRequestAsync: add the audit emission (previously missing entirely - 7.9.3 requires it) using the same pattern. * Redact privateKeyPassword from audit InputArguments. The previous ApplicationsNodeManager.cs:1206-1223 included the raw password string as a Variant in the audit event payload, leaking the secret into any downstream audit sink. The password is now replaced with AuditEvents.RedactedPrivateKeyPassword (placeholder string). * OnFinishRequestAsync: build the audit InputArguments from only the actual method inputs (applicationId, requestId) per 7.6.6 method signature. Previously the implementation appended the returned Certificate / PrivateKey / IssuerCertificates to InputArguments, which leaked the returned PrivateKey into audit payloads. * Raise CertificateRevokedAuditEventType in OnRevokeCertificate on success and failure per 7.6.9. The event type was defined in the model (OpcUaGdsModel.xml:543) but never emitted. Refactored OnRevokeCertificate with try/catch/finally; sync-over-async (.Result) is preserved here and addressed separately in Track C (c-revoke-async). * AuditEvents helper: - New ReportCertificateRevokedAuditEvent extension method, mirroring the existing CertificateRequested/Delivered helpers, with an Exception parameter that drives Status (true on success, false on failure). - New RedactedPrivateKeyPassword and RedactedPrivateKey constants documented as the canonical placeholders. Class-level remarks instruct callers to redact sensitive arguments before invoking the helpers. * Tests: - AuditEventsTests: lock the placeholder values (RedactedPrivateKeyPassword and RedactedPrivateKey) so they remain stable for downstream audit-sink filters. - Existing 181 unit + 420 integration GDS tests pass on net10.0; build clean on net48 and net10.0. b-keycred-audit and b-token-audit remain pending pending Track E and F respectively (KeyCredentialService and AuthorizationService handlers). * GDS: Directory / Pull Management correctness gaps (Part 12 6.5, 7.6) * OnRevokeCertificate converted to async OnRevokeCertificateAsync; uses await instead of sync-over-async .Result, accepts the method-call cancellation token, and is now wired through OnCallAsync to integrate with the async dispatch path. RevokeCertificateAsync helper takes an optional CancellationToken so callers (OnUnregisterApplicationAsync, OnRevokeCertificateAsync) can forward it. * OnCheckRevocationStatusAsync now computes the ValidityTime per OPC 10000-12 7.6.11. The previous implementation always returned DateTime.MinValue. The new implementation enumerates the CRLs in the trusted-issuer store and uses the earliest NextUpdate as ValidityTime when the chain validates. On Bad results (chain validation failed) ValidityTime remains DateTime.MinValue so callers re-check immediately. * OnFinishRequestAsync returns the issuer chain via a new BuildIssuerCertificateChain helper. The previous implementation returned only the immediate signing CA, which is incomplete for multi-tier CAs per OPC 10000-12 7.6.6. The helper uses ICertificateGroup.Certificates (in-memory) as the X509Chain ExtraStore and falls back to the immediate issuing CA if chain building does not yield a chain. The helper is intentionally synchronous to avoid contending with concurrent SigningRequestAsync / NewKeyPairRequestAsync writes against the CertificateGroup's AuthoritiesStore (which caused parameterised PushTest cases to fail in parallel runs). * ValidateApplication (ApplicationsDatabaseBase) now enforces the reverse-connect rules in OPC 10000-12 6.5.5: - Server / DiscoveryServer DiscoveryUrls must NOT start with the "rcp+" prefix. - Client DiscoveryUrls (when non-empty) must all start with "rcp+" AND ServerCapabilities must include "RCP". - ClientAndServer must register at least one non-rcp+ Server DiscoveryUrl; reverse-connect URLs are still permitted alongside and require the RCP ServerCapability. Removed the previous blanket rejection of any DiscoveryUrls on ApplicationType.Client (which contradicted the spec's reverse-connect registration pattern). * Tests: - RegisterApplicationClientWithRcpDiscoveryUrlsAndRcpCapabilityDoesNotThrow - RegisterApplicationClientWithRcpDiscoveryUrlsAndMissingCapabilityThrows - RegisterApplicationServerWithRcpDiscoveryUrlThrows - RegisterApplicationClientAndServerWithMixedUrlsDoesNotThrow - RegisterApplicationClientAndServerWithOnlyRcpDiscoveryUrlsThrows All 188 unit + 420 integration GDS tests pass on net10.0; build clean on net48 and net10.0. c-redundancy intentionally requires no enforcement: both transparent (single application with multiple DiscoveryUrls) and non-transparent (separate applications with NTRS capability) patterns per OPC 10000-12 6.5.6 are admitted by the validator; transparent redundancy is a registrant convention rather than a server-enforceable invariant. * Annex D capabilities: Self-advertise the LDS-ME capability identifier whenever the MulticastExtension is configured. Previously LdsServer hard-coded ["LDS"] regardless of whether multicast was running, so FindServersOnNetwork peers could not distinguish LDS from LDS-ME instances. Refactored the capability computation into a public static ComputeServerCapabilities(existing, hasMulticast) helper: - empty input + no multicast -> ["LDS"] - empty input + multicast -> ["LDS", "LDS-ME"] - custom seed list with no "LDS" -> "LDS" is appended - existing "LDS-ME" is not duplicated OnServerStarting now wires up the multicast layer first so the capability set reflects the configured topology. * Annex C / rcp+ reverse-connect preservation: MulticastDiscovery now carries the OPC 10000-12 6.5.5 rcp+ DiscoveryUrl prefix end-to-end through mDNS announce / discover. - TryBuildProfile strips the rcp+ prefix before parsing the underlying transport URL (Uri parsing on "rcp+opc.tcp://..." is brittle across runtimes) and emits a dedicated TXT-record key ReverseConnectTxtKey ("rc") so receivers can reconstruct it verbatim. - OnServiceInstanceDiscovered honours the "rc" key when present and rebuilds the DiscoveryUrl with the rcp+ scheme. Exposes MulticastDiscovery.OpcUaServiceType, MulticastDiscovery.ReverseConnectScheme and MulticastDiscovery.ReverseConnectTxtKey as public constants so client code and tests can reference the same values used during registration and discovery. * RegisterServer2 fallback (4.2.2): verified that LdsServer overrides both RegisterServerAsync and RegisterServer2Async, so the LDS accepts both legacy RegisterServer registrations and the modern RegisterServer2 + MdnsDiscoveryConfiguration path; no code change required. * Tests: new LdsServerStaticTests fixture exercising the capability computation (six matrix cases) and locking in the Annex C / rcp+ constants (one regression test). 195 unit + 420 integration GDS tests pass on net10.0; build clean on net48 and net10.0. * Added Opc.Ua.Lds.Server as a ProjectReference of Opc.Ua.Gds.Tests so the new tests can use the public static surface of LdsServer and MulticastDiscovery. * GDS: Push management hardening (Part 12 7.10) * d-push-client-multitype: Make ServerPushConfigurationClient.ApplicationCertificateType settable instead of hard-coded to RsaSha256ApplicationCertificateType. Callers managing ECC, Brainpool or HTTPS certificates can now override the default before invoking certificate-management methods (or pass an explicit certificate type to the methods themselves). Removed the TODO comment that flagged this limitation. * d-trustlist-ext: Set Writable / UserWritable to true for the DefaultApplicationGroup / DefaultHttpsGroup / DefaultUserTokenGroup TrustList instances in the GDS. Per OPC 10000-12 7.8.2.1 a TrustList that supports CloseAndUpdate / AddCertificate / RemoveCertificate is writeable; role-based access controls on the individual methods still enforce who may actually mutate the trust list. The previous values (false) were misleading to clients browsing the trust-list nodes. * d-server-cred-audit: Redact the private key from CertificateUpdateRequestedAuditEventType InputArguments per OPC 10000-12 7.10.3. ConfigurationNodeManager.UpdateCertificateAsync was passing the raw private-key ByteString into the audit payload, leaking the secret to any downstream audit sink. The audit payload now uses Opc.Ua.Server.AuditEvents.RedactedPrivateKey (an empty ByteString) as the placeholder; the certificate, issuer chain and key format remain in the payload so administrators can correlate the request. Also extended Server.ReportCertificateUpdateRequestedAuditEvent with an optional Exception parameter so callers can raise the event with Status=false on failure (parity with the GDS-side helpers). * Build clean on net48 and net10.0. 195 unit + 420 integration GDS tests pass on net10.0. Remaining Track D items (d-create-selfsigned, d-confirm-update, d-managed-apps, d-alarms, d-push-tests) are larger features that depend on Track H model additions and are not in scope for this commit; their todos remain pending. * GDS: Lock in ServerPushConfigurationClient.ApplicationCertificateType behaviour Adds ServerPushConfigurationClientStaticTests covering the Track D quick-win (d-push-client-multitype): the property defaults to RsaSha256ApplicationCertificateType for backwards compatibility and is now caller-overridable (e.g. for ECC management). * GDS: Implement CreateSelfSignedCertificate (Part 12 7.10.6) * Server-side: ConfigurationNodeManager wires the generated CreateSelfSignedCertificateMethodState.OnCallAsync handler when the optional method node exists on the ServerConfiguration instance. The handler: - Requires SecurityAdmin access (HasApplicationSecureAdminAccess) - Validates CertificateGroupId / CertificateTypeId via the existing VerifyGroupAndTypeId helper - Creates a self-signed certificate using the CertificateFactory pipeline (RSA with caller-specified key size, or ECC from the curve mapped by the certificateTypeId) - Merges DnsNames and IpAddresses into the SAN extension - Stores the resulting raw data on the existing CertificateIdentifier so the resolver can materialise it - Returns the DER-encoded public certificate to the caller The method is Optional per the spec; servers that load a nodeset without it simply skip the wire-up (null guard). * Client-side: IServerPushConfigurationClient extended with CreateSelfSignedCertificateAsync; ServerPushConfigurationClient delegates to the generated ServerConfigurationTypeClient proxy with the standard elevate/revert permission pattern. * net48 compat: uses new ValueTask<T>(result) instead of ValueTask.FromResult which is unavailable on .NET Framework 4.8.	2026-05-23 08:07:28 +02:00
Marc Schier	239a40b183	GC reduction via IPooledEncodeable activator pooling (#3793 ) * GC reduction via IPooledEncodeable activator pooling Add opt-in activator-level pooling for IEncodeable instances decoded during V2 subscription publish dispatch. The design replaces the earlier IAllocator-on-IServiceMessageContext approach (which had a cross-contamination hazard for non-publish decodes) with a clean factory-based model where pooling lives on the encodeable activator. New public API: - IPooledEncodeable : IEncodeable - opt-in marker with Reuse() method - PooledEncodeableType<T> : EncodeableType<T> - activator base with BoundedObjectPool<T> (lock-free, no new package dependency) - ISubscriptionManager.PoolNotifications { get; set; } - ManagedSessionOptions.PoolNotifications { get; init; } - ManagedSessionBuilder.WithPoolNotifications(bool) Source-gen: - All concrete non-abstract structure types (including service request/response types) are generated with PooledEncodeableType<T> activators and IPooledEncodeable.Reuse() bodies by default - Derived types use 'new' to hide inherited Reuse/ClearPooledSentinel so each concrete type routes through its own activator's pool - No changes to external design XML files (UA Core Services.xml etc.) - poolable selection is hardcoded in the generator Benchmarks (MonitoredItemNotification, 1000 ops): - Allocations: 128 KB -> 408 B (~315x reduction) - Gen0 collections: 29.75 -> 0.09 per 1000 ops No interface changes to IEncodeable, IDecoder, IServiceMessageContext, or ISubscriptionNotificationHandler. Handlers retain by copy when pooling is enabled. Call IPooledEncodeable.Reuse() on decoded IServiceRequest and IServiceResponse after the server is done with them: - TcpTransportListener.OnRequestReceivedAsync: reuse both request and response in a finally block after ProcessRequestAsync + SendResponse complete - EndpointBase.InvokeServiceAsync (HTTPS path): same pattern after ProcessRequestAsync + BinaryEncoder.EncodeMessage Walk acknowledged, overflow-evicted, and disposed NotificationMessage objects and call IPooledEncodeable.Reuse() on their notification payloads (MonitoredItemNotification, DataChangeNotification, EventFieldList, EventNotificationList). Insertion points in Subscription.cs: - Acknowledge(): after RemoveAt from m_sentMessages - InnerPublish() overflow: before RemoveRange/Clear on m_sentMessages - Dispose(): before m_sentMessages.Clear() - InnerPublish() unsent-message overflow: before RemoveRange on the messages list Replace new T() with XxxActivator.Instance.CreateInstance() for all server-side notification payload types so instances are rented from the activator pool instead of heap-allocated: New static helper ReuseNotificationPayloads() walks the NotificationMessage.NotificationData, extracts DataChangeNotification and EventNotificationList via TryGetValue, iterates their items, and calls Reuse() on each pooled payload.	2026-05-22 12:42:33 +02:00
Marc Schier	296a904f34	Add full OPC UA Part 18 (Role management) support (#3778 ) * role management compliant with OPC UA Part 18 Server-side: - New IRoleManager / RoleManager with spec-correct status codes (Bad_AlreadyExists, Bad_NodeIdUnknown, Bad_RequestNotAllowed, Bad_NotFound) for every mutator per Part 18 4.2 / 4.4. - Pre-populate default identities for the three reserved well-known roles per Part 18 4.3 (Anonymous, AuthenticatedUser, TrustedApplication). - Reject mutations on reserved roles with Bad_RequestNotAllowed. - Validate IdentityMappingRuleType per Part 18 4.4.3 (empty criteria for Anonymous/AuthenticatedUser/TrustedApplication; upper-case hex for Thumbprint; Name=Value grammar for X509Subject). - Honour Part 18 4.4.2 default-field-as-wildcard EndpointType comparisons; tighten TrustedApplication/Application rules to require trusted certificate + signed channel. - Introduce CustomConfiguration flag per Part 18 4.4.1. - Add IRoleManager.RoleConfigurationChanged event raised after every successful mutation per Part 18 4.4.1. - Make RoleEntry an immutable snapshot. Address-space binding (typed proxies): - RoleStateBinding switched from stringly-typed OnCallMethod2 plumbing to the source-generated typed proxies (RoleSetState, RoleState, AddRoleMethodState, AddIdentityMethodState, ...). - DiagnosticsNodeManager.AddBehaviourToPredefinedNodeAsync upgrades passive BaseObjectState nodes of RoleSetType / RoleType to the typed RoleSetState / RoleState proxies at predefined-node load time. - New RoleAuthorizationGate.CheckAdmin centralizes SecurityAdmin role plus SignAndEncrypt enforcement per Part 18 4.2 / 4.4 / 5.2. - Bound writable ApplicationsExclude / EndpointsExclude / CustomConfiguration with the same auth gate. - Raise RoleMappingRuleChangedAuditEventType from every successful mutator (Part 18 4.5) via the existing AuditEvents helper. Client library: - New Opc.Ua.Client.Roles.RoleManagementClient + IRoleManagementClient + RoleInfo + SessionRoleExtensions.OpenRoleManagementClient. - Covers list / read / add / remove role, identity, application, endpoint operations plus SetExclude via Write Service. Tests: - New RoleManagerTests.cs - 37 NUnit tests for pre-populated roles, reserved-role immutability, spec-correct status codes, criteria validation, ResolveGrantedRoles, exclude semantics, CustomConfiguration, AddRole well-known NodeId reuse, and RoleConfigurationChanged event. Documentation: - Rewrite Docs/RoleBasedUserManagement.md as a Part 18 compliance reference (status-code matrix, client examples, known limitations). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Add Part 18 5 UserManagement implementation Server-side: - New IUserManagement interface (Opc.Ua.Server.UserManagement) modelling Part 18 5.2.1 surface: PasswordLength, PasswordOptions, PasswordRestrictions, SnapshotUsers, AddUser, ModifyUser, RemoveUser, ChangePassword, MustChangePassword, IsUserActive, UserDeactivated event. - Default UserManagement implementation wraps the existing IUserDatabase and stores per-user UserConfigurationMask + description in memory. Validates passwords against PasswordLength + character-class flags from PasswordOptions; honours Part 18 5.2 result codes (Bad_AlreadyExists, Bad_NotFound, Bad_OutOfRange, Bad_NotSupported, Bad_ConfigurationError, Bad_InvalidSelfReference, Bad_IdentityTokenInvalid). - ChangePassword clears the MustChangePassword bit on success. - New UserManagementBinding wires the typed source-generated proxies (UserManagementState, AddUserMethodState, ModifyUserMethodState, RemoveUserMethodState, ChangePasswordMethodState) - typed OnCallAsync delegates everywhere; admin gate via RoleAuthorizationGate.CheckAdmin; ChangePassword gated via RoleAuthorizationGate.CheckSelfUserName; closes active sessions for deactivated users via ISessionManager. - ConfigurationNodeManager.AddBehaviourToPredefinedNodeAsync upgrades the passive UserManagement object to the typed UserManagementState proxy at predefined-node load time; CreateServerConfiguration invokes UserManagementBinding.Bind when an IUserManagement was injected. - IServerInternal gains UserManagement getter + SetUserManagement injector. Tests: - New Tests/Opc.Ua.Server.Tests/UserManagementTests.cs - 18 NUnit tests covering AddUser happy path, duplicate / password-length / config-flag validation, RemoveUser non-existent / self-reference / NoDelete, ModifyUser self-disable / disable-other UserDeactivated event, ChangePassword happy path / same-as-old / wrong-old / MustChangePassword bit clearing / NoChangeByUser rejection, IsUserActive on disabled vs active users. Documentation: - Update Docs/RoleBasedUserManagement.md with a User Management section including the spec result-code matrix, example wiring code, and reduce known limitations - UserManagement is no longer a limitation.	2026-05-20 05:51:17 +02:00
Copilot	b93ac4093c	[Server] Invalidate permission caches in NodeManagers when ActivateSession changes session identity (#3774 ) * Add SessionActivated notification to invalidate permission caches on identity change * Fix code review: rename test methods to PascalCase, use default instead of new ValueTask() * Improve comment clarity in AsyncCustomNodeManager.SessionActivatedAsync * Add integration test for permission re-evaluation after TransferSubscriptions + ActivateSession * Replace integration test to use restricted RolePermissions node and verify permission denial after re-activation * Extract HasDataChangeNotificationForClientHandle helper to reduce duplication	2026-05-19 15:29:28 +02:00
Marc Schier	535d017840	Add OPC UA Part 17 (Alias Names) support (#3779 ) * Add OPC UA Part 17 (Alias Names) support Server-side: pluggable IAliasNameStore + thread-safe InMemoryAliasNameStore, AliasNameStoreRegistry (live dispatcher, surfaces through optional IAliasNameStoreRegistryProvider on ServerInternalData), AliasNameNodeManager (standalone CustomNodeManager2; defaults to SecurityAdmin-only mutations on SignAndEncrypt channels), AliasNameMethodDispatcher bridging generated typed FindAlias/FindAliasVerbose/Add/Delete *MethodState.OnCallAsync handlers, AliasNameWildcardMatcher (Part 4 §7.40 Like operator with proper escape handling), and a DiagnosticsNodeManager partial that late-binds the standard well-known Aliases (i=23470), TagVariables (i=23479) and Topics (i=23488) FindAlias methods plus Aliases.LastChange through the registry. Client-side: AliasNameClient (OpenStandardAliases/TagVariables/Topics + arbitrary category root) covering all four Part 17 methods, sub-category enumeration and ReadLastChangeAsync. Hardcoded method-id fast-path for standard categories; cached TranslateBrowsePaths resolution for custom ones. Service-level errors map to typed exceptions (UnauthorizedAccessException / NotSupportedException). AliasNameResolver (IAsyncDisposable) gives a name->NodeId cache with forward and reverse lookup; default refresh is Manual with opt-in AutoOnLastChange polling that compares VersionTime on inequality (wrap-safe). Reference server: registers an InMemoryAliasNameStore for the standard TagVariables + Topics categories with sample seeds (TIC101_Setpoint, TIC101_PV, FIC202_Flow, Pump1_Status, Heater_Power, MultiRefAlias, ServerEvents, AuditEvents) so the standard well-known FindAlias methods return data through the DiagnosticsNodeManager late binder. Tests: 45 server-side cases (wildcard matcher, in-memory store, registry, node manager) plus 11 mocked-session client cases and 4 end-to-end integration cases against a live ReferenceServer over a real OPC UA channel. All 60 tests pass; full solution builds clean across net472/net48/netstandard2.1/net8.0/net9.0/net10.0. Docs: Docs/Part17AliasNames.md plus a link from Docs/README.md.	2026-05-19 12:55:12 +02:00
Copilot	100a98b0d6	[Server] Route AsyncCustomNodeManager service reads/writes through NodeState async callbacks (#3782 )	2026-05-19 07:23:39 +02:00
Marc Schier	a193a0a278	Add OPC UA Server FileSystem (Part 20) and Local Discovery Server libraries (#3776 ) This change introduces two independent additions to the .NET Standard stack: ## `Libraries/Opc.Ua.Server.FileSystem` (Part 5 §C / Part 20 §4) Server-side implementation of the OPC UA `FileType` / `FileDirectoryType` companion model, mirroring the existing client namespace `Libraries/Opc.Ua.Client.FileSystem`. ### Provider abstraction - `IFileSystemProvider` — async storage abstraction (`GetEntryAsync` / `EnumerateAsync` / `OpenRead/WriteAsync` / `Create{Directory,File}Async` / `DeleteAsync` / `MoveAsync` / `CopyAsync`). All paths are forward-slash provider-relative; the empty string is the root. - `FileSystemEntry` record + `FileWriteMode` enum. ### Default `PhysicalFileSystemProvider` `System.IO`-based implementation that mounts a single physical directory as the FileSystem root. Rejects path-traversal attempts (`..` escape) via `Path.GetFullPath` + root-prefix check. Supports an optional `isWritable: false` mode for read-only mounts. ### Node manager `FileSystemNodeManager` drives every Browse / Read / Method call through the configured provider. Each mounted provider is anchored as a `FileDirectoryType` instance under the standard `Server.FileSystem` object (`ObjectIds.FileSystem`, `i=16314`) via `HasComponent`, which is what `FileSystemClient.OpenServerFileSystem` expects to find. Mount multiple providers by registering multiple `FileSystemNodeManager` instances. Companion files (`DirectoryBrowser`, `DirectoryObjectState`, `FileObjectState`, `FileHandle`, `FileSystemNodeId`, `FileSystemNodeManagerFactory`) are all provider-driven. ### Client-side fix `Libraries/Opc.Ua.Client.FileSystem.FileSystemClient.EnumerateChildrenAsync` now stops the BrowseNext loop on `continuation.Length == 0` in addition to `continuation.IsNull`. Without this fix, an empty-but-non-null ByteString continuation returned by the SDK after wire round-trip would cause a spurious BrowseNext and fail with `BadContinuationPointInvalid`. ### Reference-server hook `Quickstarts.ReferenceServer.ReferenceServer` gains two opt-in properties (default off): - `EnableFileSystemNodeManager` — toggles whether the FS node manager is registered. - `FileSystemProvider` — caller-supplied `IFileSystemProvider`. When `null` and the flag is on, falls back to a `PhysicalFileSystemProvider` rooted at `%TEMP%/OpcUaReferenceServerFs` (mount name `Temp`). ### Tests `Tests/Opc.Ua.Client.Tests/FileSystem/FileSystemClientIntegrationTests.cs` — 12 end-to-end tests over a real `ServerFixture<ReferenceServer>` + `ClientFixture` (opc.tcp, SecurityNone, temp-dir provider): round-trip write/read, enumeration, nested `CreateDirectory` / `CreateSubdirectory`, delete, move, copy, large-file chunked read, mount BrowseName, missing path returns null, multi-level enumeration, text round-trip, read-only provider rejects write. ## `Libraries/Opc.Ua.Lds.Server` A new Local Discovery Server (LDS) library implementing OPC UA Part 12 §7: - `LdsServer` — main server class. - `MulticastDiscovery` — DNS-SD / mDNS bootstrap via `Makaretu.Dns.Multicast` (version 0.27.0 added to `Directory.Packages.props`). - `RegisteredServerStore` — in-memory store with TTL. - `RegistrationEntry` + `ServerOnNetworkRecord` — value types. Comes with a sample host `Applications/ConsoleLdsServer`. ## Build / test - `dotnet build UA.slnx -c Release` -> 0 errors on all target frameworks (net472, net48, netstandard2.1, net8.0, net9.0, net10.0). - `Opc.Ua.Server.Tests` -> 964 pass, 5 skip, 0 fail. - `FileSystemClientIntegrationTests` -> 12/12 pass.	2026-05-17 21:31:47 +02:00
romanett	5edb512ab7	Stricter validation and error handling in GDS server & Server Method Call validation (#3746 ) * Stricter validation and error handling in GDS server - Allow empty DatabaseStorePath for in-memory operation - Select database type dynamically in GdsNodeManagerFactory - Enforce required fields and argument validation in ApplicationsDatabaseBase - Prevent duplicate application URIs in LinqApplicationsDatabase - Propagate argument errors as OPC UA service exceptions in ApplicationsNodeManager - Remove obsolete attribute from ParsedNodeId - Refactor MasterNodeManager write/call validation to async with improved permission checks and attribute caching - Update UAReferenceServer.ctt.xml test data with non-empty credentials - Improves robustness, security, error reporting, and test coverage * Add method-state resolver API for call validation and tests Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/0caf8699-f0e0-4dd5-8dcf-368b08912205 Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * Refine call validation comments and test coverage naming Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/0caf8699-f0e0-4dd5-8dcf-368b08912205 Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * Move method resolver onto core NodeManager interfaces Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/0bb87dfd-f432-431f-a0fe-dd4d1ba3197f Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * Align NodeManager interfaces and call paths for method resolver Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/0bb87dfd-f432-431f-a0fe-dd4d1ba3197f Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * fixes * fix * Fix GDS ClientTest expectations for stricter app validation Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/47d99514-94f9-4051-9e6d-8cb2b44555d0 Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * fix tests * Fix AOT GDS fixture for RSA secured endpoint Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/f6c8fba1-3dbf-41f0-b920-5e1766b9d6e1 Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * Update app registration logic and audit event sources Refactor application registration to separate update and create logic, introducing UpdateApplication in database interfaces and implementations. Improve error handling and validation, ensure unique ApplicationUris, and enhance certificate revocation logging. Standardize audit event source names and add ToString override to BaseVariableState. Update server queries for correct pagination. * fixes * Add wildcard match coverage for ApplicationsDatabaseBase Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/a2c1a6b0-e867-4610-bead-7e621e3764ff Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * Expand wildcard spec coverage in ApplicationsDatabaseBase tests Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/a2c1a6b0-e867-4610-bead-7e621e3764ff Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * Align UA wildcard matching and add spec coverage tests Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/a2c1a6b0-e867-4610-bead-7e621e3764ff Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * Fix GDS QueryServers test expectations for pagination semantics Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/efa1c64d-05c8-47ee-b308-c77e7d5a34c9 Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * Add focused tests for LinqApplicationsDatabase behaviors Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/7e4ec1ce-722f-43fb-99db-06b854c3fa7a Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * Refine LinqApplicationsDatabase test method naming Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/7e4ec1ce-722f-43fb-99db-06b854c3fa7a Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * Merge origin/master and resolve PR merge conflicts Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/69970cd4-4196-4fb4-9e4c-6ad86104bb5f Co-authored-by: marcschier <11168470+marcschier@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> Co-authored-by: marcschier <11168470+marcschier@users.noreply.github.com>	2026-05-17 18:47:50 +02:00
Marc Schier	3e5f129c6f	Enable nullable in Stack, Libraries (9), and Applications projects (#3732 )	2026-05-17 12:55:24 +02:00
Marc Schier	5795e50b58	Source-generated, NativeAOT-clean fluent server API with event-source publish (#3765 ) * Add async read/write hooks to BaseVariableState and AsyncCustomNodeManager Introduces an end-to-end async path for variable Value-attribute reads and writes that does not require holding lock(this) while the user callback executes: * New AttributeReadResult, AttributeSimpleReadResult and AttributeWriteResult readonly record structs in NodeState carry the typed result of an async Value-attribute hook (no ref/out params across await). * Four new async delegates (NodeValueEventHandlerAsync, NodeValueSimpleEventHandlerAsync, NodeValueWriteEventHandlerAsync, NodeValueSimpleWriteEventHandlerAsync) sit alongside the existing sync hooks. * NodeState gains virtual ReadAttributeAsync / WriteAttributeAsync methods. The default implementation wraps the synchronous call in lock(this) so callers that have not opted into async hooks see bit-identical behaviour. * BaseVariableState exposes OnReadValueAsync, OnSimpleReadValueAsync, OnWriteValueAsync and OnSimpleWriteValueAsync slots and overrides the new virtuals to dispatch to them WITHOUT holding the lock during the await. On simple-read the framework still applies index range, data encoding and copy policy; on simple-write the cached value/status/timestamp are updated under lock after the hook completes. * AsyncCustomNodeManager.ReadAsync and WriteAsync now await the new ReadAttributeAsync / WriteAttributeAsync entry points instead of taking lock(source) around the synchronous call. Existing per-source locking semantics are preserved by the default async wrappers. * The fluent INodeBuilder surface gains four new async OnRead/OnWrite overloads that wire to the new BaseVariableState slots, with the same ThrowIfSlotOccupied + null-check pattern as the sync overloads. * Add typed IVariableBuilder<T> fluent surface Adds typed sub-interfaces and impls so the existing fluent surface can expose simple Func<T> / Action<T> / Func<CancellationToken, ValueTask<T>> overloads for variables — without losing the lower-level Variant-based overloads on INodeBuilder. * IVariableBuilder<TValue> + VariableBuilder<TValue> derive from INodeBuilder<BaseVariableState> / NodeBuilder<BaseVariableState> (NodeBuilder<TState> unsealed). * Marshalling uses Variant.AsBoxedObject(BoxingBehavior.Legacy) for reads and Variant(object) for writes; the AOT-unsafe write path is scoped-suppressed with a TODO pointing at the planned per-type generated walker. * INodeManagerBuilder gains Variable<T>(string), Variable<T>(NodeId), VariableFromTypeId<T>(NodeId), VariableFromTypeId<T>(NodeId, QualifiedName). Server library builds clean across all 6 TFMs. * Add relative-child traversal API on INodeBuilder Adds INodeBuilder.Child(QualifiedName), Child<TState>(QualifiedName) and Variable<TValue>(QualifiedName) so source-generated typed wrappers can walk one segment at a time without re-resolving from the manager root. Resolution uses NodeState.FindChild and reuses NodeManagerBuilder.ToVariableBuilder to keep the typed-variable marshalling story consistent. Adds 7 NUnit cases (Fluent category) covering the happy path, type-mismatch, null/missing browse-name, and non-variable rejection. All 66 fluent tests pass. * Mix old + new fluent APIs in MinimalBoilerServer demo BoilerNodeManager.Configure now exercises five wiring styles: (1) browse-path with the legacy ref-Variant callback (2) absolute NodeId with the legacy ref-Variant callback (3) typed Variable<double>(NodeId) + simple Func<double> sync getter (4) typed Variable<double>(NodeId) + Func<CancellationToken, ValueTask<double>> async getter — exercises the BaseVariableState.OnReadValueAsync slot end-to-end through AsyncCustomNodeManager.ReadAsync (5) NodeFromTypeId with OnNodeAdded lifecycle hook All five styles compose against the same INodeManagerBuilder, with the typed and async callbacks pulling in the new IVariableBuilder<T> surface (committed at `e557ecdd9`) and the BaseVariableState async path (committed at `2e2efb4ad`). * Add async-hook tests for BaseVariableState 15 NUnit cases covering the new On{Read,Write}ValueAsync and On Simple{Read,Write}ValueAsync slots plus the ReadAttributeAsync/WriteAttributeAsync overrides on BaseVariableState: * full async slot routes Value reads/writes * lock(this) is released around the awaited handler * simple async slot reapplies cached StatusCode and respects index ranges (BadIndexRangeInvalid for non-null ranges) * exceptions and OperationCanceledException from the hook are caught and surfaced as BadUnexpectedError, mirroring the sync flow * CancellationToken propagates to the hook * cache (m_value, m_statusCode, m_timestamp) is updated on success and skipped on Bad return * fallback to base sync ReadAttribute/WriteAttribute when no async slot is set (preserves today's lock(this) semantics) * non-Value attributes never invoke the async hook * CurrentRead/CurrentWrite access checks short-circuit before the hook runs All 596 State tests pass on net10.0. * Add round-trip tests for typed IVariableBuilder<T> Covers the typed Func<T>/Action<T>/Func<...,ValueTask<T>> overloads on IVariableBuilder<TValue>: each registers the appropriate hook slot on the underlying BaseDataVariableState, and driving the variable through ReadAttribute/WriteAttribute (sync) and ReadAttributeAsync/WriteAttributeAsync (async) reproduces the typed values the user supplied. * Add typed model-traversal source generator Adds FluentBuilderGenerator that walks the design's predefined-instance tree and emits a typed sibling for every NodeManagerBuilder. Each generated wrapper exposes IntelliSense-friendly accessors for child instances, variables (IVariableBuilder<T>) and methods (sync/async OnCall) so wiring sites become builder.Boilers.Boiler__1.LCX001.Measurement.OnRead(...) instead of a stringly typed browse path. The NodeManager template now also emits a Configure(I{Manager}NodeManagerBuilder) partial alongside the existing Configure(INodeManagerBuilder); both partials run, both are optional, and the typed surface is fully AOT-safe (no dynamic, no MakeGenericType, no reflection). * Add tests for the typed model-traversal source generator Adds 9 snapshot tests in Tests/Opc.Ua.SourceGeneration.Core.Tests covering the FluentBuilderGenerator's opt-in flag, typed-manager-interface and proxy emission, internal-sealed visibility, lazy child resolution via Context.NamespaceUris.GetIndexOrAppend, IVariableBuilder<TValue> accessors, sync+async OnCall overloads on method wrappers, and the dual Configure(INodeManagerBuilder)/Configure(I{Manager}NodeManagerBuilder) partial wiring in the NodeManager template. Adds 2 end-to-end AOT tests in Tests/Opc.Ua.Aot.Tests that exercise typed-traversal sync read on LCX001/Measurement and typed-traversal async OnCall on Simulation/Halt through the AOT-compiled MinimalBoilerServer fixture. * Document the typed model-traversal Configure(I{Manager}NodeManagerBuilder) partial	2026-05-15 07:52:49 +02:00
Marc Schier	96f8964704	Fix erroneous debug.assert in SessionManager (#3759 ) * Erroneous debug.assert in SessionManager * Improve build pipelines	2026-05-13 18:05:39 +02:00
Marc Schier	70b4498db8	Certificate manager and ref counted certificate type (#3688 ) * New certificate and secrete abstraction with certificate infrastructure and certificate/secret stores. * leak testing for certificate resources to validate new ref counting in every test assembly * Migration guide updated and documentation added for all * Remove IDisposable from Nodestate and UserIdentity. * UserCertificateTokenHandler now just points into certificate registry/stores, no dispose required * Fix CA2000 warnings and cleanup of other diagnostics, increase warning levels in .editorconfig	2026-05-12 07:56:38 +02:00
Marc Schier	bd4543e961	ManagedSession, Pluggable Subscription engine, and fluent builder + DI (#3730 ) - Add new managed session, wrapping session and providing connection management and failover handling - Add new Subscription engine that can act as alternative to current engine, but is based on channels with worker tasks - Add a fluent builder for managed session clients - Replace NodeCache with LruNodeCache, rename ILruNodeCache and LruNodeCache to INodeCache and NodeCache - Update migration guide and document new functionality.	2026-05-05 19:09:07 +02:00
romanett	2806e35cfb	[Server] Fix Publishing moreNotifications being set to false near MaxMessageQueue size and filter Certificate StatusCodes (#3734 ) * filter CertifiicateStatusCodes before returing to client * fix ClientAuditEntryId for ReportAuditOpenSecureChannelEvent * fix subscription publish bug wrongly reporting moreNotifications as false * Implement users needed for GDS CTT Testing * use InMemoryUserDatabase	2026-05-05 06:22:54 +02:00
Copilot	54cc3d88b1	Prepare for C# 15 union types: UnionAttribute polyfill, TryGetValue rename, HasValue (#3727 )	2026-05-02 18:33:46 +02:00
Copilot	300c2f44d6	Add TriggerNodes, ArrayItemType, Enumeration, Image, References nodes, and CTT server config to UAReferenceServer (#3712 ) * Initial plan * Changes before error encountered Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/f71cc706-0b40-465b-9313-a27e1330d671 Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * Fix test: use new DataValue { WrappedValue = new Variant(42) } to avoid DataValue(StatusCode) ambiguity Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/23104222-aa83-4177-8feb-fe6abfe84168 Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * Add Enumeration/Image scalar nodes, References_HasReferenceTypeAndSubType, and update CTT XML Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/ad53fb57-ecca-413b-a35b-38a9f8dd946a Co-authored-by: marcschier <11168470+marcschier@users.noreply.github.com> * Fix CS8129/CS8130 build errors: replace KeyValuePair deconstruction with kvp.Key/kvp.Value for .NET Framework compat Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/4ccbc876-42b8-4f99-a478-30791efcaa54 Co-authored-by: marcschier <11168470+marcschier@users.noreply.github.com> * Added configuration on new project format for 1.05 CTT * Add Ctt.ReferenceServer.Config.xml and wire --ctt flag to use it Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/ad67081d-1750-4945-a741-ffa710b53e97 Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * Address code review: add comment for Mono exclusion and clarify CTT config ApplicationName Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/ad67081d-1750-4945-a741-ffa710b53e97 Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * Handle CloseSession with invalid channel, refine tests Improved error handling for CloseSession requests by throwing BadSessionIdInvalid when the secure channel is invalid or missing. Updated ReferenceServerTest to use QueueSize = 1 for monitored items and made assertions more precise by checking for exactly two notification data items. --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> Co-authored-by: marcschier <11168470+marcschier@users.noreply.github.com> Co-authored-by: mrsuciu <Mircea-Adrian.Suciu@softing.com> Co-authored-by: Roman Ettlinger <romanett98@gmail.com>	2026-05-01 11:12:45 +02:00
Marc Schier	b2cbf6b03b	Fix DataValue(int) overload resolution bug (#3721 ) new DataValue(42) silently resolved to DataValue(StatusCode) instead of DataValue(Variant) due to C# 'better conversion target' rule — StatusCode wins because it implicitly converts to Variant, making it 'more specific'. This caused m_value = Variant.Null and downstream BadTypeMismatch failures. Changes: - Add [OverloadResolutionPriority(1)] on DataValue(Variant) constructor - Obsolete DataValue(StatusCode) and DataValue(StatusCode, DateTimeUtc) - Add DataValue.FromStatusCode() static factory methods (2 overloads) - Delete DataValue(DataValue) copy constructor - Add DataValue.Copy() instance method using base.MemberwiseClone() - Rewrite Clone()/MemberwiseClone() to delegate to Copy() - Migrate all call sites across 14 files - Add tests verifying new DataValue(42) wraps value correctly - Update MigrationGuide.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-04-30 14:24:45 +02:00
romanett	04802b0f20	Fix deadband handling for MonitoredItem and improve tests (#3718 ) * Fix MonitoredItem ValueChanged Deadband for Arrays * increase string length for badly designed ctt test * Add Sbyte. Add DataChangeFilter.AreEqualMethod	2026-04-30 11:45:33 +02:00
Marc Schier	94bc03b9f6	fix address space issues (#3705 ) * fix missing mandatory children * Source generator: fix encoding nodes, EventNotifier, and type RBAC - Emit DataType encoding nodes (Default Binary/XML/JSON) into the generated address space. CollectEncodingNodes() discovers DataTypeEncodingType instances and builds synthetic hierarchies with their HasEncoding/HasDescription references. - Auto-set EventNotifier=SubscribeToEvents on Object nodes that have forward HasEventSource or HasNotifier references. The fix works at two levels: ModelDesignValidator infers SupportsEvents on types with event references in design XML, and NodeStateGenerator checks the resolved reference set for merged instances that inherit references from their type definitions. - Wrap AccessRestrictions/RolePermissions in if(forInstance) guards for ObjectType, VariableType, DataType, and ReferenceType templates so type definition nodes remain accessible to all users. - Allow ModellingRule=None Object children on type definitions to be emitted (e.g. state machine states/transitions). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Update missing nodes analysis after source generator fixes Retest with admin credentials against ConsoleReferenceServer v1.05.07. Categorize 794 truly missing nodes (after filtering optional/placeholder): - 384 encoding nodes (NodeSet2.xml-only, not in design XML) - 172 role instance children - 84 other nodes - Remaining: trust list, PubSub, diagnostics, etc. RBAC and EventNotifier fixes confirmed working. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * update * plans: detailed analysis of 292 remaining missing nodes Replaced the two previous analysis files with a single consolidated validation report. Each of the 292 nodes is classified with a reason: - 212 type-level children (ObjectType definitions not instantiated) - 48 instance-level children (diagnostics, HA, FileSystem, PubSub) - 32 orphan property templates (design-time canonical definitions) Only 1 fix recommended: Server.Auditing (i=2994) should be exposed as false per Part 5 section 6.3.3. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * feat: add GDS node manager to ConsoleReferenceServer Add Global Discovery Server functionality to the reference server: - Add Opc.Ua.Gds.Server.Common project reference - Add GdsNodeManagerFactory that creates ApplicationsNodeManager with JsonApplicationsDatabase and CertificateGroup (auto-approve) - Add GlobalDiscoveryServerConfiguration extension to config XML - Add GDS to ServerCapabilities - Registration is opt-in: only when config extension is present Also fix pre-existing source generator test failures: - Add missing CreateOrReplaceTransitionNumber stub method to StateMachineTransitionState in CompilerUtils.cs (8 tests fixed) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * plans: update missing nodes report with GDS retest results Retested after adding GDS node manager to ConsoleReferenceServer. Total missing reduced from 1325 to 1243 (82 fewer). 335 remaining 'other' nodes fully classified with per-node reasons. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * plans: Server.Auditing is present (access-restricted, not missing) Live validation confirmed i=2994 exists with value=true, visible to admin users. Returns BadUserAccessDenied for anonymous. No fixes needed. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix CttTestRunner build errors for v1.6 API and Jint 4.8.0 - Update System.CommandLine 2.0.7 API: SetHandler->SetAction, InvokeAsync->Parse().InvokeAsync() - Remove ObjectInstance inheritance from CttAssert, CttServiceRegister, CttIdentifierConstants, CttMonitoredItemHelper; use ToJsObject() factory methods instead - Replace Jint.Native.JsValueType with .IsObject()/.IsNumber()/.IsString() etc. - Add missing using directives (Jint.Runtime, Microsoft.Extensions.Logging, etc.) - Fix NodeId.Identifier obsolete -> TryGetIdentifier<uint> - Fix DataValue.Value obsolete -> WrappedValue.AsBoxedObject() - Fix ApplicationInstance() obsolete -> ApplicationInstance(ITelemetryContext) - Fix LoadApplicationConfiguration -> LoadApplicationConfigurationAsync - Fix CheckApplicationInstanceCertificate -> CheckApplicationInstanceCertificatesAsync - Fix CoreClientUtils.SelectEndpointAsync signature (requires telemetry param) - Fix DefaultSessionFactory() obsolete -> DefaultSessionFactory(ITelemetryContext) - Fix DiscoveryClient.Create -> DiscoveryClient.CreateAsync - Fix FindServers/GetEndpoints -> FindServersAsync/GetEndpointsAsync - Fix StatusCode to uint conversions - Fix ArrayOf<T> iteration (use foreach instead of LINQ on IConvertableToArray) - Fix XmlNodeList null coalescing in CttProjectSettings - Fix JsValue.False -> JsValue.FromObject(engine, false) - Add --json option to Program.cs for machine-readable output Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: emit type-level children with ModellingRule=None for all node classes The source generator's GetChildren method only included ModellingRule=None children when they were ObjectDesign instances (state machine states/transitions). This excluded Variables and Methods that are explicitly defined on types without a modelling rule, such as: - ConditionType.ConditionRefresh (Method) - ConditionType.ConditionRefresh2 (Method) - ConditionType.SupportsFilteredRetain (Variable) - ProgramStateMachineType.Creatable (Variable) - Various TrueState/FalseState display-hint properties Remove the ObjectDesign restriction so all explicitly defined type-level children with ModellingRule=None are included in the generated address space. This adds ~52 previously missing nodes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * plans: update report after ModellingRule=None generator fix Type-level children dropped from 261 to 203 (-58) after fixing the source generator to emit Variables and Methods with ModellingRule=None. Total 'other' reduced from 335 to 283. No fixes needed for any remaining nodes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * plans: all 203 type-level children confirmed present via Read Verified all 203 'type-level children' exist in the server (none return BadNodeIdUnknown). They return Good, BadUserAccessDenied, or BadSecurityModeInsufficient -- all confirming the node exists but is access-restricted for anonymous users. All 1,316 export-missing nodes are now accounted for. Zero nodes are actually missing from the server address space. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix CttTestRunner session service methods for CTT JS script compatibility - Implement ServiceCreateSession with real Session.CreateAsync connection - Implement ServiceActivateSession with proper response fields - Implement ServiceCloseSession with session cleanup - Fix UaSession constructor to provide service methods via CreateServiceObject - Convert all type constructors from ClrFunction to JS functions for 'new' support (Jint 4.x ClrFunction does not support [[Construct]]) - Add UaChannel.connect/disconnect stubs for OpenSecureChannel flow - Add UaDiscovery with getEndpoints/findServers from discovery session - Add missing types: UaSubscriptionDiagnosticsDataType, UaHistoryUpdateResult, etc. - Add missing enums: IdentifierType, Constants (DateTime/numeric limits) - Add UaPkiCertificate.fromDER, UaByteString.fromStringData, PkiType, UaPkiUtility - Add UaDateTime.Now constructor, equals/msecsTo methods - Add UaStatusCode with isGood/isBad/isUncertain as JS constructor - Fix response headers with Timestamp (UaDateTime), ServiceDiagnostics, StringTable - Fix endpoint descriptions with Server, UserIdentityTokens, ServerCertificate - Add CreateResponseHeader helper for consistent response header construction - Override warnOnce.js loggers to avoid Function.caller incompatibility - Add stopTest, checkResourceError (lowercase) global functions - Add UaOpcServer constructor with all method stubs - Handle JS parse errors in include() for malformed CTT files - Test.Connect() now calls InstanciateHelpers with DiscoverySession Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Add CttTestRunner: .NET replacement for CTT JavaScript host environment Implements a Jint-based JavaScript engine that can execute the OPC Foundation's Compliance Test Tool .js test scripts using the OPC UA .NET Standard stack. Features: - Parses CTT .ctt.xml project files (Qt AbstractItemModelData format) - Loads and resolves CTT include() dependency chains (~100 library files) - Registers ~250 Ua* type constructors for JavaScript - Implements session.read/write/browse/getEndpoints/findServers - Provides all OPC UA enumerations, NodeId constants, Assert methods - CLI with --list, --file, --conformance-unit, --result, --json flags - Headless operation for agent/CI integration Current status: Framework connects to OPC UA server and loads CTT test infrastructure. Session establishment flow needs additional property compatibility for CreateSession/ActivateSession request objects. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: do not apply DefaultAccessRestrictions/DefaultRolePermissions to type definitions ObjectType and VariableType nodes should never have access restrictions or role permissions from DefaultAccessRestrictions/ DefaultRolePermissions. These defaults are meant to apply to instances of the type, not to the type definition node itself. Previously, CertificateGroupType, TrustListType, SecurityGroupType and other types were incorrectly emitted with AccessRestrictions inherited from their DefaultAccessRestrictions, making them unreadable without encryption even though the spec defines no restrictions on these type definitions. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * CttTestRunner: fix session establishment flow - Fix constructor patterns (new/no-new dual call support) - Fix ResponseHeader with ServiceDiagnostics/StringTable - Populate ServerNonce, ServerCertificate, ServerEndpoints in CreateSession response - Add UaVariant setter methods (setNodeId/setString/setBoolean/etc.) - Add UaCreateSessionRequest/ActivateSessionRequest with proper nested structures - Fix UaPkiUtility/UaPkiCertificate with Thumbprint/toDERFile/loadCertificateFromFile - Add missing enums: PerformUpdateType, SecurityPolicy, StructureType, etc. - Add HostInfo, Bit helper, KeyPairCollection, ExpectedAndAcceptedResults - Add _error.store(), MessageSecurityMode.toString() Status: Session creates successfully, CreateSession validation runs, hits validateCertificate in PKI chain (next to implement). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * plans: update report after DefaultAccessRestrictions type definition fix ObjectTypes no longer have incorrect access restrictions. Type children reduced from 203 to 164 (39 now visible). Total export- missing reduced from 1316 to 1146. Remaining 164 type children are individual methods/variables with spec-correct access restrictions. Two source generator fixes applied: - ModellingRule=None children for Variables/Methods - DefaultAccessRestrictions not applied to ObjectType/VariableType Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * CttTestRunner: fix PKI, cert validation, warnOnce, session response - Intercept warnOnce.js with Jint-compatible replacement (no Function.caller) - Add _log.store() global helper - Add HOSTNAMES/HostnameFromUrl helpers for cert hostname validation - Add UaPkiCertificate properties: PublicKey, Issuer, Subject, KeyUsage, Hostnames - Add UaPkiUtility.validateCertificate stub - Add UaByteString static helpers: FromByteArray, ToByteArray, fromHexString - Use JS UaNodeId constructor for proper equals() support - Fill AuthenticationToken and 32-byte ServerNonce in CreateSession response - Add clone/append to ByteString objects Session flow: CreateSession validates, ActivateSession reached, hits Channel.ServerCertificate.clone() (IsSecure check — next to fix). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * CttTestRunner: complete session establishment, crypto stubs, ByteString helpers - Add _makeByteString() helper for consistent ByteString objects with clone/append/isEmpty - Add UaCryptoProvider with asymmetricSign/Verify stubs - Add UaExtensionObject setter methods (setAnonymousIdentityToken, etc.) - Fix UaChannel with full properties (RequestedSecurityPolicyUri, IsSecure, etc.) - Fix duplicate type registrations overriding custom constructors - Fix ActivateSession response header with ServiceDiagnostics - Remove UaCreateSessionResponse/ActivateSessionRequest/CloseSessionRequest duplicates Status: Full session lifecycle works (GetEndpoints → OpenSecureChannel → CreateSession → ActivateSession). Test scripts execute and hit server capabilities initialization (MonitoredItem NodeId settings configuration). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * update * plans: add spec references for access restriction reasoning Added links to Part 3 sections 5.2.9, 5.2.11, and 6.3.3 explaining why DefaultRolePermissions are applied to instance children but not to type definitions. The NodeSet2.xml has no explicit RolePermissions on these 164 nodes -- restrictions come from model design defaults. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: add GDS project references to ConsoleReferenceServer Dockerfile Add Opc.Ua.Gds.Common and Opc.Ua.Gds.Server.Common csproj COPY lines to the Docker restore layer, required since the GDS node manager was added to the ConsoleReferenceServer. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * update * feat: add IsPartOfTypeHierarchy flag to bypass access restrictions on types Type hierarchy nodes (ObjectType/VariableType definitions and their children) should be universally accessible regardless of AccessRestrictions and RolePermissions. Changes: - Add IsPartOfTypeHierarchy property to NodeState - Set flag on ObjectType/VariableType in generated code (!forInstance) - Propagate flag from parent to children in AddPredefinedNode - Add flag to NodeMetadata, propagate in GetPermissionMetadata - Bypass ValidateRolePermissions and ValidateAccessRestrictions when IsPartOfTypeHierarchy is true - Revert isTypeDefinition guard: AccessRestrictions and RolePermissions are now emitted on all nodes as metadata, but enforcement is skipped for type hierarchy nodes - Fix forInstance propagation in type factories: use forInstance: forInstance for type children so deep children (TrueState/FalseState etc.) are included when !forInstance Type-level missing nodes reduced from 201 to 99. Remaining 99 are in the server but not reachable by the export tool's browse path. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * plans: update report with final IsPartOfTypeHierarchy results Missing from export reduced to 998 (from 1325 original). Type children: 201 -> 99 (forInstance propagation fix). All nodes verified present via OPC UA Read. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: propagate IsPartOfTypeHierarchy in GetNodeMetadataAsync The Browse service's per-reference ValidateRolePermissionsAsync calls GetNodeMetadataAsync (not GetPermissionMetadataAsync). The IsPartOfTypeHierarchy flag was only set in GetPermissionMetadataAsync, causing type hierarchy nodes to be filtered out of Browse results. This fixes 99 ObjectType children that were previously invisible in Browse from their parent types. Type-level missing: 99 -> 0. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * plans: final report -- 0 type-level children missing (694 total) Type-level missing: 99 -> 0 after fixing IsPartOfTypeHierarchy propagation in GetNodeMetadataAsync. Total export-missing: 694 (384 encoding + 236 access-restricted + 74 instance/orphan). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * update --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-04-28 14:20:37 +02:00
romanett	e767524854	fix some CTT Tests, raise SemanticChangeEvent, fix netstandard 2.1 CI (#3700 ) * fix some CTT Tests, fix netstandard 2.1 CI by using net 10 targets instead of net 8 * fix test * Add semantic change event * fix valueastext * add semantic change integration test SemanticChangeNotificationTestAsync	2026-04-28 14:19:56 +02:00
Marc Schier	939764b5a7	Tests for cp null vs empty (#3703 )	2026-04-24 18:41:19 +02:00
Marc Schier	39fa3030fa	Add a fluent api for server, a sample and generate node managers to use with it. (#3684 ) * Add source-generated NodeManagers and fluent wiring API Adds a fluent INodeManagerBuilder API for wiring per-node callbacks and a model-aware source generator that emits a partial CustomNodeManager2 plus an INodeManagerFactory for each design file. Opt-in is per class via [Opc.Ua.Server.Fluent.NodeManager] on a partial class (recommended) or project-wide via the ModelSourceGeneratorGenerateNodeManager MSBuild property (legacy). The attribute supports NamespaceUri / Design selectors for multi-design projects and a GenerateFactory toggle. Diagnostics MODELGEN010 / MODELGEN011 surface unmatched bindings and non-partial classes. Adds the ConsoleBoilerServer NativeAOT sample driving the new pipeline end-to-end with Microsoft.Extensions.Logging.Console and updated docs in Docs/SourceGeneratedNodeManagers.md. * Add BoilerServer AOT smoke test Verifies the source-generated Boiler.BoilerNodeManagerFactory loads the boiler address space, registers its namespace, and dispatches the fluent OnRead callbacks wired in BoilerNodeManager.Configure.cs. All 3 new tests pass in JIT mode and against the NativeAOT-published binary; total Aot.Tests suite: 71/71 pass.	2026-04-22 16:45:07 +02:00
Marc Schier	d14cd10a86	Model dependency annotations using source generator + flaky test fixes (#3687 ) * Fix publish/dispose race that hangs Client tests Subscription.Dispose pre-disposed m_publishTimer and m_messageWorkerCts before calling ResetPublishTimerAndWorkerState, causing Cancel() to throw ObjectDisposedException and leaving the publish worker stuck. Removed the duplicate disposal so the reset method is the single owner of those resources, and guarded Cancel/Dispose with try/catch ObjectDisposedException for defense in depth. Session.OnPublishComplete could run after Session.Dispose disposed m_reconnectLock, throwing ObjectDisposedException from SemaphoreSlim.Wait() and re-arming via the throttle path indefinitely. Added an early Disposed guard, wrapped Wait/Release in try/catch ObjectDisposedException, and added a Disposed guard in QueueBeginPublish so the throttle cannot reschedule publishes after disposal. Fixes the macOS net10.0 hang seen in Azure pipeline build 13257 (TransferSubscriptionAsync, ReconnectWithSavedSessionSecretsAsync). * fix lockout test and use UserName token for SuccessfulAuthenticationClearsFailedAttempts test After `c1e11b1ab` made anonymous activations no-op for clearing the lockout counter, the test must use a real (non-anonymous) credential to demonstrate that successful authentication resets failed attempts. Use user1/password with PolicyId=1 (UserName_1 in the reference server config). * Fix DirectoryCertificateStore cache staleness across instances When two DirectoryCertificateStore instances point at the same directory (e.g. a CertificateValidator's internal store and a separate store opened by a caller), the directory LastWriteTimeUtc seen by one DirectoryInfo handle does not reliably reflect modifications made through another handle on Windows, even after Refresh(). The mtime-based cache check therefore returned stale entries indefinitely, causing VerifyRejectedCertsDoNotOverflowStoreAsync to flake when the test fixture's RejectedStore failed to observe deletes performed by the validator's internal store. Add a cheap on-disk file count cross-check in the cache-hit branch: if the count of cert files on disk does not match the cached entry count, force a reload. This avoids re-parsing every certificate when nothing has changed but reliably detects external modifications. * test: fix keep-alive mock to return Int32 ServerState The mock for the Server_ServerStatus_State read returned new Variant(0u) (UInt32). The keep-alive worker expects Int32 (ServerState enum is wire-encoded as Int32), so ClientBase.ValidateDataValue logged a BadTypeMismatch warning on every keep-alive throughout the test run. Real servers always emit Int32 for enum variables (BinaryEncoder downgrades the enum encoding byte to Int32), so the warning was purely a test-mock artifact. Switch the mock to new Variant((int)ServerState.Running) to eliminate the spurious warnings. * Source generator: emit and consume ModelDependencyAttribute. Emit one [assembly: ModelDependencyAttribute(...)] per model the generated assembly emits and per upstream model it transitively consumes (new ModelDependencyGenerator in Tools/Opc.Ua.SourceGeneration.Core). * Replace the unused PEReader-based ReferenceMetadataScanner with a Roslyn IAssemblySymbol.GetAttributes() scan (ReferencedModelDependencyScanner in Tools/Opc.Ua.SourceGeneration). Hooks the per-symbol incremental cache, works for both PortableExecutableReference and CompilationReference, AOT-safe. * Wire the scanner result through ModelSourceGenerator into ModelCompilation. The reduced URI-keyed map is passed to the public Generators.GenerateCode extension methods. * NodesetFileCollection.GetDesignFileListForModel now consults the referenced-model map, so transitive nodeset dependencies that are satisfied by a referenced assembly no longer raise the missing-dependency error. * Override resolution: when a local AdditionalFile and a referenced assembly both declare the same model URI under the same C# prefix the local generation is silently skipped (avoids CS0101); different prefixes still generate so downstream consumers can intentionally override types under a different namespace. * New diagnostics MODELGEN010 (override skipped) and MODELGEN012 (multiple referenced assemblies provide same model URI -> tie-break on highest version+publication date). * Bump asserted GeneratedSources counts in ModelGeneratorTests for the new .ModelDependencies.g.cs files (one per generated model). Fix unrelated CS1574 broken cref in NodeId.TryParseLongForm xmldoc that was blocking the Opc.Ua.Types build. * Document the new flow in Docs/ModelDependencies.md. * tests for ModelDependencyAttribute flow * Refactor recently added "parsing" constructors to ParseLongForm static method. Method delegates to Parse(IServiceMessageContext) NodeId, ExpandedNodeId and QualifiedName ParseLongForm overloads are now thin wrappers around Parse(context, options) using NodeIdParsingOptions with RequireResolvedUris=true and updateTables=false. Adds the FallbackToStringIdentifier opt-in to preserve the legacy lenient quirk for callers that need it (off by default for strict parity). Tests for the refactored long-form parsers were added to the existing per-type test fixtures. * Update nuget dependencies to latest	2026-04-22 10:15:12 +02:00
Copilot	b7061ae187	Fix: Cannot call method within the ObjectType of the objectId (#3692 ) * Initial plan * Fix method call on ObjectType hierarchy per OPC UA spec Part 4 section 5.12.2.2 Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/a45b9718-fd5a-4a0e-8f79-233aaaa8532c Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * Add explanatory comment to maxHierarchyDepth constant in FindMethodInTypeHierarchy Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/a45b9718-fd5a-4a0e-8f79-233aaaa8532c Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>	2026-04-22 05:49:46 +02:00
Marc Schier	6c8c1a6d29	Enable dispose analyzers CA2000 and CA2213 and fix all issues (#3670 )	2026-04-17 13:39:34 +02:00
Marc Schier	d1883832e1	Secure channel enhancements 2025 11 (Take 3) (#3665 ) * merged security changes * Tailor SecurityPolicyUri for format expected in s_securityPolicyUriToInfo * Enhance security policy handling and key computation logic * Merge SecurityEnhancements. * Add support for SessionTransferToken. Removed obsolete SoftwareCertificate code. * Fix NonceLength for None. * Add support for RSA_DH, more fixes from IOP testings. * Finish implementation of SecureChannelEnhancements. * Rename EccUtils.cs to CryptoUtils.cs * Address feedback from reviewers. * Fix CoPilot flagged spelling errors. * Rename EccUtils to CryptoUtils * Update version from 1.5.378-preview to 1.5.378 * Fix unit tests. * Allow SignatureData.Algorithm to be NULL or Empty. * Fix issue with BrainPool_p256r1_ChaChaPoly * Fix RSA_DH_AesGcm * Fix OSC/padding by deriving HMAC keys, tightening symmetric size math, and correcting ECC_brainpoolP384r1/Basic128Rsa15 IV, signature, padding, and nonce parameters. * Policies without asymmetric encryption (ECC) return the plaintext when encrypting user tokens; this prevents null payloads from causing BadIdentityTokenInvalid. * Reserve outer CBC padding for avoiding SymetricEncryptAndSign->AddPadding to overwrite next fields (signature) * Nonce stored as byte array in SessionConfiguration; Sesion snapshot restores ServerNonce and reconstructs ECC ephemeral key Nonce from bytes and policy * Added _AesGcm and _ChaChaPoly variants to BuildSupportedSecurityPolicies() for all six ECC certificate types (nistP256, nistP384, brainpoolP256r1, brainpoolP384r1, curve25519, curve448) to SecurityConfiguration. Added Sign and SignAndEncrypt endpoints for the four ECC AesGcm/ChaChaPoly policy pairs (nistP256, nistP384, brainpoolP256r1, brainpoolP384r1) to ServerFixture. * make ephemeralKeyPolicyUri nullable * GenerateSecret also for NET7 and NET8 * Adjust Basic128Rsa15 policy properties for backword compatibility * Exclude unsuported AEAD policies from .NET Framework client tests * Addapt to new changes (still build fail) * Addapt code to make it compile * Fixed failing build on net48 (by ignoring potential null ref which is not reported on other newer targets) * Preserve the certificate reference in Clone() so copied handlers can still sign * Remove extra code and addapt to existing master configuration settings * Filter _AesGcm and _ChaChaPoly security policies based on actual runtime support, so unsupported AEAD policies are not advertised or selected on older frameworks * Expand ECC/RSA policy test coverage and keep Basic128Rsa15 nonce length backward-compatible * Fix ReconnectSessionOnAlternateChannel _AES and _ChaCha policies * Fixed IgnoreIfPolicyNotAdvertised so it now fetches endpoints on-demand (instead of relying on Endpoints being preloaded by earlier tests), which avoids false ignores when running tests directlyy * Merge with commit `5e627f2ca1` from secure-channel-enhancements-2025-11 branch * minor log mesatge formating * Fix ClientLockoutTests * Add ServerFixture policies upfront only if framework and runtime capability supports them * A few cosmetic/config changes as review sugested * Moved the session/security handling from StandardServer into a dedicated helper * use X509IdentityTokenHandler from secure-channel-enhancements-2025-11 * Removed unused Opc.Ua.Types.UnitTests.csproj * test(client): fix Basic128Rsa15 reconnect token-policy coverage Advertise an explicit Basic128Rsa15 user token policy in the test fixture and tighten the reconnect test preconditions for non-advertised policies. * test(client): fix session nonce persistence test helpers Replace the generic reflection helpers in SessionTests with explicit client/server nonce accessors that match the actual field types. Add a short Session comment to explain why client and server nonces currently use different representations. * Merge branch 'master' into secure-channel-enhancements-2025-11-merge5 Merge with latest master and fix conflicts. * Removed unused Opc.Ua.Types.UnitTests.csproj * test(client): fix Basic128Rsa15 reconnect token-policy coverage Advertise an explicit Basic128Rsa15 user token policy in the test fixture and tighten the reconnect test preconditions for non-advertised policies. * test(client): fix session nonce persistence test helpers Replace the generic reflection helpers in SessionTests with explicit client/server nonce accessors that match the actual field types. Add a short Session comment to explain why client and server nonces currently use different representations. * Build fixes * Fix build * update * Minor updates * Fix tests * Add code to check all Endpoints. * Update Design files to 1.05.7 * Run code fixers, add missing docs * Fix build * Revert removal of using * Increase build timeout --------- Co-authored-by: mrsuciu <Mircea-Adrian.Suciu@Softing.com> Co-authored-by: Randy Armstrong <randy@sparhawksoftware.com>	2026-04-16 18:56:42 +00:00
Marc Schier	64ca85fce3	Increase code coverage across solution (#3662 ) Add additional tests to increase code coverage across the solution	2026-04-14 13:32:10 +02:00
Marc Schier	fd41681f4b	Add support to publish OPC UA applications as Native AOT (#3633 ) * make most ptojects aot compatible * Remove newtonsoft * Migrate all projects from Mono.Options to System.CommandLine 2.0.5 * Fix array clone * Replace serializers for storage using new attribute driven type geberator * Add new AOT integration tests covering all functional areas * Documentation updates	2026-04-13 20:52:29 +02:00
romanett	7824e6fdeb	Enhance role-based access control and add permission tests (#3653 ) * Enhance role-based access control and add permission tests - Improve ValidateRolePermissions logic and add ILogger support for detailed access denial logging - Expand default roles (add AuthenticatedUser, TrustedApplication) - Refine RoleBasedIdentity to merge roles and avoid duplicates - Set UserIdentity default GrantedRoleIds to Anonymous - Fix MasterNodeManager PrepareValidationCache - Add comprehensive unit tests for role permission validation and logging * Fix GDS self-admin role: restore NodeId.Null in GrantedRoleIds for ApplicationSelfAdmin The RoleBasedIdentity constructor was filtering out roles with null RoleIds (!role.RoleId.IsNull), which broke the GDS ApplicationSelfAdmin mechanism. The GDS OnAddSelfAdminUserRolePermissions relies on GrantedRoleIds.Contains(NodeId.Null) to detect self-admin users (since GdsRole.ApplicationSelfAdmin has RoleId = ExpandedNodeId.Null). Also remove unused System.Data using statement. Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/3db86efa-c6d6-4e63-947f-156a88210b58 Co-authored-by: romanett <7413710+romanett@users.noreply.github.com> * fix build --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>	2026-04-08 13:13:43 +02:00

1 2 3 4 5 ...

313 Commits