* New certificate and secrete abstraction with certificate infrastructure and certificate/secret stores.
* leak testing for certificate resources to validate new ref counting in every test assembly
* Migration guide updated and documentation added for all
* Remove IDisposable from Nodestate and UserIdentity.
* UserCertificateTokenHandler now just points into certificate registry/stores, no dispose required
* Fix CA2000 warnings and cleanup of other diagnostics, increase warning levels in .editorconfig
* Enhance role-based access control and add permission tests
- Improve ValidateRolePermissions logic and add ILogger support for detailed access denial logging
- Expand default roles (add AuthenticatedUser, TrustedApplication)
- Refine RoleBasedIdentity to merge roles and avoid duplicates
- Set UserIdentity default GrantedRoleIds to Anonymous
- Fix MasterNodeManager PrepareValidationCache
- Add comprehensive unit tests for role permission validation and logging
* Fix GDS self-admin role: restore NodeId.Null in GrantedRoleIds for ApplicationSelfAdmin
The RoleBasedIdentity constructor was filtering out roles with null RoleIds
(!role.RoleId.IsNull), which broke the GDS ApplicationSelfAdmin mechanism.
The GDS OnAddSelfAdminUserRolePermissions relies on GrantedRoleIds.Contains(NodeId.Null)
to detect self-admin users (since GdsRole.ApplicationSelfAdmin has RoleId = ExpandedNodeId.Null).
Also remove unused System.Data using statement.
Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/3db86efa-c6d6-4e63-947f-156a88210b58
Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
* fix build
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
* feat: add TrustedApplication role assignment per OPC UA Part 3 §4.9
- Add Role.TrustedApplication static property to RoleBasedIdentity.cs
- Add SessionManager.AddMandatoryRoles protected virtual method that assigns
TrustedApplication role when session has a ClientCertificate and uses
MessageSecurityMode.Sign or SignAndEncrypt (per OPC UA Part 3 §4.9)
- Call AddMandatoryRoles in ActivateSessionAsync after identity resolution
- Add ObjectIds.WellKnownRole_TrustedApplication to s_kWellKnownRoles in
DiagnosticsNodeManager.cs
- Add TrustedApplicationRoleTests.cs with 7 unit tests (mock-based) and
1 integration test covering positive and negative cases
Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/86ac791b-5af2-48c6-96f9-19838dfbbde0
Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
* fix: update test assertion messages to use 'should' phrasing per codebase conventions
Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/86ac791b-5af2-48c6-96f9-19838dfbbde0
Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
* fix: traverse identity chain in GDS AuthorizationHelper for wrapped RoleBasedIdentity
The TrustedApplication role wraps effectiveIdentity in a new RoleBasedIdentity,
which broke GDS SelfAdmin privilege checks that did `is GdsRoleBasedIdentity`.
- Add InnerIdentity property to RoleBasedIdentity to expose the wrapped inner identity
- Update both CheckSelfAdminPrivilege overloads in AuthorizationHelper to traverse
the identity chain, so GdsRoleBasedIdentity is found even when wrapped
Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/e913ca94-56cf-49d4-a823-fe5861aea8aa
Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
* refactor: use WithAdditionalRoles virtual method to preserve identity type when adding mandatory roles
- InnerIdentity on RoleBasedIdentity is now protected (not public)
- Add public virtual WithAdditionalRoles() to RoleBasedIdentity so subclasses
can preserve their concrete type when additional roles are layered on
- GdsRoleBasedIdentity overrides WithAdditionalRoles to return a new
GdsRoleBasedIdentity with ApplicationId preserved
- SessionManager.AddMandatoryRoles calls WithAdditionalRoles when the identity
is already a RoleBasedIdentity, so GdsRoleBasedIdentity stays as-is
- AuthorizationHelper reverted to original simple 'is GdsRoleBasedIdentity'
check (no chain traversal needed)
Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/c2854f1f-e220-43d9-aa10-c2c4dca59fd6
Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
* fix: treat BadRequestInterrupted as expected transient error in ConnectionStabilityTest
During secure channel renewal with a short token lifetime (10s), in-flight
write requests can be interrupted with BadRequestInterrupted. This is expected
behavior during the channel transition and should not count as a test failure.
Added a specific catch clause for ServiceResultException with BadRequestInterrupted
that logs it as informational rather than adding to the error list.
Agent-Logs-Url: https://github.com/OPCFoundation/UA-.NETStandard/sessions/d58e5ecd-34de-4a6f-b060-ad6f804f8a7d
Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: romanett <7413710+romanett@users.noreply.github.com>
Co-authored-by: Roman Ettlinger <romanett98@gmail.com>
Generate stack and application code using source generators
Change built in types to readonly structs
Update localized text implementation to use JSON text serializer
Status code with symbolic names
Immutable node ids
No boxing for all built in types <= 8 bytes in Variant.
Split user identity token and token handling via token handler
Add migration guide for breaking changes
* Refactor string usage for secrets (#394)
Strings are immutable and the lifetime of secrets can not be controlled.
Use byte[] or char[] instead of strings for secrets, which can be erased
after use.
* Clear pw
---------
Co-authored-by: Martin Regen <7962757+mregen@users.noreply.github.com>
-Implement the support for ApplicationSelfAdmin privilege
-implement the workflow in a test to pull the trust list after sucessfully receiving a gds signed certificate.
-this authorization is described here in the OPC Spec: https://reference.opcfoundation.org/GDS/v105/docs/7.6
- move IUserDatabase + RoleBased Identity into standard Server
- subclass SystemConfigurationIdentity from RoleBased Identity for backward compatibility
- add OPC UA Spec Defined Roles to the RoleBasedIdentity
Marc Schier