Files
UA-.NETStandard/Libraries/Opc.Ua.Client/Subscription/ISubscriptionNotificationHandler.cs
Marc Schier 87f253bb47 Support unbounded monitored items per subscription via automatic partitioning (#3869)
# Description

Adds **unbounded monitored items per subscription** to the V2
`ManagedSession` subscription engine via automatic, transparent
partitioning. Top-level public API and runtime semantics for callers
that stay under the server's `MaxMonitoredItemsPerSubscription` cap are
unchanged; callers that exceed the cap continue to succeed instead of
failing with `BadTooManyMonitoredItems`.

## Approach (OPC UA Part 4 1.05.07 conformant)

- The public `ISubscription` is now a `LogicalSubscription` that owns
one **primary** and zero-or-more **secondary** `Subscription`
partitions, each a real server-side subscription.
- `CompositeMonitoredItemCollection` aggregates the per-partition
`MonitoredItemCollection` views so `Items`, indexer access, and
enumeration look unsharded to the caller.
- `PartitionPlacementPolicy` decides the target partition at
`TryAddMonitoredItem` time:
- **`StrictAffinity`** — keep items tagged with the same `Affinity`
co-located until the partition fills, then split with a one-time
warning.
- **`BestEffortAffinity`** (default) — prefer co-location but spill
silently when the partition is full.
- No affinity → fall back to the least-loaded partition (or the
primary).
- `PartitionForwardingHandler` proxies notifications from secondary
partitions to the caller's handler with the **primary partition's**
`ISubscription` identity, so handler code never observes the split.
- **Durable subscriptions (Part 4 §5.13.9):** when `SetAsDurableAsync`
runs before any items are added, the wrapper records the intent and
installs an `OnAfterCreateAsync` hook on every existing partition. Each
newly-minted secondary inherits the hook so `SetSubscriptionDurable` is
invoked between `CreateSubscription` and `CreateMonitoredItems` — the
only order the standard allows.
- **Snapshot/restore** preserves the partition layout so reconnect and
failover restore items into the same partition they were created in,
with affinity tags intact.
- Secondary partitions that go idle (no items, no pending
`CreateMonitoredItems`) are deleted to release server resources.

## Performance

Hot-path dispatch goes through the primary partition unchanged for the
unsharded case (single-partition fast path); the forwarding handler only
allocates on the multi-partition path. The performance smoke test in
`Tests/Opc.Ua.Stress.Tests` shows no regression.

## New configuration

```csharp
session.AddSubscription(handler, new SubscriptionOptions
{
    MaxMonitoredItemsPerPartition = 5000,          // optional cap per server-side subscription
    PartitionPlacementPolicy =                      // optional placement policy
        PartitionPlacementPolicy.StrictAffinity
});

sub.TryAddMonitoredItem(
    name,
    nodeId,
    o => o with { Affinity = "machine-A" },         // optional co-location hint
    out _);
```

Defaults preserve pre-change behaviour (`MaxMonitoredItemsPerPartition =
uint.MaxValue`, `BestEffortAffinity`).

## New types (Libraries/Opc.Ua.Client/Subscription)

| File | Purpose |
| --- | --- |
| `CompositeMonitoredItemCollection.cs` | Aggregate collection view |
| `ILogicalSubscription.cs` / `IPartitionedSubscription.cs` | Internal
contracts used by tests and infrastructure |
| `LogicalSubscription.cs` | Wrapper that owns the partitions |
| `PartitionForwardingHandler.cs` | Notification proxy |
| `PartitionPlacementPolicy.cs` | Affinity-aware item placement |

Modified: `ISubscriptionNotificationHandler`, `MonitoredItemManager`,
`MonitoredItemOptions` (adds `Affinity`), `Subscription`,
`SubscriptionManager`, `SubscriptionOptions` (adds
`MaxMonitoredItemsPerPartition`, `PartitionPlacementPolicy`),
`SubscriptionManagerSerializer`, `MonitoredItemStateSnapshot`,
`SubscriptionStateSnapshot`, `ManagedSessionExtensions`.

## Documentation

- New: `Docs/UnboundedSubscriptions.md` — feature overview, affinity
semantics, snapshot/durable interaction.
- Cross-links added in `Docs/Sessions.md`, `Docs/MigrationGuide.md`,
`Docs/README.md`.

## Validation

| Suite | Result |
| --- | --- |
| Unit tests for new types — `Opc.Ua.Client.Tests.Subscription.*`
(net10.0 + net48) | **39 / 39** |
| All `Opc.Ua.Client.Subscriptions.*` unit tests (net48) | **152 / 152**
|
| Integration — `Opc.Ua.Subscriptions.Tests.UnboundedSubscriptionTests`
(net10.0 + net48) | **3 / 3** (1 durable-only skipped) |
| Integration — `Opc.Ua.Subscriptions.Durable.Tests.*V2Async` (net10.0)
| **6 / 6** (incl. new `DurableLifetimeAppliesToAllPartitionsV2Async`) |
| Adjacent — `Opc.Ua.Sessions.Tests` (net10.0) | **690 / 690** |
| Adjacent — `Opc.Ua.Subscriptions.Classic.Tests` (net10.0) | **32 /
32** |
| Adjacent — `Opc.Ua.Features.Tests` (net10.0) | **128 / 128** |
| Adjacent — `Opc.Ua.Stress.Tests` (net10.0) | **159 / 159** |
| NativeAOT smoke — `Opc.Ua.Aot.Tests.SubscriptionAotTests` (win-x64) |
**5 / 5** (incl. new `UnboundedSubscriptionWithCapAotAsync`) |

## Compatibility

- **No public type removed**, **no obsoletions added**.
- Public surface on `ISubscription` / `ManagedSession` unchanged.
- New options non-breaking by default (`MaxMonitoredItemsPerPartition =
uint.MaxValue` preserves prior behaviour; `BestEffortAffinity` matches
the closest analogue to the prior single-partition semantics).
- Classic V1 subscription engine unchanged.

## Related Issues

- _No tracking issue filed — please reference the appropriate one if any
exists._


## Security review

Scoped against Microsoft Service Tree
``59eec07a-6f20-42b9-b41b-d20e0a6322da`` (Azure Industrial IoT) using a
combination of the security-agent MCP (code-integrity, secrets-usage,
tls, policy-governance, ai-chat) and the ``security-review`` SAST
sub-agent on the PR diff. Bar: SDL secure-coding for a client library +
OPC UA Part 2 / Part 4 §5.5 / §5.13 spec.

Fixed in commit ``c6997689``:

| # | Sev | Title | Fix |
| --- | --- | --- | --- |
| 1 | CRITICAL | Unbounded partition fan-out under hostile server
(CWE-400/770) | Added ``SubscriptionOptions.MaxPartitionCount`` (default
``32``), enforced in ``PartitionPlacementPolicy``, surfaced as
``PlacementDecision.RejectMaxPartitionCountReached`` |
| 2 | HIGH | Snapshot ``LogicalGroupId`` option-consistency not
validated (CWE-502) | ``ValidateAndSortGroup`` now asserts all snapshots
in a group agree on every subscription-wide option |
| 3 | MEDIUM | Restore-path secondaries bypassed
``PartitionForwardingHandler`` (CWE-362) |
``AttachSecondaryPartitionAsync`` now reuses the wrapper's forwarding
handler when present |

Findings explicitly assessed and dismissed (sub-agent confirmed):
* Affinity-index growth — uses ``StringComparer.Ordinal`` (no
CVE-2022-29117 class); growth is application-controlled, not
attacker-controlled.
* Idle-timer race vs ``DisposeAsync`` — race exists; worst case is a
swallowed ``ObjectDisposedException``. No attacker trigger.
* Cross-wrapper notification routing — each ``Add`` allocates its own
forwarding handler; ``BindLogical`` rejects re-binding; no structural
path for crosstalk.
* OPC UA Part 4 §5.13.6 (``SetTriggering`` cross-partition) — enforced
by ``LogicalSubscription.SetTriggeringAsync``.
* OPC UA Part 4 §5.13.9 (durable hook ordering) — installed uniformly on
every minted partition.

Validation: ``Opc.Ua.Client`` builds clean on net10.0; 43 V2 unit tests
+ 3 unbounded integration tests + 6 V2 durable integration tests all
pass.
## Checklist

- [x] I have signed the
[CLA](https://opcfoundation.org/license/cla/ContributorLicenseAgreementv1.0.pdf)
and read the
[CONTRIBUTING](https://github.com/OPCFoundation/UA-.NETStandard/blob/master/CONTRIBUTING.md)
doc.
- [x] I have added tests that prove my fix is effective or that my
feature works and increased code coverage.
- [x] I have added all necessary documentation.
- [x] I have verified that my changes do not introduce (new) build or
analyzer warnings.
- [x] I ran **all** tests locally using the **UA.slnx** solution against
at least .net **framework** and .net **10**, and all passed.
- [ ] I fixed **all** failing and flaky tests in the CI pipelines and
**all** CodeQL warnings.
- [ ] I have addressed **all** PR feedback received.
2026-06-12 18:57:38 +02:00

210 lines
9.4 KiB
C#

/* ========================================================================
* Copyright (c) 2005-2025 The OPC Foundation, Inc. All rights reserved.
*
* OPC Foundation MIT License 1.00
*
* Permission is hereby granted, free of charge, to any person
* obtaining a copy of this software and associated documentation
* files (the "Software"), to deal in the Software without
* restriction, including without limitation the rights to use,
* copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the
* Software is furnished to do so, subject to the following
* conditions:
*
* The above copyright notice and this permission notice shall be
* included in all copies or substantial portions of the Software.
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
* EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
* OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
* NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
* HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
* WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
* FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
* OTHER DEALINGS IN THE SOFTWARE.
*
* The complete license agreement can be found here:
* http://opcfoundation.org/License/MIT/1.00/
* ======================================================================*/
using System;
using System.Collections.Generic;
using System.Threading;
using System.Threading.Tasks;
using Opc.Ua.Client.Subscriptions.MonitoredItems;
namespace Opc.Ua.Client.Subscriptions
{
/// <summary>
/// <para>
/// Data value change observed on a monitored item during the V2
/// publish dispatch.
/// </para>
/// <para>
/// Lifetime note (pooled notifications): when the V2 subscription
/// manager has <see cref="ISubscriptionManager.PoolNotifications"/>
/// enabled, the underlying <c>MonitoredItemNotification</c> that
/// supplied this struct's fields is recycled back to its
/// activator pool after the handler returns. This struct's
/// references (<see cref="Value"/>, <see cref="DiagnosticInfo"/>)
/// project the inner <c>DataValue</c> / <c>DiagnosticInfo</c>
/// instances directly — those are not themselves pooled (out of
/// scope), so a handler may safely copy this struct by value and
/// continue using <see cref="Value"/> after the call. Pool-aware
/// projection audit: confirmed safe — no reference to a pooled
/// instance is surfaced.
/// </para>
/// </summary>
/// <param name="MonitoredItem"></param>
/// <param name="Value"></param>
/// <param name="DiagnosticInfo"></param>
public record struct DataValueChange(IMonitoredItem? MonitoredItem,
DataValue Value, DiagnosticInfo? DiagnosticInfo)
{
/// <summary>
/// <para>
/// Server-assigned subscription identifier of the partition
/// that delivered this notification. For single-partition
/// logical subscriptions (the default) this matches
/// <c>ISubscription.ServerId</c> of the subscription the
/// caller registered. For multi-partition subscriptions —
/// where the V2 engine has transparently split monitored
/// items across multiple server-side subscriptions — this
/// disambiguates the source partition so callers that key
/// off <c>sequenceNumber</c> in their handler can use the
/// tuple <c>(PartitionServerId, sequenceNumber)</c> to
/// correlate across publish responses.
/// </para>
/// <para>
/// <c>0</c> on records minted without partition context (e.g.
/// test fixtures); production publish dispatch always
/// populates this with the partition's server id.
/// </para>
/// </summary>
public uint PartitionServerId { get; init; }
}
/// <summary>
/// <para>
/// Event notification observed during the V2 publish dispatch.
/// </para>
/// <para>
/// Lifetime note (pooled notifications): when the V2 subscription
/// manager has <see cref="ISubscriptionManager.PoolNotifications"/>
/// enabled, the underlying <c>EventFieldList</c> is recycled back
/// to its activator pool after the handler returns. The
/// <see cref="Fields"/> property is captured by value as an
/// <see cref="ArrayOf{T}"/> wrapping the original event-fields
/// array. Arrays are not pooled in this design (out of scope), so
/// the captured backing array survives the recycle. Pool-aware
/// projection audit: confirmed safe — no reference to a pooled
/// instance is surfaced.
/// </para>
/// </summary>
/// <param name="MonitoredItem"></param>
/// <param name="Fields"></param>
public record struct EventNotification(IMonitoredItem? MonitoredItem,
ArrayOf<Variant> Fields)
{
/// <summary>
/// Server-assigned subscription identifier of the partition
/// that delivered this notification. See
/// <see cref="DataValueChange.PartitionServerId"/> for full
/// semantics — the same disambiguation rules apply to event
/// notifications.
/// </summary>
public uint PartitionServerId { get; init; }
}
/// <summary>
/// Notification handler
/// </summary>
public interface ISubscriptionNotificationHandler
{
/// <summary>
/// Process data change notification
/// </summary>
/// <param name="subscription"></param>
/// <param name="sequenceNumber"></param>
/// <param name="publishTime"></param>
/// <param name="notification"></param>
/// <param name="publishStateMask"></param>
/// <param name="stringTable"></param>
/// <returns></returns>
ValueTask OnDataChangeNotificationAsync(ISubscription subscription,
uint sequenceNumber, DateTime publishTime,
ReadOnlyMemory<DataValueChange> notification,
PublishState publishStateMask, IReadOnlyList<string> stringTable);
/// <summary>
/// Process event notification
/// </summary>
/// <param name="subscription"></param>
/// <param name="sequenceNumber"></param>
/// <param name="publishTime"></param>
/// <param name="notification"></param>
/// <param name="publishStateMask"></param>
/// <param name="stringTable"></param>
/// <returns></returns>
ValueTask OnEventDataNotificationAsync(ISubscription subscription,
uint sequenceNumber, DateTime publishTime,
ReadOnlyMemory<EventNotification> notification,
PublishState publishStateMask, IReadOnlyList<string> stringTable);
/// <summary>
/// Process keep alive notification
/// </summary>
/// <param name="subscription"></param>
/// <param name="sequenceNumber"></param>
/// <param name="publishTime"></param>
/// <param name="publishStateMask"></param>
/// <returns></returns>
ValueTask OnKeepAliveNotificationAsync(ISubscription subscription,
uint sequenceNumber, DateTime publishTime,
PublishState publishStateMask);
/// <summary>
/// Surface a transition in the subscription's lifecycle
/// (<paramref name="state"/>) or publish-side status
/// (<paramref name="publishStateMask"/>). Fires from the V2
/// engine on:
/// <list type="bullet">
/// <item><description>Lifecycle transitions —
/// <see cref="SubscriptionState.Opened"/>,
/// <see cref="SubscriptionState.Created"/>,
/// <see cref="SubscriptionState.Modified"/>,
/// <see cref="SubscriptionState.Deleted"/>.</description></item>
/// <item><description>Publish-side transitions —
/// <see cref="PublishState.Republish"/> (a gap was detected and
/// a republish was issued), <see cref="PublishState.Recovered"/>
/// (a missing message arrived or publishing resumed after a
/// stop), <see cref="PublishState.Transferred"/> (the
/// subscription was taken over on a different session via
/// <c>TransferSubscriptions</c>).</description></item>
/// </list>
/// <para>
/// Handlers that need derived state (publishing stopped, last
/// keep-alive, republish-pending, etc.) maintain it themselves
/// by responding to this callback — V2 is handler-centric and
/// the engine deliberately does not expose those as polled
/// properties on <see cref="ISubscription"/>.
/// </para>
/// <para>
/// Per-subscription delivery ordering is guaranteed by the V2
/// prioritized publish-ack channel: data / event / keep-alive
/// callbacks for a given subscription always fire in
/// publish-sequence order. State-change callbacks interleave
/// with the notification stream at the moment the transition
/// is observed.
/// </para>
/// </summary>
/// <param name="subscription"></param>
/// <param name="state"></param>
/// <param name="publishStateMask"></param>
/// <param name="ct"></param>
ValueTask OnSubscriptionStateChangedAsync(ISubscription subscription,
SubscriptionState state, PublishState publishStateMask,
CancellationToken ct = default);
}
}