UA-.NETStandard/Stack/Opc.Ua.Core/Security/Certificates/CertificateStoreIdentifier.cs

/* ========================================================================
 * Copyright (c) 2005-2025 The OPC Foundation, Inc. All rights reserved.
 *
 * OPC Foundation MIT License 1.00
 *
 * Permission is hereby granted, free of charge, to any person
 * obtaining a copy of this software and associated documentation
 * files (the "Software"), to deal in the Software without
 * restriction, including without limitation the rights to use,
 * copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the
 * Software is furnished to do so, subject to the following
 * conditions:
 *
 * The above copyright notice and this permission notice shall be
 * included in all copies or substantial portions of the Software.
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
 * OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
 * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
 * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
 * OTHER DEALINGS IN THE SOFTWARE.
 *
 * The complete license agreement can be found here:
 * http://opcfoundation.org/License/MIT/1.00/
 * ======================================================================*/

using System;
using System.Collections.Generic;
using System.IO;
using System.Threading;

namespace Opc.Ua
{
    /// <summary>
    /// Describes a certificate store.
    /// </summary>
    public partial class CertificateStoreIdentifier : IOpenStore, IFormattable, ICloneable
    {
        /// <summary>
        /// Ctor of a certificate store.
        /// </summary>
        public CertificateStoreIdentifier()
            : this(null!, true)
        {
        }

        /// <summary>
        /// Ctor of a certificate store.
        /// </summary>
        /// <param name="storePath">The store path of the store.</param>
        /// <param name="noPrivateKeys">If the store supports no private keys.</param>
        public CertificateStoreIdentifier(
            string storePath,
            bool noPrivateKeys = true)
            : this(storePath, DetermineStoreType(storePath), noPrivateKeys)
        {
        }

        /// <summary>
        /// Ctor of a certificate store.
        /// </summary>
        /// <param name="storePath">The store path of the store.</param>
        /// <param name="storeType">The type of the store.</param>
        /// <param name="noPrivateKeys">If the store supports no private keys.</param>
        public CertificateStoreIdentifier(
            string storePath,
            string storeType,
            bool noPrivateKeys = true)
        {
            StorePath = storePath ?? string.Empty;
            StoreType = storeType ?? string.Empty;
            m_noPrivateKeys = noPrivateKeys;
        }

        /// <summary>
        /// Formats the value of the current instance using the specified format.
        /// </summary>
        /// <param name="format">The <see cref="string"/> specifying the format to use.
        /// -or-
        /// null to use the default format defined for the type of the <see cref="IFormattable"/> implementation.</param>
        /// <param name="formatProvider">The <see cref="IFormatProvider"/> to use to format the value.
        /// -or-
        /// null to obtain the numeric format information from the current locale setting of the operating system.</param>
        /// <returns>
        /// A <see cref="string"/> containing the value of the current instance in the specified format.
        /// </returns>
        /// <exception cref="FormatException"></exception>
        public string ToString(string? format, IFormatProvider? formatProvider)
        {
            if (format != null)
            {
                throw new FormatException(Utils.Format("Invalid format string: '{0}'.", format));
            }

            return ToString();
        }

        /// <summary>
        /// Returns a <see cref="string"/> that represents the current <see cref="object"/>.
        /// </summary>
        /// <returns>
        /// A <see cref="string"/> that represents the current <see cref="object"/>.
        /// </returns>
        public override string ToString()
        {
            if (string.IsNullOrEmpty(StoreType))
            {
                return Utils.Format("{0}", StorePath ?? string.Empty);
            }

            return Utils.Format("[{0}]{1}", StoreType!, StorePath ?? string.Empty);
        }

        /// <summary>
        /// The path to the default PKI Root.
        /// </summary>
#if NETFRAMEWORK
        public static readonly string DefaultPKIRoot = Path.Combine(
            "%CommonApplicationData%",
            "OPC Foundation",
            "pki");
#else
        public static readonly string DefaultPKIRoot = Path.Combine(
            "%LocalApplicationData%",
            "OPC Foundation",
            "pki");
#endif

        /// <summary>
        /// The path to the current user X509Store.
        /// </summary>
        public static readonly string CurrentUser = "CurrentUser\\";

        /// <summary>
        /// The path to the local machine X509Store.
        /// </summary>
        public static readonly string LocalMachine = "LocalMachine\\";

        /// <summary>
        /// Options that can be used to suppress certificate validation errors.
        /// </summary>
        public CertificateValidationOptions ValidationOptions { get; set; }

        /// <summary>
        /// Detects the type of store represented by the path.
        /// </summary>
        public static string DetermineStoreType(string storePath)
        {
            if (string.IsNullOrEmpty(storePath))
            {
                return CertificateStoreType.Directory;
            }

            if (storePath.StartsWith(LocalMachine, StringComparison.OrdinalIgnoreCase))
            {
                return CertificateStoreType.X509Store;
            }

            if (storePath.StartsWith(CurrentUser, StringComparison.OrdinalIgnoreCase))
            {
                return CertificateStoreType.X509Store;
            }

            foreach (string storeTypeName in CertificateStoreType.RegisteredStoreTypeNames)
            {
                ICertificateStoreType? storeType = CertificateStoreType
                    .GetCertificateStoreTypeByName(storeTypeName);
                if (storeType != null && storeType.SupportsStorePath(storePath))
                {
                    return storeTypeName;
                }
            }

            return CertificateStoreType.Directory;
        }

        /// <summary>
        /// Resolves a store type using registered <see cref="ICertificateStoreProvider"/>
        /// instances, falling back to the built-in store types.
        /// </summary>
        /// <param name="storeTypeName">The store type name to resolve.</param>
        /// <param name="telemetry">The telemetry context for logging and diagnostics.</param>
        /// <param name="providers">
        /// An optional set of providers to try before the built-in store types.
        /// </param>
        /// <returns>A new <see cref="ICertificateStore"/> instance.</returns>
#nullable enable
        public static ICertificateStore CreateStore(
            string storeTypeName,
            ITelemetryContext telemetry,
            IEnumerable<ICertificateStoreProvider>? providers)
        {
            if (providers != null)
            {
                foreach (ICertificateStoreProvider provider in providers)
                {
                    if (provider.StoreTypeName == storeTypeName)
                    {
                        return provider.CreateStore(telemetry);
                    }
                }
            }

            // Fallback to existing logic
            return CreateStore(storeTypeName, telemetry);
        }

        /// <summary>
        /// Returns an object that can be used to access the store.
        /// </summary>
        /// <exception cref="ArgumentException"></exception>
        public static ICertificateStore CreateStore(string storeTypeName, ITelemetryContext telemetry)
        {
            if (string.IsNullOrEmpty(storeTypeName))
            {
                return new CertificateIdentifierCollectionStore(telemetry);
            }

            ICertificateStore store;
            switch (storeTypeName)
            {
                case CertificateStoreType.X509Store:
                    store = new X509CertificateStore(telemetry);
                    break;
                case CertificateStoreType.Directory:
                    store = new DirectoryCertificateStore(telemetry);
                    break;
                default:
                    ICertificateStoreType? storeType = CertificateStoreType
                        .GetCertificateStoreTypeByName(storeTypeName);
                    if (storeType != null)
                    {
                        store = storeType.CreateStore(telemetry);
                        break;
                    }
                    throw new ArgumentException($"Invalid store type name: {storeTypeName}");
            }
            return store;
        }

        /// <summary>
        /// Obsoleted open call
        /// </summary>
        [Obsolete("Use OpenStore(ITelemetryContext) instead")]
        public ICertificateStore OpenStore()
        {
            return OpenStore(null!);
        }

        /// <summary>
        /// Returns an object to access the store containing the certificates.
        /// </summary>
        /// <remarks>
        /// Opens a cached instance of the store which contains public and private keys.
        /// To take advantage of the certificate cache use <see cref="ICertificateStore.Close"/>.
        /// Disposing the store has no functional impact but may
        /// enforce unnecessary refresh of the cached certificate store.
        /// </remarks>
        /// <returns>A disposable instance of the <see cref="ICertificateStore"/>.</returns>
        public virtual ICertificateStore OpenStore(ITelemetryContext telemetry)
        {
            ICertificateStore? store = m_store;

            // determine if the store configuration changed
            if (store != null &&
                (
                    store.StoreType != StoreType ||
                    store.StorePath != StorePath ||
                    store.NoPrivateKeys != m_noPrivateKeys))
            {
                ICertificateStore? previousStore = Interlocked.CompareExchange(
                    ref m_store,
                    null,
                    store);
                previousStore?.Dispose();
                store = null;
            }

            // create and open the store
            if (store == null &&
                !string.IsNullOrEmpty(StoreType) &&
                !string.IsNullOrEmpty(StorePath))
            {
                store = CreateStore(StoreType!, telemetry);
                ICertificateStore? currentStore = Interlocked.CompareExchange(
                    ref m_store,
                    store,
                    null);
                if (currentStore != null)
                {
                    store?.Dispose();
                    store = currentStore;
                }
            }

            store?.Open(StorePath ?? string.Empty, m_noPrivateKeys);

            return store!;
        }

        private ICertificateStore? m_store;
        private readonly bool m_noPrivateKeys;
    }

    /// <summary>
    /// The type of certificate store.
    /// </summary>
    public static class CertificateStoreType
    {
        /// <summary>
        /// Registers a new certificate store type that con be specified in config files.
        /// </summary>
        /// <param name="storeTypeName">The name of the store type.</param>
        /// <param name="storeType">Store type</param>
        [Obsolete("Use ICertificateStoreProvider registered via DI instead.")]
        public static void RegisterCertificateStoreType(
            string storeTypeName,
            ICertificateStoreType storeType)
        {
            s_registeredStoreTypes.Add(storeTypeName, storeType);
        }

        /// <summary>
        /// Returns the registered type for a custom certificate store.
        /// </summary>
        public static ICertificateStoreType? GetCertificateStoreTypeByName(string storeTypeName)
        {
            s_registeredStoreTypes.TryGetValue(storeTypeName, out ICertificateStoreType? result);
            return result;
        }

        /// <summary>
        /// Returns the collection of registered certificate store keys.
        /// </summary>
        public static IReadOnlyCollection<string> RegisteredStoreTypeNames
            => s_registeredStoreTypes.Keys;

        /// <summary>
        /// A windows certificate store.
        /// </summary>
        public const string X509Store = "X509Store";

        /// <summary>
        /// A directory certificate store.
        /// </summary>
        public const string Directory = "Directory";

        private static readonly Dictionary<string, ICertificateStoreType> s_registeredStoreTypes = [];
    }
}