UA-.NETStandard/tests/Opc.Ua.Server.Tests/KeyCredential/KeyCredentialPushTests.cs

/* ========================================================================
 * Copyright (c) 2005-2026 The OPC Foundation, Inc. All rights reserved.
 *
 * OPC Foundation MIT License 1.00
 *
 * Permission is hereby granted, free of charge, to any person
 * obtaining a copy of this software and associated documentation
 * files (the "Software"), to deal in the Software without
 * restriction, including without limitation the rights to use,
 * copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the
 * Software is furnished to do so, subject to the following
 * conditions:
 *
 * The above copyright notice and this permission notice shall be
 * included in all copies or substantial portions of the Software.
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
 * OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
 * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
 * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
 * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
 * OTHER DEALINGS IN THE SOFTWARE.
 *
 * The complete license agreement can be found here:
 * http://opcfoundation.org/License/MIT/1.00/
 * ======================================================================*/

using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading;
using System.Threading.Tasks;
using Moq;
using NUnit.Framework;
using Opc.Ua.Tests;

namespace Opc.Ua.Server.Tests.KeyCredential
{
    [TestFixture]
    [Category("KeyCredential")]
    public class KeyCredentialPushTests
    {
        private static readonly ITelemetryContext s_telemetry = NUnitTelemetryContext.Create();

        /// <summary>
        /// Verifies that updating a credential stores its plaintext secret and deleting the credential removes it.
        /// </summary>
        [Test]
        public async Task UpdateCredentialThenDeleteCredentialUpdatesStore()
        {
            using var store = new InMemoryKeyCredentialStore();
            var subject = new KeyCredentialPushSubject(store);
            KeyCredentialConfigurationFolderState folder = CreateFolder();
            ISystemContext context = CreateAdminContext();
            await subject.BindAsync(folder, context).ConfigureAwait(false);

            KeyCredentialConfigurationState credentialNode = await CreateCredentialNodeAsync(folder, context)
                .ConfigureAwait(false);
            byte[] secret = [1, 2, 3, 4];
            KeyCredentialUpdateMethodStateResult updateResult = await credentialNode.UpdateCredential!.OnCallAsync!(
                    context,
                    credentialNode.UpdateCredential,
                    credentialNode.NodeId,
                    "credential-1",
                    ByteString.From(secret),
                    string.Empty,
                    string.Empty,
                    CancellationToken.None)
                .ConfigureAwait(false);

            Assert.That(ServiceResult.IsGood(updateResult.ServiceResult), Is.True);
            Server.KeyCredential stored = (await store.GetAsync("credential-1", CancellationToken.None)
                .ConfigureAwait(false))!;
            Assert.That(stored, Is.Not.Null);
            Assert.That(stored.Secret, Is.EqualTo(secret));

            ServiceResult deleteResult = await credentialNode.DeleteCredential!.OnCallMethod2Async!(
                    context,
                    credentialNode.DeleteCredential,
                    credentialNode.NodeId,
                    [],
                    [],
                    CancellationToken.None)
                .ConfigureAwait(false);

            Assert.That(ServiceResult.IsGood(deleteResult), Is.True);
            Assert.That(await store.GetAsync("credential-1", CancellationToken.None).ConfigureAwait(false), Is.Null);
        }

        [Test]
        public async Task UpdateCredentialRotationRemovesPreviousSecret()
        {
            using var store = new InMemoryKeyCredentialStore();
            var subject = new KeyCredentialPushSubject(store);
            KeyCredentialConfigurationFolderState folder = CreateFolder();
            ISystemContext context = CreateAdminContext();
            await subject.BindAsync(folder, context).ConfigureAwait(false);
            KeyCredentialConfigurationState credentialNode = await CreateCredentialNodeAsync(folder, context)
                .ConfigureAwait(false);

            await credentialNode.UpdateCredential!.OnCallAsync!(
                context,
                credentialNode.UpdateCredential,
                credentialNode.NodeId,
                "credential-old",
                ByteString.From([1, 2, 3, 4]),
                string.Empty,
                string.Empty,
                CancellationToken.None).ConfigureAwait(false);

            KeyCredentialUpdateMethodStateResult result = await credentialNode.UpdateCredential.OnCallAsync(
                context,
                credentialNode.UpdateCredential,
                credentialNode.NodeId,
                "credential-new",
                ByteString.From([5, 6, 7, 8]),
                string.Empty,
                string.Empty,
                CancellationToken.None).ConfigureAwait(false);

            Assert.That(ServiceResult.IsGood(result.ServiceResult), Is.True);
            Assert.That(await store.GetAsync("credential-old", CancellationToken.None).ConfigureAwait(false), Is.Null);
            Assert.That(await store.GetAsync("credential-new", CancellationToken.None).ConfigureAwait(false), Is.Not.Null);
        }

        [Test]
        public async Task CreateCredentialRejectsDuplicateBrowseName()
        {
            using var store = new InMemoryKeyCredentialStore();
            var subject = new KeyCredentialPushSubject(store);
            KeyCredentialConfigurationFolderState folder = CreateFolder();
            ISystemContext context = CreateAdminContext();
            await subject.BindAsync(folder, context).ConfigureAwait(false);
            await CreateCredentialNodeAsync(folder, context).ConfigureAwait(false);

            CreateCredentialMethodStateResult result = await folder.CreateCredential!.OnCallAsync!(
                context,
                folder.CreateCredential,
                folder.NodeId,
                "ServiceA",
                "urn:test:resource-2",
                KeyCredentialBridgeOptions.DefaultProfileUri,
                [],
                CancellationToken.None).ConfigureAwait(false);

            Assert.That(result.ServiceResult.StatusCode, Is.EqualTo(StatusCodes.BadNodeIdExists));
        }

        [Test]
        public async Task UpdateCredentialRejectsUnauthorizedCaller()
        {
            using var store = new InMemoryKeyCredentialStore();
            var subject = new KeyCredentialPushSubject(store);
            KeyCredentialConfigurationFolderState folder = CreateFolder();
            ISystemContext adminContext = CreateAdminContext();
            await subject.BindAsync(folder, adminContext).ConfigureAwait(false);
            KeyCredentialConfigurationState credentialNode = await CreateCredentialNodeAsync(folder, adminContext)
                .ConfigureAwait(false);

            KeyCredentialUpdateMethodStateResult result = await credentialNode.UpdateCredential!.OnCallAsync!(
                    CreateAnonymousContext(),
                    credentialNode.UpdateCredential,
                    credentialNode.NodeId,
                    "credential-1",
                    ByteString.From([1, 2, 3, 4]),
                    string.Empty,
                    SecurityPolicies.Basic256Sha256,
                    CancellationToken.None)
                .ConfigureAwait(false);

            Assert.That(result.ServiceResult.StatusCode, Is.EqualTo(StatusCodes.BadUserAccessDenied));
        }

        [Test]
        public async Task BindAddsBrowseChildrenForStoredCredentials()
        {
            using var store = new InMemoryKeyCredentialStore();
            await store.UpdateAsync(
                    "browse-credential",
                    new Server.KeyCredential([9, 8, 7], DateTime.UtcNow.AddHours(1)),
                    CancellationToken.None)
                .ConfigureAwait(false);
            var subject = new KeyCredentialPushSubject(store);
            KeyCredentialConfigurationFolderState folder = CreateFolder();
            ISystemContext context = CreateAdminContext();

            await subject.BindAsync(folder, context).ConfigureAwait(false);

            IList<BaseInstanceState> children = [];
            folder.GetChildren(context, children);
            Assert.That(children.OfType<KeyCredentialConfigurationState>()
                .Any(child => child.CredentialId!.Value == "browse-credential"), Is.True);
        }

        private static async Task<KeyCredentialConfigurationState> CreateCredentialNodeAsync(
            KeyCredentialConfigurationFolderState folder,
            ISystemContext context)
        {
            CreateCredentialMethodStateResult createResult = await folder.CreateCredential!.OnCallAsync!(
                    context,
                    folder.CreateCredential,
                    folder.NodeId,
                    "ServiceA",
                    "urn:test:resource",
                    KeyCredentialBridgeOptions.DefaultProfileUri,
                    [],
                    CancellationToken.None)
                .ConfigureAwait(false);
            Assert.That(ServiceResult.IsGood(createResult.ServiceResult), Is.True);
            ushort expectedNamespaceIndex = (ushort)context.NamespaceUris.GetIndex(
                KeyCredentialPushSubject.NamespaceUri);
            Assert.Multiple(() =>
            {
                // The standard folder is in namespace 0, which is reserved for the
                // OPC UA standard address space, so instances get a server-owned namespace.
                Assert.That(folder.NodeId.NamespaceIndex, Is.Zero);
                Assert.That(expectedNamespaceIndex, Is.GreaterThan((ushort)0));
                Assert.That(
                    createResult.CredentialNodeId.NamespaceIndex,
                    Is.EqualTo(expectedNamespaceIndex));
            });

            IList<BaseInstanceState> children = [];
            folder.GetChildren(context, children);
            return children.OfType<KeyCredentialConfigurationState>()
                .Single(child => child.NodeId == createResult.CredentialNodeId);
        }

        private static KeyCredentialConfigurationFolderState CreateFolder()
        {
            return new KeyCredentialConfigurationFolderState(null)
            {
                NodeId = KeyCredentialPushSubject.StandardConfigurationFolderNodeId,
                BrowseName = new QualifiedName("KeyCredentialConfiguration"),
                DisplayName = LocalizedText.From("KeyCredentialConfiguration"),
                TypeDefinitionId = ObjectTypeIds.KeyCredentialConfigurationFolderType
            };
        }

        private static SessionSystemContext CreateAdminContext()
        {
            return CreateContext(UserTokenType.UserName, ObjectIds.WellKnownRole_SecurityAdmin);
        }

        private static SessionSystemContext CreateAnonymousContext()
        {
            return CreateContext(UserTokenType.Anonymous);
        }

        private static SessionSystemContext CreateContext(UserTokenType tokenType, params NodeId[] grantedRoles)
        {
            var identity = new Mock<IUserIdentity>();
            identity.Setup(i => i.TokenType).Returns(tokenType);
            identity.Setup(i => i.DisplayName).Returns(tokenType.ToString());
            identity.Setup(i => i.GrantedRoleIds).Returns(ArrayOf.Wrapped(grantedRoles));
            var endpoint = new EndpointDescription { SecurityMode = MessageSecurityMode.SignAndEncrypt };
            var channelContext = new SecureChannelContext("test", endpoint, RequestEncoding.Binary);
            var operationContext = new OperationContext(
                new RequestHeader(),
                channelContext,
                RequestType.Call,
                RequestLifetime.None,
                identity.Object);
            return new SessionSystemContext(operationContext, s_telemetry)
            {
                NamespaceUris = new NamespaceTable(),
                ServerUris = new StringTable()
            };
        }
    }
}