node-opcua-address-space 2.173.0 → 2.174.0

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "node-opcua-address-space",
-    "version": "2.173.0",
+    "version": "2.174.0",
     "description": "pure nodejs OPCUA SDK - module address-space",
     "main": "./dist/src/index_current.js",
     "types": "./dist/source/index.d.ts",
@@ -21,37 +21,37 @@
         "@types/semver": "7.7.1",
         "chalk": "4.1.2",
         "dequeue": "^1.0.5",
-        "node-opcua-address-space-base": "2.173.0",
+        "node-opcua-address-space-base": "2.174.0",
         "node-opcua-assert": "2.164.0",
-        "node-opcua-basic-types": "2.173.0",
+        "node-opcua-basic-types": "2.174.0",
         "node-opcua-binary-stream": "2.173.0",
-        "node-opcua-client-dynamic-extension-object": "2.173.0",
-        "node-opcua-constants": "2.157.0",
+        "node-opcua-client-dynamic-extension-object": "2.174.0",
+        "node-opcua-constants": "2.174.0",
         "node-opcua-crypto": "5.3.6",
-        "node-opcua-data-access": "2.173.0",
-        "node-opcua-data-model": "2.173.0",
-        "node-opcua-data-value": "2.173.0",
-        "node-opcua-date-time": "2.173.0",
+        "node-opcua-data-access": "2.174.0",
+        "node-opcua-data-model": "2.174.0",
+        "node-opcua-data-value": "2.174.0",
+        "node-opcua-date-time": "2.174.0",
         "node-opcua-debug": "2.172.0",
         "node-opcua-enum": "2.173.0",
-        "node-opcua-extension-object": "2.173.0",
-        "node-opcua-factory": "2.173.0",
-        "node-opcua-nodeid": "2.173.0",
-        "node-opcua-nodeset-ua": "2.173.0",
-        "node-opcua-numeric-range": "2.173.0",
+        "node-opcua-extension-object": "2.174.0",
+        "node-opcua-factory": "2.174.0",
+        "node-opcua-nodeid": "2.174.0",
+        "node-opcua-nodeset-ua": "2.174.0",
+        "node-opcua-numeric-range": "2.174.0",
         "node-opcua-object-registry": "2.172.0",
-        "node-opcua-pseudo-session": "2.173.0",
-        "node-opcua-service-browse": "2.173.0",
-        "node-opcua-service-call": "2.173.0",
-        "node-opcua-service-history": "2.173.0",
-        "node-opcua-service-translate-browse-path": "2.173.0",
-        "node-opcua-service-write": "2.173.0",
+        "node-opcua-pseudo-session": "2.174.0",
+        "node-opcua-service-browse": "2.174.0",
+        "node-opcua-service-call": "2.174.0",
+        "node-opcua-service-history": "2.174.0",
+        "node-opcua-service-translate-browse-path": "2.174.0",
+        "node-opcua-service-write": "2.174.0",
         "node-opcua-status-code": "2.173.0",
-        "node-opcua-types": "2.173.0",
+        "node-opcua-types": "2.174.0",
         "node-opcua-utils": "2.173.0",
-        "node-opcua-variant": "2.173.0",
+        "node-opcua-variant": "2.174.0",
         "node-opcua-xml2json": "2.173.0",
-        "semver": "^7.8.0",
+        "semver": "^7.8.5",
         "thenify-ex": "4.4.0",
         "xml-writer": "^1.7.0"
     },
@@ -59,10 +59,10 @@
         "humanize": "0.0.9",
         "node-opcua-benchmarker": "2.173.0",
         "node-opcua-leak-detector": "2.172.0",
-        "node-opcua-nodesets": "2.163.1",
-        "node-opcua-packet-analyzer": "2.173.0",
-        "node-opcua-schemas": "2.173.0",
-        "node-opcua-service-filter": "2.173.0",
+        "node-opcua-nodesets": "2.174.0",
+        "node-opcua-packet-analyzer": "2.174.0",
+        "node-opcua-schemas": "2.174.0",
+        "node-opcua-service-filter": "2.174.0",
         "node-opcua-test-fixtures": "2.157.0"
     },
     "author": "Etienne Rossignon",
@@ -80,7 +80,7 @@
         "internet of things"
     ],
     "homepage": "http://node-opcua.github.io/",
-    "gitHead": "4aa6634e2e1e14e223fa46a632438295be12744c",
+    "gitHead": "011657a3a4805ad106df7381c24ed84e2a18d8f1",
     "files": [
         "dist",
         "distHelpers",

package/source/loader/load_nodeset2.ts

@@ -133,6 +133,28 @@ function makeDefaultVariant(
     }
     return variant;
 }
+
+/**
+ * a Matrix variant is "uninitialized" when it carries no element (value=[]) but declares
+ * non-zero dimensions (e.g. ArrayDimensions="256,128"). Such a variant is internally inconsistent
+ * (value.length !== product(dimensions)) and, if serialized, produces a spec-violating wire form.
+ */
+function isUninitializedMatrix(value: VariantOptions): boolean {
+    if (value.arrayType !== VariantArrayType.Matrix) {
+        return false;
+    }
+    const length = Array.isArray(value.value) ? value.value.length : 0;
+    if (length !== 0) {
+        return false;
+    }
+    const dimensions = value.dimensions;
+    if (!dimensions || dimensions.length === 0) {
+        return false;
+    }
+    const product = dimensions.reduce((n, p) => n * p, 1);
+    return product > 0;
+}
+
 export interface NodeSet2ParserEngine {
     addNodeSet: (xmlData: string) => Promise<void>;
     terminate: () => Promise<void>;
@@ -731,7 +753,12 @@ function makeNodeSetParserEngine(addressSpace: IAddressSpace, options: NodeSetLo
                         if (false && doDebug) {
                             debugLog("2 setting value to ", cv.nodeId.toString(), value);
                         }
-                        if (value.dataType === DataType.Null) {
+                        // a Matrix variable declared with fixed ArrayDimensions but no <Value> is built with
+                        // an empty value (value=[]) yet non-zero declared dimensions. This is an *uninitialized*
+                        // and internally inconsistent matrix (value.length !== product(dimensions)). Advertising
+                        // it as Good would put a spec-violating matrix on the wire (ArraySize 0 + non-empty
+                        // ArrayDimensions), so flag it as BadWaitingForInitialData like any other missing value.
+                        if (value.dataType === DataType.Null || isUninitializedMatrix(value)) {
                             cv.setValueFromSource(value, StatusCodes.BadWaitingForInitialData);
                         } else {
                             cv.setValueFromSource(value, StatusCodes.Good);

package/source/session_context.ts

@@ -22,7 +22,7 @@ import type { NamespacePrivate } from "../src/namespace_private";
 
 export { PermissionType, RolePermissionType, RolePermissionTypeOptions } from "node-opcua-types";
 
-type AnyUserIdentityToken = UserNameIdentityToken | AnonymousIdentityToken | X509IdentityToken;
+export type AnyUserIdentityToken = UserNameIdentityToken | AnonymousIdentityToken | X509IdentityToken;
 
 function getUserName(userIdentityToken: AnyUserIdentityToken): string {
     if (userIdentityToken instanceof AnonymousIdentityToken) {
@@ -48,29 +48,23 @@ function getUserName(userIdentityToken: AnyUserIdentityToken): string {
     throw new Error("Invalid user identity token");
 }
 
-/**
- *
- */
-export enum WellKnownRoles {
-    Anonymous = ObjectIds.WellKnownRole_Anonymous,
-    AuthenticatedUser = ObjectIds.WellKnownRole_AuthenticatedUser,
-    ConfigureAdmin = ObjectIds.WellKnownRole_ConfigureAdmin,
-    Engineer = ObjectIds.WellKnownRole_Engineer,
-    Observer = ObjectIds.WellKnownRole_Observer,
-    Operator = ObjectIds.WellKnownRole_Operator,
-    SecurityAdmin = ObjectIds.WellKnownRole_SecurityAdmin,
-    Supervisor = ObjectIds.WellKnownRole_Supervisor
-}
-export enum WellKnownRolesNodeId {
-    Anonymous = ObjectIds.WellKnownRole_Anonymous,
-    AuthenticatedUser = ObjectIds.WellKnownRole_AuthenticatedUser,
-    ConfigureAdmin = ObjectIds.WellKnownRole_ConfigureAdmin,
-    Engineer = ObjectIds.WellKnownRole_Engineer,
-    Observer = ObjectIds.WellKnownRole_Observer,
-    Operator = ObjectIds.WellKnownRole_Operator,
-    SecurityAdmin = ObjectIds.WellKnownRole_SecurityAdmin,
-    Supervisor = ObjectIds.WellKnownRole_Supervisor
-}
+// Re-exported from node-opcua-constants for backward compatibility.
+// The canonical definition now lives in node-opcua-constants so that
+// client-side packages can use it without pulling in address-space.
+import { WellKnownRoles } from "node-opcua-constants";
+export { WellKnownRoles } from "node-opcua-constants";
+
+/** @deprecated Use WellKnownRoles instead */
+export const WellKnownRolesNodeId = {
+    Anonymous: ObjectIds.WellKnownRole_Anonymous,
+    AuthenticatedUser: ObjectIds.WellKnownRole_AuthenticatedUser,
+    ConfigureAdmin: ObjectIds.WellKnownRole_ConfigureAdmin,
+    Engineer: ObjectIds.WellKnownRole_Engineer,
+    Observer: ObjectIds.WellKnownRole_Observer,
+    Operator: ObjectIds.WellKnownRole_Operator,
+    SecurityAdmin: ObjectIds.WellKnownRole_SecurityAdmin,
+    Supervisor: ObjectIds.WellKnownRole_Supervisor
+} as const;
 /**
  * OPC Unified Architecture, Part 3 13 Release 1.04
  * 4.8.2 Well Known Roles
@@ -114,9 +108,38 @@ export interface IRolePolicyOverride {
     getUserRoles(username: string): NodeId[] | null;
 }
 
+/**
+ * Session attributes a resolver may use to evaluate application/endpoint
+ * restrictions on a Role (OPC 10000-18 §4.4.1).
+ */
+export interface IRoleResolutionContext {
+    /** ApplicationUri from the Client certificate, if any. */
+    applicationUri?: string | null;
+    /** SecureChannel security mode. */
+    securityMode?: MessageSecurityMode;
+    /** SecureChannel security policy URI. */
+    securityPolicyUri?: string;
+    /** Endpoint URL used by the Session, if known. */
+    endpointUrl?: string;
+}
+
+/**
+ * Pluggable role resolver (OPC 10000-18 §4.4).
+ *
+ * Receives the full UserIdentityToken so implementations can match by
+ * Thumbprint, X509Subject, UserName, etc., plus an optional resolution context
+ * to enforce application/endpoint restrictions. Registered on
+ * IServerBase.roleResolvers by packages like node-opcua-role-set-server.
+ */
+export interface IRoleResolver {
+    resolveRoles(userIdentityToken: AnyUserIdentityToken, context?: IRoleResolutionContext): NodeId[];
+}
+
 export interface IServerBase {
     userManager?: IUserManager;
     rolePolicyOverride?: IRolePolicyOverride | null;
+    /** Additional role resolvers (identity stores, LDAP, etc.) */
+    roleResolvers?: IRoleResolver[];
 }
 
 export interface SessionContextOptions {
@@ -252,6 +275,11 @@ export class SessionContext implements ISessionContext {
         }
     }
 
+    /** The URL of the Endpoint the Session was created on, or `null` if unknown. */
+    public get endpointUrl(): string | null {
+        return this.session?.getEndpointUrl?.() ?? null;
+    }
+
     public toJSON(): Record<string, string | null> {
         return {
             userName: this.getUserName(),
@@ -325,7 +353,25 @@ export class SessionContext implements ISessionContext {
             return anonymous;
         }
 
-        const rolesNodeId = this.server.userManager.getUserRoles(username);
+        const rolesNodeId = this.server.userManager.getUserRoles(username) || [];
+
+        // OPC 10000-18 §4.4: check registered role resolvers
+        if (this.server.roleResolvers && this.session?.userIdentityToken) {
+            const resolutionContext: IRoleResolutionContext = {
+                applicationUri: this.clientApplicationUri,
+                securityMode: this.session.channel?.securityMode,
+                securityPolicyUri: this.session.channel?.securityPolicy,
+                endpointUrl: this.endpointUrl ?? undefined
+            };
+            for (const resolver of this.server.roleResolvers) {
+                const extra = resolver.resolveRoles(this.session.userIdentityToken, resolutionContext);
+                for (const r of extra) {
+                    if (!rolesNodeId.find((e) => sameNodeId(e, r))) {
+                        rolesNodeId.push(r);
+                    }
+                }
+            }
+        }
 
         if (rolesNodeId.findIndex((r) => r.namespace === 0 && r.value === WellKnownRoles.AuthenticatedUser) < 0) {
             rolesNodeId.push(resolveNodeId(WellKnownRoles.AuthenticatedUser));

package/src/nodeid_manager.ts

@@ -180,7 +180,25 @@ export class NodeIdManager {
             }
             return nodeId;
         }
-        return this._constructNodeId(options);
+        const nodeId = this._constructNodeId(options);
+        // When registerSymbolicNames is true and a nodeId was already
+        // provided (e.g. loaded from XML during reverse engineering),
+        // also record the BrowseName → NodeId mapping in the symbol
+        // cache so that getSymbols() returns the original NodeIds.
+        if (options.registerSymbolicNames && nodeId.identifierType === NodeIdType.NUMERIC) {
+            const parentInfo = this.findParentNodeId(options);
+            let fullParentName = "";
+            if (parentInfo) {
+                const [parentNodeId, suffix] = parentInfo;
+                fullParentName = buildUpName2(parentNodeId, suffix);
+            }
+            const fullName = compose(fullParentName, prepareName(options.browseName!));
+            if (!this._cacheSymbolicName[fullName]) {
+                this._cacheSymbolicName[fullName] = [nodeId.value as number, options.nodeClass!];
+                this._cacheSymbolicNameRev.add(nodeId.value as number);
+            }
+        }
+        return nodeId;
     }
 
     private _constructNodeId(options: ConstructNodeIdOptions): NodeId {

package/src/nodeset_tools/construct_namespace_dependency.ts

@@ -14,17 +14,18 @@ import type { UAVariableImpl } from "../ua_variable_impl";
 const warningLog = make_warningLog(__filename);
 const _debugLog = make_debugLog(__filename);
 
+interface RequiredModel {
+    requiredNamespaceIndexes: number[];
+    nbTypes: number;
+}
 // eslint-disable-next-line max-statements, complexity
-export function _recomputeRequiredModelsFromTypes(
-    namespace: INamespace,
-    cache?: Map<number, { requiredNamespaceIndexes: number[]; nbTypes: number }>
-): { requiredNamespaceIndexes: number[]; nbTypes: number } {
+export function _recomputeRequiredModelsFromTypes(namespace: INamespace, cache?: Map<number, RequiredModel>): RequiredModel {
     if (namespace.index === 0) {
         return { requiredNamespaceIndexes: [], nbTypes: 1 };
     }
     if (cache) {
         if (cache.has(namespace.index)) {
-            return cache.get(namespace.index)!;
+            return cache.get(namespace.index) as RequiredModel;
         }
     }
     const requiredNamespaceIndexes = [0];
@@ -155,17 +156,14 @@ export function _recomputeRequiredModelsFromTypes(
         }
     }
 
-    const result = { requiredNamespaceIndexes: requiredNamespaceIndexes, nbTypes: nbTypes };
+    const result: RequiredModel = { requiredNamespaceIndexes: requiredNamespaceIndexes, nbTypes: nbTypes };
     if (cache) {
         cache.set(namespace.index, result);
     }
     return result;
 }
 
-export function _recomputeRequiredModelsFromTypes2(
-    namespace: INamespace,
-    cache?: Map<number, { requiredNamespaceIndexes: number[]; nbTypes: number }>
-): { requiredNamespaceIndexes: number[] } {
+export function _recomputeRequiredModelsFromTypes2(namespace: INamespace, cache?: Map<number, RequiredModel>): RequiredModel {
     const addressSpace = namespace.addressSpace;
 
     const { requiredNamespaceIndexes } = _recomputeRequiredModelsFromTypes(namespace, cache);
@@ -187,13 +185,13 @@ export function _recomputeRequiredModelsFromTypes2(
         pass2.push(r);
     }
 
-    return { requiredNamespaceIndexes: pass2 };
+    return { requiredNamespaceIndexes: pass2, nbTypes: 0 };
 }
 
 export function _getCompleteRequiredModelsFromValuesAndReferences(
     namespace: INamespace,
     priorityList: number[],
-    cache?: Map<number, { requiredNamespaceIndexes: number[]; nbTypes: number }>
+    cache?: Map<number, RequiredModel>
 ): number[] {
     const namespace_ = namespace as NamespacePrivate;
 
@@ -230,16 +228,27 @@ export function _getCompleteRequiredModelsFromValuesAndReferences(
                 if (refPriority <= thisPriority) {
                     consider(namespaceIndexOfTargetNode);
                 } else {
-                    // For forward NonHierarchicalReferences (e.g. HasInterface),
-                    // always include the target namespace as a dependency
-                    // regardless of priority, since the current node owns
-                    // this relationship.
                     const referenceType = getReferenceType(reference);
-                    if (reference.isForward
-                        && referenceType
-                        && nonHierarchicalReferencesType
-                        && referenceType.isSubtypeOf(nonHierarchicalReferencesType)) {
-                        consider(namespaceIndexOfTargetNode);
+                    if (referenceType) {
+                        // For forward NonHierarchicalReferences (e.g. HasInterface),
+                        // always include the target namespace as a dependency
+                        // regardless of priority, since the current node owns
+                        // this relationship.
+                        if (reference.isForward
+                            && nonHierarchicalReferencesType
+                            && referenceType.isSubtypeOf(nonHierarchicalReferencesType)) {
+                            consider(namespaceIndexOfTargetNode);
+                        }
+                        // For inverse HierarchicalReferences (e.g. Organizes),
+                        // always include the target namespace as a dependency
+                        // regardless of priority, since the reference is
+                        // stored on this node (organizedBy pattern).
+                        const hierarchicalReferencesType = addressSpace.findReferenceType("HierarchicalReferences");
+                        if (!reference.isForward
+                            && hierarchicalReferencesType
+                            && referenceType.isSubtypeOf(hierarchicalReferencesType)) {
+                            consider(namespaceIndexOfTargetNode);
+                        }
                     }
                 }
             }