node-opcua-address-space 2.175.3 → 2.176.0

package/distHelpers/mock_session.d.ts

@@ -1,6 +1,9 @@
-import type { ContinuationData, IContinuationPointInfo, IContinuationPointManager, ISessionBase } from "node-opcua-address-space-base";
+import type { ContinuationData, IChannelBase, IContinuationPointInfo, IContinuationPointManager, ISessionBase, UAObject, UAObjectType } from "node-opcua-address-space-base";
+import type { Certificate } from "node-opcua-crypto/web";
 import type { DataValue } from "node-opcua-data-value";
 import type { ReferenceDescription } from "node-opcua-service-browse";
+import { MessageSecurityMode } from "node-opcua-types";
+import { type AnyUserIdentityToken, type IServerBase, SessionContext } from "..";
 export declare class MockContinuationPointManager implements IContinuationPointManager {
     registerHistoryReadRaw(_maxElements: number, _dataValues: DataValue[], _cnt: ContinuationData): IContinuationPointInfo<DataValue>;
     getNextHistoryReadRaw(_numValues: number, _cnt: ContinuationData): IContinuationPointInfo<DataValue>;
@@ -9,3 +12,67 @@ export declare class MockContinuationPointManager implements IContinuationPointM
     dispose(): void;
 }
 export declare const mockSession: ISessionBase;
+export interface MockSessionContextOptions {
+    /**
+     * user name carried by the Session's UserIdentityToken.
+     * `"anonymous"` produces an AnonymousIdentityToken; omitting it produces a Session
+     * with no token at all, i.e. one that was never activated. Either way the Session
+     * exists, which is what distinguishes this from SessionContext.defaultContext.
+     */
+    userName?: string;
+    /**
+     * the UserIdentityToken itself, when `userName` cannot express it — an X509IdentityToken,
+     * or a UserNameIdentityToken carrying a policyId. Takes precedence over `userName`.
+     */
+    userIdentityToken?: AnyUserIdentityToken;
+    /**
+     * SecureChannel security mode seen by isAccessRestricted().
+     *
+     * Leaving this undefined is the trap this helper exists to avoid: a node carrying
+     * AccessRestrictions SigningRequired then fails with BadSecurityModeInsufficient,
+     * because a hand-written mock that omits `channel` reads back securityMode ===
+     * undefined rather than "no restriction".
+     * @default MessageSecurityMode.None
+     */
+    securityMode?: MessageSecurityMode;
+    /** @default "" */
+    securityPolicy?: string;
+    /** client application-instance certificate, for the X509 / applicationUri paths */
+    clientCertificate?: Certificate | null;
+    /**
+     * pass `null` to attach no SecureChannel at all — a Session created but not yet bound
+     * to a channel. Otherwise a channel is synthesized from securityMode / securityPolicy /
+     * clientCertificate, or you may supply a complete one.
+     */
+    channel?: IChannelBase | null;
+    /**
+     * the Session's continuation point manager. The default throws on use, which is what
+     * you want unless the code under test really browses or reads history through it.
+     */
+    continuationPointManager?: IContinuationPointManager;
+    /** the server whose userManager / roleResolvers resolve this user's Roles */
+    server?: IServerBase;
+    /** the object a Method is being called on */
+    object?: UAObject | UAObjectType;
+    /** endpoint URL the Session was created on */
+    endpointUrl?: string;
+}
+/**
+ * Build a SessionContext that simulates a remote Session on a SecureChannel.
+ *
+ * Writing this by hand means assembling an ISessionBase and an IChannelBase and casting
+ * through `any`; every field omitted silently reads back as undefined, which is not the
+ * same as a permissive default. Use this instead:
+ *
+ * ```ts
+ * const context = makeMockSessionContext({
+ *     userName: "admin",
+ *     securityMode: MessageSecurityMode.SignAndEncrypt,
+ *     server
+ * });
+ * ```
+ *
+ * For an in-process caller with no Session at all, use SessionContext.defaultContext —
+ * that one is granted every permission by design.
+ */
+export declare function makeMockSessionContext(options?: MockSessionContextOptions): SessionContext;

package/distHelpers/mock_session.js

@@ -1,7 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.mockSession = exports.MockContinuationPointManager = void 0;
+exports.makeMockSessionContext = makeMockSessionContext;
 const node_opcua_nodeid_1 = require("node-opcua-nodeid");
+const node_opcua_types_1 = require("node-opcua-types");
+const __1 = require("..");
 class MockContinuationPointManager {
     registerHistoryReadRaw(_maxElements, _dataValues, _cnt) {
         throw new Error("Method not implemented.");
@@ -26,4 +29,59 @@ exports.mockSession = {
     },
     continuationPointManager: new MockContinuationPointManager()
 };
+/**
+ * Build a SessionContext that simulates a remote Session on a SecureChannel.
+ *
+ * Writing this by hand means assembling an ISessionBase and an IChannelBase and casting
+ * through `any`; every field omitted silently reads back as undefined, which is not the
+ * same as a permissive default. Use this instead:
+ *
+ * ```ts
+ * const context = makeMockSessionContext({
+ *     userName: "admin",
+ *     securityMode: MessageSecurityMode.SignAndEncrypt,
+ *     server
+ * });
+ * ```
+ *
+ * For an in-process caller with no Session at all, use SessionContext.defaultContext —
+ * that one is granted every permission by design.
+ */
+function makeMockSessionContext(options) {
+    const { userName, userIdentityToken, securityMode = node_opcua_types_1.MessageSecurityMode.None, securityPolicy = "", clientCertificate = null, channel, continuationPointManager = new MockContinuationPointManager(), server, object, endpointUrl } = options || {};
+    const makeChannel = () => {
+        if (channel !== undefined) {
+            return channel ?? undefined; // null means: no SecureChannel at all
+        }
+        return {
+            clientCertificate,
+            securityMode,
+            securityPolicy,
+            getTransportSettings() {
+                return { maxMessageSize: 0 };
+            }
+        };
+    };
+    const makeIdentityToken = () => {
+        if (userIdentityToken !== undefined) {
+            return userIdentityToken;
+        }
+        if (userName === undefined) {
+            return undefined; // a Session that was never activated
+        }
+        return userName === "anonymous" ? new node_opcua_types_1.AnonymousIdentityToken() : new node_opcua_types_1.UserNameIdentityToken({ userName });
+    };
+    const session = {
+        getSessionId() {
+            return node_opcua_nodeid_1.NodeId.nullNodeId;
+        },
+        continuationPointManager,
+        userIdentityToken: makeIdentityToken(),
+        channel: makeChannel(),
+        getEndpointUrl() {
+            return endpointUrl;
+        }
+    };
+    return new __1.SessionContext({ session, server, object });
+}
 //# sourceMappingURL=mock_session.js.map

package/distHelpers/mock_session.js.map

@@ -1 +1 @@
-{"version":3,"file":"mock_session.js","sourceRoot":"","sources":["../test_helpers/mock_session.ts"],"names":[],"mappings":";;;AAOA,yDAA2C;AAG3C,MAAa,4BAA4B;IAC9B,sBAAsB,CACzB,YAAoB,EACpB,WAAwB,EACxB,IAAsB;QAEtB,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC/C,CAAC;IACM,qBAAqB,CAAC,UAAkB,EAAE,IAAsB;QACnE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC/C,CAAC;IACM,kBAAkB,CACrB,YAAoB,EACpB,OAA+B,EAC/B,IAAsB;QAEtB,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC/C,CAAC;IACM,iBAAiB,CAAC,SAAiB,EAAE,IAAsB;QAC9D,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC/C,CAAC;IACM,OAAO;QACV,aAAa;IACjB,CAAC;CACJ;AAxBD,oEAwBC;AAEY,QAAA,WAAW,GAAiB;IACrC,YAAY;QACR,OAAO,IAAI,0BAAM,EAAE,CAAC;IACxB,CAAC;IACD,wBAAwB,EAAE,IAAI,4BAA4B,EAAE;CAC/D,CAAC"}
+{"version":3,"file":"mock_session.js","sourceRoot":"","sources":["../test_helpers/mock_session.ts"],"names":[],"mappings":";;;AAiHA,wDAmDC;AAzJD,yDAA2C;AAE3C,uDAAsG;AACtG,0BAAiF;AAEjF,MAAa,4BAA4B;IAC9B,sBAAsB,CACzB,YAAoB,EACpB,WAAwB,EACxB,IAAsB;QAEtB,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC/C,CAAC;IACM,qBAAqB,CAAC,UAAkB,EAAE,IAAsB;QACnE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC/C,CAAC;IACM,kBAAkB,CACrB,YAAoB,EACpB,OAA+B,EAC/B,IAAsB;QAEtB,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC/C,CAAC;IACM,iBAAiB,CAAC,SAAiB,EAAE,IAAsB;QAC9D,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC/C,CAAC;IACM,OAAO;QACV,aAAa;IACjB,CAAC;CACJ;AAxBD,oEAwBC;AAEY,QAAA,WAAW,GAAiB;IACrC,YAAY;QACR,OAAO,IAAI,0BAAM,EAAE,CAAC;IACxB,CAAC;IACD,wBAAwB,EAAE,IAAI,4BAA4B,EAAE;CAC/D,CAAC;AAgDF;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,sBAAsB,CAAC,OAAmC;IACtE,MAAM,EACF,QAAQ,EACR,iBAAiB,EACjB,YAAY,GAAG,sCAAmB,CAAC,IAAI,EACvC,cAAc,GAAG,EAAE,EACnB,iBAAiB,GAAG,IAAI,EACxB,OAAO,EACP,wBAAwB,GAAG,IAAI,4BAA4B,EAAE,EAC7D,MAAM,EACN,MAAM,EACN,WAAW,EACd,GAAG,OAAO,IAAI,EAAE,CAAC;IAElB,MAAM,WAAW,GAAG,GAA6B,EAAE;QAC/C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,OAAO,IAAI,SAAS,CAAC,CAAC,sCAAsC;QACvE,CAAC;QACD,OAAO;YACH,iBAAiB;YACjB,YAAY;YACZ,cAAc;YACd,oBAAoB;gBAChB,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC;YACjC,CAAC;SACJ,CAAC;IACN,CAAC,CAAC;IAEF,MAAM,iBAAiB,GAAG,GAAqC,EAAE;QAC7D,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,iBAAiB,CAAC;QAC7B,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,SAAS,CAAC,CAAC,qCAAqC;QAC3D,CAAC;QACD,OAAO,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,yCAAsB,EAAE,CAAC,CAAC,CAAC,IAAI,wCAAqB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC7G,CAAC,CAAC;IAEF,MAAM,OAAO,GAAiB;QAC1B,YAAY;YACR,OAAO,0BAAM,CAAC,UAAU,CAAC;QAC7B,CAAC;QACD,wBAAwB;QACxB,iBAAiB,EAAE,iBAAiB,EAAE;QACtC,OAAO,EAAE,WAAW,EAAE;QACtB,cAAc;YACV,OAAO,WAAW,CAAC;QACvB,CAAC;KACJ,CAAC;IAEF,OAAO,IAAI,kBAAc,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AAC3D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "node-opcua-address-space",
-    "version": "2.175.3",
+    "version": "2.176.0",
     "description": "pure nodejs OPCUA SDK - module address-space",
     "main": "./dist/src/index_current.js",
     "types": "./dist/source/index.d.ts",
@@ -21,48 +21,48 @@
         "@types/semver": "7.7.1",
         "chalk": "4.1.2",
         "dequeue": "^1.0.5",
-        "node-opcua-address-space-base": "2.175.2",
-        "node-opcua-assert": "2.175.1",
-        "node-opcua-basic-types": "2.175.1",
-        "node-opcua-binary-stream": "2.175.1",
-        "node-opcua-client-dynamic-extension-object": "2.175.2",
-        "node-opcua-constants": "2.175.1",
-        "node-opcua-crypto": "5.3.6",
-        "node-opcua-data-access": "2.175.2",
-        "node-opcua-data-model": "2.175.1",
-        "node-opcua-data-value": "2.175.1",
-        "node-opcua-date-time": "2.175.1",
-        "node-opcua-debug": "2.175.1",
-        "node-opcua-enum": "2.175.1",
-        "node-opcua-extension-object": "2.175.1",
-        "node-opcua-factory": "2.175.1",
-        "node-opcua-nodeid": "2.175.1",
-        "node-opcua-nodeset-ua": "2.175.3",
-        "node-opcua-numeric-range": "2.175.1",
-        "node-opcua-object-registry": "2.175.1",
-        "node-opcua-pseudo-session": "2.175.2",
-        "node-opcua-service-browse": "2.175.2",
-        "node-opcua-service-call": "2.175.2",
-        "node-opcua-service-history": "2.175.2",
-        "node-opcua-service-translate-browse-path": "2.175.2",
-        "node-opcua-service-write": "2.175.2",
-        "node-opcua-status-code": "2.175.1",
-        "node-opcua-types": "2.175.2",
-        "node-opcua-utils": "2.175.1",
-        "node-opcua-variant": "2.175.1",
-        "node-opcua-xml2json": "2.175.2",
+        "node-opcua-address-space-base": "2.176.0",
+        "node-opcua-assert": "2.175.6",
+        "node-opcua-basic-types": "2.176.0",
+        "node-opcua-binary-stream": "2.176.0",
+        "node-opcua-client-dynamic-extension-object": "2.176.0",
+        "node-opcua-constants": "2.176.0",
+        "node-opcua-crypto": "5.4.0",
+        "node-opcua-data-access": "2.176.0",
+        "node-opcua-data-model": "2.176.0",
+        "node-opcua-data-value": "2.176.0",
+        "node-opcua-date-time": "2.176.0",
+        "node-opcua-debug": "2.175.6",
+        "node-opcua-enum": "2.176.0",
+        "node-opcua-extension-object": "2.176.0",
+        "node-opcua-factory": "2.176.0",
+        "node-opcua-nodeid": "2.176.0",
+        "node-opcua-nodeset-ua": "2.176.0",
+        "node-opcua-numeric-range": "2.176.0",
+        "node-opcua-object-registry": "2.175.6",
+        "node-opcua-pseudo-session": "2.176.0",
+        "node-opcua-service-browse": "2.176.0",
+        "node-opcua-service-call": "2.176.0",
+        "node-opcua-service-history": "2.176.0",
+        "node-opcua-service-translate-browse-path": "2.176.0",
+        "node-opcua-service-write": "2.176.0",
+        "node-opcua-status-code": "2.176.0",
+        "node-opcua-types": "2.176.0",
+        "node-opcua-utils": "2.176.0",
+        "node-opcua-variant": "2.176.0",
+        "node-opcua-xml2json": "2.176.0",
         "semver": "^7.8.5",
         "thenify-ex": "4.4.0",
         "xml-writer": "^1.7.0"
     },
     "devDependencies": {
         "humanize": "0.0.9",
-        "node-opcua-benchmarker": "2.175.1",
-        "node-opcua-leak-detector": "2.175.1",
+        "node-opcua-benchmarker": "2.176.0",
+        "node-opcua-leak-detector": "2.175.6",
         "node-opcua-nodesets": "2.175.3",
-        "node-opcua-packet-analyzer": "2.175.1",
-        "node-opcua-schemas": "2.175.2",
-        "node-opcua-service-filter": "2.175.2",
+        "node-opcua-packet-analyzer": "2.176.0",
+        "node-opcua-schemas": "2.176.0",
+        "node-opcua-service-filter": "2.176.0",
         "node-opcua-test-fixtures": "2.175.1"
     },
     "author": "Etienne Rossignon",
@@ -80,7 +80,7 @@
         "internet of things"
     ],
     "homepage": "http://node-opcua.github.io/",
-    "gitHead": "31f407d4ad2712b7bf2882d4dc70085f598b0fcd",
+    "gitHead": "a4569830a5a564a7ff3e8cf37c44fd35b3f72ac1",
     "files": [
         "dist",
         "distHelpers",

package/source/interfaces/nodeset_loader_options.ts

@@ -1,4 +1,38 @@
+/**
+ * how a part of the access policy declared in a NodeSet2 file is handled at load time.
+ *
+ *  - `"apply"`  : the declaration is installed on the node, as mandated by OPC UA Part 6 F.3.
+ *  - `"ignore"` : the declaration is discarded. This is what node-opcua did before these options
+ *                 existed: a nodeset declaring a restrictive policy would load fail-open.
+ */
+export type NodeSetPermissionsPolicy = "apply" | "ignore";
+
 export interface NodeSetLoaderOptions {
     loadDraftNodes?: boolean;
     loadDeprecatedNodes?: boolean;
+    /**
+     * the `<RolePermissions>` element and the `HasNoPermissions` attribute: *who* may do *what*.
+     *
+     * This is a property of the information model, so it applies by default. `HasNoPermissions`
+     * yields an empty permission list, which is distinct from an absent `<RolePermissions>`:
+     * the former grants nothing, the latter inherits the namespace default.
+     * @default "apply"
+     */
+    permissions?: NodeSetPermissionsPolicy;
+    /**
+     * the `AccessRestrictions` attribute: how the SecureChannel must be secured — signed,
+     * encrypted, session-bound — before the node may be reached at all.
+     *
+     * This one is **opt-in**, because it is a property of the deployment rather than of the
+     * model, and node-opcua cannot assume the deployment matches what the nodeset author had
+     * in mind. `Opc.Ua.NodeSet2.xml` carries 359 of these, and enforcing them denies 199
+     * variables under the Server Object alone — the RoleSet internals, `ServerConfiguration`,
+     * method arguments — to any Session on an unsecured channel. That is the correct reading
+     * of the attribute, and exactly what you want on a hardened server; it is also a large
+     * behaviour change for the many deployments that run with `MessageSecurityMode.None`.
+     *
+     * Turn it on once your endpoints require signing or encryption.
+     * @default "ignore"
+     */
+    accessRestrictions?: NodeSetPermissionsPolicy;
 }

package/source/loader/load_nodeset2.ts

@@ -21,9 +21,11 @@ import { coerceBoolean, coerceByte, coerceInt32, StatusCodes } from "node-opcua-
 import { DataTypeIds } from "node-opcua-constants";
 import {
     type AccessLevelFlag,
+    type AccessRestrictionsFlag,
     coerceLocalizedText,
     type LocalizedText,
     makeAccessLevelFlag,
+    makeAccessRestrictionsFlag,
     NodeClass,
     type QualifiedName,
     stringToQualifiedName
@@ -32,7 +34,7 @@ import { checkDebugFlag, make_debugLog, make_errorLog } from "node-opcua-debug";
 import type { ExtensionObject } from "node-opcua-extension-object";
 import { getBuiltInType } from "node-opcua-factory";
 import { NodeId, resolveNodeId } from "node-opcua-nodeid";
-import type { EnumFieldOptions } from "node-opcua-types";
+import type { EnumFieldOptions, RolePermissionTypeOptions } from "node-opcua-types";
 import { DataType, Variant, VariantArrayType, type VariantOptions } from "node-opcua-variant";
 import { _definitionParser, ReaderState, type ReaderStateParserLike, Xml2Json, type XmlAttributes } from "node-opcua-xml2json";
 import semver from "semver";
@@ -75,6 +77,32 @@ function convertAccessLevel(accessLevel?: string | null): AccessLevelFlag {
     return makeAccessLevelFlag(accessLevelN);
 }
 
+/**
+ * the XSD gives UserAccessLevel a default of 1, but a nodeset that raises AccessLevel and stays
+ * silent on UserAccessLevel means "the user may do whatever the node allows", not "read only".
+ * Falling back on accessLevel is what every other stack does and what node-opcua has always done;
+ * what changes here is that an *explicit* UserAccessLevel is no longer dropped.
+ */
+function convertUserAccessLevel(userAccessLevel: string | null | undefined, accessLevel: AccessLevelFlag): AccessLevelFlag {
+    if (userAccessLevel === undefined || userAccessLevel === null || userAccessLevel === "") {
+        return accessLevel;
+    }
+    return convertAccessLevel(userAccessLevel);
+}
+
+function convertAccessRestrictions(accessRestrictions?: string | null): AccessRestrictionsFlag | undefined {
+    if (accessRestrictions === undefined || accessRestrictions === null || accessRestrictions === "") {
+        // undefined is not None: it means "inherit the namespace default"
+        return undefined;
+    }
+    const value = parseInt(accessRestrictions, 10);
+    if (Number.isNaN(value)) {
+        errorLog("load_nodeset2: ignoring invalid AccessRestrictions attribute", accessRestrictions);
+        return undefined;
+    }
+    return makeAccessRestrictionsFlag(value);
+}
+
 type Task = (addressSpace: IAddressSpace) => Promise<void>;
 
 function makeDefaultVariant(
@@ -404,6 +432,53 @@ function makeNodeSetParserEngine(addressSpace: IAddressSpace, options: NodeSetLo
             }
         }
     };
+    // #region access policy (AccessRestrictions / HasNoPermissions / RolePermissions)
+    // two independent switches: who may do what is a property of the model and applies by
+    // default, whereas how the channel must be secured is a property of the deployment and
+    // is opt-in. See NodeSetLoaderOptions.
+    const applyRolePermissions = (options.permissions ?? "apply") === "apply";
+    const applyAccessRestrictions = (options.accessRestrictions ?? "ignore") === "apply";
+
+    interface INodePermissions {
+        accessRestrictions?: AccessRestrictionsFlag;
+        rolePermissions?: RolePermissionTypeOptions[];
+    }
+
+    /**
+     * read the access policy carried by the attributes of any UANode.
+     * The `<RolePermissions>` element is handled separately by `role_permissions_parser`.
+     */
+    function convertNodePermissions(attrs: XmlAttributes): INodePermissions {
+        return {
+            accessRestrictions: applyAccessRestrictions ? convertAccessRestrictions(attrs.AccessRestrictions) : undefined,
+            // HasNoPermissions="true" is not the same as an absent <RolePermissions>: the former
+            // grants nothing at all, the latter inherits the namespace default. An empty array
+            // is how BaseNode distinguishes the two.
+            rolePermissions: applyRolePermissions && coerceBoolean(attrs.HasNoPermissions) ? [] : undefined
+        };
+    }
+
+    const role_permissions_parser = {
+        // biome-ignore lint/suspicious/noExplicitAny: xml2json parser callback with dynamic this binding
+        init(this: any) {
+            this.array = [] as RolePermissionTypeOptions[];
+            if (applyRolePermissions) {
+                this.parent.obj.rolePermissions = this.array;
+            }
+        },
+        parser: {
+            RolePermission: {
+                // biome-ignore lint/suspicious/noExplicitAny: xml2json parser callback with dynamic this binding
+                finish(this: any) {
+                    this.parent.array.push({
+                        roleId: _translateNodeId(this.text.trim()),
+                        permissions: parseInt(this.attrs.Permissions || "0", 10)
+                    });
+                }
+            }
+        }
+    };
+    // #endregion
     // #region UAObject
     const state_UAObject = {
         // biome-ignore lint/suspicious/noExplicitAny: xml2json parser callback with dynamic this binding
@@ -416,7 +491,8 @@ function makeNodeSetParserEngine(addressSpace: IAddressSpace, options: NodeSetLo
                 nodeId: convertToNodeId(attrs.NodeId) || null,
                 browseName: convertQualifiedName(attrs.BrowseName),
                 eventNotifier: coerceByte(attrs.EventNotifier) || 0,
-                symbolicName: attrs.SymbolicName || null
+                symbolicName: attrs.SymbolicName || null,
+                ...convertNodePermissions(attrs)
             };
 
             this.isDraft = attrs.ReleaseStatus === "Draft";
@@ -444,7 +520,8 @@ function makeNodeSetParserEngine(addressSpace: IAddressSpace, options: NodeSetLo
                 }
             },
 
-            References: references_parser
+            References: references_parser,
+            RolePermissions: role_permissions_parser
         }
     };
     // #endregion
@@ -459,7 +536,8 @@ function makeNodeSetParserEngine(addressSpace: IAddressSpace, options: NodeSetLo
                 isAbstract: coerceBoolean(attrs.IsAbstract),
                 nodeId: convertToNodeId(attrs.NodeId) || null,
                 browseName: convertQualifiedName(attrs.BrowseName),
-                eventNotifier: coerceByte(attrs.EventNotifier) || 0
+                eventNotifier: coerceByte(attrs.EventNotifier) || 0,
+                ...convertNodePermissions(attrs)
             };
         },
         // biome-ignore lint/suspicious/noExplicitAny: xml2json parser callback with dynamic this binding
@@ -481,7 +559,8 @@ function makeNodeSetParserEngine(addressSpace: IAddressSpace, options: NodeSetLo
                 }
             },
 
-            References: references_parser
+            References: references_parser,
+            RolePermissions: role_permissions_parser
         }
     };
     // #endregion
@@ -495,7 +574,8 @@ function makeNodeSetParserEngine(addressSpace: IAddressSpace, options: NodeSetLo
                 nodeClass: NodeClass.ReferenceType,
                 isAbstract: coerceBoolean(attrs.IsAbstract),
                 nodeId: convertToNodeId(attrs.NodeId) || null,
-                browseName: convertQualifiedName(attrs.BrowseName)
+                browseName: convertQualifiedName(attrs.BrowseName),
+                ...convertNodePermissions(attrs)
             };
         },
         // biome-ignore lint/suspicious/noExplicitAny: xml2json parser callback with dynamic this binding
@@ -523,7 +603,8 @@ function makeNodeSetParserEngine(addressSpace: IAddressSpace, options: NodeSetLo
                     this.parent.obj.inverseName = this.text;
                 }
             },
-            References: references_parser
+            References: references_parser,
+            RolePermissions: role_permissions_parser
         }
     };
 
@@ -555,7 +636,8 @@ function makeNodeSetParserEngine(addressSpace: IAddressSpace, options: NodeSetLo
                 displayName: "",
                 description: "",
                 symbolicName: attrs.SymbolicName,
-                partialDefinition: []
+                partialDefinition: [],
+                ...convertNodePermissions(attrs)
             };
 
             this.isDraft = attrs.ReleaseStatus === "Draft";
@@ -618,6 +700,7 @@ function makeNodeSetParserEngine(addressSpace: IAddressSpace, options: NodeSetLo
                 }
             },
             References: references_parser,
+            RolePermissions: role_permissions_parser,
 
             Definition: _definitionParser
         }
@@ -677,6 +760,8 @@ function makeNodeSetParserEngine(addressSpace: IAddressSpace, options: NodeSetLo
         historizing: boolean;
         accessLevel: number;
         userAccessLevel: number;
+        accessRestrictions?: AccessRestrictionsFlag;
+        rolePermissions?: RolePermissionTypeOptions[];
     }
     type ReaderUAVariableL1 = ReaderStateParserLike & { obj: IUAVariableProps; isDraft: boolean; isDeprecated: boolean };
     type ReaderUAVariableL2 = ReaderStateParserLike & { parent: ReaderUAVariableL1; text: string };
@@ -699,10 +784,11 @@ function makeNodeSetParserEngine(addressSpace: IAddressSpace, options: NodeSetLo
                 valueRank,
                 arrayDimensions: valueRank <= 0 ? null : stringToUInt32Array(attrs.ArrayDimensions),
                 minimumSamplingInterval: attrs.MinimumSamplingInterval ? parseInt(attrs.MinimumSamplingInterval, 10) : 0,
-                historizing: false,
+                historizing: coerceBoolean(attrs.Historizing),
                 nodeId,
                 accessLevel: accessLevel,
-                userAccessLevel: accessLevel // convertAccessLevel(attrs.UserAccessLevel || attrs.AccessLevel);
+                userAccessLevel: convertUserAccessLevel(attrs.UserAccessLevel, accessLevel),
+                ...convertNodePermissions(attrs)
             };
             this.isDraft = attrs.ReleaseStatus === "Draft" || false;
             this.isDeprecated = attrs.ReleaseStatus === "Deprecated" || false;
@@ -784,6 +870,7 @@ function makeNodeSetParserEngine(addressSpace: IAddressSpace, options: NodeSetLo
                 }
             },
             References: references_parser,
+            RolePermissions: role_permissions_parser,
 
             Value: makeVariantReader<ReaderUAVariableL2>(
                 (self: ReaderUAVariableL2, data: VariantOptions) => {
@@ -822,8 +909,10 @@ function makeNodeSetParserEngine(addressSpace: IAddressSpace, options: NodeSetLo
                 valueRank,
                 arrayDimensions: valueRank <= 0 ? null : stringToUInt32Array(attrs.ArrayDimensions),
                 minimumSamplingInterval: attrs.MinimumSamplingInterval ? parseInt(attrs.MinimumSamplingInterval, 10) : 0,
+                // UAVariableType has no Historizing attribute in the XSD: keep it false
                 historizing: false,
-                nodeId: convertToNodeId(attrs.NodeId) || null
+                nodeId: convertToNodeId(attrs.NodeId) || null,
+                ...convertNodePermissions(attrs)
             };
             this.isDraft = attrs.ReleaseStatus === "Draft";
             this.isDeprecated = attrs.ReleaseStatus === "Deprecated";
@@ -847,6 +936,7 @@ function makeNodeSetParserEngine(addressSpace: IAddressSpace, options: NodeSetLo
                 }
             },
             References: references_parser,
+            RolePermissions: role_permissions_parser,
             Value: makeVariantReader<ReaderUAVariableTypeL2>(
                 (self: ReaderUAVariableTypeL2, data: VariantOptions) => {
                     self.parent.obj.value = data;
@@ -877,7 +967,8 @@ function makeNodeSetParserEngine(addressSpace: IAddressSpace, options: NodeSetLo
                 browseName: convertQualifiedName(attrs.BrowseName),
                 parentNodeId: attrs.ParentNodeId || null,
                 nodeId: convertToNodeId(attrs.NodeId) || null,
-                methodDeclarationId: attrs.MethodDeclarationId ? _translateNodeId(attrs.MethodDeclarationId) : null
+                methodDeclarationId: attrs.MethodDeclarationId ? _translateNodeId(attrs.MethodDeclarationId) : null,
+                ...convertNodePermissions(attrs)
             };
             this.isDraft = attrs.ReleaseStatus === "Draft";
             this.isDeprecated = attrs.ReleaseStatus === "Deprecated";
@@ -896,7 +987,8 @@ function makeNodeSetParserEngine(addressSpace: IAddressSpace, options: NodeSetLo
                     this.parent.obj.displayName = this.text;
                 }
             },
-            References: references_parser
+            References: references_parser,
+            RolePermissions: role_permissions_parser
         }
     };
     // #endregion

package/source/loader/make_xml_extension_object_parser.ts

@@ -13,6 +13,7 @@ import {
 } from "node-opcua-basic-types";
 import { make_debugLog, make_warningLog } from "node-opcua-debug";
 import { coerceNodeId, ExpandedNodeId, type INodeId, type NodeId, NodeIdType } from "node-opcua-nodeid";
+import { coerceStatusCode, StatusCodes } from "node-opcua-status-code";
 import { EnumDefinition, StructureDefinition } from "node-opcua-types";
 import { lowerFirstLetter } from "node-opcua-utils";
 import { DataType, Variant, type VariantOptions } from "node-opcua-variant";
@@ -72,6 +73,61 @@ interface Parser<T> extends ReaderStateParserLike {
     parent: any;
     text: string;
 }
+
+// <StatusCode><Code>2153644032</Code></StatusCode>
+const statusCode_parser: ReaderStateParserLike = {
+    init(this: any) {
+        this.value = StatusCodes.Good;
+    },
+    parser: {
+        Code: {
+            finish(this: any) {
+                this.parent.value = coerceStatusCode(parseInt(this.text, 10));
+            }
+        }
+    }
+};
+
+// a DiagnosticInfo field is stored on the enclosing DiagnosticInfo, which is only
+// created when at least one field is present ( <DiagnosticInfo/> stays empty ).
+function _diagnosticInfoField(name: string, convert: (text: string) => unknown): ReaderStateParserLike {
+    return {
+        finish(this: any) {
+            this.parent.value = this.parent.value || {};
+            this.parent.value[name] = convert(this.text);
+        }
+    };
+}
+
+// <DiagnosticInfo><SymbolicId>1</SymbolicId>...<InnerDiagnosticInfo>...</InnerDiagnosticInfo></DiagnosticInfo>
+const diagnosticInfo_parser: ReaderStateParserLike = {
+    init(this: any) {
+        this.value = undefined;
+    },
+    parser: {
+        SymbolicId: _diagnosticInfoField("symbolicId", (text) => parseInt(text, 10)),
+        NamespaceUri: _diagnosticInfoField("namespaceUri", (text) => parseInt(text, 10)),
+        Locale: _diagnosticInfoField("locale", (text) => parseInt(text, 10)),
+        LocalizedText: _diagnosticInfoField("localizedText", (text) => parseInt(text, 10)),
+        AdditionalInfo: _diagnosticInfoField("additionalInfo", (text) => text),
+        InnerStatusCode: {
+            ...statusCode_parser,
+            finish(this: any) {
+                this.parent.value = this.parent.value || {};
+                this.parent.value.innerStatusCode = this.value;
+            }
+        }
+    }
+};
+// InnerDiagnosticInfo is a DiagnosticInfo in turn: the parser is registered after the
+// fact so that it can refer to the reader being built.
+diagnosticInfo_parser.parser!.InnerDiagnosticInfo = {
+    ...diagnosticInfo_parser,
+    finish(this: any) {
+        this.parent.value = this.parent.value || {};
+        this.parent.value.innerDiagnosticInfo = this.value;
+    }
+};
 const partials = {
     LocalizedText: localizedText_parser.LocalizedText,
     QualifiedName: makeQualifiedNameParser((nodeId: string) => coerceNodeId(nodeId)).QualifiedName,
@@ -195,6 +251,10 @@ const partials = {
         }
     },
 
+    StatusCode: statusCode_parser,
+
+    DiagnosticInfo: diagnosticInfo_parser,
+
     // <ExpandedNodeId><Identifier>svr=1;nsu=http://acme.com/UA/;i=42</Identifier></ExpandedNodeId>
     ExpandedNodeId: <Parser<ExpandedNodeId>>{
         finish(this: Parser<ExpandedNodeId>) {
@@ -305,6 +365,13 @@ function _makeTypeReader(
 
                 reader.parser![field.name || ""] = {
                     parser: fieldParser.parser,
+                    // the field reader borrows the partial's sub-parsers: it must borrow its init
+                    // too, or the state those sub-parsers write into is never set up.
+                    init(this: any, elementName: string, attrs: XmlAttributes, parent: IReaderState, engine: Xml2Json) {
+                        if (fieldParser.init) {
+                            fieldParser.init.call(this, elementName, attrs, parent, engine);
+                        }
+                    },
                     // endElement: fieldReader.endElement,
                     finish(this: any) {
                         const elName = lowerFirstLetter(field.name || "");