node-opcua-address-space 2.175.3 → 2.176.0

package/source/session_context.ts

@@ -3,13 +3,31 @@
  */
 /** biome-ignore-all lint/style/useLiteralEnumMembers: still needed */
 
-import type { BaseNode, ISessionBase, ISessionContext, UAObject, UAObjectType, UAVariable } from "node-opcua-address-space-base";
+import type {
+    BaseNode,
+    IAddressSpace,
+    ISessionBase,
+    ISessionContext,
+    UAObject,
+    UAObjectType,
+    UAVariable
+} from "node-opcua-address-space-base";
 import { assert } from "node-opcua-assert";
+import type { UAString } from "node-opcua-basic-types";
 import { ObjectIds } from "node-opcua-constants";
 import { type Certificate, type CertificateInternals, exploreCertificate } from "node-opcua-crypto/web";
-import { AccessRestrictionsFlag, AttributeIds, allPermissions, PermissionFlag } from "node-opcua-data-model";
+import {
+    AccessRestrictionsFlag,
+    AttributeIds,
+    allPermissions,
+    BrowseDirection,
+    NodeClass,
+    PermissionFlag,
+    type QualifiedNameLike,
+    type QualifiedNameOptions
+} from "node-opcua-data-model";
 import type { PreciseClock } from "node-opcua-date-time";
-import { type NodeId, type NodeIdLike, resolveNodeId, sameNodeId } from "node-opcua-nodeid";
+import { NodeId, type NodeIdLike, resolveNodeId, sameNodeId } from "node-opcua-nodeid";
 import {
     AnonymousIdentityToken,
     MessageSecurityMode,
@@ -135,11 +153,34 @@ export interface IRoleResolver {
     resolveRoles(userIdentityToken: AnyUserIdentityToken, context?: IRoleResolutionContext): NodeId[];
 }
 
+/**
+ * What to do when a permission cannot be resolved for a Session — either because no Role
+ * could be attached to its identity, or because neither the node nor its namespace declares
+ * any RolePermissions.
+ *
+ *  - `"allow"` : grant every permission. This is what node-opcua has always done, and what
+ *                the vast majority of address spaces need, since almost no server declares
+ *                RolePermissions on its own nodes.
+ *  - `"deny"`  : grant nothing. Fail-closed, for products that drive access entirely from
+ *                declared policy. Expect to set DefaultRolePermissions on every namespace,
+ *                otherwise the address space becomes unreadable.
+ *
+ * Note that this governs *Sessions only*. A SessionContext with no Session at all is an
+ * in-process caller (SessionContext.defaultContext, PseudoSession) and stays permissive
+ * whatever this is set to — see {@link SessionContext.getPermissions}.
+ */
+export type UnresolvedPermissionPolicy = "allow" | "deny";
+
 export interface IServerBase {
     userManager?: IUserManager;
     rolePolicyOverride?: IRolePolicyOverride | null;
     /** Additional role resolvers (identity stores, LDAP, etc.) */
     roleResolvers?: IRoleResolver[];
+    /**
+     * how to treat a permission that could not be resolved for a Session.
+     * @default "allow"
+     */
+    unresolvedPermissionPolicy?: UnresolvedPermissionPolicy;
 }
 
 export interface SessionContextOptions {
@@ -148,9 +189,15 @@ export interface SessionContextOptions {
     server?: IServerBase /* OPCUAServer*/;
 }
 
-function getPermissionForRole(rolePermissions: RolePermissionType[] | null, role: NodeId): PermissionFlag {
+function getPermissionForRole(
+    rolePermissions: RolePermissionType[] | null,
+    role: NodeId,
+    unresolved: PermissionFlag
+): PermissionFlag {
     if (rolePermissions === null) {
-        return allPermissions;
+        // neither the node nor its namespace declares any policy: nothing to match the
+        // Role against, so the answer is the caller's fail-open / fail-closed default
+        return unresolved;
     }
     const a = rolePermissions.find((r) => {
         if (!r.roleId) {
@@ -221,14 +268,157 @@ function getDefaultUserRolePermissionsOnNamespace(
     return null;
 }
 
-export function makeRoles(roleIds: NodeIdLike[] | string | WellKnownRoles): NodeId[] {
+/**
+ * A Role, designated either by its NodeId or by its BrowseName.
+ *
+ * Roles outside namespace 0 (the GDS Roles, or any Role added with AddRole) have
+ * NodeIds that depend on the order in which nodesets were loaded, so naming them is
+ * more robust than hard coding `ns=1;i=1661`. Resolving a BrowseName requires an
+ * address space, since the RoleSet is where the answer lives.
+ *
+ * A QualifiedName whose namespaceIndex is left undefined matches in any namespace,
+ * as long as the BrowseName is unambiguous.
+ */
+export type RoleIdLike = NodeIdLike | QualifiedNameLike;
+
+/** "i=15668", "ns=1;i=1661", "ns=2;s=MyRole", "g=...", "b=..." */
+const nodeIdExpressionRegExp = /^(ns=\d+;)?[isgb]=/;
+/** "1:DiscoveryAdmin" */
+const namespacedBrowseNameRegExp = /^(\d+):(.+)$/;
+/** the left-hand half of a NodeId that a naive split(";") has torn in two */
+const namespacePrefixRegExp = /^ns=\d+$/;
+
+const roleSetNodeId = resolveNodeId(ObjectIds.Server_ServerCapabilities_RoleSet);
+const anonymousRoleNodeId = resolveNodeId(WellKnownRoles.Anonymous);
+
+function isQualifiedName(role: RoleIdLike): role is QualifiedNameOptions {
+    return typeof role === "object" && role !== null && !(role instanceof NodeId) && "name" in role;
+}
+
+/**
+ * split a semicolon separated list of Roles.
+ *
+ * NodeId expressions contain a semicolon of their own ("ns=1;i=1661"), so a plain
+ * split() would tear them in half: glue the two pieces back together.
+ */
+function splitRoleList(roleIds: string): string[] {
+    const roles: string[] = [];
+    for (const token of roleIds.split(";")) {
+        const role = token.trim();
+        if (role.length === 0) {
+            continue;
+        }
+        const previous = roles.length > 0 ? roles[roles.length - 1] : undefined;
+        if (previous !== undefined && namespacePrefixRegExp.test(previous)) {
+            roles[roles.length - 1] = `${previous};${role}`;
+            continue;
+        }
+        roles.push(role);
+    }
+    return roles;
+}
+
+/** the standard Roles of OPC 10000-3, which live in namespace 0 and need no address space */
+function tryResolveWellKnownRole(browseName: string): NodeId | null {
+    const name = browseName.startsWith("WellKnownRole_") ? browseName.slice("WellKnownRole_".length) : browseName;
+    try {
+        return resolveNodeId(`WellKnownRole_${name}`);
+    } catch {
+        return null;
+    }
+}
+
+/**
+ * look a Role up by BrowseName in the RoleSet (OPC 10000-18 §4.3), which is where
+ * both the standard Roles and the ones contributed by companion nodesets are listed.
+ */
+function resolveRoleByBrowseName(
+    browseName: UAString | undefined,
+    namespaceIndex: number | undefined,
+    addressSpace: IAddressSpace | undefined
+): NodeId {
+    if (!browseName) {
+        throw new Error("makeRoles: a Role given as a QualifiedName must carry a name");
+    }
+    if (!addressSpace) {
+        throw new Error(
+            `makeRoles: cannot resolve the Role "${browseName}": it is not a standard Role of namespace 0, ` +
+                "so an address space must be passed as the second argument of makeRoles()"
+        );
+    }
+
+    const roleSet = addressSpace.findNode(roleSetNodeId);
+    if (!roleSet) {
+        throw new Error(`makeRoles: cannot resolve the Role "${browseName}": the address space has no RoleSet`);
+    }
+
+    const candidates = roleSet
+        .findReferencesExAsObject("HasComponent", BrowseDirection.Forward)
+        .filter((node) => node.nodeClass === NodeClass.Object && node.browseName.name === browseName)
+        .filter((node) => namespaceIndex === undefined || node.browseName.namespaceIndex === namespaceIndex);
+
+    if (candidates.length === 0) {
+        const known = roleSet
+            .findReferencesExAsObject("HasComponent", BrowseDirection.Forward)
+            .filter((node) => node.nodeClass === NodeClass.Object)
+            .map((node) => node.browseName.toString())
+            .join(", ");
+        throw new Error(`makeRoles: cannot find a Role named "${browseName}" in the RoleSet. Known Roles are: ${known}`);
+    }
+    if (candidates.length > 1) {
+        const ambiguous = candidates.map((node) => node.browseName.toString()).join(", ");
+        throw new Error(
+            `makeRoles: the Role name "${browseName}" is ambiguous (${ambiguous}), please qualify it with its namespace`
+        );
+    }
+    return candidates[0].nodeId;
+}
+
+function resolveRole(role: RoleIdLike, addressSpace: IAddressSpace | undefined): NodeId {
+    if (isQualifiedName(role)) {
+        return resolveRoleByBrowseName(role.name, role.namespaceIndex, addressSpace);
+    }
+    if (typeof role !== "string") {
+        return resolveNodeId(role);
+    }
+    if (nodeIdExpressionRegExp.test(role)) {
+        return resolveNodeId(role);
+    }
+    const namespacedBrowseName = namespacedBrowseNameRegExp.exec(role);
+    if (namespacedBrowseName) {
+        return resolveRoleByBrowseName(namespacedBrowseName[2], parseInt(namespacedBrowseName[1], 10), addressSpace);
+    }
+    // a bare name: the standard Roles resolve without an address space, the others need one
+    return tryResolveWellKnownRole(role) ?? resolveRoleByBrowseName(role, undefined, addressSpace);
+}
+
+/**
+ * build the list of Role NodeIds a user is granted, from any of the accepted spellings:
+ *
+ * ```ts
+ * makeRoles(WellKnownRoles.Observer);                        // a well known Role
+ * makeRoles("Observer;Operator");                            // semicolon separated names
+ * makeRoles("ns=1;i=1661");                                  // an explicit NodeId
+ * makeRoles(["Observer", "ns=1;i=1661"]);                    // mixed
+ * makeRoles("1:DiscoveryAdmin", addressSpace);               // BrowseName, namespace index
+ * makeRoles("DiscoveryAdmin", addressSpace);                 // BrowseName, any namespace
+ * makeRoles([{ name: "DiscoveryAdmin" }], addressSpace);     // idem, as a QualifiedName
+ * // when the namespace is known by its URI rather than by its index:
+ * makeRoles([{ namespaceIndex: addressSpace.getNamespaceIndex(gdsUri), name: "DiscoveryAdmin" }], addressSpace);
+ * ```
+ *
+ * @param roleIds  the Roles to resolve
+ * @param addressSpace  required only to resolve a Role by BrowseName, since that
+ *                      lookup goes through the RoleSet
+ */
+export function makeRoles(roleIds: RoleIdLike[] | string | WellKnownRoles, addressSpace?: IAddressSpace): NodeId[] {
     if (typeof roleIds === "number") {
         roleIds = [roleIds];
     }
     if (typeof roleIds === "string") {
-        roleIds = roleIds.split(";").map((r) => resolveNodeId(`WellKnownRole_${r}`));
+        roleIds = splitRoleList(roleIds);
     }
-    return roleIds.map((r) => resolveNodeId(r));
+    return roleIds.map((role) => resolveRole(role, addressSpace));
 }
 
 export class SessionContext implements ISessionContext {
@@ -318,12 +508,17 @@ export class SessionContext implements ISessionContext {
      */
     public getCurrentUserRoles(): NodeId[] {
         if (!this.session) {
-            return []; // default context => no Session
+            // no Session: an in-process caller. getPermissions grants it everything —
+            // an empty list here does NOT mean "no rights", see unresolvedPermissions.
+            return [];
         }
 
         assert(this.session != null, "expecting a session");
         const userIdentityToken = this.session.userIdentityToken;
         if (!userIdentityToken) {
+            // a Session that was never activated. Distinct from the case above: this one
+            // is remote, and how the empty list is then interpreted depends on
+            // IServerBase.unresolvedPermissionPolicy.
             return [];
         }
 
@@ -387,16 +582,71 @@ export class SessionContext implements ISessionContext {
         }
         return node.rolePermissions;
     }
+    /**
+     * true when this context carries no Session at all.
+     *
+     * That is an in-process caller — SessionContext.defaultContext, or a PseudoSession
+     * driving the address space from inside the server — not a remote one. Such a caller
+     * has already passed whatever authorization its own entry point applies, and the
+     * address space is not the place to second-guess it, so it is always granted every
+     * permission. This is deliberate, and distinct from a remote Session whose identity
+     * merely failed to resolve to a Role: that case is governed by
+     * IServerBase.unresolvedPermissionPolicy.
+     */
+    private get isInProcessCaller(): boolean {
+        return !this.session;
+    }
+
+    /** what an unresolved permission means for this context: everything, or nothing */
+    private get unresolvedPermissions(): PermissionFlag {
+        if (this.isInProcessCaller) {
+            return allPermissions;
+        }
+        return this.server?.unresolvedPermissionPolicy === "deny" ? PermissionFlag.None : allPermissions;
+    }
+
+    /**
+     * the Roles to evaluate permissions against: the ones the user resolved to, plus the
+     * Anonymous Role, which every Session stands on.
+     *
+     * Opc.Ua.NodeSet2.xml names exactly five Roles across its 854 RolePermission entries —
+     * Anonymous, SecurityAdmin, ConfigureAdmin and the two SecurityKeyServer ones — and
+     * never AuthenticatedUser, Observer, Operator, Engineer or Supervisor. Its 195 Anonymous
+     * entries (Browse, Browse|Read, Browse|Call) are therefore not a privilege reserved for
+     * unauthenticated Sessions; they are the floor granted to everyone. Read literally, an
+     * authenticated user would be unable to browse the Server Object at all, and would have
+     * strictly less access than an anonymous one.
+     *
+     * Adding the Anonymous Role here can only widen a permission set, never narrow it, and
+     * only ever to what an unauthenticated Session already has — so it cannot grant anything
+     * an attacker could not obtain by simply not authenticating. It leaves
+     * getCurrentUserRoles() alone: the identity a Session reports stays truthful, only the
+     * permission evaluation gains the baseline.
+     */
+    private getRolesForPermissionEvaluation(roles: NodeId[]): NodeId[] {
+        if (roles.find((role) => sameNodeId(role, anonymousRoleNodeId))) {
+            return roles;
+        }
+        return [...roles, anonymousRoleNodeId];
+    }
+
     public getPermissions(node: BaseNode): PermissionFlag {
         const applicableRolePermissions = this.getApplicableRolePermissions(node);
 
         const roles = this.getCurrentUserRoles();
         if (roles.length === 0) {
-            return allPermissions;
+            // Two very different situations land here:
+            //  - no Session at all: an in-process caller, always trusted (see isInProcessCaller)
+            //  - a Session that resolved to no Role, either because it carries no
+            //    UserIdentityToken (it was never activated) or because its user matched
+            //    nothing. Permissive by default, for backwards compatibility, but a server
+            //    can set unresolvedPermissionPolicy: "deny" to fail closed instead.
+            return this.unresolvedPermissions;
         }
+        const unresolved = this.unresolvedPermissions;
         let orFlags: PermissionFlag = 0;
-        for (const role of roles) {
-            orFlags = orFlags | getPermissionForRole(applicableRolePermissions, role);
+        for (const role of this.getRolesForPermissionEvaluation(roles)) {
+            orFlags = orFlags | getPermissionForRole(applicableRolePermissions, role, unresolved);
         }
         return orFlags;
     }

package/src/base_node_impl.ts

@@ -970,9 +970,14 @@ extends TypedEventEmitter<T> implements BaseNode<T> {
 
         install_components_as_object_properties(this);
 
+        // Only this node is new, so only this node has to appear on the parent.
+        // Re-walking every child the parent already has made building a folder
+        // of N children cost O(N^2) - measured at 7.2s for 3000 children, of
+        // which 4.1s was spent re-installing properties that were already there.
+        const self = this as BaseNode;
         function install_extra_properties_on_parent(ref: UAReference): void {
             const node = ReferenceImpl.resolveReferenceNode(addressSpace, ref) as BaseNode;
-            install_components_as_object_properties(node);
+            install_child_as_object_property(node, self);
         }
 
         // make sure parent have extra properties updated
@@ -1836,52 +1841,64 @@ const reservedNames = {
  * install hierarchical references as javascript properties
  * Components/Properties/Organizes
  */
-function install_components_as_object_properties(parentObj: BaseNode) {
-    if (!parentObj) {
+/**
+ * Expose a single child of `parentObj` as a JavaScript property on it.
+ *
+ * Split out of {@link install_components_as_object_properties} so that adding
+ * one child does not have to re-walk every child the parent already has: that
+ * made building a large folder quadratic. See
+ * {@link BaseNodeImpl.install_extra_properties}.
+ */
+function install_child_as_object_property(parentObj: BaseNode | null, child: BaseNode | null): void {
+    // the parent may be unresolvable while a nodeset is still loading, which is
+    // why the whole-parent form guarded it too
+    if (!parentObj || !child) {
         return;
     }
+    // assumption: we ignore namespace here .
+    const name = lowerFirstLetter(child.browseName.name || "");
 
-    const addressSpace = parentObj.addressSpace;
-    const hierarchicalRefs = (parentObj as BaseNodeImpl).findHierarchicalReferences();
+    if (Object.hasOwn(reservedNames, name)) {
+        // ignore reserved names
+        if (doDebug) {
+            debugLog(chalk.bgWhite.red(`Ignoring reserved keyword                                               ${name}`));
+        }
+        return;
+    }
 
-    const children = hierarchicalRefs.map((r: UAReference) => ReferenceImpl.resolveReferenceNode(addressSpace, r));
+    // ignore reserved names
+    doDebug && debugLog(`Installing property ${name}`, " on ", parentObj.browseName.toString());
 
-    for (const child of children) {
-        if (!child) {
-            continue;
-        }
-        // assumption: we ignore namespace here .
-        const name = lowerFirstLetter(child.browseName.name || "");
+    const hasProperty = Object.hasOwn(parentObj, name);
+    if (
+        hasProperty &&
+        (parentObj as unknown as Record<string, unknown>)[name] !== null &&
+        (parentObj as unknown as Record<string, unknown>)[name] !== undefined
+    ) {
+        return;
+    }
 
-        if (Object.hasOwn(reservedNames, name)) {
-            // ignore reserved names
-            if (doDebug) {
-                debugLog(chalk.bgWhite.red(`Ignoring reserved keyword                                               ${name}`));
-            }
-            continue;
+    Object.defineProperty(parentObj, name, {
+        configurable: true, // set to true, so we can undefine later
+        enumerable: true,
+        // xx writable: false,
+        get() {
+            return child;
         }
+        // value: child
+    });
+}
 
-        // ignore reserved names
-        doDebug && debugLog(`Installing property ${name}`, " on ", parentObj.browseName.toString());
+function install_components_as_object_properties(parentObj: BaseNode) {
+    if (!parentObj) {
+        return;
+    }
 
-        const hasProperty = Object.hasOwn(parentObj, name);
-        if (
-            hasProperty &&
-            (parentObj as unknown as Record<string, unknown>)[name] !== null &&
-            (parentObj as unknown as Record<string, unknown>)[name] !== undefined
-        ) {
-            continue;
-        }
+    const addressSpace = parentObj.addressSpace;
+    const hierarchicalRefs = (parentObj as BaseNodeImpl).findHierarchicalReferences();
 
-        Object.defineProperty(parentObj, name, {
-            configurable: true, // set to true, so we can undefine later
-            enumerable: true,
-            // xx writable: false,
-            get() {
-                return child;
-            }
-            // value: child
-        });
+    for (const reference of hierarchicalRefs) {
+        install_child_as_object_property(parentObj, ReferenceImpl.resolveReferenceNode(addressSpace, reference) as BaseNode);
     }
 }
 

package/src/base_node_private.ts

@@ -1107,8 +1107,10 @@ export function _clone<T extends UAObject | UAVariable | UAMethod, O>(
 }
 
 function _add(_childByNameMap: HierarchicalIndexMap, reference: UAReferenceWithNodeRef) {
-    assert(reference.node); // const targetNode = ReferenceImpl.resolveReferenceNode(addressSpace, reference);
     const targetNode = reference.node;
+    // a reference may point to a node that is not (yet) in the address space:
+    // such a dangling reference simply cannot be indexed by browse name.
+    if (!targetNode) return;
     const hash = targetNode.browseName?.name || "";
     const existing = _childByNameMap.get(hash);
     if (existing) {
@@ -1130,6 +1132,7 @@ function sameRef(a: UAReference, b: UAReference) {
 }
 function _remove(_childByNameMap: HierarchicalIndexMap, reference: UAReferenceWithNodeRef) {
     const target = reference.node;
+    if (!target) return;
     const hash = target.browseName.name || "";
     const existing = _childByNameMap.get(hash);
     if (Array.isArray(existing)) {

package/src/nodeset_tools/nodeset_to_xml.ts

@@ -833,11 +833,29 @@ function dumpCommonAttributes(xw: XmlWriter, node: BaseNode) {
             xw.writeAttribute("IsAbstract", (node as any).isAbstract ? "true" : "false");
         }
     }
-    if (Object.hasOwn(node, "accessLevel")) {
+    // AccessLevel and UserAccessLevel exist in the XSD on UAVariable only. Gate on the node
+    // class rather than on the presence of the property: UAVariableTypeImpl happens not to own
+    // an accessLevel today, but it does own a `historizing` (see #1550), so a property-presence
+    // guard is one refactor away from emitting an attribute the schema rejects.
+    if (node.nodeClass === NodeClass.Variable) {
+        const variable = node as UAVariable;
         // CurrentRead is by default
-        if ((node as UAVariable).accessLevel !== currentReadFlag) {
-            xw.writeAttribute("AccessLevel", (node as UAVariable).accessLevel.toString());
+        if (variable.accessLevel !== currentReadFlag) {
+            xw.writeAttribute("AccessLevel", variable.accessLevel.toString());
         }
+        // UserAccessLevel is implicitly accessLevel when omitted (see convertUserAccessLevel in the loader),
+        // so it only needs to be written down when it further restricts accessLevel.
+        if (variable.userAccessLevel !== undefined && variable.userAccessLevel !== variable.accessLevel) {
+            xw.writeAttribute("UserAccessLevel", variable.userAccessLevel.toString());
+        }
+    }
+    // access policy: undefined means "inherit from the namespace", an empty rolePermissions array
+    // means "this node deliberately grants nothing".
+    if (node.accessRestrictions !== undefined) {
+        xw.writeAttribute("AccessRestrictions", node.accessRestrictions.toString());
+    }
+    if (node.rolePermissions !== undefined && node.rolePermissions.length === 0) {
+        xw.writeAttribute("HasNoPermissions", "true");
     }
     if (Object.hasOwn(node, "minimumSamplingInterval")) {
         const minimumSamplingInterval = (node as UAVariable).minimumSamplingInterval;
@@ -845,12 +863,38 @@ function dumpCommonAttributes(xw: XmlWriter, node: BaseNode) {
             xw.writeAttribute("MinimumSamplingInterval", minimumSamplingInterval);
         }
     }
+    // Historizing exists in the XSD on UAVariable only: UAVariableType is restricted to
+    // DataType/ValueRank/ArrayDimensions. UAVariableTypeImpl nevertheless owns a `historizing`
+    // property, so the node class must be tested here rather than the presence of the property.
+    // false being the default, the attribute is only emitted when it is set.
+    if (node.nodeClass === NodeClass.Variable && (node as UAVariable).historizing) {
+        xw.writeAttribute("Historizing", "true");
+    }
+}
+
+// the UANode XSD sequence is DisplayName, Description, Category, Documentation, References,
+// RolePermissions, Extensions: RolePermissions must therefore come after References.
+function _dumpRolePermissions(xw: XmlWriter, node: BaseNode) {
+    const rolePermissions = node.rolePermissions;
+    if (!rolePermissions || rolePermissions.length === 0) {
+        // the empty case is carried by the HasNoPermissions attribute
+        return;
+    }
+    xw.startElement("RolePermissions");
+    for (const rolePermission of rolePermissions) {
+        xw.startElement("RolePermission");
+        xw.writeAttribute("Permissions", rolePermission.permissions.toString());
+        xw.text(n(xw, rolePermission.roleId));
+        xw.endElement();
+    }
+    xw.endElement();
 }
 
 function dumpCommonElements(xw: XmlWriter, node: BaseNode) {
     _dumpDisplayName(xw, node);
     _dumpDescription(xw, node);
     _dumpReferences(xw, node);
+    _dumpRolePermissions(xw, node);
 }
 
 function coerceInt64ToInt32(int64: Int64): number {
@@ -1142,7 +1186,9 @@ function _dumpUAObject(xw: XmlWriter, node: UAObject) {
 function dumpElementInFolder(xw: XmlWriter, node: BaseNodeImpl) {
     const aggregates = node
         .getFolderElements()
-        .sort((x: BaseNode, y: BaseNode) => ((x?.browseName.name?.toString() || 0) > (y?.browseName.name?.toString() || 0) ? 1 : -1));
+        .sort((x: BaseNode, y: BaseNode) =>
+            (x?.browseName.name?.toString() || 0) > (y?.browseName.name?.toString() || 0) ? 1 : -1
+        );
     for (const aggregate of aggregates.sort(sortByNodeId)) {
         // do not export node that do not belong to our namespace
         if (node.nodeId.namespace !== aggregate.nodeId.namespace) {

package/src/ua_variable_impl_ext_obj.ts

@@ -573,7 +573,12 @@ export function _bindExtensionObject(
                     uaVariable.$extensionObject?.schema.name
             );
         }
-        return uaVariable.$extensionObject;
+        // the variable may have been bound at load time with createMissingProp:false ( the loader only
+        // binds what the nodeset declares ): a caller explicitly asking for the missing child
+        // properties must still get them installed on the existing extension object.
+        if (!options.createMissingProp) {
+            return uaVariable.$extensionObject;
+        }
     }
 
     if (uaVariable.dataTypeObj.isAbstract) {