node-opcua-client 2.163.1 → 2.165.0

package/source/private/reconnection/client_subscription_reconnection.ts

@@ -1,8 +1,7 @@
-import { promisify } from "util";
+import { promisify } from "node:util";
 import assert from "node-opcua-assert";
 import { TimestampsToReturn } from "node-opcua-data-value";
-import { make_debugLog, checkDebugFlag } from "node-opcua-debug";
-import { warningLog } from "node-opcua-pki";
+import { make_debugLog, checkDebugFlag, make_warningLog } from "node-opcua-debug";
 import { MonitoredItemCreateRequestOptions, CreateMonitoredItemsRequest, CreateMonitoredItemsResponse } from "node-opcua-types";
 
 import {
@@ -18,6 +17,7 @@ import { _shouldNotContinue } from "./reconnection";
 
 const debugLog = make_debugLog("RECONNECTION");
 const doDebug = checkDebugFlag("RECONNECTION");
+const warningLog = make_warningLog("RECONNECTION");
 
 async function createMonitoredItemsAndRespectOperationalLimits(
     session: IBasicSessionReadAsync & IBasicSessionWithSubscription,
@@ -82,7 +82,7 @@ export async function recreateSubscriptionAndMonitoredItem(_subscription: Client
     });
 
     const session = subscription.session;
-    // istanbul ignore next
+    // c8 ignore next
     if (!session) {
         throw new Error("no session");
     }
@@ -97,13 +97,13 @@ export async function recreateSubscriptionAndMonitoredItem(_subscription: Client
     let _errCount = 0;
     monitoredItemResults.forEach((monitoredItemResult, index) => {
         const itemToCreate = itemsToCreate[index];
-        /* istanbul ignore next */
+        /* c8 ignore next */
         if (!itemToCreate || !itemToCreate.requestedParameters) {
             _errCount++;
             return;
         }
         const clientHandle = itemToCreate.requestedParameters.clientHandle;
-        /* istanbul ignore next */
+        /* c8 ignore next */
         if (!clientHandle) {
             _errCount++;
             return;

package/source/private/reconnection/reconnection.ts

@@ -192,7 +192,7 @@ function repair_client_session_by_recreating_a_new_session(
     // and may be upgraded in between, we have to invalidate the extra data type manager
     invalidateExtraDataTypeManager(session);
 
-    // istanbul ignore next
+    // c8 ignore next
     if (doDebug) {
         debugLog(" repairing client session by_recreating a new session for old session ", session.sessionId.toString());
     }
@@ -247,7 +247,7 @@ function repair_client_session_by_recreating_a_new_session(
                 // prettier-ignore
                 { const err = _shouldNotContinue(session); if (err) { return innerCallback(err); } }
 
-                // istanbul ignore next
+                // c8 ignore next
                 doDebug && debugLog(chalk.bgWhite.red("    => suspend old session publish engine...."));
                 session.getPublishEngine().suspend(true);
                 innerCallback();
@@ -275,7 +275,7 @@ function repair_client_session_by_recreating_a_new_session(
                     newSession,
                     newSession.userIdentityInfo!,
                     (err: Error | null, session1?: ClientSessionImpl) => {
-                        // istanbul ignore next
+                        // c8 ignore next
                         doDebug && debugLog("    =>  activating a new session .... Done err=", err ? err.message : "null");
                         if (err) {
                             doDebug &&
@@ -293,9 +293,9 @@ function repair_client_session_by_recreating_a_new_session(
                                 if (err2) {
                                     warningLog("closing session", err2.message);
                                 }
-                                // istanbul ignore next
+                                // c8 ignore next
                                 doDebug && debugLog("the temporary replacement session is now closed");
-                                // istanbul ignore next
+                                // c8 ignore next
                                 doDebug && debugLog(" err ", err.message, "propagated upwards");
                                 innerCallback(err);
                             });
@@ -372,7 +372,7 @@ function repair_client_session_by_recreating_a_new_session(
                         }
 
                         const results = transferSubscriptionsResponse.results || [];
-                        // istanbul ignore next
+                        // c8 ignore next
                         if (doDebug) {
                             debugLog(
                                 chalk.cyan("    =>  transfer subscriptions  done"),
@@ -550,7 +550,7 @@ export function repair_client_session(client: IClientBase, session: ClientSessio
                 return;
             }
 
-            // istanbul ignore next
+            // c8 ignore next
             doDebug && debugLog(chalk.yellow("session has been restored"), session.sessionId.toString());
             session.emit("session_restored");
             callback(err);
@@ -561,7 +561,7 @@ export function repair_client_session(client: IClientBase, session: ClientSessio
         const otherCallbacks = privateSession._reconnecting.pendingCallbacks.splice(0);
         // re-inject element in queue
         
-        // istanbul ignore next
+        // c8 ignore next
         if (transactionQueue.length > 0) {
             doDebug && debugLog(chalk.yellow("re-injecting transaction queue"), transactionQueue.length);
             transactionQueue.forEach((e: any) => privateSession._reconnecting.pendingTransactions.push(e));

package/source/tools/read_history_server_capabilities.ts

@@ -37,7 +37,7 @@ export function readHistoryServerCapabilities(
         if (err) {
             return callback(err);
         }
-        /* istanbul ignore next */
+        /* c8 ignore next */
         if (!result) {
             return callback(new Error("Internal Error"));
         }
@@ -89,7 +89,7 @@ export function readHistoryServerCapabilities(
             if (innerErr) {
                 return callback(innerErr);
             }
-            /* istanbul ignore next */
+            /* c8 ignore next */
             if (!results) {
                 return callback(new Error("Internal Error"));
             }
@@ -111,7 +111,7 @@ export function readHistoryServerCapabilities(
                 if (err2) {
                     return callback(err2);
                 }
-                /* istanbul ignore next */
+                /* c8 ignore next */
                 if (!dataValues) {
                     return callback(new Error("Internal Error"));
                 }

package/source/verify.ts

@@ -1,17 +1,12 @@
-import { OPCUACertificateManager } from "node-opcua-certificate-manager";
-import { OPCUASecureObject } from "node-opcua-common";
+import type { OPCUACertificateManager } from "node-opcua-certificate-manager";
+import type { OPCUASecureObject } from "node-opcua-common";
 
-import {
-    Certificate,
-    exploreCertificate,
-    explorePrivateKey,
-    publicKeyAndPrivateKeyMatches
-} from "node-opcua-crypto/web";
+import { type Certificate, exploreCertificate, explorePrivateKey, publicKeyAndPrivateKeyMatches } from "node-opcua-crypto/web";
 import { checkDebugFlag, make_debugLog, make_errorLog, make_warningLog } from "node-opcua-debug";
-import { VerifyCertificateOptions } from "node-opcua-pki";
+import type { VerifyCertificateOptions } from "node-opcua-pki";
 
-const doDebug = checkDebugFlag(__filename);
-const debugLog = make_debugLog(__filename);
+const _doDebug = checkDebugFlag(__filename);
+const _debugLog = make_debugLog(__filename);
 const errorLog = make_errorLog(__filename);
 const warningLog = make_warningLog(__filename);
 
@@ -29,8 +24,8 @@ export function verifyIsOPCUAValidCertificate(
         // certificate is not active yet
         warningLog(
             `[NODE-OPCUA-W02] The certificate is not active yet\n` +
-                `notBefore       ${certificateInfo.tbsCertificate.validity.notBefore.toISOString()}\n` +
-                `certificateFile ${certificateFile}`
+            `notBefore       ${certificateInfo.tbsCertificate.validity.notBefore.toISOString()}\n` +
+            `certificateFile ${certificateFile}`
         );
     }
     //  check that certificate has not expired
@@ -38,9 +33,9 @@ export function verifyIsOPCUAValidCertificate(
         // certificate is obsolete
         warningLog(
             `[NODE-OPCUA-W03] The certificate has expired\n` +
-                `Please regenerate a valid certificate\n` +
-                `notAfter       = ${certificateInfo.tbsCertificate.validity.notAfter.toISOString()}\n` +
-                `certificateFile= ${certificateFile}`
+            `Please regenerate a valid certificate\n` +
+            `notAfter       = ${certificateInfo.tbsCertificate.validity.notAfter.toISOString()}\n` +
+            `certificateFile= ${certificateFile}`
         );
     } else {
         const tenDays = 10 * 24 * 60 * 60 * 1000;
@@ -48,9 +43,9 @@ export function verifyIsOPCUAValidCertificate(
             // certificate is going to expired very soon
             warningLog(
                 `[NODE-OPCUA-W05] The certificate is about to expire in less than 10 days.\n` +
-                    `Please regenerate a valid certificate as soon as possible\n` +
-                    `notAfter       = ${certificateInfo.tbsCertificate.validity.notAfter.toISOString()}\n` +
-                    `certificateFile= ${certificateFile}\n`
+                `Please regenerate a valid certificate as soon as possible\n` +
+                `notAfter       = ${certificateInfo.tbsCertificate.validity.notAfter.toISOString()}\n` +
+                `certificateFile= ${certificateFile}\n`
             );
         }
     }
@@ -59,46 +54,46 @@ export function verifyIsOPCUAValidCertificate(
     if (!uniformResourceIdentifier) {
         warningLog(
             `[NODE-OPCUA-W14] The certificate subjectAltName uniformResourceIdentifier is missing.\n` +
-                `Please regenerate a specific certificate with a uniformResourceIdentifier that matches your ${type} applicationUri\n` +
-                `applicationUri  = ${applicationUri}\n` +
-                `certificateFile = ${certificateFile}\n`
+            `Please regenerate a specific certificate with a uniformResourceIdentifier that matches your ${type} applicationUri\n` +
+            `applicationUri  = ${applicationUri}\n` +
+            `certificateFile = ${certificateFile}\n`
         );
         return;
     } else if (uniformResourceIdentifier[0] !== applicationUri) {
         warningLog(
             `[NODE-OPCUA-W06] The certificate subjectAltName does not match the ${type} applicationUri\n` +
-                `Please regenerate a specific certificate that matches your ${type} applicationUri\n` +
-                `certificate subjectAltName  = ${uniformResourceIdentifier[0]}\n` +
-                `${type} applicationUri  = ${applicationUri}\n` +
-                `certificateFile         = ${certificateFile}\n`
+            `Please regenerate a specific certificate that matches your ${type} applicationUri\n` +
+            `certificate subjectAltName  = ${uniformResourceIdentifier[0]}\n` +
+            `${type} applicationUri  = ${applicationUri}\n` +
+            `certificateFile         = ${certificateFile}\n`
         );
     }
     const keyUsage = certificateInfo.tbsCertificate.extensions?.keyUsage;
     if (!keyUsage) {
-        warningLog(`[NODE-OPCUA-W15] The certificate keyUsage is missing\n` + `certificateFile = ${certificateFile}`);
+        warningLog(`[NODE-OPCUA-W15] The certificate keyUsage is missing\ncertificateFile = ${certificateFile}`);
     } else {
         // spec says that certificate shall include digitalSignature, nonRepudiation, keyEncipherment and dataEncipherment.
         // Other key uses are allowed.
         if (!keyUsage.digitalSignature || !keyUsage.nonRepudiation || !keyUsage.keyEncipherment || !keyUsage.dataEncipherment) {
             warningLog(
                 `[NODE-OPCUA-W16] The certificate keyUsage must include digitalSignature, nonRepudiation, keyEncipherment and dataEncipherment.\n` +
-                    `see https://reference.opcfoundation.org/v104/Core/docs/Part6/6.2.2/\n` +
-                    `certificateFile = ${certificateFile}`
+                `see https://reference.opcfoundation.org/v104/Core/docs/Part6/6.2.2/\n` +
+                `certificateFile = ${certificateFile}`
             );
             warningLog(`keyUsage = ${JSON.stringify(keyUsage, null, " ")}`);
         }
     }
     const extKeyUsage = certificateInfo.tbsCertificate.extensions?.extKeyUsage;
     if (!extKeyUsage) {
-        warningLog(`[NODE-OPCUA-W17] The certificate extKeyUsage is missing\n` + `certificateFile = ${certificateFile}`);
+        warningLog(`[NODE-OPCUA-W17] The certificate extKeyUsage is missing\ncertificateFile = ${certificateFile}`);
     } else {
         // spec says that certificate shall include digitalSignature, nonRepudiation, keyEncipherment and dataEncipherment.
         // Other key uses are allowed.
         if (!extKeyUsage.clientAuth && !extKeyUsage.serverAuth) {
             warningLog(
                 `[NODE-OPCUA-W18] The certificate extKeyUsage must include clientAuth and/or serverAuth.\n` +
-                    `see https://reference.opcfoundation.org/v104/Core/docs/Part6/6.2.2/\n` +
-                    `certificateFile = ${certificateFile}`
+                `see https://reference.opcfoundation.org/v104/Core/docs/Part6/6.2.2/\n` +
+                `certificateFile = ${certificateFile}`
             );
         }
     }
@@ -107,14 +102,14 @@ export function verifyIsOPCUAValidCertificate(
     if (keyLengthInBits < 1024) {
         errorLog(
             `[NODE-OPCUA-W19] The public key length shall be greater than or equal to 1024 bits. key length is ${keyLengthInBits}.\n` +
-                `see https://reference.opcfoundation.org/v104/GDS/docs/7.6.3/\n` +
-                `certificateFile = ${certificateFile}`
+            `see https://reference.opcfoundation.org/v104/GDS/docs/7.6.3/\n` +
+            `certificateFile = ${certificateFile}`
         );
     } else if (keyLengthInBits < 2048) {
         warningLog(
             `[NODE-OPCUA-W23] key lengths less than 2048 are considered insecure. key length is ${keyLengthInBits}\n` +
-                `see https://reference.opcfoundation.org/v104/Core/docs/Part2/6.8/\n` +
-                `certificateFile = ${certificateFile}`
+            `see https://reference.opcfoundation.org/v104/Core/docs/Part2/6.8/\n` +
+            `certificateFile = ${certificateFile}`
         );
     }
 }
@@ -145,23 +140,25 @@ export async function performCertificateSanityCheck(
     if (keyLengthInBits <= 1024) {
         warningLog(
             `[NODE-OPCUA-W04] The public/private key pair uses a key length which is equal or lower than 1024 bits. ( key length was ${keyLengthInBits} )\n` +
-                `OPCUA version 1.04 requires that security key length are greater or equal to 2048 bits.\n` +
-                `The ${serverOrClient} is operating at risk.                                             `
+            `OPCUA version 1.04 requires that security key length are greater or equal to 2048 bits.\n` +
+            `The ${serverOrClient} is operating at risk.                                             `
         );
     }
-    // verify that the certificate has a valid date and has expected extensions fields such as DNS and IP.
-    const status1 = await certificateManager.trustCertificate(certificate);
 
     const options: VerifyCertificateOptions = {
         acceptOutdatedCertificate: false,
         acceptOutDatedIssuerCertificate: false,
-        acceptPendingCertificate: false,
+        acceptPendingCertificate: false
     };
 
     const status = await certificateManager.verifyCertificate(certificate, options);
 
-    if (status !== "Good") {
-        warningLog("[NODE-OPCUA-W04] Warning: the certificate status is = ", status, " file = ", secureObject.certificateFile);
+    // BadCertificateUntrusted is expected for the application's own
+    // certificate — it does not need to be in its own trust list.
+    // Only warn about genuinely problematic statuses (expired,
+    // revoked, invalid signature, etc.).
+    if (status !== "Good" && status !== "BadCertificateUntrusted") {
+        warningLog("[NODE-OPCUA-W35] Warning: the certificate status is = ", status, " file = ", secureObject.certificateFile);
     }
 
     verifyIsOPCUAValidCertificate(certificate, secureObject.certificateFile, serverOrClient, applicationUri);