node-opcua-client 2.177.0 → 2.179.0

package/source/private/client_base_impl.ts

@@ -1,7 +1,6 @@
 /**
  * @module node-opcua-client-private
  */
-// tslint:disable:no-unused-expression
 import fs from "node:fs";
 import path from "node:path";
 
@@ -10,7 +9,16 @@ import { withLock } from "@ster5/global-mutex";
 import chalk from "chalk";
 import { assert } from "node-opcua-assert";
 import { getDefaultCertificateManager, type OPCUACertificateManager } from "node-opcua-certificate-manager";
-import { type ICertificateStore, InMemoryCertificateStore, type IOPCUASecureObjectOptions, makeApplicationUrn, makeSubject, OPCUASecureObject } from "node-opcua-common";
+import {
+    type ICertificateStore,
+    InMemoryCertificateStore,
+    type IOPCUASecureObjectOptions,
+    makeApplicationUrn,
+    makeSubject,
+    OPCUASecureObject,
+    resolvePrivateKeyProviderIfNeeded
+} from "node-opcua-common";
+import { PrivateKeyPassphraseRequiredError } from "node-opcua-crypto";
 import { type Certificate, makeSHA1Thumbprint, split_der } from "node-opcua-crypto/web";
 import { installPeriodicClockAdjustment, periodicClockAdjustment, uninstallPeriodicClockAdjustment } from "node-opcua-date-time";
 import { checkDebugFlag, make_debugLog, make_errorLog, make_warningLog } from "node-opcua-debug";
@@ -27,7 +35,6 @@ import {
     type Response as Response1,
     type SecurityPolicy
 } from "node-opcua-secure-channel";
-import { type IAcceptedReverseConnection, type IClientTransportFactory, makeReverseClientTransportFactory } from "node-opcua-transport";
 import {
     FindServersOnNetworkRequest,
     type FindServersOnNetworkRequestOptions,
@@ -45,6 +52,11 @@ import {
 import { type ChannelSecurityToken, coerceMessageSecurityMode, MessageSecurityMode } from "node-opcua-service-secure-channel";
 import { CloseSessionRequest, type CloseSessionResponse } from "node-opcua-service-session";
 import { type ErrorCallback, StatusCodes } from "node-opcua-status-code";
+import {
+    type IAcceptedReverseConnection,
+    type IClientTransportFactory,
+    makeReverseClientTransportFactory
+} from "node-opcua-transport";
 import { checkFileExistsAndIsNotEmpty, matchUri } from "node-opcua-utils";
 import {
     type CreateSecureChannelCallbackFunc,
@@ -116,7 +128,15 @@ function __findEndpoint(this: ClientBaseImpl, endpointUrl: string, params: FindE
         //     maxRetry: 0 /* no- retry */,
         //     maxDelay: 2000
         // },
-        privateKeyFile: params.privateKeyFile
+        privateKeyFile: params.privateKeyFile,
+
+        // TmpClient.connect() (below) calls _connectStep2() directly and never
+        // runs initializeCM() — so it never resolves a passphrase-encrypted
+        // private key on its own. Hand it the master client's own provider
+        // (already resolved, if needed) instead of letting it build a fresh
+        // disk provider from certificateFile/privateKeyFile, which would
+        // re-read the file and fail synchronously on an encrypted key.
+        certificateKeyPairProvider: masterClient.getProvider()
     };
 
     const client = new TmpClient(options);
@@ -205,10 +225,10 @@ function __findEndpoint(this: ClientBaseImpl, endpointUrl: string, params: FindE
                 return callback(
                     new Error(
                         "Cannot find an Endpoint matching " +
-                        " security mode: " +
-                        securityMode.toString() +
-                        " policy: " +
-                        securityPolicy.toString()
+                            " security mode: " +
+                            securityMode.toString() +
+                            " policy: " +
+                            securityPolicy.toString()
                     )
                 );
             }
@@ -246,16 +266,19 @@ async function _verify_serverCertificate(certificateManager: ICertificateStore,
 }
 
 const forceEndpointDiscoveryOnConnect = !!parseInt(process.env.NODEOPCUA_CLIENT_FORCE_ENDPOINT_DISCOVERY || "0", 10);
-debugLog("forceEndpointDiscoveryOnConnect = ", forceEndpointDiscoveryOnConnect);
+// c8 ignore next
+doDebug && debugLog("forceEndpointDiscoveryOnConnect = ", forceEndpointDiscoveryOnConnect);
 
 class ClockAdjustment {
     constructor() {
-        debugLog("installPeriodicClockAdjustment ", periodicClockAdjustment.timerInstallationCount);
+        // c8 ignore next
+        doDebug && debugLog("installPeriodicClockAdjustment ", periodicClockAdjustment.timerInstallationCount);
         installPeriodicClockAdjustment();
     }
     dispose() {
         uninstallPeriodicClockAdjustment();
-        debugLog("uninstallPeriodicClockAdjustment ", periodicClockAdjustment.timerInstallationCount);
+        // c8 ignore next
+        doDebug && debugLog("uninstallPeriodicClockAdjustment ", periodicClockAdjustment.timerInstallationCount);
     }
 }
 
@@ -294,10 +317,10 @@ let g_ClientCounter = 0;
 /**
  * @internal
  */
-// tslint:disable-next-line: max-classes-per-file
 export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBaseEvents>
     extends OPCUASecureObject<Events>
-    implements OPCUAClientBase<Events>, IClientBase {
+    implements OPCUAClientBase<Events>, IClientBase
+{
     /**
      * total number of requests that been canceled due to timeout
      */
@@ -396,6 +419,8 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
     private _reverseConnectRegistration?: ICancelableRegistration;
 
     public clientCertificateManager: ICertificateStore;
+    /** true when the caller supplied a certificateKeyPairProvider — the private-key resolution escape hatch. */
+    #hasUserProvidedProvider = false;
 
     public isUnusable() {
         return (
@@ -438,6 +463,8 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
     constructor(options?: OPCUAClientBaseOptions) {
         options = options || {};
 
+        const hasUserProvidedProvider = !!options.certificateKeyPairProvider;
+
         if (options.certificateKeyPairProvider) {
             // In-memory path — use a lightweight in-memory store
             // when no cert manager was explicitly provided.
@@ -452,11 +479,12 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
             }
             const cm = options.clientCertificateManager as OPCUACertificateManager;
             options.privateKeyFile = options.privateKeyFile || cm.privateKey;
-            options.certificateFile =
-                options.certificateFile || path.join(cm.rootDir, "own/certs/client_certificate.pem");
+            options.certificateFile = options.certificateFile || path.join(cm.rootDir, "own/certs/client_certificate.pem");
             super(options as IOPCUASecureObjectOptions);
         }
 
+        this.#hasUserProvidedProvider = hasUserProvidedProvider;
+
         this._setInternalState("uninitialized");
 
         this._instanceNumber = g_ClientCounter++;
@@ -468,7 +496,10 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
         // we need to delay _applicationUri initialization
         this._applicationUri = options.applicationUri || this._getBuiltApplicationUri();
 
-        this.clientCertificateManager = options.clientCertificateManager!;
+        if (!options.clientCertificateManager) {
+            throw new Error("internal error: clientCertificateManager should have been set above");
+        }
+        this.clientCertificateManager = options.clientCertificateManager;
         this.clientCertificateManager.referenceCounter++;
 
         this._secureChannel = null;
@@ -532,13 +563,16 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
             warningLog("internal error: _cancel_reconnection should only be used when reconnecting is in progress");
         }
 
-        debugLog("canceling reconnection : ", this.clientName);
+        // c8 ignore next
+        doDebug && debugLog("canceling reconnection : ", this.clientName);
 
         this._reconnectionIsCanceled = true;
 
         // c8 ignore next
         if (!this._secureChannel) {
-            debugLog("_cancel_reconnection:  Nothing to do for !", this.clientName, " because secure channel doesn't exist");
+            // c8 ignore next
+            doDebug &&
+                debugLog("_cancel_reconnection:  Nothing to do for !", this.clientName, " because secure channel doesn't exist");
             return callback(); // nothing to do
         }
 
@@ -549,10 +583,12 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
     }
 
     public _recreate_secure_channel(callback: ErrorCallback): void {
-        debugLog("_recreate_secure_channel... while internalState is", this._internalState);
+        // c8 ignore next
+        doDebug && debugLog("_recreate_secure_channel... while internalState is", this._internalState);
 
         if (!this.knowsServerEndpoint) {
-            debugLog("Cannot reconnect , server endpoint is unknown");
+            // c8 ignore next
+            doDebug && debugLog("Cannot reconnect , server endpoint is unknown");
             callback(new Error("Cannot reconnect, server endpoint is unknown - this.knowsServerEndpoint = false"));
             return;
         }
@@ -579,7 +615,8 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
         };
 
         const _failAndRetry = (err: Error, message: string, callback: ErrorCallback) => {
-            debugLog("failAndRetry; ", message);
+            // c8 ignore next
+            doDebug && debugLog("failAndRetry; ", message);
             if (this._reconnectionIsCanceled) {
                 return _when_reconnectionIsCanceled(callback);
             }
@@ -595,13 +632,15 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
             this.emit("after_reconnection", null); // send after callback
             assert(this._secureChannel, "expecting a secureChannel here ");
             // a new channel has be created and a new connection is established
-            debugLog(chalk.bgWhite.red("ClientBaseImpl:  RECONNECTED                !!!"));
+            // c8 ignore next
+            doDebug && debugLog(chalk.bgWhite.red("ClientBaseImpl:  RECONNECTED                !!!"));
             this._setInternalState("reconnecting_newchannel_connected");
             return callback();
         };
 
         const _attempt_to_recreate_secure_channel = (callback: ErrorCallback) => {
-            debugLog("attempt to recreate a new secure channel");
+            // c8 ignore next
+            doDebug && debugLog("attempt to recreate a new secure channel");
             if (this._reconnectionIsCanceled) {
                 return _when_reconnectionIsCanceled(callback);
             }
@@ -704,11 +743,13 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
         assert(this._secureChannel === null);
         assert(typeof this.endpointUrl === "string");
 
-        debugLog(
-            "_internal_create_secure_channel creating new ClientSecureChannelLayer _internalState =",
-            this._internalState,
-            this.clientName
-        );
+        // c8 ignore next
+        doDebug &&
+            debugLog(
+                "_internal_create_secure_channel creating new ClientSecureChannelLayer _internalState =",
+                this._internalState,
+                this.clientName
+            );
         const secureChannel = new ClientSecureChannelLayer({
             connectionStrategy,
             defaultSecureTokenLifetime: this.defaultSecureTokenLifetime,
@@ -738,12 +779,15 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
 
         const step2_openSecureChannel = (): Promise<void> => {
             return new Promise<void>((resolve, reject) => {
-                debugLog("_internal_create_secure_channel before secureChannel.create");
+                // c8 ignore next
+                doDebug && debugLog("_internal_create_secure_channel before secureChannel.create");
 
                 secureChannel.create(this.endpointUrl, (err?: Error) => {
-                    debugLog("_internal_create_secure_channel after secureChannel.create");
+                    // c8 ignore next
+                    doDebug && debugLog("_internal_create_secure_channel after secureChannel.create");
                     if (!this._secureChannel) {
-                        debugLog("_secureChannel has been closed during the transaction !");
+                        // c8 ignore next
+                        doDebug && debugLog("_secureChannel has been closed during the transaction !");
                         return reject(new Error("Secure Channel Closed"));
                     }
                     if (err) {
@@ -763,7 +807,8 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
 
                     this.getEndpoints((err: Error | null /*, endpoints?: EndpointDescription[]*/) => {
                         if (!this._secureChannel) {
-                            debugLog("_secureChannel has been closed during the transaction ! (while getEndpoints)");
+                            // c8 ignore next
+                            doDebug && debugLog("_secureChannel has been closed during the transaction ! (while getEndpoints)");
                             return reject(new Error("Secure Channel Closed"));
                         }
                         if (err) {
@@ -847,13 +892,25 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
                     this.applicationName,
                     this._getBuiltApplicationUri()
                 );
-                debugLog("privateKey      = ", this.privateKeyFile);
+                // c8 ignore next
+                doDebug && debugLog("privateKey      = ", this.privateKeyFile);
                 if ("privateKey" in this.clientCertificateManager) {
-                    debugLog("                = ", (this.clientCertificateManager as unknown as OPCUACertificateManager).privateKey);
+                    // c8 ignore next
+                    doDebug &&
+                        debugLog(
+                            "                = ",
+                            (this.clientCertificateManager as unknown as OPCUACertificateManager).privateKey
+                        );
                 }
-                debugLog("certificateFile = ", this.certificateFile);
+                // c8 ignore next
+                doDebug && debugLog("certificateFile = ", this.certificateFile);
                 const _certificate = this.getCertificate();
-                const _privateKey = this.getPrivateKey();
+                // Note: do NOT eagerly call this.getPrivateKey() here. A freshly
+                // generated key may already be passphrase-encrypted on disk (when
+                // clientCertificateManager is configured with privateKeyPassphrase),
+                // and the disk provider's getPrivateKey() is synchronous — it cannot
+                // decrypt. initializeCM() resolves the private key asynchronously
+                // (once) right after this method returns.
             });
         }
         (this as unknown as { _inCreateDefaultCertificate: boolean })._inCreateDefaultCertificate = false;
@@ -872,22 +929,48 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
             // disconnect
             errorLog(
                 "[NODE-OPCUA-E08] initializeCM: clientCertificateManager is null\n" +
-                "                 This happen when you disconnected the client, to free resources.\n" +
-                "                 Please create a new OPCUAClient instance if you want to reconnect"
+                    "                 This happen when you disconnected the client, to free resources.\n" +
+                    "                 Please create a new OPCUAClient instance if you want to reconnect"
             );
             return;
         }
-        await this.clientCertificateManager.initialize();
+        // The pki-level initialize() itself already decrypts (or re-encrypts)
+        // the on-disk key when clientCertificateManager is configured with a
+        // privateKeyPassphrase, and fails closed with
+        // PrivateKeyPassphraseRequiredError on a mismatch — so this whole
+        // sequence, not just the resolve step below, needs the friendlier
+        // error message.
+        try {
+            await this.clientCertificateManager.initialize();
+
+            if (this.certificateFile === "<in-memory>" || this.certificateFile === "<unknown>") {
+                // In-memory provider — cert already available, skip disk operations
+            } else {
+                // Disk path — create default cert if missing
+                await this.createDefaultCertificate();
+                // c8 ignore next
+                if (!fs.existsSync(this.privateKeyFile)) {
+                    throw new Error(` cannot locate private key file ${this.privateKeyFile}`);
+                }
 
-        if (this.certificateFile === "<in-memory>" || this.certificateFile === "<unknown>") {
-            // In-memory provider — cert already available, skip disk operations
-        } else {
-            // Disk path — create default cert if missing
-            await this.createDefaultCertificate();
-            // c8 ignore next
-            if (!fs.existsSync(this.privateKeyFile)) {
-                throw new Error(` cannot locate private key file ${this.privateKeyFile}`);
+                // Resolve the (possibly passphrase-encrypted) private key once,
+                // asynchronously, and install it as this client's provider — so
+                // that every later, synchronous getPrivateKey() call (secure
+                // channel layer, ...) succeeds without touching disk again.
+                // No-ops when the caller supplied its own
+                // certificateKeyPairProvider, or when clientCertificateManager
+                // doesn't expose an async getPrivateKey() (e.g. a bare
+                // ICertificateStore).
+                await resolvePrivateKeyProviderIfNeeded(this, this.clientCertificateManager, this.#hasUserProvidedProvider);
             }
+        } catch (err) {
+            if (err instanceof PrivateKeyPassphraseRequiredError) {
+                throw new Error(
+                    `[NODE-OPCUA-E31] private key ${this.privateKeyFile} is encrypted; ` +
+                        "set privateKeyPassphrase on the OPCUACertificateManager passed as clientCertificateManager"
+                );
+            }
+            throw err;
         }
         if (this.isUnusable()) return;
 
@@ -901,7 +984,8 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
     protected _internalState: InternalClientState = "uninitialized";
 
     protected _handleUnrecoverableConnectionFailure(err: Error, callback: ErrorCallback): void {
-        debugLog(err.message);
+        // c8 ignore next
+        doDebug && debugLog(err.message);
         // Terminal connect failure: make sure the client is removed from the leak registry. A
         // synchronous throw out of _connectStep2 (e.g. an invalid SecureChannel config) lands here
         // WITHOUT the error-branch unregister ever running, which would otherwise leak the client.
@@ -912,7 +996,8 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
         callback(err);
     }
     private _handleDisconnectionWhileConnecting(err: Error, callback: ErrorCallback) {
-        debugLog(err.message);
+        // c8 ignore next
+        doDebug && debugLog(err.message);
         // see _handleUnrecoverableConnectionFailure: idempotent unregister guards against a leaked
         // client when a connect attempt fails before the error-branch unregister runs.
         OPCUAClientBase.registry.unregister(this);
@@ -921,7 +1006,8 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
         callback(err);
     }
     private _handleSuccessfulConnection(callback: ErrorCallback) {
-        debugLog(" Connected successfully  to ", this.endpointUrl);
+        // c8 ignore next
+        doDebug && debugLog(" Connected successfully  to ", this.endpointUrl);
         this.emit("connected");
         this._setInternalState("connected");
         callback();
@@ -959,7 +1045,8 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
 
         this.initializeCM()
             .then(() => {
-                debugLog("ClientBaseImpl#connect ", endpointUrl, this.clientName);
+                // c8 ignore next
+                doDebug && debugLog("ClientBaseImpl#connect ", endpointUrl, this.clientName);
                 if (this._internalState === "disconnecting" || this._internalState === "disconnected") {
                     return this._handleDisconnectionWhileConnecting(new Error("premature disconnection 1"), callback);
                 }
@@ -968,7 +1055,8 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
                     !this.serverCertificate &&
                     (forceEndpointDiscoveryOnConnect || this.securityMode !== MessageSecurityMode.None)
                 ) {
-                    debugLog("Fetching certificates from endpoints");
+                    // c8 ignore next
+                    doDebug && debugLog("Fetching certificates from endpoints");
                     this.fetchServerCertificate(endpointUrl, (err: Error | null, adjustedEndpointUrl?: string) => {
                         if (err) {
                             return this._handleUnrecoverableConnectionFailure(err, callback);
@@ -977,10 +1065,13 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
                             return this._handleDisconnectionWhileConnecting(new Error("premature disconnection 2"), callback);
                         }
                         if (forceEndpointDiscoveryOnConnect) {
-                            debugLog("connecting with adjusted endpoint : ", adjustedEndpointUrl, "  was =", endpointUrl);
+                            // c8 ignore next
+                            doDebug &&
+                                debugLog("connecting with adjusted endpoint : ", adjustedEndpointUrl, "  was =", endpointUrl);
                             this._connectStep2(adjustedEndpointUrl || "", callback);
                         } else {
-                            debugLog("connecting with endpoint : ", endpointUrl);
+                            // c8 ignore next
+                            doDebug && debugLog("connecting with endpoint : ", endpointUrl);
                             this._connectStep2(endpointUrl, callback);
                         }
                     });
@@ -995,7 +1086,11 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
 
     public connectReverse(reverseConnect: ClientReverseConnect, expectation?: ReverseConnectExpectation): Promise<void>;
     public connectReverse(reverseConnect: ClientReverseConnect, callback: ErrorCallback): void;
-    public connectReverse(reverseConnect: ClientReverseConnect, expectation: ReverseConnectExpectation, callback: ErrorCallback): void;
+    public connectReverse(
+        reverseConnect: ClientReverseConnect,
+        expectation: ReverseConnectExpectation,
+        callback: ErrorCallback
+    ): void;
     public connectReverse(...args: unknown[]): Promise<void> | void {
         const reverseConnect = args[0] as ClientReverseConnect;
         const callback = args[args.length - 1] as ErrorCallback;
@@ -1068,7 +1163,8 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
 
         this.initializeCM()
             .then(() => {
-                debugLog("ClientBaseImpl#connectReverse ", placeholderEndpointUrl, this.clientName);
+                // c8 ignore next
+                doDebug && debugLog("ClientBaseImpl#connectReverse ", placeholderEndpointUrl, this.clientName);
                 if (this._internalState === "disconnecting" || this._internalState === "disconnected") {
                     return this._handleDisconnectionWhileConnecting(new Error("premature disconnection 1"), callback);
                 }
@@ -1092,7 +1188,8 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
         this._clockAdjuster = this._clockAdjuster || new ClockAdjustment();
         OPCUAClientBase.registry.register(this);
 
-        debugLog("__connectStep2 ", this._internalState);
+        // c8 ignore next
+        doDebug && debugLog("__connectStep2 ", this._internalState);
 
         this._internal_create_secure_channel(this.connectionStrategy, (err: Error | null) => {
             if (!err) {
@@ -1103,19 +1200,22 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
                     this._clockAdjuster.dispose();
                     this._clockAdjuster = undefined;
                 }
-                debugLog(chalk.red("SecureChannel creation has failed with error :", err.message));
+                // c8 ignore next
+                doDebug && debugLog(chalk.red("SecureChannel creation has failed with error :", err.message));
                 if (err.message.match(/ECONNABORTED/)) {
-                    debugLog(chalk.yellow(`- The client cannot to :${endpointUrl}. Connection has been aborted.`));
+                    // c8 ignore next
+                    doDebug && debugLog(chalk.yellow(`- The client cannot to :${endpointUrl}. Connection has been aborted.`));
                     err = new Error("The connection has been aborted");
                     this._handleUnrecoverableConnectionFailure(err, callback);
                 } else if (err.message.match(/ECONNREF/)) {
-                    debugLog(chalk.yellow(`- The client cannot to :${endpointUrl}. Server is not reachable.`));
+                    // c8 ignore next
+                    doDebug && debugLog(chalk.yellow(`- The client cannot to :${endpointUrl}. Server is not reachable.`));
                     err = new Error(
                         `The connection cannot be established with server ${endpointUrl} .\n` +
-                        "Please check that the server is up and running or your network configuration.\n" +
-                        "Err = (" +
-                        err.message +
-                        ")"
+                            "Please check that the server is up and running or your network configuration.\n" +
+                            "Err = (" +
+                            err.message +
+                            ")"
                     );
                     this._handleUnrecoverableConnectionFailure(err, callback);
                 } else if (err.message.match(/disconnecting/)) {
@@ -1136,7 +1236,8 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
             callback(
                 new Error(
                     "performMessageTransaction: No SecureChannel , connection may have been canceled abruptly by server" +
-                    " while performing " + request.schema.name
+                        " while performing " +
+                        request.schema.name
                 )
             );
             return;
@@ -1150,9 +1251,9 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
             callback(
                 new Error(
                     "performMessageTransaction: Invalid client state = " +
-                    this._internalState +
-                    " while performing a transaction " +
-                    request.schema.name
+                        this._internalState +
+                        " while performing a transaction " +
+                        request.schema.name
                 )
             );
             return;
@@ -1351,7 +1452,8 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
             return callback(null);
         }
 
-        debugLog(chalk.bgWhite.green("_closeSession ") + this._secureChannel.channelId);
+        // c8 ignore next
+        doDebug && debugLog(chalk.bgWhite.green("_closeSession ") + this._secureChannel.channelId);
 
         const request = new CloseSessionRequest({
             deleteSubscriptions
@@ -1390,7 +1492,6 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
 
     public disconnect(): Promise<void>;
     public disconnect(callback: ErrorCallback): void;
-    // eslint-disable-next-line max-statements
     public disconnect(...args: unknown[]): undefined | Promise<void> {
         const callback = args[0] as ErrorCallback;
         assert(typeof callback === "function", "expecting a callback function here");
@@ -1421,16 +1522,20 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
             callback();
             return undefined;
         }
-        debugLog("disconnecting client! (will set reconnectionIsCanceled to true");
+        // c8 ignore next
+        doDebug && debugLog("disconnecting client! (will set reconnectionIsCanceled to true");
         this._reconnectionIsCanceled = true;
 
-        debugLog("ClientBaseImpl#disconnect", this.endpointUrl);
+        // c8 ignore next
+        doDebug && debugLog("ClientBaseImpl#disconnect", this.endpointUrl);
 
         if (this.isReconnecting && !this._reconnectionIsCanceled) {
-            debugLog("ClientBaseImpl#disconnect called while reconnection is in progress");
+            // c8 ignore next
+            doDebug && debugLog("ClientBaseImpl#disconnect called while reconnection is in progress");
             // let's abort the reconnection process
             this._cancel_reconnection((err?: Error) => {
-                debugLog("ClientBaseImpl#disconnect reconnection has been canceled", this.applicationName);
+                // c8 ignore next
+                doDebug && debugLog("ClientBaseImpl#disconnect reconnection has been canceled", this.applicationName);
                 assert(!err, " why would this fail ?");
                 // sessions cannot be cancelled properly and must be discarded.
                 this.disconnect(callback);
@@ -1439,7 +1544,8 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
         }
 
         if (this._sessions.length && !this.keepPendingSessionsOnDisconnect) {
-            debugLog("warning : disconnection : closing pending sessions");
+            // c8 ignore next
+            doDebug && debugLog("warning : disconnection : closing pending sessions");
             // disconnect has been called whereas living session exists
             // we need to close them first .... (unless keepPendingSessionsOnDisconnect)
             this._close_pending_sessions((/*err*/) => {
@@ -1448,13 +1554,15 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
             return undefined;
         }
 
-        debugLog("Disconnecting !");
+        // c8 ignore next
+        doDebug && debugLog("Disconnecting !");
         this._setInternalState("disconnecting");
         if (this.clientCertificateManager) {
             const tmp = this.clientCertificateManager;
             // (this as any).clientCertificateManager = null;
             tmp.dispose().catch((err: Error) => {
-                debugLog("Error disposing clientCertificateManager", err.message);
+                // c8 ignore next
+                doDebug && debugLog("Error disposing clientCertificateManager", err.message);
             });
         }
 
@@ -1477,7 +1585,8 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
         if (this._secureChannel) {
             let tmpChannel: ClientSecureChannelLayer | null = this._secureChannel;
             this._secureChannel = null;
-            debugLog("Closing channel");
+            // c8 ignore next
+            doDebug && debugLog("Closing channel");
             tmpChannel.close(() => {
                 this._secureChannel = tmpChannel;
                 tmpChannel = null;
@@ -1549,7 +1658,8 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
 
     private fetchServerCertificate(endpointUrl: string, callback: (err: Error | null, adjustedEndpointUrl?: string) => void): void {
         const discoveryUrl = this.discoveryUrl.length > 0 ? this.discoveryUrl : endpointUrl;
-        debugLog("OPCUAClientImpl : getting serverCertificate");
+        // c8 ignore next
+        doDebug && debugLog("OPCUAClientImpl : getting serverCertificate");
         // we have not been given the serverCertificate but this certificate
         // is required as the connection is to be secured.
         //
@@ -1602,9 +1712,9 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
                 // no matching end point can be found ...
                 const err1 = new Error(
                     "cannot find endpoint for securityMode=" +
-                    MessageSecurityMode[this.securityMode] +
-                    " policy = " +
-                    this.securityPolicy
+                        MessageSecurityMode[this.securityMode] +
+                        " policy = " +
+                        this.securityPolicy
                 );
                 callback(err1);
                 return;
@@ -1620,7 +1730,10 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
                 .catch((err1: Error) => {
                     warningLog("[NODE-OPCUA-W25] client's server certificate verification has failed ", err1.message);
                     if ("rootDir" in this.clientCertificateManager) {
-                        warningLog("                 clientCertificateManager.rootDir = ", (this.clientCertificateManager as unknown as { rootDir: string }).rootDir);
+                        warningLog(
+                            "                 clientCertificateManager.rootDir = ",
+                            (this.clientCertificateManager as unknown as { rootDir: string }).rootDir
+                        );
                     }
 
                     const chain = split_der(endpoint.serverCertificate);
@@ -1637,8 +1750,12 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
                             const isCA = tbs.extensions?.basicConstraints?.cA === true;
                             const isSelfSigned = JSON.stringify(tbs.subject) === JSON.stringify(tbs.issuer);
                             const certType = isCA
-                                ? (isSelfSigned ? "Root CA" : "Intermediate CA")
-                                : (isSelfSigned ? "Application (self-signed)" : "Application (CA-signed)");
+                                ? isSelfSigned
+                                    ? "Root CA"
+                                    : "Intermediate CA"
+                                : isSelfSigned
+                                  ? "Application (self-signed)"
+                                  : "Application (CA-signed)";
                             const ski = tbs.extensions?.subjectKeyIdentifier ?? "-";
                             const aki = tbs.extensions?.authorityKeyIdentifier?.keyIdentifier ?? "-";
                             const notBefore = tbs.validity.notBefore.toISOString();
@@ -1650,13 +1767,15 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
                             warningLog(`                   AKI:        ${aki}`);
                             warningLog(`                   validity:   ${notBefore} → ${notAfter}`);
                         } catch {
-                            warningLog(`                 [${i + 1}/${chain.length}] thumbprint: ${thumbprint} (details unavailable)`);
+                            warningLog(
+                                `                 [${i + 1}/${chain.length}] thumbprint: ${thumbprint} (details unavailable)`
+                            );
                         }
                     }
                     if (chain.length > 1) {
                         warningLog(
                             "                 verify also that the issuer certificate is trusted and the issuer's certificate is present in the issuer.cert folder\n" +
-                            "                 of the client certificate manager located in ",
+                                "                 of the client certificate manager located in ",
                             "rootDir" in this.clientCertificateManager
                                 ? (this.clientCertificateManager as unknown as { rootDir: string }).rootDir
                                 : "<in-memory>"
@@ -1718,7 +1837,8 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
                         resolved = true;
                         if (err) {
                             const msg = session.authenticationToken ? session.authenticationToken.toString() : "";
-                            debugLog(` failing to close session ${msg}`);
+                            // c8 ignore next
+                            doDebug && debugLog(` failing to close session ${msg}`);
                         }
                         resolve();
                     });
@@ -1730,11 +1850,13 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
             .then(() => {
                 // c8 ignore next
                 if (this._sessions.length > 0) {
-                    debugLog(
-                        this._sessions
-                            .map((s: ClientSessionImpl) => (s.authenticationToken ? s.authenticationToken.toString() : ""))
-                            .join(" ")
-                    );
+                    // c8 ignore next
+                    doDebug &&
+                        debugLog(
+                            this._sessions
+                                .map((s: ClientSessionImpl) => (s.authenticationToken ? s.authenticationToken.toString() : ""))
+                                .join(" ")
+                        );
                 }
                 assert(this._sessions.length === 0, " failed to disconnect exiting sessions ");
                 callback();
@@ -1783,13 +1905,15 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
 
         secureChannel.on("lifetime_75", (token: ChannelSecurityToken) => {
             // secureChannel requests a new token
-            debugLog(
-                "SecureChannel Security Token ",
-                token.tokenId,
-                "live time was =",
-                token.revisedLifetime,
-                " is about to expired , it's time to request a new token"
-            );
+            // c8 ignore next
+            doDebug &&
+                debugLog(
+                    "SecureChannel Security Token ",
+                    token.tokenId,
+                    "live time was =",
+                    token.revisedLifetime,
+                    " is about to expired , it's time to request a new token"
+                );
             // forward message to upper level
             this.emit("lifetime_75", token);
         });
@@ -1803,7 +1927,8 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
             if (err) {
                 this._setInternalState("panic");
             }
-            debugLog(chalk.yellow.bold(" ClientBaseImpl emitting close"), err?.message);
+            // c8 ignore next
+            doDebug && debugLog(chalk.yellow.bold(" ClientBaseImpl emitting close"), err?.message);
             this._destroy_secure_channel();
             if (!err || !this.reconnectOnFailure) {
                 if (err) {
@@ -1820,7 +1945,8 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
                     this._internalState !== "reconnecting" &&
                     this._internalState !== "reconnecting_newchannel_connected"
                 ) {
-                    debugLog(" ClientBaseImpl emitting connection_lost");
+                    // c8 ignore next
+                    doDebug && debugLog(" ClientBaseImpl emitting connection_lost");
                     this._setInternalState("reconnecting");
                     /**
                      * @event connection_lost
@@ -1871,7 +1997,8 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
     private __innerRepairConnection() {
         if (this.isUnusable()) return;
 
-        debugLog("Entering _repairConnection ", this._internalState);
+        // c8 ignore next
+        doDebug && debugLog("Entering _repairConnection ", this._internalState);
         if (this.#insideRepairConnection) {
             errorLog(
                 "_repairConnection already in progress internal state = ",
@@ -1884,11 +2011,14 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
         }
         this.emit("repairConnectionStarted");
         this.#insideRepairConnection = true;
-        debugLog("recreating new secure channel ", this._internalState);
+        // c8 ignore next
+        doDebug && debugLog("recreating new secure channel ", this._internalState);
         this._recreate_secure_channel((err1?: Error) => {
-            debugLog("secureChannel#on(close) => _recreate_secure_channel returns ", err1 ? err1.message : "OK");
+            // c8 ignore next
+            doDebug && debugLog("secureChannel#on(close) => _recreate_secure_channel returns ", err1 ? err1.message : "OK");
             if (err1) {
-                debugLog("_recreate_secure_channel has failed: err = ", err1.message);
+                // c8 ignore next
+                doDebug && debugLog("_recreate_secure_channel has failed: err = ", err1.message);
                 this.emit("close", err1);
                 this.#insideRepairConnection = false;
                 if (this.#shouldRepairAgain) {
@@ -1908,8 +2038,11 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
                             debugLog("err= ", err2.message);
                         }
                         // we still need to retry connecting here !!!
-                        debugLog("Disconnected following reconnection failure", err2.message);
-                        debugLog(`I will retry OPCUA client reconnection in ${OPCUAClientBase.retryDelay / 1000} seconds`);
+                        // c8 ignore next
+                        if (doDebug) {
+                            debugLog("Disconnected following reconnection failure", err2.message);
+                            debugLog(`I will retry OPCUA client reconnection in ${OPCUAClientBase.retryDelay / 1000} seconds`);
+                        }
                         this.#insideRepairConnection = false;
                         this.#shouldRepairAgain = false;
 
@@ -1964,7 +2097,6 @@ export class ClientBaseImpl<Events extends OPCUAClientBaseEvents = OPCUAClientBa
     }
 }
 
-// tslint:disable-next-line: max-classes-per-file
 class TmpClient extends ClientBaseImpl {
     constructor(options: OPCUAClientBaseOptions) {
         options.clientName = `${options.clientName || ""}_TmpClient`;
@@ -1974,7 +2106,8 @@ class TmpClient extends ClientBaseImpl {
     async connect(endpoint: string): Promise<void>;
     connect(endpoint: string, callback: ErrorCallback): void;
     connect(endpoint: string, callback?: ErrorCallback): Promise<void> | void {
-        debugLog("connecting to TmpClient");
+        // c8 ignore next
+        doDebug && debugLog("connecting to TmpClient");
 
         // c8 ignore next
         if (this._internalState !== "disconnected") {
@@ -1985,7 +2118,7 @@ class TmpClient extends ClientBaseImpl {
         this._setInternalState("connecting");
         this._connectStep2(endpoint, (err?: Error) => {
             if (this.isUnusable()) {
-                this._handleUnrecoverableConnectionFailure(new Error("premature disconnection 4"), callback || (() => { }));
+                this._handleUnrecoverableConnectionFailure(new Error("premature disconnection 4"), callback || (() => {}));
                 return;
             }
             callback?.(err);
@@ -1993,8 +2126,6 @@ class TmpClient extends ClientBaseImpl {
     }
 }
 
-// tslint:disable:no-var-requires
-// tslint:disable:max-line-length
 import { withCallback } from "thenify-ex";
 
 ClientBaseImpl.prototype.connect = withCallback(ClientBaseImpl.prototype.connect);