node-opcua-client 2.177.0 → 2.179.0

package/dist/private/client_base_impl.js

@@ -7,7 +7,6 @@ exports.ClientBaseImpl = void 0;
 /**
  * @module node-opcua-client-private
  */
-// tslint:disable:no-unused-expression
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const global_mutex_1 = require("@ster5/global-mutex");
@@ -15,17 +14,18 @@ const chalk_1 = __importDefault(require("chalk"));
 const node_opcua_assert_1 = require("node-opcua-assert");
 const node_opcua_certificate_manager_1 = require("node-opcua-certificate-manager");
 const node_opcua_common_1 = require("node-opcua-common");
+const node_opcua_crypto_1 = require("node-opcua-crypto");
 const web_1 = require("node-opcua-crypto/web");
 const node_opcua_date_time_1 = require("node-opcua-date-time");
 const node_opcua_debug_1 = require("node-opcua-debug");
 const node_opcua_hostname_1 = require("node-opcua-hostname");
 const node_opcua_secure_channel_1 = require("node-opcua-secure-channel");
-const node_opcua_transport_1 = require("node-opcua-transport");
 const node_opcua_service_discovery_1 = require("node-opcua-service-discovery");
 const node_opcua_service_endpoints_1 = require("node-opcua-service-endpoints");
 const node_opcua_service_secure_channel_1 = require("node-opcua-service-secure-channel");
 const node_opcua_service_session_1 = require("node-opcua-service-session");
 const node_opcua_status_code_1 = require("node-opcua-status-code");
+const node_opcua_transport_1 = require("node-opcua-transport");
 const node_opcua_utils_1 = require("node-opcua-utils");
 const client_base_1 = require("../client_base");
 const verify_1 = require("../verify");
@@ -72,7 +72,14 @@ function __findEndpoint(endpointUrl, params, _callback) {
         //     maxRetry: 0 /* no- retry */,
         //     maxDelay: 2000
         // },
-        privateKeyFile: params.privateKeyFile
+        privateKeyFile: params.privateKeyFile,
+        // TmpClient.connect() (below) calls _connectStep2() directly and never
+        // runs initializeCM() — so it never resolves a passphrase-encrypted
+        // private key on its own. Hand it the master client's own provider
+        // (already resolved, if needed) instead of letting it build a fresh
+        // disk provider from certificateFile/privateKeyFile, which would
+        // re-read the file and fail synchronously on an encrypted key.
+        certificateKeyPairProvider: masterClient.getProvider()
     };
     const client = new TmpClient(options);
     masterClient._tmpClient = client;
@@ -175,15 +182,18 @@ async function _verify_serverCertificate(certificateManager, serverCertificate)
     }
 }
 const forceEndpointDiscoveryOnConnect = !!parseInt(process.env.NODEOPCUA_CLIENT_FORCE_ENDPOINT_DISCOVERY || "0", 10);
-debugLog("forceEndpointDiscoveryOnConnect = ", forceEndpointDiscoveryOnConnect);
+// c8 ignore next
+doDebug && debugLog("forceEndpointDiscoveryOnConnect = ", forceEndpointDiscoveryOnConnect);
 class ClockAdjustment {
     constructor() {
-        debugLog("installPeriodicClockAdjustment ", node_opcua_date_time_1.periodicClockAdjustment.timerInstallationCount);
+        // c8 ignore next
+        doDebug && debugLog("installPeriodicClockAdjustment ", node_opcua_date_time_1.periodicClockAdjustment.timerInstallationCount);
         (0, node_opcua_date_time_1.installPeriodicClockAdjustment)();
     }
     dispose() {
         (0, node_opcua_date_time_1.uninstallPeriodicClockAdjustment)();
-        debugLog("uninstallPeriodicClockAdjustment ", node_opcua_date_time_1.periodicClockAdjustment.timerInstallationCount);
+        // c8 ignore next
+        doDebug && debugLog("uninstallPeriodicClockAdjustment ", node_opcua_date_time_1.periodicClockAdjustment.timerInstallationCount);
     }
 }
 /*
@@ -209,7 +219,6 @@ let g_ClientCounter = 0;
 /**
  * @internal
  */
-// tslint:disable-next-line: max-classes-per-file
 class ClientBaseImpl extends node_opcua_common_1.OPCUASecureObject {
     /**
      * total number of requests that been canceled due to timeout
@@ -294,6 +303,8 @@ class ClientBaseImpl extends node_opcua_common_1.OPCUASecureObject {
     /** the current reverse-connect waiter registration, cancelled on disconnect to avoid a leaked waiter */
     _reverseConnectRegistration;
     clientCertificateManager;
+    /** true when the caller supplied a certificateKeyPairProvider — the private-key resolution escape hatch. */
+    #hasUserProvidedProvider = false;
     isUnusable() {
         return (this._internalState === "disconnected" ||
             this._internalState === "disconnecting" ||
@@ -322,6 +333,7 @@ class ClientBaseImpl extends node_opcua_common_1.OPCUASecureObject {
     }
     constructor(options) {
         options = options || {};
+        const hasUserProvidedProvider = !!options.certificateKeyPairProvider;
         if (options.certificateKeyPairProvider) {
             // In-memory path — use a lightweight in-memory store
             // when no cert manager was explicitly provided.
@@ -337,10 +349,10 @@ class ClientBaseImpl extends node_opcua_common_1.OPCUASecureObject {
             }
             const cm = options.clientCertificateManager;
             options.privateKeyFile = options.privateKeyFile || cm.privateKey;
-            options.certificateFile =
-                options.certificateFile || node_path_1.default.join(cm.rootDir, "own/certs/client_certificate.pem");
+            options.certificateFile = options.certificateFile || node_path_1.default.join(cm.rootDir, "own/certs/client_certificate.pem");
             super(options);
         }
+        this.#hasUserProvidedProvider = hasUserProvidedProvider;
         this._setInternalState("uninitialized");
         this._instanceNumber = g_ClientCounter++;
         this.applicationName = options.applicationName || "NodeOPCUA-Client";
@@ -348,6 +360,9 @@ class ClientBaseImpl extends node_opcua_common_1.OPCUASecureObject {
         (0, node_opcua_assert_1.assert)(!this.applicationName.match(/urn:/), "applicationName should not be a URI");
         // we need to delay _applicationUri initialization
         this._applicationUri = options.applicationUri || this._getBuiltApplicationUri();
+        if (!options.clientCertificateManager) {
+            throw new Error("internal error: clientCertificateManager should have been set above");
+        }
         this.clientCertificateManager = options.clientCertificateManager;
         this.clientCertificateManager.referenceCounter++;
         this._secureChannel = null;
@@ -391,11 +406,14 @@ class ClientBaseImpl extends node_opcua_common_1.OPCUASecureObject {
         if (!this.isReconnecting) {
             warningLog("internal error: _cancel_reconnection should only be used when reconnecting is in progress");
         }
-        debugLog("canceling reconnection : ", this.clientName);
+        // c8 ignore next
+        doDebug && debugLog("canceling reconnection : ", this.clientName);
         this._reconnectionIsCanceled = true;
         // c8 ignore next
         if (!this._secureChannel) {
-            debugLog("_cancel_reconnection:  Nothing to do for !", this.clientName, " because secure channel doesn't exist");
+            // c8 ignore next
+            doDebug &&
+                debugLog("_cancel_reconnection:  Nothing to do for !", this.clientName, " because secure channel doesn't exist");
             return callback(); // nothing to do
         }
         this._secureChannel.abortConnection(( /*err?: Error*/) => {
@@ -404,9 +422,11 @@ class ClientBaseImpl extends node_opcua_common_1.OPCUASecureObject {
         });
     }
     _recreate_secure_channel(callback) {
-        debugLog("_recreate_secure_channel... while internalState is", this._internalState);
+        // c8 ignore next
+        doDebug && debugLog("_recreate_secure_channel... while internalState is", this._internalState);
         if (!this.knowsServerEndpoint) {
-            debugLog("Cannot reconnect , server endpoint is unknown");
+            // c8 ignore next
+            doDebug && debugLog("Cannot reconnect , server endpoint is unknown");
             callback(new Error("Cannot reconnect, server endpoint is unknown - this.knowsServerEndpoint = false"));
             return;
         }
@@ -428,7 +448,8 @@ class ClientBaseImpl extends node_opcua_common_1.OPCUASecureObject {
             return callback(new Error(`Reconnection has been canceled - ${this.clientName}`));
         };
         const _failAndRetry = (err, message, callback) => {
-            debugLog("failAndRetry; ", message);
+            // c8 ignore next
+            doDebug && debugLog("failAndRetry; ", message);
             if (this._reconnectionIsCanceled) {
                 return _when_reconnectionIsCanceled(callback);
             }
@@ -443,12 +464,14 @@ class ClientBaseImpl extends node_opcua_common_1.OPCUASecureObject {
             this.emit("after_reconnection", null); // send after callback
             (0, node_opcua_assert_1.assert)(this._secureChannel, "expecting a secureChannel here ");
             // a new channel has be created and a new connection is established
-            debugLog(chalk_1.default.bgWhite.red("ClientBaseImpl:  RECONNECTED                !!!"));
+            // c8 ignore next
+            doDebug && debugLog(chalk_1.default.bgWhite.red("ClientBaseImpl:  RECONNECTED                !!!"));
             this._setInternalState("reconnecting_newchannel_connected");
             return callback();
         };
         const _attempt_to_recreate_secure_channel = (callback) => {
-            debugLog("attempt to recreate a new secure channel");
+            // c8 ignore next
+            doDebug && debugLog("attempt to recreate a new secure channel");
             if (this._reconnectionIsCanceled) {
                 return _when_reconnectionIsCanceled(callback);
             }
@@ -524,7 +547,9 @@ class ClientBaseImpl extends node_opcua_common_1.OPCUASecureObject {
     _internal_create_secure_channel(connectionStrategy, callback) {
         (0, node_opcua_assert_1.assert)(this._secureChannel === null);
         (0, node_opcua_assert_1.assert)(typeof this.endpointUrl === "string");
-        debugLog("_internal_create_secure_channel creating new ClientSecureChannelLayer _internalState =", this._internalState, this.clientName);
+        // c8 ignore next
+        doDebug &&
+            debugLog("_internal_create_secure_channel creating new ClientSecureChannelLayer _internalState =", this._internalState, this.clientName);
         const secureChannel = new node_opcua_secure_channel_1.ClientSecureChannelLayer({
             connectionStrategy,
             defaultSecureTokenLifetime: this.defaultSecureTokenLifetime,
@@ -549,11 +574,14 @@ class ClientBaseImpl extends node_opcua_common_1.OPCUASecureObject {
         this.emit("secure_channel_created", secureChannel);
         const step2_openSecureChannel = () => {
             return new Promise((resolve, reject) => {
-                debugLog("_internal_create_secure_channel before secureChannel.create");
+                // c8 ignore next
+                doDebug && debugLog("_internal_create_secure_channel before secureChannel.create");
                 secureChannel.create(this.endpointUrl, (err) => {
-                    debugLog("_internal_create_secure_channel after secureChannel.create");
+                    // c8 ignore next
+                    doDebug && debugLog("_internal_create_secure_channel after secureChannel.create");
                     if (!this._secureChannel) {
-                        debugLog("_secureChannel has been closed during the transaction !");
+                        // c8 ignore next
+                        doDebug && debugLog("_secureChannel has been closed during the transaction !");
                         return reject(new Error("Secure Channel Closed"));
                     }
                     if (err) {
@@ -571,7 +599,8 @@ class ClientBaseImpl extends node_opcua_common_1.OPCUASecureObject {
                     this._setInternalState("connecting");
                     this.getEndpoints((err /*, endpoints?: EndpointDescription[]*/) => {
                         if (!this._secureChannel) {
-                            debugLog("_secureChannel has been closed during the transaction ! (while getEndpoints)");
+                            // c8 ignore next
+                            doDebug && debugLog("_secureChannel has been closed during the transaction ! (while getEndpoints)");
                             return reject(new Error("Secure Channel Closed"));
                         }
                         if (err) {
@@ -642,13 +671,22 @@ class ClientBaseImpl extends node_opcua_common_1.OPCUASecureObject {
                 }
                 warningLog("Creating default certificate ... please wait");
                 await ClientBaseImpl.createCertificate(this.clientCertificateManager, this.certificateFile, this.applicationName, this._getBuiltApplicationUri());
-                debugLog("privateKey      = ", this.privateKeyFile);
+                // c8 ignore next
+                doDebug && debugLog("privateKey      = ", this.privateKeyFile);
                 if ("privateKey" in this.clientCertificateManager) {
-                    debugLog("                = ", this.clientCertificateManager.privateKey);
+                    // c8 ignore next
+                    doDebug &&
+                        debugLog("                = ", this.clientCertificateManager.privateKey);
                 }
-                debugLog("certificateFile = ", this.certificateFile);
+                // c8 ignore next
+                doDebug && debugLog("certificateFile = ", this.certificateFile);
                 const _certificate = this.getCertificate();
-                const _privateKey = this.getPrivateKey();
+                // Note: do NOT eagerly call this.getPrivateKey() here. A freshly
+                // generated key may already be passphrase-encrypted on disk (when
+                // clientCertificateManager is configured with privateKeyPassphrase),
+                // and the disk provider's getPrivateKey() is synchronous — it cannot
+                // decrypt. initializeCM() resolves the private key asynchronously
+                // (once) right after this method returns.
             });
         }
         this._inCreateDefaultCertificate = false;
@@ -668,17 +706,41 @@ class ClientBaseImpl extends node_opcua_common_1.OPCUASecureObject {
                 "                 Please create a new OPCUAClient instance if you want to reconnect");
             return;
         }
-        await this.clientCertificateManager.initialize();
-        if (this.certificateFile === "<in-memory>" || this.certificateFile === "<unknown>") {
-            // In-memory provider — cert already available, skip disk operations
+        // The pki-level initialize() itself already decrypts (or re-encrypts)
+        // the on-disk key when clientCertificateManager is configured with a
+        // privateKeyPassphrase, and fails closed with
+        // PrivateKeyPassphraseRequiredError on a mismatch — so this whole
+        // sequence, not just the resolve step below, needs the friendlier
+        // error message.
+        try {
+            await this.clientCertificateManager.initialize();
+            if (this.certificateFile === "<in-memory>" || this.certificateFile === "<unknown>") {
+                // In-memory provider — cert already available, skip disk operations
+            }
+            else {
+                // Disk path — create default cert if missing
+                await this.createDefaultCertificate();
+                // c8 ignore next
+                if (!node_fs_1.default.existsSync(this.privateKeyFile)) {
+                    throw new Error(` cannot locate private key file ${this.privateKeyFile}`);
+                }
+                // Resolve the (possibly passphrase-encrypted) private key once,
+                // asynchronously, and install it as this client's provider — so
+                // that every later, synchronous getPrivateKey() call (secure
+                // channel layer, ...) succeeds without touching disk again.
+                // No-ops when the caller supplied its own
+                // certificateKeyPairProvider, or when clientCertificateManager
+                // doesn't expose an async getPrivateKey() (e.g. a bare
+                // ICertificateStore).
+                await (0, node_opcua_common_1.resolvePrivateKeyProviderIfNeeded)(this, this.clientCertificateManager, this.#hasUserProvidedProvider);
+            }
         }
-        else {
-            // Disk path — create default cert if missing
-            await this.createDefaultCertificate();
-            // c8 ignore next
-            if (!node_fs_1.default.existsSync(this.privateKeyFile)) {
-                throw new Error(` cannot locate private key file ${this.privateKeyFile}`);
+        catch (err) {
+            if (err instanceof node_opcua_crypto_1.PrivateKeyPassphraseRequiredError) {
+                throw new Error(`[NODE-OPCUA-E31] private key ${this.privateKeyFile} is encrypted; ` +
+                    "set privateKeyPassphrase on the OPCUACertificateManager passed as clientCertificateManager");
             }
+            throw err;
         }
         if (this.isUnusable())
             return;
@@ -690,7 +752,8 @@ class ClientBaseImpl extends node_opcua_common_1.OPCUASecureObject {
     }
     _internalState = "uninitialized";
     _handleUnrecoverableConnectionFailure(err, callback) {
-        debugLog(err.message);
+        // c8 ignore next
+        doDebug && debugLog(err.message);
         // Terminal connect failure: make sure the client is removed from the leak registry. A
         // synchronous throw out of _connectStep2 (e.g. an invalid SecureChannel config) lands here
         // WITHOUT the error-branch unregister ever running, which would otherwise leak the client.
@@ -701,7 +764,8 @@ class ClientBaseImpl extends node_opcua_common_1.OPCUASecureObject {
         callback(err);
     }
     _handleDisconnectionWhileConnecting(err, callback) {
-        debugLog(err.message);
+        // c8 ignore next
+        doDebug && debugLog(err.message);
         // see _handleUnrecoverableConnectionFailure: idempotent unregister guards against a leaked
         // client when a connect attempt fails before the error-branch unregister runs.
         client_base_1.OPCUAClientBase.registry.unregister(this);
@@ -710,7 +774,8 @@ class ClientBaseImpl extends node_opcua_common_1.OPCUASecureObject {
         callback(err);
     }
     _handleSuccessfulConnection(callback) {
-        debugLog(" Connected successfully  to ", this.endpointUrl);
+        // c8 ignore next
+        doDebug && debugLog(" Connected successfully  to ", this.endpointUrl);
         this.emit("connected");
         this._setInternalState("connected");
         callback();
@@ -738,13 +803,15 @@ class ClientBaseImpl extends node_opcua_common_1.OPCUASecureObject {
         this._setInternalState("connecting");
         this.initializeCM()
             .then(() => {
-            debugLog("ClientBaseImpl#connect ", endpointUrl, this.clientName);
+            // c8 ignore next
+            doDebug && debugLog("ClientBaseImpl#connect ", endpointUrl, this.clientName);
             if (this._internalState === "disconnecting" || this._internalState === "disconnected") {
                 return this._handleDisconnectionWhileConnecting(new Error("premature disconnection 1"), callback);
             }
             if (!this.serverCertificate &&
                 (forceEndpointDiscoveryOnConnect || this.securityMode !== node_opcua_service_secure_channel_1.MessageSecurityMode.None)) {
-                debugLog("Fetching certificates from endpoints");
+                // c8 ignore next
+                doDebug && debugLog("Fetching certificates from endpoints");
                 this.fetchServerCertificate(endpointUrl, (err, adjustedEndpointUrl) => {
                     if (err) {
                         return this._handleUnrecoverableConnectionFailure(err, callback);
@@ -753,11 +820,14 @@ class ClientBaseImpl extends node_opcua_common_1.OPCUASecureObject {
                         return this._handleDisconnectionWhileConnecting(new Error("premature disconnection 2"), callback);
                     }
                     if (forceEndpointDiscoveryOnConnect) {
-                        debugLog("connecting with adjusted endpoint : ", adjustedEndpointUrl, "  was =", endpointUrl);
+                        // c8 ignore next
+                        doDebug &&
+                            debugLog("connecting with adjusted endpoint : ", adjustedEndpointUrl, "  was =", endpointUrl);
                         this._connectStep2(adjustedEndpointUrl || "", callback);
                     }
                     else {
-                        debugLog("connecting with endpoint : ", endpointUrl);
+                        // c8 ignore next
+                        doDebug && debugLog("connecting with endpoint : ", endpointUrl);
                         this._connectStep2(endpointUrl, callback);
                     }
                 });
@@ -827,7 +897,8 @@ class ClientBaseImpl extends node_opcua_common_1.OPCUASecureObject {
         this._setInternalState("connecting");
         this.initializeCM()
             .then(() => {
-            debugLog("ClientBaseImpl#connectReverse ", placeholderEndpointUrl, this.clientName);
+            // c8 ignore next
+            doDebug && debugLog("ClientBaseImpl#connectReverse ", placeholderEndpointUrl, this.clientName);
             if (this._internalState === "disconnecting" || this._internalState === "disconnected") {
                 return this._handleDisconnectionWhileConnecting(new Error("premature disconnection 1"), callback);
             }
@@ -848,7 +919,8 @@ class ClientBaseImpl extends node_opcua_common_1.OPCUASecureObject {
         this.endpointUrl = endpointUrl;
         this._clockAdjuster = this._clockAdjuster || new ClockAdjustment();
         client_base_1.OPCUAClientBase.registry.register(this);
-        debugLog("__connectStep2 ", this._internalState);
+        // c8 ignore next
+        doDebug && debugLog("__connectStep2 ", this._internalState);
         this._internal_create_secure_channel(this.connectionStrategy, (err) => {
             if (!err) {
                 this._handleSuccessfulConnection(callback);
@@ -859,14 +931,17 @@ class ClientBaseImpl extends node_opcua_common_1.OPCUASecureObject {
                     this._clockAdjuster.dispose();
                     this._clockAdjuster = undefined;
                 }
-                debugLog(chalk_1.default.red("SecureChannel creation has failed with error :", err.message));
+                // c8 ignore next
+                doDebug && debugLog(chalk_1.default.red("SecureChannel creation has failed with error :", err.message));
                 if (err.message.match(/ECONNABORTED/)) {
-                    debugLog(chalk_1.default.yellow(`- The client cannot to :${endpointUrl}. Connection has been aborted.`));
+                    // c8 ignore next
+                    doDebug && debugLog(chalk_1.default.yellow(`- The client cannot to :${endpointUrl}. Connection has been aborted.`));
                     err = new Error("The connection has been aborted");
                     this._handleUnrecoverableConnectionFailure(err, callback);
                 }
                 else if (err.message.match(/ECONNREF/)) {
-                    debugLog(chalk_1.default.yellow(`- The client cannot to :${endpointUrl}. Server is not reachable.`));
+                    // c8 ignore next
+                    doDebug && debugLog(chalk_1.default.yellow(`- The client cannot to :${endpointUrl}. Server is not reachable.`));
                     err = new Error(`The connection cannot be established with server ${endpointUrl} .\n` +
                         "Please check that the server is up and running or your network configuration.\n" +
                         "Err = (" +
@@ -890,7 +965,8 @@ class ClientBaseImpl extends node_opcua_common_1.OPCUASecureObject {
             // this may happen if the Server has closed the connection abruptly for some unknown reason
             // or if the tcp connection has been broken.
             callback(new Error("performMessageTransaction: No SecureChannel , connection may have been canceled abruptly by server" +
-                " while performing " + request.schema.name));
+                " while performing " +
+                request.schema.name));
             return;
         }
         if (this._internalState !== "connected" &&
@@ -1055,7 +1131,8 @@ class ClientBaseImpl extends node_opcua_common_1.OPCUASecureObject {
         if (!this._secureChannel.isValid()) {
             return callback(null);
         }
-        debugLog(chalk_1.default.bgWhite.green("_closeSession ") + this._secureChannel.channelId);
+        // c8 ignore next
+        doDebug && debugLog(chalk_1.default.bgWhite.green("_closeSession ") + this._secureChannel.channelId);
         const request = new node_opcua_service_session_1.CloseSessionRequest({
             deleteSubscriptions
         });
@@ -1083,7 +1160,6 @@ class ClientBaseImpl extends node_opcua_common_1.OPCUASecureObject {
             callback?.(err ? err : undefined);
         });
     }
-    // eslint-disable-next-line max-statements
     disconnect(...args) {
         const callback = args[0];
         (0, node_opcua_assert_1.assert)(typeof callback === "function", "expecting a callback function here");
@@ -1111,14 +1187,18 @@ class ClientBaseImpl extends node_opcua_common_1.OPCUASecureObject {
             callback();
             return undefined;
         }
-        debugLog("disconnecting client! (will set reconnectionIsCanceled to true");
+        // c8 ignore next
+        doDebug && debugLog("disconnecting client! (will set reconnectionIsCanceled to true");
         this._reconnectionIsCanceled = true;
-        debugLog("ClientBaseImpl#disconnect", this.endpointUrl);
+        // c8 ignore next
+        doDebug && debugLog("ClientBaseImpl#disconnect", this.endpointUrl);
         if (this.isReconnecting && !this._reconnectionIsCanceled) {
-            debugLog("ClientBaseImpl#disconnect called while reconnection is in progress");
+            // c8 ignore next
+            doDebug && debugLog("ClientBaseImpl#disconnect called while reconnection is in progress");
             // let's abort the reconnection process
             this._cancel_reconnection((err) => {
-                debugLog("ClientBaseImpl#disconnect reconnection has been canceled", this.applicationName);
+                // c8 ignore next
+                doDebug && debugLog("ClientBaseImpl#disconnect reconnection has been canceled", this.applicationName);
                 (0, node_opcua_assert_1.assert)(!err, " why would this fail ?");
                 // sessions cannot be cancelled properly and must be discarded.
                 this.disconnect(callback);
@@ -1126,7 +1206,8 @@ class ClientBaseImpl extends node_opcua_common_1.OPCUASecureObject {
             return undefined;
         }
         if (this._sessions.length && !this.keepPendingSessionsOnDisconnect) {
-            debugLog("warning : disconnection : closing pending sessions");
+            // c8 ignore next
+            doDebug && debugLog("warning : disconnection : closing pending sessions");
             // disconnect has been called whereas living session exists
             // we need to close them first .... (unless keepPendingSessionsOnDisconnect)
             this._close_pending_sessions(( /*err*/) => {
@@ -1134,13 +1215,15 @@ class ClientBaseImpl extends node_opcua_common_1.OPCUASecureObject {
             });
             return undefined;
         }
-        debugLog("Disconnecting !");
+        // c8 ignore next
+        doDebug && debugLog("Disconnecting !");
         this._setInternalState("disconnecting");
         if (this.clientCertificateManager) {
             const tmp = this.clientCertificateManager;
             // (this as any).clientCertificateManager = null;
             tmp.dispose().catch((err) => {
-                debugLog("Error disposing clientCertificateManager", err.message);
+                // c8 ignore next
+                doDebug && debugLog("Error disposing clientCertificateManager", err.message);
             });
         }
         if (this._sessions.length) {
@@ -1160,7 +1243,8 @@ class ClientBaseImpl extends node_opcua_common_1.OPCUASecureObject {
         if (this._secureChannel) {
             let tmpChannel = this._secureChannel;
             this._secureChannel = null;
-            debugLog("Closing channel");
+            // c8 ignore next
+            doDebug && debugLog("Closing channel");
             tmpChannel.close(() => {
                 this._secureChannel = tmpChannel;
                 tmpChannel = null;
@@ -1225,7 +1309,8 @@ class ClientBaseImpl extends node_opcua_common_1.OPCUASecureObject {
     }
     fetchServerCertificate(endpointUrl, callback) {
         const discoveryUrl = this.discoveryUrl.length > 0 ? this.discoveryUrl : endpointUrl;
-        debugLog("OPCUAClientImpl : getting serverCertificate");
+        // c8 ignore next
+        doDebug && debugLog("OPCUAClientImpl : getting serverCertificate");
         // we have not been given the serverCertificate but this certificate
         // is required as the connection is to be secured.
         //
@@ -1302,8 +1387,12 @@ class ClientBaseImpl extends node_opcua_common_1.OPCUASecureObject {
                         const isCA = tbs.extensions?.basicConstraints?.cA === true;
                         const isSelfSigned = JSON.stringify(tbs.subject) === JSON.stringify(tbs.issuer);
                         const certType = isCA
-                            ? (isSelfSigned ? "Root CA" : "Intermediate CA")
-                            : (isSelfSigned ? "Application (self-signed)" : "Application (CA-signed)");
+                            ? isSelfSigned
+                                ? "Root CA"
+                                : "Intermediate CA"
+                            : isSelfSigned
+                                ? "Application (self-signed)"
+                                : "Application (CA-signed)";
                         const ski = tbs.extensions?.subjectKeyIdentifier ?? "-";
                         const aki = tbs.extensions?.authorityKeyIdentifier?.keyIdentifier ?? "-";
                         const notBefore = tbs.validity.notBefore.toISOString();
@@ -1375,7 +1464,8 @@ class ClientBaseImpl extends node_opcua_common_1.OPCUASecureObject {
                         resolved = true;
                         if (err) {
                             const msg = session.authenticationToken ? session.authenticationToken.toString() : "";
-                            debugLog(` failing to close session ${msg}`);
+                            // c8 ignore next
+                            doDebug && debugLog(` failing to close session ${msg}`);
                         }
                         resolve();
                     });
@@ -1386,9 +1476,11 @@ class ClientBaseImpl extends node_opcua_common_1.OPCUASecureObject {
             .then(() => {
             // c8 ignore next
             if (this._sessions.length > 0) {
-                debugLog(this._sessions
-                    .map((s) => (s.authenticationToken ? s.authenticationToken.toString() : ""))
-                    .join(" "));
+                // c8 ignore next
+                doDebug &&
+                    debugLog(this._sessions
+                        .map((s) => (s.authenticationToken ? s.authenticationToken.toString() : ""))
+                        .join(" "));
             }
             (0, node_opcua_assert_1.assert)(this._sessions.length === 0, " failed to disconnect exiting sessions ");
             callback();
@@ -1431,7 +1523,9 @@ class ClientBaseImpl extends node_opcua_common_1.OPCUASecureObject {
         });
         secureChannel.on("lifetime_75", (token) => {
             // secureChannel requests a new token
-            debugLog("SecureChannel Security Token ", token.tokenId, "live time was =", token.revisedLifetime, " is about to expired , it's time to request a new token");
+            // c8 ignore next
+            doDebug &&
+                debugLog("SecureChannel Security Token ", token.tokenId, "live time was =", token.revisedLifetime, " is about to expired , it's time to request a new token");
             // forward message to upper level
             this.emit("lifetime_75", token);
         });
@@ -1443,7 +1537,8 @@ class ClientBaseImpl extends node_opcua_common_1.OPCUASecureObject {
             if (err) {
                 this._setInternalState("panic");
             }
-            debugLog(chalk_1.default.yellow.bold(" ClientBaseImpl emitting close"), err?.message);
+            // c8 ignore next
+            doDebug && debugLog(chalk_1.default.yellow.bold(" ClientBaseImpl emitting close"), err?.message);
             this._destroy_secure_channel();
             if (!err || !this.reconnectOnFailure) {
                 if (err) {
@@ -1459,7 +1554,8 @@ class ClientBaseImpl extends node_opcua_common_1.OPCUASecureObject {
                 if (this.reconnectOnFailure &&
                     this._internalState !== "reconnecting" &&
                     this._internalState !== "reconnecting_newchannel_connected") {
-                    debugLog(" ClientBaseImpl emitting connection_lost");
+                    // c8 ignore next
+                    doDebug && debugLog(" ClientBaseImpl emitting connection_lost");
                     this._setInternalState("reconnecting");
                     /**
                      * @event connection_lost
@@ -1508,7 +1604,8 @@ class ClientBaseImpl extends node_opcua_common_1.OPCUASecureObject {
     __innerRepairConnection() {
         if (this.isUnusable())
             return;
-        debugLog("Entering _repairConnection ", this._internalState);
+        // c8 ignore next
+        doDebug && debugLog("Entering _repairConnection ", this._internalState);
         if (this.#insideRepairConnection) {
             errorLog("_repairConnection already in progress internal state = ", this._internalState, "clientName =", this.clientName);
             this.#shouldRepairAgain = true;
@@ -1516,11 +1613,14 @@ class ClientBaseImpl extends node_opcua_common_1.OPCUASecureObject {
         }
         this.emit("repairConnectionStarted");
         this.#insideRepairConnection = true;
-        debugLog("recreating new secure channel ", this._internalState);
+        // c8 ignore next
+        doDebug && debugLog("recreating new secure channel ", this._internalState);
         this._recreate_secure_channel((err1) => {
-            debugLog("secureChannel#on(close) => _recreate_secure_channel returns ", err1 ? err1.message : "OK");
+            // c8 ignore next
+            doDebug && debugLog("secureChannel#on(close) => _recreate_secure_channel returns ", err1 ? err1.message : "OK");
             if (err1) {
-                debugLog("_recreate_secure_channel has failed: err = ", err1.message);
+                // c8 ignore next
+                doDebug && debugLog("_recreate_secure_channel has failed: err = ", err1.message);
                 this.emit("close", err1);
                 this.#insideRepairConnection = false;
                 if (this.#shouldRepairAgain) {
@@ -1543,8 +1643,11 @@ class ClientBaseImpl extends node_opcua_common_1.OPCUASecureObject {
                             debugLog("err= ", err2.message);
                         }
                         // we still need to retry connecting here !!!
-                        debugLog("Disconnected following reconnection failure", err2.message);
-                        debugLog(`I will retry OPCUA client reconnection in ${client_base_1.OPCUAClientBase.retryDelay / 1000} seconds`);
+                        // c8 ignore next
+                        if (doDebug) {
+                            debugLog("Disconnected following reconnection failure", err2.message);
+                            debugLog(`I will retry OPCUA client reconnection in ${client_base_1.OPCUAClientBase.retryDelay / 1000} seconds`);
+                        }
                         this.#insideRepairConnection = false;
                         this.#shouldRepairAgain = false;
                         this._destroy_secure_channel();
@@ -1591,14 +1694,14 @@ class ClientBaseImpl extends node_opcua_common_1.OPCUASecureObject {
     }
 }
 exports.ClientBaseImpl = ClientBaseImpl;
-// tslint:disable-next-line: max-classes-per-file
 class TmpClient extends ClientBaseImpl {
     constructor(options) {
         options.clientName = `${options.clientName || ""}_TmpClient`;
         super(options);
     }
     connect(endpoint, callback) {
-        debugLog("connecting to TmpClient");
+        // c8 ignore next
+        doDebug && debugLog("connecting to TmpClient");
         // c8 ignore next
         if (this._internalState !== "disconnected") {
             callback?.(new Error(`TmpClient#connect: invalid internal state = ${this._internalState}`));
@@ -1614,8 +1717,6 @@ class TmpClient extends ClientBaseImpl {
         });
     }
 }
-// tslint:disable:no-var-requires
-// tslint:disable:max-line-length
 const thenify_ex_1 = require("thenify-ex");
 ClientBaseImpl.prototype.connect = (0, thenify_ex_1.withCallback)(ClientBaseImpl.prototype.connect);
 ClientBaseImpl.prototype.connectReverse = (0, thenify_ex_1.withCallback)(ClientBaseImpl.prototype.connectReverse);