node-opcua-client 2.73.1 → 2.76.0

package/dist/private/opcua_client_impl.js

@@ -1,982 +1,982 @@
-"use strict";
-/**
- * @module node-opcua-client-private
- */
-// tslint:disable:variable-name
-// tslint:disable:no-console
-// tslint:disable:no-empty
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.OPCUAClientImpl = void 0;
-const crypto = require("crypto");
-const util_1 = require("util");
-const async = require("async");
-const chalk = require("chalk");
-const node_opcua_assert_1 = require("node-opcua-assert");
-const node_opcua_buffer_utils_1 = require("node-opcua-buffer-utils");
-const node_opcua_crypto_1 = require("node-opcua-crypto");
-const node_opcua_data_model_1 = require("node-opcua-data-model");
-const node_opcua_debug_1 = require("node-opcua-debug");
-const node_opcua_hostname_1 = require("node-opcua-hostname");
-const node_opcua_secure_channel_1 = require("node-opcua-secure-channel");
-const node_opcua_service_endpoints_1 = require("node-opcua-service-endpoints");
-const node_opcua_service_secure_channel_1 = require("node-opcua-service-secure-channel");
-const node_opcua_service_session_1 = require("node-opcua-service-session");
-const node_opcua_status_code_1 = require("node-opcua-status-code");
-const node_opcua_utils_1 = require("node-opcua-utils");
-const opcua_client_1 = require("../opcua_client");
-const reconnection_1 = require("../reconnection");
-const client_base_impl_1 = require("./client_base_impl");
-const client_session_impl_1 = require("./client_session_impl");
-const client_subscription_impl_1 = require("./client_subscription_impl");
-const doDebug = (0, node_opcua_debug_1.checkDebugFlag)(__filename);
-const debugLog = (0, node_opcua_debug_1.make_debugLog)(__filename);
-const errorLog = (0, node_opcua_debug_1.make_errorLog)(__filename);
-const warningLog = (0, node_opcua_debug_1.make_warningLog)(__filename);
-function validateServerNonce(serverNonce) {
-    return !(serverNonce && serverNonce.length < 32) || (serverNonce && serverNonce.length === 0);
-}
-function verifyEndpointDescriptionMatches(client, responseServerEndpoints) {
-    // The Server returns its EndpointDescriptions in the response. Clients use this information to
-    // determine whether the list of EndpointDescriptions returned from the Discovery Endpoint matches
-    // the Endpoints that the Server has. If there is a difference then the Client shall close the
-    // Session and report an error.
-    // The Server returns all EndpointDescriptions for the serverUri
-    // specified by the Client in the request. The Client only verifies EndpointDescriptions with a
-    // transportProfileUri that matches the profileUri specified in the original GetEndpoints request.
-    // A Client may skip this check if the EndpointDescriptions were provided by a trusted source
-    // such as the Administrator.
-    // serverEndpoints:
-    // The Client shall verify this list with the list from a Discovery Endpoint if it used a Discovery Endpoint
-    // fetch to the EndpointDescriptions.
-    // ToDo
-    return true;
-}
-function findUserTokenPolicy(endpointDescription, userTokenType) {
-    endpointDescription.userIdentityTokens = endpointDescription.userIdentityTokens || [];
-    const r = endpointDescription.userIdentityTokens.filter((userIdentity) => userIdentity.tokenType === userTokenType);
-    return r.length === 0 ? null : r[0];
-}
-function createAnonymousIdentityToken(context) {
-    const endpoint = context.endpoint;
-    const userTokenPolicy = findUserTokenPolicy(endpoint, node_opcua_service_endpoints_1.UserTokenType.Anonymous);
-    if (!userTokenPolicy) {
-        throw new Error("Cannot find ANONYMOUS user token policy in end point description");
-    }
-    return new node_opcua_service_session_1.AnonymousIdentityToken({ policyId: userTokenPolicy.policyId });
-}
-/**
- *
- * @param context
- * @param certificate - the user certificate
- * @param privateKey  - the private key associated with the user certificate
- */
-function createX509IdentityToken(context, certificate, privateKey) {
-    const endpoint = context.endpoint;
-    (0, node_opcua_assert_1.assert)(endpoint instanceof node_opcua_service_endpoints_1.EndpointDescription);
-    const userTokenPolicy = findUserTokenPolicy(endpoint, node_opcua_service_endpoints_1.UserTokenType.Certificate);
-    // istanbul ignore next
-    if (!userTokenPolicy) {
-        throw new Error("Cannot find Certificate (X509) user token policy in end point description");
-    }
-    let securityPolicy = (0, node_opcua_secure_channel_1.fromURI)(userTokenPolicy.securityPolicyUri);
-    // if the security policy is not specified we use the session security policy
-    if (securityPolicy === node_opcua_secure_channel_1.SecurityPolicy.Invalid) {
-        securityPolicy = context.securityPolicy;
-    }
-    const userIdentityToken = new node_opcua_service_session_1.X509IdentityToken({
-        certificateData: certificate,
-        policyId: userTokenPolicy.policyId
-    });
-    const serverCertificate = context.serverCertificate;
-    (0, node_opcua_assert_1.assert)(serverCertificate instanceof Buffer);
-    const serverNonce = context.serverNonce || Buffer.alloc(0);
-    (0, node_opcua_assert_1.assert)(serverNonce instanceof Buffer);
-    // see Release 1.02 155 OPC Unified Architecture, Part 4
-    const cryptoFactory = (0, node_opcua_secure_channel_1.getCryptoFactory)(securityPolicy);
-    // istanbul ignore next
-    if (!cryptoFactory) {
-        throw new Error(" Unsupported security Policy");
-    }
-    /**
-     * OPCUA Spec 1.04 - part 4
-     * page 28:
-     * 5.6.3.1
-     * ...
-     * If the token is an X509IdentityToken then the proof is a signature generated with private key
-     * associated with the Certificate. The data to sign is created by appending the last serverNonce to
-     * the **serverCertificate** specified in the CreateSession response. If a token includes a secret then it
-     * should be encrypted using the public key from the serverCertificate.
-     *
-     * page 155:
-     * Token Encryption and Proof of Possession
-     * 7.36.2.1 Overview
-     * The Client shall always prove possession of a UserIdentityToken when it passes it to the Server.
-     * Some tokens include a secret such as a password which the Server will accept as proof. In order
-     * to protect these secrets the Token may be encrypted before it is passed to the Server. Other types
-     * of tokens allow the Client to create a signature with the secret associated with the Token. In these
-     * cases, the Client proves possession of a UserIdentityToken by creating a signature with the secret
-     * and passing it to the Server
-     *
-     * page 159:
-     * 7.36.5 X509IdentityTokens
-     * The X509IdentityToken is used to pass an X.509 v3 Certificate which is issued by the user.
-     * This token shall always be accompanied by a Signature in the userTokenSignature parameter of
-     * ActivateSession if required by the SecurityPolicy. The Server should specify a SecurityPolicy for
-     * the UserTokenPolicy if the SecureChannel has a SecurityPolicy of None.
-     */
-    // now create the proof of possession, by creating a signature
-    // The data to sign is created by appending the last serverNonce to the serverCertificate
-    // The signature generated with private key associated with the User Certificate
-    const userTokenSignature = (0, node_opcua_secure_channel_1.computeSignature)(serverCertificate, serverNonce, privateKey, securityPolicy);
-    return { userIdentityToken, userTokenSignature };
-}
-function createUserNameIdentityToken(session, userName, password) {
-    // assert(endpoint instanceof EndpointDescription);
-    (0, node_opcua_assert_1.assert)(userName === null || typeof userName === "string");
-    (0, node_opcua_assert_1.assert)(password === null || typeof password === "string");
-    const endpoint = session.endpoint;
-    (0, node_opcua_assert_1.assert)(endpoint instanceof node_opcua_service_endpoints_1.EndpointDescription);
-    /**
-     * OPC Unified Architecture 1.0.4:  Part 4 155
-     * Each UserIdentityToken allowed by an Endpoint shall have a UserTokenPolicy specified in the
-     * EndpointDescription. The UserTokenPolicy specifies what SecurityPolicy to use when encrypting
-     * or signing. If this SecurityPolicy is omitted then the Client uses the SecurityPolicy in the
-     * EndpointDescription. If the matching SecurityPolicy is set to None then no encryption or signature
-     * is required.
-     *
-     */
-    const userTokenPolicy = findUserTokenPolicy(endpoint, node_opcua_service_endpoints_1.UserTokenType.UserName);
-    // istanbul ignore next
-    if (!userTokenPolicy) {
-        throw new Error("Cannot find USERNAME user token policy in end point description");
-    }
-    let securityPolicy = (0, node_opcua_secure_channel_1.fromURI)(userTokenPolicy.securityPolicyUri);
-    // if the security policy is not specified we use the session security policy
-    if (securityPolicy === node_opcua_secure_channel_1.SecurityPolicy.Invalid) {
-        securityPolicy = session.securityPolicy;
-    }
-    let identityToken;
-    let serverCertificate = session.serverCertificate;
-    // if server does not provide certificate use unencrypted password
-    if (!serverCertificate) {
-        identityToken = new node_opcua_service_session_1.UserNameIdentityToken({
-            encryptionAlgorithm: null,
-            password: Buffer.from(password, "utf-8"),
-            policyId: userTokenPolicy ? userTokenPolicy.policyId : null,
-            userName
-        });
-        return identityToken;
-    }
-    (0, node_opcua_assert_1.assert)(serverCertificate instanceof Buffer);
-    serverCertificate = (0, node_opcua_crypto_1.toPem)(serverCertificate, "CERTIFICATE");
-    const publicKey = (0, node_opcua_crypto_1.extractPublicKeyFromCertificateSync)(serverCertificate);
-    const serverNonce = session.serverNonce || Buffer.alloc(0);
-    (0, node_opcua_assert_1.assert)(serverNonce instanceof Buffer);
-    // If None is specified for the UserTokenPolicy and SecurityPolicy is None
-    // then the password only contains the UTF-8 encoded password.
-    // note: this means that password is sent in clear text to the server
-    // note: OPCUA specification discourages use of unencrypted password
-    //       but some old OPCUA server may only provide this policy and we
-    //       still have to support in the client?
-    if (securityPolicy === node_opcua_secure_channel_1.SecurityPolicy.None) {
-        identityToken = new node_opcua_service_session_1.UserNameIdentityToken({
-            encryptionAlgorithm: null,
-            password: Buffer.from(password, "utf-8"),
-            policyId: userTokenPolicy.policyId,
-            userName
-        });
-        return identityToken;
-    }
-    // see Release 1.02 155 OPC Unified Architecture, Part 4
-    const cryptoFactory = (0, node_opcua_secure_channel_1.getCryptoFactory)(securityPolicy);
-    // istanbul ignore next
-    if (!cryptoFactory) {
-        throw new Error(" Unsupported security Policy " + securityPolicy.toString());
-    }
-    identityToken = new node_opcua_service_session_1.UserNameIdentityToken({
-        encryptionAlgorithm: cryptoFactory.asymmetricEncryptionAlgorithm,
-        password: Buffer.from(password, "utf-8"),
-        policyId: userTokenPolicy.policyId,
-        userName
-    });
-    // now encrypt password as requested
-    const lenBuf = (0, node_opcua_buffer_utils_1.createFastUninitializedBuffer)(4);
-    lenBuf.writeUInt32LE(identityToken.password.length + serverNonce.length, 0);
-    const block = Buffer.concat([lenBuf, identityToken.password, serverNonce]);
-    identityToken.password = cryptoFactory.asymmetricEncrypt(block, publicKey);
-    return identityToken;
-}
-function _adjustRevisedSessionTimeout(revisedSessionTimeout, requestedTimeout) {
-    // Some old OPCUA Servers are known to report an invalid revisedSessionTimeout
-    // such as Siemens SimoCode Pro V.
-    // we need to adjust the value here, by guessing a sensible sessionTimeout value to use instead.
-    if (revisedSessionTimeout < 1e-10) {
-        warningLog(`the revisedSessionTimeout ${revisedSessionTimeout} reported by the server is inconsistent and has been adjusted back to requestedTimeout ${requestedTimeout}`);
-        return requestedTimeout;
-    }
-    if (revisedSessionTimeout < OPCUAClientImpl.minimumRevisedSessionTimeout) {
-        warningLog(`the revisedSessionTimeout ${revisedSessionTimeout} is smaller than the minimum timeout (OPCUAClientImpl.minimumRevisedSessionTimeout = ${OPCUAClientImpl.minimumRevisedSessionTimeout}) and has been clamped to this value`);
-        return OPCUAClientImpl.minimumRevisedSessionTimeout;
-    }
-    return revisedSessionTimeout;
-}
-/***
- * @constructor
- * @internal
- */
-class OPCUAClientImpl extends client_base_impl_1.ClientBaseImpl {
-    constructor(options) {
-        options = options || {};
-        super(options);
-        // @property endpointMustExist {Boolean}
-        // if set to true , create Session will only accept connection from server which endpoint_url has been reported
-        // by GetEndpointsRequest.
-        // By default, the client is strict.
-        if (Object.prototype.hasOwnProperty.call(options, "endpoint_must_exist")) {
-            if (Object.prototype.hasOwnProperty.call(options, "endpointMustExist")) {
-                throw new Error("endpoint_must_exist is deprecated! you must now use endpointMustExist instead of endpoint_must_exist ");
-            }
-            warningLog("Warning: endpoint_must_exist is now deprecated, use endpointMustExist instead");
-            options.endpointMustExist = options.endpoint_must_exist;
-        }
-        this.endpointMustExist = (0, node_opcua_utils_1.isNullOrUndefined)(options.endpointMustExist) ? true : !!options.endpointMustExist;
-        this.requestedSessionTimeout = options.requestedSessionTimeout || 60000; // 1 minute
-        this.___sessionName_counter = 0;
-        this.userIdentityInfo = { type: node_opcua_service_endpoints_1.UserTokenType.Anonymous };
-        this.endpoint = undefined;
-    }
-    static create(options) {
-        return new OPCUAClientImpl(options);
-    }
-    /**
-     * @internal
-     * @param args
-     *
-     */
-    createSession(...args) {
-        if (args.length === 1) {
-            return this.createSession({ type: node_opcua_service_endpoints_1.UserTokenType.Anonymous }, args[0]);
-        }
-        const userIdentityInfo = args[0] || { type: node_opcua_service_endpoints_1.UserTokenType.Anonymous };
-        const callback = args[1];
-        this.userIdentityInfo = userIdentityInfo;
-        (0, node_opcua_assert_1.assert)(typeof callback === "function");
-        this._createSession((err, session) => {
-            if (err) {
-                callback(err);
-            }
-            else {
-                /* istanbul ignore next */
-                if (!session) {
-                    return callback(new Error("Internal Error"));
-                }
-                this._addSession(session);
-                this._activateSession(session, (err1, session2) => {
-                    callback(err1, session2);
-                });
-            }
-        });
-    }
-    createSession2(...args) {
-        if (args.length === 1) {
-            return this.createSession2({ type: node_opcua_service_endpoints_1.UserTokenType.Anonymous }, args[0]);
-        }
-        const userIdentityInfo = args[0];
-        const callback = args[1];
-        if (!this._secureChannel) {
-            // we do not have a connection anymore
-            return callback(new Error("Connection is closed"));
-        }
-        return this.createSession(args[0], (err, session) => {
-            if (err && err.message.match(/BadTooManySessions/)) {
-                const delayToRetry = 5; // seconds
-                errorLog(`TooManySession .... we need to retry later  ... in  ${delayToRetry} secondes`);
-                const retryCreateSessionTimer = setTimeout(() => {
-                    errorLog("TooManySession .... now retrying");
-                    this.createSession2(userIdentityInfo, callback);
-                }, delayToRetry * 1000);
-                return;
-            }
-            callback(err, session);
-        });
-    }
-    /**
-     * @internal
-     * @param args
-     */
-    changeSessionIdentity(...args) {
-        const session = args[0];
-        const userIdentityInfo = args[1];
-        const callback = args[2];
-        (0, node_opcua_assert_1.assert)(typeof callback === "function");
-        const old_userIdentity = this.userIdentityInfo;
-        this.userIdentityInfo = userIdentityInfo;
-        this._activateSession(session, (err1, session1) => {
-            callback(err1 ? err1 : undefined);
-        });
-    }
-    /**
-     * @internals
-     * @param args
-     */
-    closeSession(...args) {
-        super.closeSession(...args);
-    }
-    toString() {
-        let str = client_base_impl_1.ClientBaseImpl.prototype.toString.call(this);
-        str += "  requestedSessionTimeout....... " + this.requestedSessionTimeout + "\n";
-        str += "  endpointUrl................... " + this.endpointUrl + "\n";
-        str += "  serverUri..................... " + this.serverUri + "\n";
-        return str;
-    }
-    /**
-     *
-     * @example
-     *
-     * ```javascript
-     *
-     * const session = await OPCUAClient.createSession(endpointUrl);
-     * const dataValue = await session.read({ nodeId, attributeId: AttributeIds.Value });
-     * await session.close();
-     *
-     * ```
-     * @stability experimental
-     *
-     * @param endpointUrl
-     * @param userIdentity
-     * @returns session
-     *
-     *
-     * const create
-     */
-    static createSession(endpointUrl, userIdentity, clientOptions) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const client = opcua_client_1.OPCUAClient.create(clientOptions || {});
-            yield client.connect(endpointUrl);
-            const session = yield client.createSession2(userIdentity);
-            const oldClose = session.close;
-            session.close = thenify.withCallback((...args) => {
-                if (args.length === 1) {
-                    return session.close(true, args[0]);
-                }
-                const deleteSubscriptions = args[0];
-                const callback = args[1];
-                session.close = oldClose;
-                oldClose.call(session, deleteSubscriptions, (err) => {
-                    client.disconnect((err) => {
-                        callback(err);
-                    });
-                });
-            });
-            return session;
-        });
-    }
-    /**
-     * @internal
-     * @param args
-     */
-    withSession(connectionPoint, inner_func, ...args) {
-        const endpointUrl = typeof connectionPoint === "string" ? connectionPoint : connectionPoint.endpointUrl;
-        const userIdentity = typeof connectionPoint === "string" ? { type: node_opcua_service_endpoints_1.UserTokenType.Anonymous } : connectionPoint.userIdentity;
-        const callback = args[0];
-        (0, node_opcua_assert_1.assert)(typeof inner_func === "function", "expecting inner function");
-        (0, node_opcua_assert_1.assert)(typeof callback === "function", "expecting callback function");
-        let theSession;
-        let the_error;
-        let need_disconnect = false;
-        async.series([
-            // step 1 : connect to
-            (innerCallback) => {
-                this.connect(endpointUrl, (err) => {
-                    need_disconnect = true;
-                    if (err) {
-                        warningLog(err.message);
-                        errorLog(" cannot connect to endpoint :", endpointUrl);
-                    }
-                    innerCallback(err);
-                });
-            },
-            // step 2 : createSession
-            (innerCallback) => {
-                this.createSession2(userIdentity, (err, session) => {
-                    if (err) {
-                        return innerCallback(err);
-                    }
-                    if (!session) {
-                        return innerCallback(new Error("internal error"));
-                    }
-                    theSession = session;
-                    innerCallback();
-                });
-            },
-            (innerCallback) => {
-                try {
-                    inner_func(theSession, (err) => {
-                        the_error = err;
-                        innerCallback();
-                    });
-                }
-                catch (err) {
-                    console.log("Exception catch in inner function,  check your code ", err);
-                    errorLog("OPCUAClientImpl#withClientSession", err.message);
-                    the_error = err;
-                    innerCallback();
-                }
-            },
-            // close session
-            (innerCallback) => {
-                theSession.close(/*deleteSubscriptions=*/ true, (err) => {
-                    if (err) {
-                        debugLog("OPCUAClientImpl#withClientSession: session closed failed ?");
-                    }
-                    innerCallback();
-                });
-            },
-            (innerCallback) => {
-                this.disconnect((err) => {
-                    need_disconnect = false;
-                    if (err) {
-                        errorLog("OPCUAClientImpl#withClientSession: client disconnect failed ?");
-                    }
-                    innerCallback();
-                });
-            }
-        ], (err1) => {
-            if (err1) {
-                console.log("err", err1.message);
-            }
-            if (need_disconnect) {
-                errorLog("Disconnecting client after failure");
-                this.disconnect((err2) => {
-                    return callback(the_error || err1 || err2);
-                });
-            }
-            else {
-                return callback(the_error || err1);
-            }
-        });
-    }
-    withSubscription(endpointUrl, subscriptionParameters, innerFunc, callback) {
-        (0, node_opcua_assert_1.assert)(typeof innerFunc === "function");
-        (0, node_opcua_assert_1.assert)(typeof callback === "function");
-        this.withSession(endpointUrl, (session, done) => {
-            (0, node_opcua_assert_1.assert)(typeof done === "function");
-            const subscription = new client_subscription_impl_1.ClientSubscriptionImpl(session, subscriptionParameters);
-            try {
-                innerFunc(session, subscription, (err) => {
-                    subscription.terminate((err1) => {
-                        done(err1);
-                    });
-                });
-            }
-            catch (err) {
-                debugLog(err);
-                done(err);
-            }
-        }, callback);
-    }
-    withSessionAsync(connectionPoint, func) {
-        return __awaiter(this, void 0, void 0, function* () {
-            (0, node_opcua_assert_1.assert)(typeof func === "function");
-            (0, node_opcua_assert_1.assert)(func.length === 1, "expecting a single argument in func");
-            const endpointUrl = typeof connectionPoint === "string" ? connectionPoint : connectionPoint.endpointUrl;
-            const userIdentity = typeof connectionPoint === "string" ? { type: node_opcua_service_endpoints_1.UserTokenType.Anonymous } : connectionPoint.userIdentity;
-            yield this.connect(endpointUrl);
-            const session = yield this.createSession2(userIdentity);
-            let result;
-            try {
-                result = yield func(session);
-            }
-            catch (err) {
-                errorLog(err);
-                throw err;
-            }
-            finally {
-                yield session.close();
-                yield this.disconnect();
-            }
-            return result;
-        });
-    }
-    withSubscriptionAsync(connectionPoint, parameters, func) {
-        return __awaiter(this, void 0, void 0, function* () {
-            yield this.withSessionAsync(connectionPoint, (session) => __awaiter(this, void 0, void 0, function* () {
-                (0, node_opcua_assert_1.assert)(session, " session must exist");
-                const subscription = yield session.createSubscription2(parameters);
-                try {
-                    const result = yield func(session, subscription);
-                    return result;
-                }
-                catch (err) {
-                    console.log("withSubscriptionAsync inner function failed ", err.message);
-                    throw err;
-                }
-                finally {
-                    yield subscription.terminate();
-                }
-            }));
-        });
-    }
-    reactivateSession(session, callback) {
-        const internalSession = session;
-        (0, node_opcua_assert_1.assert)(typeof callback === "function");
-        if (!this._secureChannel) {
-            return callback(new Error(" client must be connected first"));
-        }
-        // istanbul ignore next
-        if (!this.__resolveEndPoint() || !this.endpoint) {
-            return callback(new Error(" End point must exist " + this._secureChannel.endpointUrl));
-        }
-        (0, node_opcua_assert_1.assert)(!internalSession._client || (0, node_opcua_utils_1.matchUri)(internalSession._client.endpointUrl, this.endpointUrl), "cannot reactivateSession on a different endpoint");
-        const old_client = internalSession._client;
-        debugLog("OPCUAClientImpl#reactivateSession");
-        this._activateSession(internalSession, (err /*, newSession?: ClientSessionImpl*/) => {
-            if (!err) {
-                if (old_client !== this) {
-                    // remove session from old client:
-                    if (old_client) {
-                        old_client._removeSession(internalSession);
-                        (0, node_opcua_assert_1.assert)(old_client._sessions.indexOf(internalSession) === -1);
-                    }
-                    this._addSession(internalSession);
-                    (0, node_opcua_assert_1.assert)(internalSession._client === this);
-                    (0, node_opcua_assert_1.assert)(!internalSession._closed, "session should not vbe closed");
-                    (0, node_opcua_assert_1.assert)(this._sessions.indexOf(internalSession) !== -1);
-                }
-                callback();
-            }
-            else {
-                // istanbul ignore next
-                if (doDebug) {
-                    debugLog(chalk.red.bgWhite("reactivateSession has failed !"), err.message);
-                }
-                callback(err);
-            }
-        });
-    }
-    /**
-     * @internal
-     * @private
-     */
-    _on_connection_reestablished(callback) {
-        (0, node_opcua_assert_1.assert)(typeof callback === "function");
-        // call base class implementation first
-        client_base_impl_1.ClientBaseImpl.prototype._on_connection_reestablished.call(this, ( /*err?: Error*/) => {
-            (0, reconnection_1.repair_client_sessions)(this, callback);
-        });
-    }
-    /**
-     *
-     * @internal
-     * @private
-     */
-    __createSession_step3(session, callback) {
-        (0, node_opcua_assert_1.assert)(typeof callback === "function");
-        (0, node_opcua_assert_1.assert)(this.serverUri !== undefined, " must have a valid server URI " + this.serverUri);
-        (0, node_opcua_assert_1.assert)(this.endpointUrl !== undefined, " must have a valid server endpointUrl");
-        (0, node_opcua_assert_1.assert)(this.endpoint);
-        // istanbul ignore next
-        if (!this._secureChannel) {
-            return callback(new Error("Invalid channel"));
-        }
-        const applicationUri = this._getApplicationUri();
-        const applicationDescription = {
-            applicationName: new node_opcua_data_model_1.LocalizedText({ text: this.applicationName, locale: null }),
-            applicationType: node_opcua_service_endpoints_1.ApplicationType.Client,
-            applicationUri,
-            discoveryProfileUri: undefined,
-            discoveryUrls: [],
-            gatewayServerUri: undefined,
-            productUri: "NodeOPCUA-Client"
-        };
-        // note : do not confuse CreateSessionRequest.clientNonce with OpenSecureChannelRequest.clientNonce
-        //        which are two different nonce, with different size (although they share the same name )
-        this.clientNonce = crypto.randomBytes(32);
-        const request = new node_opcua_service_session_1.CreateSessionRequest({
-            clientCertificate: this.getCertificate(),
-            clientDescription: applicationDescription,
-            clientNonce: this.clientNonce,
-            endpointUrl: this.endpointUrl,
-            maxResponseMessageSize: 800000,
-            requestedSessionTimeout: this.requestedSessionTimeout,
-            serverUri: this.serverUri,
-            sessionName: this._nextSessionName()
-        });
-        // a client Nonce must be provided if security mode is set
-        (0, node_opcua_assert_1.assert)(this._secureChannel.securityMode === node_opcua_service_secure_channel_1.MessageSecurityMode.None || request.clientNonce !== null);
-        this.performMessageTransaction(request, (err, response) => {
-            /* istanbul ignore next */
-            if (err) {
-                console.log("__createSession_step3 has failed", err.message);
-                return callback(err);
-                //  //xxxxxx               qdqsdqsdqsdqsd
-                //                 // we could have an invalid state here or a connection error
-                //                 errorLog("error: ", err.message, " retrying in ... 5 secondes");
-                //                 setTimeout(() => {
-                //                     errorLog(" .... now retrying");
-                //                     this.__createSession_step3(session, callback);
-                //                 }, 5 * 1000);
-                //                 return;
-            }
-            /* istanbul ignore next */
-            if (!response || !(response instanceof node_opcua_service_session_1.CreateSessionResponse)) {
-                return callback(new Error("internal error"));
-            }
-            if (response.responseHeader.serviceResult === node_opcua_status_code_1.StatusCodes.BadTooManySessions) {
-                return callback(new Error(response.responseHeader.serviceResult.toString()));
-            }
-            if (response.responseHeader.serviceResult !== node_opcua_status_code_1.StatusCodes.Good) {
-                err = new Error("Error " + response.responseHeader.serviceResult.name + " " + response.responseHeader.serviceResult.description);
-                return callback(err);
-            }
-            // istanbul ignore next
-            if (!validateServerNonce(response.serverNonce)) {
-                return callback(new Error("Invalid server Nonce"));
-            }
-            // todo: verify SignedSoftwareCertificates and  response.serverSignature
-            session = session || new client_session_impl_1.ClientSessionImpl(this);
-            session.name = request.sessionName || "";
-            session.sessionId = response.sessionId;
-            session.authenticationToken = response.authenticationToken;
-            session.timeout = _adjustRevisedSessionTimeout(response.revisedSessionTimeout, this.requestedSessionTimeout);
-            session.serverNonce = response.serverNonce;
-            session.serverCertificate = response.serverCertificate;
-            session.serverSignature = response.serverSignature;
-            debugLog("revised session timeout = ", session.timeout, response.revisedSessionTimeout);
-            response.serverEndpoints = response.serverEndpoints || [];
-            if (!verifyEndpointDescriptionMatches(this, response.serverEndpoints)) {
-                errorLog("Endpoint description previously retrieved with GetEndpointsDescription");
-                errorLog("CreateSessionResponse.serverEndpoints= ");
-                errorLog(response.serverEndpoints);
-                return callback(new Error("Invalid endpoint descriptions Found"));
-            }
-            // this._serverEndpoints = response.serverEndpoints;
-            session.serverEndpoints = response.serverEndpoints;
-            callback(null, session);
-        });
-    }
-    /**
-     *
-     * @internal
-     * @private
-     */
-    __createSession_step2(session, callback) {
-        (0, util_1.callbackify)(node_opcua_hostname_1.extractFullyQualifiedDomainName)(() => {
-            this.__createSession_step3(session, callback);
-        });
-    }
-    /**
-     * @internal
-     * @private
-     */
-    _activateSession(session, callback) {
-        // see OPCUA Part 4 - $7.35
-        (0, node_opcua_assert_1.assert)(typeof callback === "function");
-        // istanbul ignore next
-        if (!this._secureChannel) {
-            return callback(new Error(" No secure channel"));
-        }
-        const serverCertificate = session.serverCertificate;
-        // If the securityPolicyUri is None and none of the UserTokenPolicies requires encryption,
-        // the Client shall ignore the ApplicationInstanceCertificate (serverCertificate)
-        (0, node_opcua_assert_1.assert)(serverCertificate === null || serverCertificate instanceof Buffer);
-        const serverNonce = session.serverNonce;
-        (0, node_opcua_assert_1.assert)(!serverNonce || serverNonce instanceof Buffer);
-        // make sure session is attached to this client
-        const _old_client = session._client;
-        session._client = this;
-        const context = {
-            endpoint: this.endpoint,
-            securityPolicy: this._secureChannel.securityPolicy,
-            serverCertificate,
-            serverNonce: serverNonce // please check this !
-        };
-        this.createUserIdentityToken(context, this.userIdentityInfo, (err, data) => {
-            if (err) {
-                session._client = _old_client;
-                return callback(err);
-            }
-            data = data;
-            const userIdentityToken = data.userIdentityToken;
-            const userTokenSignature = data.userTokenSignature;
-            // TODO. fill the ActivateSessionRequest
-            // see 5.6.3.2 Parameters OPC Unified Architecture, Part 4 30 Release 1.02
-            const request = new node_opcua_service_session_1.ActivateSessionRequest({
-                // This is a signature generated with the private key associated with the
-                // clientCertificate. The SignatureAlgorithm shall be the AsymmetricSignatureAlgorithm
-                // specified in the SecurityPolicy for the Endpoint. The SignatureData type is defined in 7.30.
-                clientSignature: this.computeClientSignature(this._secureChannel, serverCertificate, serverNonce) || undefined,
-                // These are the SoftwareCertificates which have been issued to the Client application.
-                // The productUri contained in the SoftwareCertificates shall match the productUri in the
-                // ApplicationDescription passed by the Client in the CreateSession requests. Certificates without
-                // matching productUri should be ignored.  Servers may reject connections from Clients if they are
-                // not satisfied with the SoftwareCertificates provided by the Client.
-                // This parameter only needs to be specified in the first ActivateSession request
-                // after CreateSession.
-                // It shall always be omitted if the maxRequestMessageSize returned from the Server in the
-                // CreateSession response is less than one megabyte.
-                // The SignedSoftwareCertificate type is defined in 7.31.
-                clientSoftwareCertificates: [],
-                // List of locale ids in priority order for localized strings. The first LocaleId in the list
-                // has the highest priority. If the Server returns a localized string to the Client, the Server
-                // shall return the translation with the highest priority that it can. If it does not have a
-                // translation for any of the locales identified in this list, then it shall return the string
-                // value that it has and include the locale id with the string.
-                // See Part 3 for more detail on locale ids. If the Client fails to specify at least one locale id,
-                // the Server shall use any that it has.
-                // This parameter only needs to be specified during the first call to ActivateSession during
-                // a single application Session. If it is not specified the Server shall keep using the current
-                // localeIds for the Session.
-                localeIds: [],
-                // The credentials of the user associated with the Client application. The Server uses these
-                // credentials to determine whether the Client should be allowed to activate a Session and what
-                // resources the Client has access to during this Session. The UserIdentityToken is an extensible
-                // parameter type defined in 7.35.
-                // The EndpointDescription specifies what UserIdentityTokens the Server shall accept.
-                userIdentityToken,
-                // If the Client specified a user   identity token that supports digital signatures,
-                // then it shall create a signature and pass it as this parameter. Otherwise the parameter
-                // is omitted.
-                // The SignatureAlgorithm depends on the identity token type.
-                userTokenSignature
-            });
-            request.requestHeader.authenticationToken = session.authenticationToken;
-            session.lastRequestSentTime = new Date();
-            this.performMessageTransaction(request, (err1, response) => {
-                if (!err1 && response && response.responseHeader.serviceResult === node_opcua_status_code_1.StatusCodes.Good) {
-                    /* istanbul ignore next */
-                    if (!(response instanceof node_opcua_service_session_1.ActivateSessionResponse)) {
-                        return callback(new Error("Internal Error"));
-                    }
-                    if (!validateServerNonce(response.serverNonce)) {
-                        return callback(new Error("Invalid server Nonce"));
-                    }
-                    session._client = this;
-                    session.serverNonce = response.serverNonce;
-                    session.lastResponseReceivedTime = new Date();
-                    if (this.keepSessionAlive) {
-                        session.startKeepAliveManager();
-                    }
-                    return callback(null, session);
-                }
-                else {
-                    // restore client
-                    session._client = _old_client;
-                    /* istanbul ignore next */
-                    if (!err1 && response) {
-                        err1 = new Error(response.responseHeader.serviceResult.toString());
-                    }
-                    session._client = _old_client;
-                    return callback(err1);
-                }
-            });
-        });
-    }
-    /**
-     *
-     * @private
-     */
-    _nextSessionName() {
-        if (!this.___sessionName_counter) {
-            this.___sessionName_counter = 0;
-        }
-        this.___sessionName_counter += 1;
-        return this.clientName + this.___sessionName_counter;
-    }
-    /**
-     *
-     * @private
-     */
-    _getApplicationUri() {
-        var _a, _b;
-        const certificate = this.getCertificate();
-        let applicationUri;
-        if (certificate) {
-            const e = (0, node_opcua_crypto_1.exploreCertificate)(certificate);
-            if ((_b = (_a = e.tbsCertificate.extensions) === null || _a === void 0 ? void 0 : _a.subjectAltName) === null || _b === void 0 ? void 0 : _b.uniformResourceIdentifier) {
-                applicationUri = e.tbsCertificate.extensions.subjectAltName.uniformResourceIdentifier[0];
-            }
-            else {
-                errorLog("Certificate has no extensions.subjectAltName.uniformResourceIdentifier, ");
-                errorLog((0, node_opcua_crypto_1.toPem)(certificate, "CERTIFICATE"));
-                applicationUri = this._getBuiltApplicationUri();
-            }
-        }
-        else {
-            applicationUri = this._getBuiltApplicationUri();
-        }
-        return applicationUri;
-    }
-    /**
-     *
-     * @private
-     */
-    __resolveEndPoint() {
-        this.securityPolicy = this.securityPolicy || node_opcua_secure_channel_1.SecurityPolicy.None;
-        let endpoint = this.findEndpoint(this._secureChannel.endpointUrl, this.securityMode, this.securityPolicy);
-        this.endpoint = endpoint;
-        // this is explained here : see OPCUA Part 4 Version 1.02 $5.4.1 page 12:
-        //   A  Client  shall verify the  HostName  specified in the  Server Certificate  is the same as the  HostName
-        //   contained in the  endpointUrl  provided in the  EndpointDescription. If there is a difference  then  the
-        //   Client  shall report the difference and may close the  SecureChannel.
-        if (!this.endpoint) {
-            if (this.endpointMustExist) {
-                debugLog("OPCUAClientImpl#endpointMustExist = true and endpoint with url ", this._secureChannel.endpointUrl, " cannot be found");
-                return false;
-            }
-            else {
-                // fallback :
-                // our strategy is to take the first server_end_point that match the security settings
-                // ( is this really OK ?)
-                // this will permit us to access a OPCUA Server using it's IP address instead of its hostname
-                endpoint = this.findEndpointForSecurity(this.securityMode, this.securityPolicy);
-                if (!endpoint) {
-                    return false;
-                }
-                this.endpoint = endpoint;
-            }
-        }
-        return true;
-    }
-    /**
-     *
-     * @private
-     */
-    _createSession(callback) {
-        (0, node_opcua_assert_1.assert)(typeof callback === "function");
-        (0, node_opcua_assert_1.assert)(this._secureChannel);
-        if (!this.__resolveEndPoint() || !this.endpoint) {
-            /* istanbul ignore next */
-            if (doDebug && this._serverEndpoints) {
-                debugLog(this._serverEndpoints.map((endpoint) => endpoint.endpointUrl + " " + endpoint.securityMode.toString() + " " + endpoint.securityPolicyUri));
-            }
-            return callback(new Error(" End point must exist " + this._secureChannel.endpointUrl));
-        }
-        this.serverUri = this.endpoint.server.applicationUri || "invalid application uri";
-        this.endpointUrl = this._secureChannel.endpointUrl;
-        const session = new client_session_impl_1.ClientSessionImpl(this);
-        this.__createSession_step2(session, callback);
-    }
-    /**
-     *
-     * @private
-     */
-    computeClientSignature(channel, serverCertificate, serverNonce) {
-        return (0, node_opcua_secure_channel_1.computeSignature)(serverCertificate, serverNonce || Buffer.alloc(0), this.getPrivateKey(), channel.securityPolicy);
-    }
-    /**
-     *
-     * @private
-     */
-    createUserIdentityToken(context, userIdentityInfo, callback) {
-        function coerceUserIdentityInfo(identityInfo) {
-            if (!identityInfo) {
-                return { type: node_opcua_service_endpoints_1.UserTokenType.Anonymous };
-            }
-            if (Object.prototype.hasOwnProperty.call(identityInfo, "type")) {
-                return identityInfo;
-            }
-            if (Object.prototype.hasOwnProperty.call(identityInfo, "userName")) {
-                identityInfo.type = node_opcua_service_endpoints_1.UserTokenType.UserName;
-                return identityInfo;
-            }
-            if (Object.prototype.hasOwnProperty.call(identityInfo, "certificateData")) {
-                identityInfo.type = node_opcua_service_endpoints_1.UserTokenType.Certificate;
-                return identityInfo;
-            }
-            identityInfo.type = node_opcua_service_endpoints_1.UserTokenType.Anonymous;
-            return identityInfo;
-        }
-        userIdentityInfo = coerceUserIdentityInfo(userIdentityInfo);
-        (0, node_opcua_assert_1.assert)(typeof callback === "function");
-        if (null === userIdentityInfo) {
-            return callback(null, {
-                userIdentityToken: null,
-                userTokenSignature: {}
-            });
-        }
-        let userIdentityToken;
-        let userTokenSignature = {
-            algorithm: undefined,
-            signature: undefined
-        };
-        try {
-            switch (userIdentityInfo.type) {
-                case node_opcua_service_endpoints_1.UserTokenType.Anonymous:
-                    userIdentityToken = createAnonymousIdentityToken(context);
-                    break;
-                case node_opcua_service_endpoints_1.UserTokenType.UserName: {
-                    const userName = userIdentityInfo.userName || "";
-                    const password = userIdentityInfo.password || "";
-                    userIdentityToken = createUserNameIdentityToken(context, userName, password);
-                    break;
-                }
-                case node_opcua_service_endpoints_1.UserTokenType.Certificate: {
-                    const certificate = userIdentityInfo.certificateData;
-                    const privateKey = userIdentityInfo.privateKey;
-                    ({ userIdentityToken, userTokenSignature } = createX509IdentityToken(context, certificate, privateKey));
-                    break;
-                }
-                default:
-                    debugLog(" userIdentityInfo = ", userIdentityInfo);
-                    return callback(new Error("CLIENT: Invalid userIdentityInfo"));
-            }
-        }
-        catch (err) {
-            if (typeof err === "string") {
-                return callback(new Error("Create identity token failed " + userIdentityInfo.type + " " + err));
-            }
-            return callback(err);
-        }
-        return callback(null, { userIdentityToken, userTokenSignature });
-    }
-}
-exports.OPCUAClientImpl = OPCUAClientImpl;
-OPCUAClientImpl.minimumRevisedSessionTimeout = 100.0;
-// tslint:disable:no-var-requires
-// tslint:disable:max-line-length
-const thenify = require("thenify");
-/**
- * @method createSession
- * @async
- *
- * @example
- *     // create a anonymous session
- *     const session = await client.createSession();
- *
- * @example
- *     // create a session with a userName and password
- *     const userIdentityInfo  = {
- *          type: UserTokenType.UserName,
- *          userName: "JoeDoe",
- *          password:"secret"
- *     };
- *     const session = client.createSession(userIdentityInfo);
- *
- */
-OPCUAClientImpl.prototype.createSession = thenify.withCallback(OPCUAClientImpl.prototype.createSession);
-OPCUAClientImpl.prototype.createSession2 = thenify.withCallback(OPCUAClientImpl.prototype.createSession2);
-/**
- * @method changeSessionIdentity
- * @async
- */
-OPCUAClientImpl.prototype.changeSessionIdentity = thenify.withCallback(OPCUAClientImpl.prototype.changeSessionIdentity);
-/**
- * @method closeSession
- * @async
- * @example
- *    const session  = await client.createSession();
- *    await client.closeSession(session);
- */
-OPCUAClientImpl.prototype.closeSession = thenify.withCallback(OPCUAClientImpl.prototype.closeSession);
-OPCUAClientImpl.prototype.reactivateSession = thenify.withCallback(OPCUAClientImpl.prototype.reactivateSession);
+"use strict";
+/**
+ * @module node-opcua-client-private
+ */
+// tslint:disable:variable-name
+// tslint:disable:no-console
+// tslint:disable:no-empty
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OPCUAClientImpl = void 0;
+const crypto = require("crypto");
+const util_1 = require("util");
+const async = require("async");
+const chalk = require("chalk");
+const node_opcua_assert_1 = require("node-opcua-assert");
+const node_opcua_buffer_utils_1 = require("node-opcua-buffer-utils");
+const node_opcua_crypto_1 = require("node-opcua-crypto");
+const node_opcua_data_model_1 = require("node-opcua-data-model");
+const node_opcua_debug_1 = require("node-opcua-debug");
+const node_opcua_hostname_1 = require("node-opcua-hostname");
+const node_opcua_secure_channel_1 = require("node-opcua-secure-channel");
+const node_opcua_service_endpoints_1 = require("node-opcua-service-endpoints");
+const node_opcua_service_secure_channel_1 = require("node-opcua-service-secure-channel");
+const node_opcua_service_session_1 = require("node-opcua-service-session");
+const node_opcua_status_code_1 = require("node-opcua-status-code");
+const node_opcua_utils_1 = require("node-opcua-utils");
+const opcua_client_1 = require("../opcua_client");
+const reconnection_1 = require("../reconnection");
+const client_base_impl_1 = require("./client_base_impl");
+const client_session_impl_1 = require("./client_session_impl");
+const client_subscription_impl_1 = require("./client_subscription_impl");
+const doDebug = (0, node_opcua_debug_1.checkDebugFlag)(__filename);
+const debugLog = (0, node_opcua_debug_1.make_debugLog)(__filename);
+const errorLog = (0, node_opcua_debug_1.make_errorLog)(__filename);
+const warningLog = (0, node_opcua_debug_1.make_warningLog)(__filename);
+function validateServerNonce(serverNonce) {
+    return !(serverNonce && serverNonce.length < 32) || (serverNonce && serverNonce.length === 0);
+}
+function verifyEndpointDescriptionMatches(client, responseServerEndpoints) {
+    // The Server returns its EndpointDescriptions in the response. Clients use this information to
+    // determine whether the list of EndpointDescriptions returned from the Discovery Endpoint matches
+    // the Endpoints that the Server has. If there is a difference then the Client shall close the
+    // Session and report an error.
+    // The Server returns all EndpointDescriptions for the serverUri
+    // specified by the Client in the request. The Client only verifies EndpointDescriptions with a
+    // transportProfileUri that matches the profileUri specified in the original GetEndpoints request.
+    // A Client may skip this check if the EndpointDescriptions were provided by a trusted source
+    // such as the Administrator.
+    // serverEndpoints:
+    // The Client shall verify this list with the list from a Discovery Endpoint if it used a Discovery Endpoint
+    // fetch to the EndpointDescriptions.
+    // ToDo
+    return true;
+}
+function findUserTokenPolicy(endpointDescription, userTokenType) {
+    endpointDescription.userIdentityTokens = endpointDescription.userIdentityTokens || [];
+    const r = endpointDescription.userIdentityTokens.filter((userIdentity) => userIdentity.tokenType === userTokenType);
+    return r.length === 0 ? null : r[0];
+}
+function createAnonymousIdentityToken(context) {
+    const endpoint = context.endpoint;
+    const userTokenPolicy = findUserTokenPolicy(endpoint, node_opcua_service_endpoints_1.UserTokenType.Anonymous);
+    if (!userTokenPolicy) {
+        throw new Error("Cannot find ANONYMOUS user token policy in end point description");
+    }
+    return new node_opcua_service_session_1.AnonymousIdentityToken({ policyId: userTokenPolicy.policyId });
+}
+/**
+ *
+ * @param context
+ * @param certificate - the user certificate
+ * @param privateKey  - the private key associated with the user certificate
+ */
+function createX509IdentityToken(context, certificate, privateKey) {
+    const endpoint = context.endpoint;
+    (0, node_opcua_assert_1.assert)(endpoint instanceof node_opcua_service_endpoints_1.EndpointDescription);
+    const userTokenPolicy = findUserTokenPolicy(endpoint, node_opcua_service_endpoints_1.UserTokenType.Certificate);
+    // istanbul ignore next
+    if (!userTokenPolicy) {
+        throw new Error("Cannot find Certificate (X509) user token policy in end point description");
+    }
+    let securityPolicy = (0, node_opcua_secure_channel_1.fromURI)(userTokenPolicy.securityPolicyUri);
+    // if the security policy is not specified we use the session security policy
+    if (securityPolicy === node_opcua_secure_channel_1.SecurityPolicy.Invalid) {
+        securityPolicy = context.securityPolicy;
+    }
+    const userIdentityToken = new node_opcua_service_session_1.X509IdentityToken({
+        certificateData: certificate,
+        policyId: userTokenPolicy.policyId
+    });
+    const serverCertificate = context.serverCertificate;
+    (0, node_opcua_assert_1.assert)(serverCertificate instanceof Buffer);
+    const serverNonce = context.serverNonce || Buffer.alloc(0);
+    (0, node_opcua_assert_1.assert)(serverNonce instanceof Buffer);
+    // see Release 1.02 155 OPC Unified Architecture, Part 4
+    const cryptoFactory = (0, node_opcua_secure_channel_1.getCryptoFactory)(securityPolicy);
+    // istanbul ignore next
+    if (!cryptoFactory) {
+        throw new Error(" Unsupported security Policy");
+    }
+    /**
+     * OPCUA Spec 1.04 - part 4
+     * page 28:
+     * 5.6.3.1
+     * ...
+     * If the token is an X509IdentityToken then the proof is a signature generated with private key
+     * associated with the Certificate. The data to sign is created by appending the last serverNonce to
+     * the **serverCertificate** specified in the CreateSession response. If a token includes a secret then it
+     * should be encrypted using the public key from the serverCertificate.
+     *
+     * page 155:
+     * Token Encryption and Proof of Possession
+     * 7.36.2.1 Overview
+     * The Client shall always prove possession of a UserIdentityToken when it passes it to the Server.
+     * Some tokens include a secret such as a password which the Server will accept as proof. In order
+     * to protect these secrets the Token may be encrypted before it is passed to the Server. Other types
+     * of tokens allow the Client to create a signature with the secret associated with the Token. In these
+     * cases, the Client proves possession of a UserIdentityToken by creating a signature with the secret
+     * and passing it to the Server
+     *
+     * page 159:
+     * 7.36.5 X509IdentityTokens
+     * The X509IdentityToken is used to pass an X.509 v3 Certificate which is issued by the user.
+     * This token shall always be accompanied by a Signature in the userTokenSignature parameter of
+     * ActivateSession if required by the SecurityPolicy. The Server should specify a SecurityPolicy for
+     * the UserTokenPolicy if the SecureChannel has a SecurityPolicy of None.
+     */
+    // now create the proof of possession, by creating a signature
+    // The data to sign is created by appending the last serverNonce to the serverCertificate
+    // The signature generated with private key associated with the User Certificate
+    const userTokenSignature = (0, node_opcua_secure_channel_1.computeSignature)(serverCertificate, serverNonce, privateKey, securityPolicy);
+    return { userIdentityToken, userTokenSignature };
+}
+function createUserNameIdentityToken(session, userName, password) {
+    // assert(endpoint instanceof EndpointDescription);
+    (0, node_opcua_assert_1.assert)(userName === null || typeof userName === "string");
+    (0, node_opcua_assert_1.assert)(password === null || typeof password === "string");
+    const endpoint = session.endpoint;
+    (0, node_opcua_assert_1.assert)(endpoint instanceof node_opcua_service_endpoints_1.EndpointDescription);
+    /**
+     * OPC Unified Architecture 1.0.4:  Part 4 155
+     * Each UserIdentityToken allowed by an Endpoint shall have a UserTokenPolicy specified in the
+     * EndpointDescription. The UserTokenPolicy specifies what SecurityPolicy to use when encrypting
+     * or signing. If this SecurityPolicy is omitted then the Client uses the SecurityPolicy in the
+     * EndpointDescription. If the matching SecurityPolicy is set to None then no encryption or signature
+     * is required.
+     *
+     */
+    const userTokenPolicy = findUserTokenPolicy(endpoint, node_opcua_service_endpoints_1.UserTokenType.UserName);
+    // istanbul ignore next
+    if (!userTokenPolicy) {
+        throw new Error("Cannot find USERNAME user token policy in end point description");
+    }
+    let securityPolicy = (0, node_opcua_secure_channel_1.fromURI)(userTokenPolicy.securityPolicyUri);
+    // if the security policy is not specified we use the session security policy
+    if (securityPolicy === node_opcua_secure_channel_1.SecurityPolicy.Invalid) {
+        securityPolicy = session.securityPolicy;
+    }
+    let identityToken;
+    let serverCertificate = session.serverCertificate;
+    // if server does not provide certificate use unencrypted password
+    if (!serverCertificate) {
+        identityToken = new node_opcua_service_session_1.UserNameIdentityToken({
+            encryptionAlgorithm: null,
+            password: Buffer.from(password, "utf-8"),
+            policyId: userTokenPolicy ? userTokenPolicy.policyId : null,
+            userName
+        });
+        return identityToken;
+    }
+    (0, node_opcua_assert_1.assert)(serverCertificate instanceof Buffer);
+    serverCertificate = (0, node_opcua_crypto_1.toPem)(serverCertificate, "CERTIFICATE");
+    const publicKey = (0, node_opcua_crypto_1.extractPublicKeyFromCertificateSync)(serverCertificate);
+    const serverNonce = session.serverNonce || Buffer.alloc(0);
+    (0, node_opcua_assert_1.assert)(serverNonce instanceof Buffer);
+    // If None is specified for the UserTokenPolicy and SecurityPolicy is None
+    // then the password only contains the UTF-8 encoded password.
+    // note: this means that password is sent in clear text to the server
+    // note: OPCUA specification discourages use of unencrypted password
+    //       but some old OPCUA server may only provide this policy and we
+    //       still have to support in the client?
+    if (securityPolicy === node_opcua_secure_channel_1.SecurityPolicy.None) {
+        identityToken = new node_opcua_service_session_1.UserNameIdentityToken({
+            encryptionAlgorithm: null,
+            password: Buffer.from(password, "utf-8"),
+            policyId: userTokenPolicy.policyId,
+            userName
+        });
+        return identityToken;
+    }
+    // see Release 1.02 155 OPC Unified Architecture, Part 4
+    const cryptoFactory = (0, node_opcua_secure_channel_1.getCryptoFactory)(securityPolicy);
+    // istanbul ignore next
+    if (!cryptoFactory) {
+        throw new Error(" Unsupported security Policy " + securityPolicy.toString());
+    }
+    identityToken = new node_opcua_service_session_1.UserNameIdentityToken({
+        encryptionAlgorithm: cryptoFactory.asymmetricEncryptionAlgorithm,
+        password: Buffer.from(password, "utf-8"),
+        policyId: userTokenPolicy.policyId,
+        userName
+    });
+    // now encrypt password as requested
+    const lenBuf = (0, node_opcua_buffer_utils_1.createFastUninitializedBuffer)(4);
+    lenBuf.writeUInt32LE(identityToken.password.length + serverNonce.length, 0);
+    const block = Buffer.concat([lenBuf, identityToken.password, serverNonce]);
+    identityToken.password = cryptoFactory.asymmetricEncrypt(block, publicKey);
+    return identityToken;
+}
+function _adjustRevisedSessionTimeout(revisedSessionTimeout, requestedTimeout) {
+    // Some old OPCUA Servers are known to report an invalid revisedSessionTimeout
+    // such as Siemens SimoCode Pro V.
+    // we need to adjust the value here, by guessing a sensible sessionTimeout value to use instead.
+    if (revisedSessionTimeout < 1e-10) {
+        warningLog(`the revisedSessionTimeout ${revisedSessionTimeout} reported by the server is inconsistent and has been adjusted back to requestedTimeout ${requestedTimeout}`);
+        return requestedTimeout;
+    }
+    if (revisedSessionTimeout < OPCUAClientImpl.minimumRevisedSessionTimeout) {
+        warningLog(`the revisedSessionTimeout ${revisedSessionTimeout} is smaller than the minimum timeout (OPCUAClientImpl.minimumRevisedSessionTimeout = ${OPCUAClientImpl.minimumRevisedSessionTimeout}) and has been clamped to this value`);
+        return OPCUAClientImpl.minimumRevisedSessionTimeout;
+    }
+    return revisedSessionTimeout;
+}
+/***
+ * @constructor
+ * @internal
+ */
+class OPCUAClientImpl extends client_base_impl_1.ClientBaseImpl {
+    constructor(options) {
+        options = options || {};
+        super(options);
+        // @property endpointMustExist {Boolean}
+        // if set to true , create Session will only accept connection from server which endpoint_url has been reported
+        // by GetEndpointsRequest.
+        // By default, the client is strict.
+        if (Object.prototype.hasOwnProperty.call(options, "endpoint_must_exist")) {
+            if (Object.prototype.hasOwnProperty.call(options, "endpointMustExist")) {
+                throw new Error("endpoint_must_exist is deprecated! you must now use endpointMustExist instead of endpoint_must_exist ");
+            }
+            warningLog("Warning: endpoint_must_exist is now deprecated, use endpointMustExist instead");
+            options.endpointMustExist = options.endpoint_must_exist;
+        }
+        this.endpointMustExist = (0, node_opcua_utils_1.isNullOrUndefined)(options.endpointMustExist) ? true : !!options.endpointMustExist;
+        this.requestedSessionTimeout = options.requestedSessionTimeout || 60000; // 1 minute
+        this.___sessionName_counter = 0;
+        this.userIdentityInfo = { type: node_opcua_service_endpoints_1.UserTokenType.Anonymous };
+        this.endpoint = undefined;
+    }
+    static create(options) {
+        return new OPCUAClientImpl(options);
+    }
+    /**
+     * @internal
+     * @param args
+     *
+     */
+    createSession(...args) {
+        if (args.length === 1) {
+            return this.createSession({ type: node_opcua_service_endpoints_1.UserTokenType.Anonymous }, args[0]);
+        }
+        const userIdentityInfo = args[0] || { type: node_opcua_service_endpoints_1.UserTokenType.Anonymous };
+        const callback = args[1];
+        this.userIdentityInfo = userIdentityInfo;
+        (0, node_opcua_assert_1.assert)(typeof callback === "function");
+        this._createSession((err, session) => {
+            if (err) {
+                callback(err);
+            }
+            else {
+                /* istanbul ignore next */
+                if (!session) {
+                    return callback(new Error("Internal Error"));
+                }
+                this._addSession(session);
+                this._activateSession(session, (err1, session2) => {
+                    callback(err1, session2);
+                });
+            }
+        });
+    }
+    createSession2(...args) {
+        if (args.length === 1) {
+            return this.createSession2({ type: node_opcua_service_endpoints_1.UserTokenType.Anonymous }, args[0]);
+        }
+        const userIdentityInfo = args[0];
+        const callback = args[1];
+        if (!this._secureChannel) {
+            // we do not have a connection anymore
+            return callback(new Error("Connection is closed"));
+        }
+        return this.createSession(args[0], (err, session) => {
+            if (err && err.message.match(/BadTooManySessions/)) {
+                const delayToRetry = 5; // seconds
+                errorLog(`TooManySession .... we need to retry later  ... in  ${delayToRetry} secondes`);
+                const retryCreateSessionTimer = setTimeout(() => {
+                    errorLog("TooManySession .... now retrying");
+                    this.createSession2(userIdentityInfo, callback);
+                }, delayToRetry * 1000);
+                return;
+            }
+            callback(err, session);
+        });
+    }
+    /**
+     * @internal
+     * @param args
+     */
+    changeSessionIdentity(...args) {
+        const session = args[0];
+        const userIdentityInfo = args[1];
+        const callback = args[2];
+        (0, node_opcua_assert_1.assert)(typeof callback === "function");
+        const old_userIdentity = this.userIdentityInfo;
+        this.userIdentityInfo = userIdentityInfo;
+        this._activateSession(session, (err1, session1) => {
+            callback(err1 ? err1 : undefined);
+        });
+    }
+    /**
+     * @internals
+     * @param args
+     */
+    closeSession(...args) {
+        super.closeSession(...args);
+    }
+    toString() {
+        let str = client_base_impl_1.ClientBaseImpl.prototype.toString.call(this);
+        str += "  requestedSessionTimeout....... " + this.requestedSessionTimeout + "\n";
+        str += "  endpointUrl................... " + this.endpointUrl + "\n";
+        str += "  serverUri..................... " + this.serverUri + "\n";
+        return str;
+    }
+    /**
+     *
+     * @example
+     *
+     * ```javascript
+     *
+     * const session = await OPCUAClient.createSession(endpointUrl);
+     * const dataValue = await session.read({ nodeId, attributeId: AttributeIds.Value });
+     * await session.close();
+     *
+     * ```
+     * @stability experimental
+     *
+     * @param endpointUrl
+     * @param userIdentity
+     * @returns session
+     *
+     *
+     * const create
+     */
+    static createSession(endpointUrl, userIdentity, clientOptions) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const client = opcua_client_1.OPCUAClient.create(clientOptions || {});
+            yield client.connect(endpointUrl);
+            const session = yield client.createSession2(userIdentity);
+            const oldClose = session.close;
+            session.close = thenify.withCallback((...args) => {
+                if (args.length === 1) {
+                    return session.close(true, args[0]);
+                }
+                const deleteSubscriptions = args[0];
+                const callback = args[1];
+                session.close = oldClose;
+                oldClose.call(session, deleteSubscriptions, (err) => {
+                    client.disconnect((err) => {
+                        callback(err);
+                    });
+                });
+            });
+            return session;
+        });
+    }
+    /**
+     * @internal
+     * @param args
+     */
+    withSession(connectionPoint, inner_func, ...args) {
+        const endpointUrl = typeof connectionPoint === "string" ? connectionPoint : connectionPoint.endpointUrl;
+        const userIdentity = typeof connectionPoint === "string" ? { type: node_opcua_service_endpoints_1.UserTokenType.Anonymous } : connectionPoint.userIdentity;
+        const callback = args[0];
+        (0, node_opcua_assert_1.assert)(typeof inner_func === "function", "expecting inner function");
+        (0, node_opcua_assert_1.assert)(typeof callback === "function", "expecting callback function");
+        let theSession;
+        let the_error;
+        let need_disconnect = false;
+        async.series([
+            // step 1 : connect to
+            (innerCallback) => {
+                this.connect(endpointUrl, (err) => {
+                    need_disconnect = true;
+                    if (err) {
+                        warningLog(err.message);
+                        errorLog(" cannot connect to endpoint :", endpointUrl);
+                    }
+                    innerCallback(err);
+                });
+            },
+            // step 2 : createSession
+            (innerCallback) => {
+                this.createSession2(userIdentity, (err, session) => {
+                    if (err) {
+                        return innerCallback(err);
+                    }
+                    if (!session) {
+                        return innerCallback(new Error("internal error"));
+                    }
+                    theSession = session;
+                    innerCallback();
+                });
+            },
+            (innerCallback) => {
+                try {
+                    inner_func(theSession, (err) => {
+                        the_error = err;
+                        innerCallback();
+                    });
+                }
+                catch (err) {
+                    console.log("Exception catch in inner function,  check your code ", err);
+                    errorLog("OPCUAClientImpl#withClientSession", err.message);
+                    the_error = err;
+                    innerCallback();
+                }
+            },
+            // close session
+            (innerCallback) => {
+                theSession.close(/*deleteSubscriptions=*/ true, (err) => {
+                    if (err) {
+                        debugLog("OPCUAClientImpl#withClientSession: session closed failed ?");
+                    }
+                    innerCallback();
+                });
+            },
+            (innerCallback) => {
+                this.disconnect((err) => {
+                    need_disconnect = false;
+                    if (err) {
+                        errorLog("OPCUAClientImpl#withClientSession: client disconnect failed ?");
+                    }
+                    innerCallback();
+                });
+            }
+        ], (err1) => {
+            if (err1) {
+                console.log("err", err1.message);
+            }
+            if (need_disconnect) {
+                errorLog("Disconnecting client after failure");
+                this.disconnect((err2) => {
+                    return callback(the_error || err1 || err2);
+                });
+            }
+            else {
+                return callback(the_error || err1);
+            }
+        });
+    }
+    withSubscription(endpointUrl, subscriptionParameters, innerFunc, callback) {
+        (0, node_opcua_assert_1.assert)(typeof innerFunc === "function");
+        (0, node_opcua_assert_1.assert)(typeof callback === "function");
+        this.withSession(endpointUrl, (session, done) => {
+            (0, node_opcua_assert_1.assert)(typeof done === "function");
+            const subscription = new client_subscription_impl_1.ClientSubscriptionImpl(session, subscriptionParameters);
+            try {
+                innerFunc(session, subscription, (err) => {
+                    subscription.terminate((err1) => {
+                        done(err1);
+                    });
+                });
+            }
+            catch (err) {
+                debugLog(err);
+                done(err);
+            }
+        }, callback);
+    }
+    withSessionAsync(connectionPoint, func) {
+        return __awaiter(this, void 0, void 0, function* () {
+            (0, node_opcua_assert_1.assert)(typeof func === "function");
+            (0, node_opcua_assert_1.assert)(func.length === 1, "expecting a single argument in func");
+            const endpointUrl = typeof connectionPoint === "string" ? connectionPoint : connectionPoint.endpointUrl;
+            const userIdentity = typeof connectionPoint === "string" ? { type: node_opcua_service_endpoints_1.UserTokenType.Anonymous } : connectionPoint.userIdentity;
+            yield this.connect(endpointUrl);
+            const session = yield this.createSession2(userIdentity);
+            let result;
+            try {
+                result = yield func(session);
+            }
+            catch (err) {
+                errorLog(err);
+                throw err;
+            }
+            finally {
+                yield session.close();
+                yield this.disconnect();
+            }
+            return result;
+        });
+    }
+    withSubscriptionAsync(connectionPoint, parameters, func) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.withSessionAsync(connectionPoint, (session) => __awaiter(this, void 0, void 0, function* () {
+                (0, node_opcua_assert_1.assert)(session, " session must exist");
+                const subscription = yield session.createSubscription2(parameters);
+                try {
+                    const result = yield func(session, subscription);
+                    return result;
+                }
+                catch (err) {
+                    console.log("withSubscriptionAsync inner function failed ", err.message);
+                    throw err;
+                }
+                finally {
+                    yield subscription.terminate();
+                }
+            }));
+        });
+    }
+    reactivateSession(session, callback) {
+        const internalSession = session;
+        (0, node_opcua_assert_1.assert)(typeof callback === "function");
+        if (!this._secureChannel) {
+            return callback(new Error(" client must be connected first"));
+        }
+        // istanbul ignore next
+        if (!this.__resolveEndPoint() || !this.endpoint) {
+            return callback(new Error(" End point must exist " + this._secureChannel.endpointUrl));
+        }
+        (0, node_opcua_assert_1.assert)(!internalSession._client || (0, node_opcua_utils_1.matchUri)(internalSession._client.endpointUrl, this.endpointUrl), "cannot reactivateSession on a different endpoint");
+        const old_client = internalSession._client;
+        debugLog("OPCUAClientImpl#reactivateSession");
+        this._activateSession(internalSession, (err /*, newSession?: ClientSessionImpl*/) => {
+            if (!err) {
+                if (old_client !== this) {
+                    // remove session from old client:
+                    if (old_client) {
+                        old_client._removeSession(internalSession);
+                        (0, node_opcua_assert_1.assert)(old_client._sessions.indexOf(internalSession) === -1);
+                    }
+                    this._addSession(internalSession);
+                    (0, node_opcua_assert_1.assert)(internalSession._client === this);
+                    (0, node_opcua_assert_1.assert)(!internalSession._closed, "session should not vbe closed");
+                    (0, node_opcua_assert_1.assert)(this._sessions.indexOf(internalSession) !== -1);
+                }
+                callback();
+            }
+            else {
+                // istanbul ignore next
+                if (doDebug) {
+                    debugLog(chalk.red.bgWhite("reactivateSession has failed !"), err.message);
+                }
+                callback(err);
+            }
+        });
+    }
+    /**
+     * @internal
+     * @private
+     */
+    _on_connection_reestablished(callback) {
+        (0, node_opcua_assert_1.assert)(typeof callback === "function");
+        // call base class implementation first
+        client_base_impl_1.ClientBaseImpl.prototype._on_connection_reestablished.call(this, ( /*err?: Error*/) => {
+            (0, reconnection_1.repair_client_sessions)(this, callback);
+        });
+    }
+    /**
+     *
+     * @internal
+     * @private
+     */
+    __createSession_step3(session, callback) {
+        (0, node_opcua_assert_1.assert)(typeof callback === "function");
+        (0, node_opcua_assert_1.assert)(this.serverUri !== undefined, " must have a valid server URI " + this.serverUri);
+        (0, node_opcua_assert_1.assert)(this.endpointUrl !== undefined, " must have a valid server endpointUrl");
+        (0, node_opcua_assert_1.assert)(this.endpoint);
+        // istanbul ignore next
+        if (!this._secureChannel) {
+            return callback(new Error("Invalid channel"));
+        }
+        const applicationUri = this._getApplicationUri();
+        const applicationDescription = {
+            applicationName: new node_opcua_data_model_1.LocalizedText({ text: this.applicationName, locale: null }),
+            applicationType: node_opcua_service_endpoints_1.ApplicationType.Client,
+            applicationUri,
+            discoveryProfileUri: undefined,
+            discoveryUrls: [],
+            gatewayServerUri: undefined,
+            productUri: "NodeOPCUA-Client"
+        };
+        // note : do not confuse CreateSessionRequest.clientNonce with OpenSecureChannelRequest.clientNonce
+        //        which are two different nonce, with different size (although they share the same name )
+        this.clientNonce = crypto.randomBytes(32);
+        const request = new node_opcua_service_session_1.CreateSessionRequest({
+            clientCertificate: this.getCertificate(),
+            clientDescription: applicationDescription,
+            clientNonce: this.clientNonce,
+            endpointUrl: this.endpointUrl,
+            maxResponseMessageSize: 800000,
+            requestedSessionTimeout: this.requestedSessionTimeout,
+            serverUri: this.serverUri,
+            sessionName: this._nextSessionName()
+        });
+        // a client Nonce must be provided if security mode is set
+        (0, node_opcua_assert_1.assert)(this._secureChannel.securityMode === node_opcua_service_secure_channel_1.MessageSecurityMode.None || request.clientNonce !== null);
+        this.performMessageTransaction(request, (err, response) => {
+            /* istanbul ignore next */
+            if (err) {
+                console.log("__createSession_step3 has failed", err.message);
+                return callback(err);
+                //  //xxxxxx               qdqsdqsdqsdqsd
+                //                 // we could have an invalid state here or a connection error
+                //                 errorLog("error: ", err.message, " retrying in ... 5 secondes");
+                //                 setTimeout(() => {
+                //                     errorLog(" .... now retrying");
+                //                     this.__createSession_step3(session, callback);
+                //                 }, 5 * 1000);
+                //                 return;
+            }
+            /* istanbul ignore next */
+            if (!response || !(response instanceof node_opcua_service_session_1.CreateSessionResponse)) {
+                return callback(new Error("internal error"));
+            }
+            if (response.responseHeader.serviceResult === node_opcua_status_code_1.StatusCodes.BadTooManySessions) {
+                return callback(new Error(response.responseHeader.serviceResult.toString()));
+            }
+            if (response.responseHeader.serviceResult !== node_opcua_status_code_1.StatusCodes.Good) {
+                err = new Error("Error " + response.responseHeader.serviceResult.name + " " + response.responseHeader.serviceResult.description);
+                return callback(err);
+            }
+            // istanbul ignore next
+            if (!validateServerNonce(response.serverNonce)) {
+                return callback(new Error("Invalid server Nonce"));
+            }
+            // todo: verify SignedSoftwareCertificates and  response.serverSignature
+            session = session || new client_session_impl_1.ClientSessionImpl(this);
+            session.name = request.sessionName || "";
+            session.sessionId = response.sessionId;
+            session.authenticationToken = response.authenticationToken;
+            session.timeout = _adjustRevisedSessionTimeout(response.revisedSessionTimeout, this.requestedSessionTimeout);
+            session.serverNonce = response.serverNonce;
+            session.serverCertificate = response.serverCertificate;
+            session.serverSignature = response.serverSignature;
+            debugLog("revised session timeout = ", session.timeout, response.revisedSessionTimeout);
+            response.serverEndpoints = response.serverEndpoints || [];
+            if (!verifyEndpointDescriptionMatches(this, response.serverEndpoints)) {
+                errorLog("Endpoint description previously retrieved with GetEndpointsDescription");
+                errorLog("CreateSessionResponse.serverEndpoints= ");
+                errorLog(response.serverEndpoints);
+                return callback(new Error("Invalid endpoint descriptions Found"));
+            }
+            // this._serverEndpoints = response.serverEndpoints;
+            session.serverEndpoints = response.serverEndpoints;
+            callback(null, session);
+        });
+    }
+    /**
+     *
+     * @internal
+     * @private
+     */
+    __createSession_step2(session, callback) {
+        (0, util_1.callbackify)(node_opcua_hostname_1.extractFullyQualifiedDomainName)(() => {
+            this.__createSession_step3(session, callback);
+        });
+    }
+    /**
+     * @internal
+     * @private
+     */
+    _activateSession(session, callback) {
+        // see OPCUA Part 4 - $7.35
+        (0, node_opcua_assert_1.assert)(typeof callback === "function");
+        // istanbul ignore next
+        if (!this._secureChannel) {
+            return callback(new Error(" No secure channel"));
+        }
+        const serverCertificate = session.serverCertificate;
+        // If the securityPolicyUri is None and none of the UserTokenPolicies requires encryption,
+        // the Client shall ignore the ApplicationInstanceCertificate (serverCertificate)
+        (0, node_opcua_assert_1.assert)(serverCertificate === null || serverCertificate instanceof Buffer);
+        const serverNonce = session.serverNonce;
+        (0, node_opcua_assert_1.assert)(!serverNonce || serverNonce instanceof Buffer);
+        // make sure session is attached to this client
+        const _old_client = session._client;
+        session._client = this;
+        const context = {
+            endpoint: this.endpoint,
+            securityPolicy: this._secureChannel.securityPolicy,
+            serverCertificate,
+            serverNonce: serverNonce // please check this !
+        };
+        this.createUserIdentityToken(context, this.userIdentityInfo, (err, data) => {
+            if (err) {
+                session._client = _old_client;
+                return callback(err);
+            }
+            data = data;
+            const userIdentityToken = data.userIdentityToken;
+            const userTokenSignature = data.userTokenSignature;
+            // TODO. fill the ActivateSessionRequest
+            // see 5.6.3.2 Parameters OPC Unified Architecture, Part 4 30 Release 1.02
+            const request = new node_opcua_service_session_1.ActivateSessionRequest({
+                // This is a signature generated with the private key associated with the
+                // clientCertificate. The SignatureAlgorithm shall be the AsymmetricSignatureAlgorithm
+                // specified in the SecurityPolicy for the Endpoint. The SignatureData type is defined in 7.30.
+                clientSignature: this.computeClientSignature(this._secureChannel, serverCertificate, serverNonce) || undefined,
+                // These are the SoftwareCertificates which have been issued to the Client application.
+                // The productUri contained in the SoftwareCertificates shall match the productUri in the
+                // ApplicationDescription passed by the Client in the CreateSession requests. Certificates without
+                // matching productUri should be ignored.  Servers may reject connections from Clients if they are
+                // not satisfied with the SoftwareCertificates provided by the Client.
+                // This parameter only needs to be specified in the first ActivateSession request
+                // after CreateSession.
+                // It shall always be omitted if the maxRequestMessageSize returned from the Server in the
+                // CreateSession response is less than one megabyte.
+                // The SignedSoftwareCertificate type is defined in 7.31.
+                clientSoftwareCertificates: [],
+                // List of locale ids in priority order for localized strings. The first LocaleId in the list
+                // has the highest priority. If the Server returns a localized string to the Client, the Server
+                // shall return the translation with the highest priority that it can. If it does not have a
+                // translation for any of the locales identified in this list, then it shall return the string
+                // value that it has and include the locale id with the string.
+                // See Part 3 for more detail on locale ids. If the Client fails to specify at least one locale id,
+                // the Server shall use any that it has.
+                // This parameter only needs to be specified during the first call to ActivateSession during
+                // a single application Session. If it is not specified the Server shall keep using the current
+                // localeIds for the Session.
+                localeIds: [],
+                // The credentials of the user associated with the Client application. The Server uses these
+                // credentials to determine whether the Client should be allowed to activate a Session and what
+                // resources the Client has access to during this Session. The UserIdentityToken is an extensible
+                // parameter type defined in 7.35.
+                // The EndpointDescription specifies what UserIdentityTokens the Server shall accept.
+                userIdentityToken,
+                // If the Client specified a user   identity token that supports digital signatures,
+                // then it shall create a signature and pass it as this parameter. Otherwise the parameter
+                // is omitted.
+                // The SignatureAlgorithm depends on the identity token type.
+                userTokenSignature
+            });
+            request.requestHeader.authenticationToken = session.authenticationToken;
+            session.lastRequestSentTime = new Date();
+            this.performMessageTransaction(request, (err1, response) => {
+                if (!err1 && response && response.responseHeader.serviceResult === node_opcua_status_code_1.StatusCodes.Good) {
+                    /* istanbul ignore next */
+                    if (!(response instanceof node_opcua_service_session_1.ActivateSessionResponse)) {
+                        return callback(new Error("Internal Error"));
+                    }
+                    if (!validateServerNonce(response.serverNonce)) {
+                        return callback(new Error("Invalid server Nonce"));
+                    }
+                    session._client = this;
+                    session.serverNonce = response.serverNonce;
+                    session.lastResponseReceivedTime = new Date();
+                    if (this.keepSessionAlive) {
+                        session.startKeepAliveManager();
+                    }
+                    return callback(null, session);
+                }
+                else {
+                    // restore client
+                    session._client = _old_client;
+                    /* istanbul ignore next */
+                    if (!err1 && response) {
+                        err1 = new Error(response.responseHeader.serviceResult.toString());
+                    }
+                    session._client = _old_client;
+                    return callback(err1);
+                }
+            });
+        });
+    }
+    /**
+     *
+     * @private
+     */
+    _nextSessionName() {
+        if (!this.___sessionName_counter) {
+            this.___sessionName_counter = 0;
+        }
+        this.___sessionName_counter += 1;
+        return this.clientName + this.___sessionName_counter;
+    }
+    /**
+     *
+     * @private
+     */
+    _getApplicationUri() {
+        var _a, _b;
+        const certificate = this.getCertificate();
+        let applicationUri;
+        if (certificate) {
+            const e = (0, node_opcua_crypto_1.exploreCertificate)(certificate);
+            if ((_b = (_a = e.tbsCertificate.extensions) === null || _a === void 0 ? void 0 : _a.subjectAltName) === null || _b === void 0 ? void 0 : _b.uniformResourceIdentifier) {
+                applicationUri = e.tbsCertificate.extensions.subjectAltName.uniformResourceIdentifier[0];
+            }
+            else {
+                errorLog("Certificate has no extensions.subjectAltName.uniformResourceIdentifier, ");
+                errorLog((0, node_opcua_crypto_1.toPem)(certificate, "CERTIFICATE"));
+                applicationUri = this._getBuiltApplicationUri();
+            }
+        }
+        else {
+            applicationUri = this._getBuiltApplicationUri();
+        }
+        return applicationUri;
+    }
+    /**
+     *
+     * @private
+     */
+    __resolveEndPoint() {
+        this.securityPolicy = this.securityPolicy || node_opcua_secure_channel_1.SecurityPolicy.None;
+        let endpoint = this.findEndpoint(this._secureChannel.endpointUrl, this.securityMode, this.securityPolicy);
+        this.endpoint = endpoint;
+        // this is explained here : see OPCUA Part 4 Version 1.02 $5.4.1 page 12:
+        //   A  Client  shall verify the  HostName  specified in the  Server Certificate  is the same as the  HostName
+        //   contained in the  endpointUrl  provided in the  EndpointDescription. If there is a difference  then  the
+        //   Client  shall report the difference and may close the  SecureChannel.
+        if (!this.endpoint) {
+            if (this.endpointMustExist) {
+                debugLog("OPCUAClientImpl#endpointMustExist = true and endpoint with url ", this._secureChannel.endpointUrl, " cannot be found");
+                return false;
+            }
+            else {
+                // fallback :
+                // our strategy is to take the first server_end_point that match the security settings
+                // ( is this really OK ?)
+                // this will permit us to access a OPCUA Server using it's IP address instead of its hostname
+                endpoint = this.findEndpointForSecurity(this.securityMode, this.securityPolicy);
+                if (!endpoint) {
+                    return false;
+                }
+                this.endpoint = endpoint;
+            }
+        }
+        return true;
+    }
+    /**
+     *
+     * @private
+     */
+    _createSession(callback) {
+        (0, node_opcua_assert_1.assert)(typeof callback === "function");
+        (0, node_opcua_assert_1.assert)(this._secureChannel);
+        if (!this.__resolveEndPoint() || !this.endpoint) {
+            /* istanbul ignore next */
+            if (doDebug && this._serverEndpoints) {
+                debugLog(this._serverEndpoints.map((endpoint) => endpoint.endpointUrl + " " + endpoint.securityMode.toString() + " " + endpoint.securityPolicyUri));
+            }
+            return callback(new Error(" End point must exist " + this._secureChannel.endpointUrl));
+        }
+        this.serverUri = this.endpoint.server.applicationUri || "invalid application uri";
+        this.endpointUrl = this._secureChannel.endpointUrl;
+        const session = new client_session_impl_1.ClientSessionImpl(this);
+        this.__createSession_step2(session, callback);
+    }
+    /**
+     *
+     * @private
+     */
+    computeClientSignature(channel, serverCertificate, serverNonce) {
+        return (0, node_opcua_secure_channel_1.computeSignature)(serverCertificate, serverNonce || Buffer.alloc(0), this.getPrivateKey(), channel.securityPolicy);
+    }
+    /**
+     *
+     * @private
+     */
+    createUserIdentityToken(context, userIdentityInfo, callback) {
+        function coerceUserIdentityInfo(identityInfo) {
+            if (!identityInfo) {
+                return { type: node_opcua_service_endpoints_1.UserTokenType.Anonymous };
+            }
+            if (Object.prototype.hasOwnProperty.call(identityInfo, "type")) {
+                return identityInfo;
+            }
+            if (Object.prototype.hasOwnProperty.call(identityInfo, "userName")) {
+                identityInfo.type = node_opcua_service_endpoints_1.UserTokenType.UserName;
+                return identityInfo;
+            }
+            if (Object.prototype.hasOwnProperty.call(identityInfo, "certificateData")) {
+                identityInfo.type = node_opcua_service_endpoints_1.UserTokenType.Certificate;
+                return identityInfo;
+            }
+            identityInfo.type = node_opcua_service_endpoints_1.UserTokenType.Anonymous;
+            return identityInfo;
+        }
+        userIdentityInfo = coerceUserIdentityInfo(userIdentityInfo);
+        (0, node_opcua_assert_1.assert)(typeof callback === "function");
+        if (null === userIdentityInfo) {
+            return callback(null, {
+                userIdentityToken: null,
+                userTokenSignature: {}
+            });
+        }
+        let userIdentityToken;
+        let userTokenSignature = {
+            algorithm: undefined,
+            signature: undefined
+        };
+        try {
+            switch (userIdentityInfo.type) {
+                case node_opcua_service_endpoints_1.UserTokenType.Anonymous:
+                    userIdentityToken = createAnonymousIdentityToken(context);
+                    break;
+                case node_opcua_service_endpoints_1.UserTokenType.UserName: {
+                    const userName = userIdentityInfo.userName || "";
+                    const password = userIdentityInfo.password || "";
+                    userIdentityToken = createUserNameIdentityToken(context, userName, password);
+                    break;
+                }
+                case node_opcua_service_endpoints_1.UserTokenType.Certificate: {
+                    const certificate = userIdentityInfo.certificateData;
+                    const privateKey = userIdentityInfo.privateKey;
+                    ({ userIdentityToken, userTokenSignature } = createX509IdentityToken(context, certificate, privateKey));
+                    break;
+                }
+                default:
+                    debugLog(" userIdentityInfo = ", userIdentityInfo);
+                    return callback(new Error("CLIENT: Invalid userIdentityInfo"));
+            }
+        }
+        catch (err) {
+            if (typeof err === "string") {
+                return callback(new Error("Create identity token failed " + userIdentityInfo.type + " " + err));
+            }
+            return callback(err);
+        }
+        return callback(null, { userIdentityToken, userTokenSignature });
+    }
+}
+exports.OPCUAClientImpl = OPCUAClientImpl;
+OPCUAClientImpl.minimumRevisedSessionTimeout = 100.0;
+// tslint:disable:no-var-requires
+// tslint:disable:max-line-length
+const thenify = require("thenify");
+/**
+ * @method createSession
+ * @async
+ *
+ * @example
+ *     // create a anonymous session
+ *     const session = await client.createSession();
+ *
+ * @example
+ *     // create a session with a userName and password
+ *     const userIdentityInfo  = {
+ *          type: UserTokenType.UserName,
+ *          userName: "JoeDoe",
+ *          password:"secret"
+ *     };
+ *     const session = client.createSession(userIdentityInfo);
+ *
+ */
+OPCUAClientImpl.prototype.createSession = thenify.withCallback(OPCUAClientImpl.prototype.createSession);
+OPCUAClientImpl.prototype.createSession2 = thenify.withCallback(OPCUAClientImpl.prototype.createSession2);
+/**
+ * @method changeSessionIdentity
+ * @async
+ */
+OPCUAClientImpl.prototype.changeSessionIdentity = thenify.withCallback(OPCUAClientImpl.prototype.changeSessionIdentity);
+/**
+ * @method closeSession
+ * @async
+ * @example
+ *    const session  = await client.createSession();
+ *    await client.closeSession(session);
+ */
+OPCUAClientImpl.prototype.closeSession = thenify.withCallback(OPCUAClientImpl.prototype.closeSession);
+OPCUAClientImpl.prototype.reactivateSession = thenify.withCallback(OPCUAClientImpl.prototype.reactivateSession);
 //# sourceMappingURL=opcua_client_impl.js.map