node-opcua-pki 6.12.2 → 6.14.0

package/dist/index.mjs

@@ -808,15 +808,16 @@ nsComment                 = "CA Generated by Node-OPCUA Certificate utility usin
 subjectKeyIdentifier      = hash
 basicConstraints          = CA:TRUE
 keyUsage                  = critical, cRLSign, keyCertSign
+subjectAltName            = $ENV::ALTNAME
 nsComment                 = "CA CSR generated by Node-OPCUA Certificate utility using openssl"
 [ v3_ca ]
 subjectKeyIdentifier      = hash
 authorityKeyIdentifier    = keyid:always,issuer:always
 basicConstraints          = CA:TRUE
 keyUsage                  = critical, cRLSign, keyCertSign
+subjectAltName            = $ENV::ALTNAME
 nsComment                 = "CA Certificate generated by Node-OPCUA Certificate utility using openssl"
 #nsCertType                 = sslCA, emailCA
-#subjectAltName             = email:copy
 #issuerAltName              = issuer:copy
 #obj                        = DER:02:03
 crlDistributionPoints     = @crl_info
@@ -903,7 +904,8 @@ async function construct_CertificateAuthority(certificateAuthority) {
     await fs7.promises.writeFile(caConfigFile, data);
   }
   const subjectOpt = ` -subj "${subject.toString()}" `;
-  processAltNames({});
+  const caCommonName = subject.commonName || "NodeOPCUA-CA";
+  setEnv("ALTNAME", `URI:urn:${caCommonName}`);
   const options = { cwd: caRootDir };
   const configFile = generateStaticConfig("conf/caconfig.cnf", options);
   const configOption = ` -config ${q3(n4(configFile))}`;
@@ -2022,6 +2024,14 @@ var CertificateManagerState = /* @__PURE__ */ ((CertificateManagerState2) => {
   CertificateManagerState2[CertificateManagerState2["Disposed"] = 4] = "Disposed";
   return CertificateManagerState2;
 })(CertificateManagerState || {});
+var ChainCompletionStatus = /* @__PURE__ */ ((ChainCompletionStatus2) => {
+  ChainCompletionStatus2["AlreadyComplete"] = "AlreadyComplete";
+  ChainCompletionStatus2["ChainCompleted"] = "ChainCompleted";
+  ChainCompletionStatus2["IssuerNotFound"] = "IssuerNotFound";
+  ChainCompletionStatus2["EmptyChain"] = "EmptyChain";
+  ChainCompletionStatus2["MaxDepthReached"] = "MaxDepthReached";
+  return ChainCompletionStatus2;
+})(ChainCompletionStatus || {});
 var CertificateManager = class _CertificateManager extends EventEmitter {
   // ── Global instance registry ─────────────────────────────────
   // Tracks all initialized CertificateManager instances so their
@@ -2114,6 +2124,7 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
   #filenameToHash = /* @__PURE__ */ new Map();
   #initializingPromise;
   #addCertValidation;
+  #disableFileWatchers;
   #thumbs = {
     rejected: /* @__PURE__ */ new Map(),
     trusted: /* @__PURE__ */ new Map(),
@@ -2147,6 +2158,7 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
       ignoreMissingRevocationList: v.ignoreMissingRevocationList ?? false,
       maxChainLength: v.maxChainLength ?? 5
     };
+    this.#disableFileWatchers = options.disableFileWatchers ?? process.env.OPCUA_PKI_DISABLE_FILE_WATCHERS === "true";
     mkdirRecursiveSync(options.location);
     if (!fs10.existsSync(this.#location)) {
       throw new Error(`CertificateManager cannot access location ${this.#location}`);
@@ -3011,6 +3023,75 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
     }
     return selectedTrustedCertificates.length > 0 ? selectedTrustedCertificates[0].certificate : null;
   }
+  /**
+   * Outcome status for {@link CertificateManager.completeCertificateChain}.
+   */
+  static ChainCompletionStatus = ChainCompletionStatus;
+  /**
+   * Complete a certificate chain by walking the issuer store.
+   *
+   * Starting from the last certificate in the provided chain, this method
+   * repeatedly calls {@link findIssuerCertificate} to locate the parent
+   * certificate until it reaches a self-signed root or can no longer find
+   * an issuer.
+   *
+   * @param chain - the (potentially partial) certificate chain, leaf first
+   * @param maxDepth - maximum number of issuers to append (default: 10)
+   * @returns a {@link ChainCompletionResult} containing the (possibly completed)
+   *          chain, a status code, and an optional diagnostic message.
+   */
+  async completeCertificateChain(chain, maxDepth = 10) {
+    if (chain.length === 0) {
+      return {
+        chain,
+        status: "EmptyChain" /* EmptyChain */,
+        message: "Input chain is empty \u2014 nothing to complete."
+      };
+    }
+    await this.#scanCertFolder(this.issuersCertFolder, this.#thumbs.issuers.certs);
+    const result = [...chain];
+    let depth = 0;
+    while (depth < maxDepth) {
+      const lastCert = result[result.length - 1];
+      const lastInfo = exploreCertificate2(lastCert);
+      if (isSelfSigned2(lastInfo)) {
+        const wasExtended = result.length > chain.length;
+        return {
+          chain: result,
+          status: wasExtended ? "ChainCompleted" /* ChainCompleted */ : "AlreadyComplete" /* AlreadyComplete */,
+          message: wasExtended ? `Chain completed: ${result.length - chain.length} issuer(s) appended, ending at self-signed root "${lastInfo.tbsCertificate.subject.commonName}".` : `Chain is already complete (self-signed root "${lastInfo.tbsCertificate.subject.commonName}").`
+        };
+      }
+      const issuerCert = await this.findIssuerCertificate(lastCert);
+      if (!issuerCert) {
+        const cn = lastInfo.tbsCertificate.subject.commonName ?? "?";
+        const akid = lastInfo.tbsCertificate.extensions?.authorityKeyIdentifier?.keyIdentifier ?? "?";
+        const msg = `Cannot find issuer for "${cn}" (authorityKeyIdentifier: ${akid}). Ensure the CA certificate is present in the issuers/certs folder.`;
+        warningLog(`completeCertificateChain: ${msg}`);
+        return {
+          chain: result,
+          status: "IssuerNotFound" /* IssuerNotFound */,
+          message: msg
+        };
+      }
+      const issuerFingerprint = makeFingerprint(issuerCert);
+      const alreadyInChain = result.some((c) => makeFingerprint(c) === issuerFingerprint);
+      if (alreadyInChain) {
+        return {
+          chain: result,
+          status: "AlreadyComplete" /* AlreadyComplete */,
+          message: `Chain ends at root "${exploreCertificate2(issuerCert).tbsCertificate.subject.commonName}" (already present in chain).`
+        };
+      }
+      result.push(issuerCert);
+      depth++;
+    }
+    return {
+      chain: result,
+      status: "MaxDepthReached" /* MaxDepthReached */,
+      message: `Chain completion stopped after ${maxDepth} iterations \u2014 possible circular chain or very deep hierarchy.`
+    };
+  }
   /**
    *
    * check if the certificate explicitly appear in the trust list, the reject list or none.
@@ -3206,11 +3287,15 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
       this.#scanCrlFolder(this.crlFolder, this.#thumbs.crl),
       this.#scanCrlFolder(this.issuersCrlFolder, this.#thumbs.issuersCrl)
     ]);
-    this.#startWatcher(this.trustedFolder, this.#thumbs.trusted, createUnreffedWatcher, "trusted");
-    this.#startWatcher(this.issuersCertFolder, this.#thumbs.issuers.certs, createUnreffedWatcher, "issuersCerts");
-    this.#startWatcher(this.rejectedFolder, this.#thumbs.rejected, createUnreffedWatcher, "rejected");
-    this.#startCrlWatcher(this.crlFolder, this.#thumbs.crl, createUnreffedWatcher, "crl");
-    this.#startCrlWatcher(this.issuersCrlFolder, this.#thumbs.issuersCrl, createUnreffedWatcher, "issuersCrl");
+    if (this.#disableFileWatchers) {
+      fs10.watch = origWatch;
+    } else {
+      this.#startWatcher(this.trustedFolder, this.#thumbs.trusted, createUnreffedWatcher, "trusted");
+      this.#startWatcher(this.issuersCertFolder, this.#thumbs.issuers.certs, createUnreffedWatcher, "issuersCerts");
+      this.#startWatcher(this.rejectedFolder, this.#thumbs.rejected, createUnreffedWatcher, "rejected");
+      this.#startCrlWatcher(this.crlFolder, this.#thumbs.crl, createUnreffedWatcher, "crl");
+      this.#startCrlWatcher(this.issuersCrlFolder, this.#thumbs.issuersCrl, createUnreffedWatcher, "issuersCrl");
+    }
   }
   /**
    * Scan a certificate folder and populate the in-memory index.
@@ -3391,6 +3476,7 @@ export {
   CertificateAuthority,
   CertificateManager,
   CertificateManagerState,
+  ChainCompletionStatus,
   Subject,
   VerificationStatus,
   adjustApplicationUri,