node-opcua-pki 6.7.0 → 6.7.2

package/dist/index.mjs

@@ -1175,10 +1175,28 @@ var configurationFileSimpleTemplate = simple_config_template_cnf_default;
 var fsWriteFile = fs9.promises.writeFile;
 function getOrComputeInfo(entry) {
   if (!entry.info) {
-    entry.info = exploreCertificate(entry.certificate);
+    entry.info = exploreCertificateCached(entry.certificate);
   }
   return entry.info;
 }
+var EXPLORE_CACHE_MAX = 8;
+var _exploreCache = /* @__PURE__ */ new Map();
+function exploreCertificateCached(certificate) {
+  const key = makeSHA1Thumbprint(certificate).toString("hex");
+  const cached = _exploreCache.get(key);
+  if (cached) {
+    _exploreCache.delete(key);
+    _exploreCache.set(key, cached);
+    return cached;
+  }
+  const info = exploreCertificate(certificate);
+  _exploreCache.set(key, info);
+  if (_exploreCache.size > EXPLORE_CACHE_MAX) {
+    const oldest = _exploreCache.keys().next().value;
+    if (oldest) _exploreCache.delete(oldest);
+  }
+  return info;
+}
 var VerificationStatus = /* @__PURE__ */ ((VerificationStatus2) => {
   VerificationStatus2["BadCertificateInvalid"] = "BadCertificateInvalid";
   VerificationStatus2["BadSecurityChecksFailed"] = "BadSecurityChecksFailed";
@@ -1209,7 +1227,7 @@ var forbiddenChars = /[\x00-\x1F<>:"/\\|?*]/g;
 function buildIdealCertificateName(certificate) {
   const fingerprint = makeFingerprint(certificate);
   try {
-    const commonName = exploreCertificate(certificate).tbsCertificate.subject.commonName || "";
+    const commonName = exploreCertificateCached(certificate).tbsCertificate.subject.commonName || "";
     const sanitizedCommonName = commonName.replace(forbiddenChars, "_");
     return `${sanitizedCommonName}[${fingerprint}]`;
   } catch (_err) {
@@ -1226,14 +1244,14 @@ function isSelfSigned2(info) {
   return info.tbsCertificate.extensions?.subjectKeyIdentifier === info.tbsCertificate.extensions?.authorityKeyIdentifier?.keyIdentifier;
 }
 function isSelfSigned3(certificate) {
-  const info = exploreCertificate(certificate);
+  const info = exploreCertificateCached(certificate);
   return isSelfSigned2(info);
 }
 function findIssuerCertificateInChain(certificate, chain) {
   if (!certificate) {
     return null;
   }
-  const certInfo = exploreCertificate(certificate);
+  const certInfo = exploreCertificateCached(certificate);
   if (isSelfSigned2(certInfo)) {
     return certificate;
   }
@@ -1243,7 +1261,7 @@ function findIssuerCertificateInChain(certificate, chain) {
     return null;
   }
   const potentialIssuers = chain.filter((c) => {
-    const info = exploreCertificate(c);
+    const info = exploreCertificateCached(c);
     return info.tbsCertificate.extensions && info.tbsCertificate.extensions.subjectKeyIdentifier === wantedIssuerKey;
   });
   if (potentialIssuers.length === 1) {
@@ -1479,7 +1497,7 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
     }
     const chain = split_der(certificate);
     debugLog("NB CERTIFICATE IN CHAIN = ", chain.length);
-    const info = exploreCertificate(chain[0]);
+    const info = exploreCertificateCached(chain[0]);
     let hasValidIssuer = false;
     let hasTrustedIssuer = false;
     const hasIssuerKey = info.tbsCertificate.extensions?.authorityKeyIdentifier?.keyIdentifier;
@@ -1756,7 +1774,7 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
     await this.#readCertificates();
   }
   async withLock2(action) {
-    const lockFileName = path6.join(this.rootDir, "mutex.lock");
+    const lockFileName = path6.join(this.rootDir, "mutex");
     return withLock({ fileToLock: lockFileName }, async () => {
       return await action();
     });
@@ -1967,7 +1985,7 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
    * @param target - "issuers", "trusted", or "all" (default "all")
    */
   async removeRevocationListsForIssuer(issuerCertificate, target = "all") {
-    const issuerInfo = exploreCertificate(issuerCertificate);
+    const issuerInfo = exploreCertificateCached(issuerCertificate);
     const issuerFingerprint = issuerInfo.tbsCertificate.subjectFingerPrint;
     const processIndex = async (index) => {
       const crlData = index.get(issuerFingerprint);
@@ -2013,7 +2031,7 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
     const certificates = split_der(certificateChain);
     const leafCertificate = certificates[0];
     try {
-      exploreCertificate(leafCertificate);
+      exploreCertificateCached(leafCertificate);
     } catch (_err) {
       return "BadCertificateInvalid" /* BadCertificateInvalid */;
     }
@@ -2073,7 +2091,7 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
    *
    */
   async findIssuerCertificate(certificate) {
-    const certInfo = exploreCertificate(certificate);
+    const certInfo = exploreCertificateCached(certificate);
     if (isSelfSigned2(certInfo)) {
       return certificate;
     }
@@ -2154,7 +2172,7 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
     });
   }
   #findAssociatedCRLs(issuerCertificate) {
-    const issuerCertificateInfo = exploreCertificate(issuerCertificate);
+    const issuerCertificateInfo = exploreCertificateCached(issuerCertificate);
     const key = issuerCertificateInfo.tbsCertificate.subjectFingerPrint;
     return this.#thumbs.issuersCrl.get(key) ?? this.#thumbs.crl.get(key) ?? null;
   }
@@ -2188,7 +2206,7 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
     if (!crls) {
       return "BadCertificateRevocationUnknown" /* BadCertificateRevocationUnknown */;
     }
-    const certInfo = exploreCertificate(certificate);
+    const certInfo = exploreCertificateCached(certificate);
     const serialNumber = certInfo.tbsCertificate.serialNumber || certInfo.tbsCertificate.extensions?.authorityKeyIdentifier?.serial || "";
     const key = certInfo.tbsCertificate.extensions?.authorityKeyIdentifier?.authorityCertIssuerFingerPrint || "<unknown>";
     const crl2 = this.#thumbs.crl.get(key) ?? null;
@@ -2255,22 +2273,31 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
       ...usePolling ? { interval: pollingInterval } : {},
       persistent: false
     };
-    const createUnreffedWatcher = (folder) => {
-      const capturedHandles = [];
-      const origWatch = fs9.watch;
-      fs9.watch = ((...args) => {
-        const handle = origWatch.apply(fs9, args);
-        capturedHandles.push(handle);
-        return handle;
+    const allCapturedHandles = [];
+    const origWatch = fs9.watch;
+    let watcherReadyCount = 0;
+    const totalWatchers = 5;
+    fs9.watch = ((...args) => {
+      const handle = origWatch.apply(fs9, args);
+      handle.setMaxListeners(handle.getMaxListeners() + 1);
+      handle.on("error", () => {
       });
+      allCapturedHandles.push(handle);
+      return handle;
+    });
+    const createUnreffedWatcher = (folder) => {
+      const startIdx = allCapturedHandles.length;
       const w = chokidar.watch(folder, chokidarOptions);
       const unreffAll = () => {
-        fs9.watch = origWatch;
-        for (const h of capturedHandles) {
-          h.unref();
+        for (let i = startIdx; i < allCapturedHandles.length; i++) {
+          allCapturedHandles[i].unref();
+        }
+        watcherReadyCount++;
+        if (watcherReadyCount >= totalWatchers) {
+          fs9.watch = origWatch;
         }
       };
-      return { w, capturedHandles, unreffAll };
+      return { w, capturedHandles: allCapturedHandles.slice(startIdx), unreffAll };
     };
     await Promise.all([
       this.#scanCertFolder(this.trustedFolder, this.#thumbs.trusted),
@@ -2299,7 +2326,7 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
         const stat = await fs9.promises.stat(filename);
         if (!stat.isFile()) continue;
         const certificate = await readCertificateAsync(filename);
-        const info = exploreCertificate(certificate);
+        const info = exploreCertificateCached(certificate);
         const fingerprint = makeFingerprint(certificate);
         index.set(fingerprint, { certificate, filename, info });
         this.#filenameToHash.set(filename, fingerprint);
@@ -2332,6 +2359,9 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
    */
   #startCrlWatcher(folder, index, createUnreffedWatcher, store) {
     const { w, unreffAll } = createUnreffedWatcher(folder);
+    w.on("error", (err) => {
+      debugLog(`chokidar CRL watcher error on ${folder}:`, err);
+    });
     let ready = false;
     w.on("unlink", (filename) => {
       for (const [key, data] of index.entries()) {
@@ -2367,6 +2397,9 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
    */
   #startWatcher(folder, index, createUnreffedWatcher, store) {
     const { w, unreffAll } = createUnreffedWatcher(folder);
+    w.on("error", (err) => {
+      debugLog(`chokidar cert watcher error on ${folder}:`, err);
+    });
     let ready = false;
     w.on("unlink", (filename) => {
       debugLog(chalk6.cyan(`unlink in folder ${folder}`), filename);
@@ -2380,7 +2413,7 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
       debugLog(chalk6.cyan(`add in folder ${folder}`), filename);
       try {
         const certificate = readCertificate(filename);
-        const info = exploreCertificate(certificate);
+        const info = exploreCertificateCached(certificate);
         const fingerprint = makeFingerprint(certificate);
         const isNew = !index.has(fingerprint);
         index.set(fingerprint, { certificate, filename, info });
@@ -2408,7 +2441,7 @@ var CertificateManager = class _CertificateManager extends EventEmitter {
         if (oldHash && oldHash !== newFingerprint) {
           index.delete(oldHash);
         }
-        index.set(newFingerprint, { certificate, filename: changedPath, info: exploreCertificate(certificate) });
+        index.set(newFingerprint, { certificate, filename: changedPath, info: exploreCertificateCached(certificate) });
         this.#filenameToHash.set(changedPath, newFingerprint);
         this.emit("certificateChange", { store, certificate, fingerprint: newFingerprint, filename: changedPath });
       } catch (err) {