node-opcua-role-set-admin 2.174.0

package/LICENSE

@@ -0,0 +1,22 @@
+The MIT License (MIT)
+
+Copyright (c) 2022-2024  Sterfive SAS - 833264583 RCS ORLEANS - France (https://www.sterfive.com)
+
+Copyright (c) 2014-2022 Etienne Rossignon
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -0,0 +1,87 @@
+# node-opcua-role-set-admin
+
+A small command-line tool to administer the **RoleSet** and **User Management**
+(OPC 10000-18) of any OPC UA server, built on
+[`node-opcua-role-set-client`](../node-opcua-role-set-client). It connects over a
+real session and drives the standard Methods, so it works against any compliant
+server.
+
+## Install
+
+```bash
+npm install -g node-opcua-role-set-admin
+```
+
+This installs the `role-set-admin` command.
+
+## Usage
+
+```bash
+role-set-admin -e opc.tcp://host:4840 -u admin -p ***  list-roles
+role-set-admin -e opc.tcp://host:4840 -u admin          show-role Operator   # password prompted
+role-set-admin -e ... -u admin -p *** add-identity Operator joe
+role-set-admin -e ... -u admin -p *** add-user alice s3cret -r Operator
+role-set-admin -e ... -u admin -p *** remove-user alice
+```
+
+By default it connects with **SignAndEncrypt / Basic256Sha256** (most management
+Methods require an encrypted channel and the `SecurityAdmin` Role). Use
+`--insecure` for `None/None`.
+
+If `--password` is omitted (but `--username` is given), the password is read from
+the terminal with **hidden input** — so it never lands in your shell history or
+the process list.
+
+### Global options
+
+| Option | Description |
+|--------|-------------|
+| `-e, --endpoint <url>` | OPC UA endpoint (required), e.g. `opc.tcp://host:4840`. |
+| `-u, --username <name>` | User name (omit for anonymous). |
+| `-p, --password <pw>` | Password (prompted with hidden input if omitted). |
+| `--insecure` | Connect without security (`None/None`). |
+
+### Commands
+
+| Command | Description |
+|---------|-------------|
+| `list-roles` | List all Roles and their identities. |
+| `show-role <name>` | Show one Role's identities. |
+| `add-role <name>` | Add a custom Role. |
+| `remove-role <name>` | Remove a custom Role. |
+| `add-identity <role> <user>` | Map a UserName to a Role. |
+| `remove-identity <role> <user>` | Unmap a UserName from a Role. |
+| `list-users` | List managed users. |
+| `add-user <user> <password> [-r <role...>]` | Add a user, optionally granting Roles. |
+| `remove-user <user>` | Remove a user. |
+| `change-password <old> <new>` | Change the connected user's password. |
+
+## Programmatic API
+
+The command actions are also exported, so you can script the same administration:
+
+```ts
+import { addIdentity, listRoles } from "node-opcua-role-set-admin";
+
+await listRoles({ endpoint: "opc.tcp://host:4840", username: "admin", password: "***" });
+await addIdentity({ endpoint, username: "admin", password: "***" }, "Operator", "joe");
+```
+
+## Related packages
+
+- [`node-opcua-role-set-client`](../node-opcua-role-set-client) — client-side RoleSet/UserManagement API.
+- [`node-opcua-role-set-server`](../node-opcua-role-set-server) — server-side install & enforcement.
+- [`node-opcua-role-set-common`](../node-opcua-role-set-common) — shared stores, persistence, matching.
+- [Role-Based Security & User Management guide](https://github.com/node-opcua/node-opcua/blob/master/documentation/role_based_security.md) — cross-package overview & getting started.
+
+# License
+
+Node-OPCUA is made available to you under the MIT open source license.
+
+See [LICENSE](./LICENSE) for details.
+
+# Copyright
+
+Copyright (c) 2022-2026 Sterfive SAS - https://www.sterfive.com
+
+Copyright (c) 2014-2022 Etienne Rossignon

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,52 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * @module node-opcua-role-set-admin
+ *
+ * `role-set-admin` — administer the RoleSet & User Management (OPC 10000-18) of
+ * any OPC UA server over a real session.
+ */
+const commander_1 = require("commander");
+const commands_js_1 = require("./commands.js");
+const program = new commander_1.Command()
+    .name("role-set-admin")
+    .description("Administer the RoleSet & User Management of an OPC UA server (OPC 10000-18)")
+    .requiredOption("-e, --endpoint <url>", "OPC UA endpoint, e.g. opc.tcp://host:4840")
+    .option("-u, --username <name>", "user name (omit for anonymous)")
+    .option("-p, --password <password>", "password (prompted with hidden input if omitted)")
+    .option("--insecure", "connect without security (None/None) instead of SignAndEncrypt");
+const fail = (err) => {
+    console.error(`error: ${err.message}`);
+    process.exit(1);
+};
+/**
+ * Adapt one of the {@link GlobalOpts}-first command actions to a commander
+ * handler. commander appends an options object (for commands with options) and
+ * the `Command` itself after the declared positionals — we keep only the leading
+ * string positionals and read the global options off the root program.
+ */
+function run(action) {
+    return (...args) => {
+        const positionals = args.filter((a) => typeof a === "string");
+        action(program.opts(), ...positionals).catch(fail);
+    };
+}
+program.command("list-roles").description("list all Roles and their identities").action(run(commands_js_1.listRoles));
+program.command("show-role <name>").description("show one Role's identities").action(run(commands_js_1.showRole));
+program.command("add-role <name>").description("add a custom Role").action(run(commands_js_1.addRole));
+program.command("remove-role <name>").description("remove a custom Role").action(run(commands_js_1.removeRole));
+program.command("add-identity <role> <user>").description("map a UserName to a Role").action(run(commands_js_1.addIdentity));
+program.command("remove-identity <role> <user>").description("unmap a UserName from a Role").action(run(commands_js_1.removeIdentity));
+program.command("list-users").description("list managed users").action(run(commands_js_1.listUsers));
+program
+    .command("add-user <user> <password>")
+    .description("add a user, optionally granting Roles")
+    .option("-r, --role <name...>", "Role(s) to grant", [])
+    .action((user, password, cmdOpts) => {
+    (0, commands_js_1.addUser)(program.opts(), user, password, cmdOpts.role).catch(fail);
+});
+program.command("remove-user <user>").description("remove a user").action(run(commands_js_1.removeUser));
+program.command("change-password <old> <new>").description("change the connected user's password").action(run(commands_js_1.changePassword));
+program.parse(process.argv);
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../source/cli.ts"],"names":[],"mappings":";;;AACA;;;;;GAKG;AACH,yCAAoC;AACpC,+CAYuB;AAEvB,MAAM,OAAO,GAAG,IAAI,mBAAO,EAAE;KACxB,IAAI,CAAC,gBAAgB,CAAC;KACtB,WAAW,CAAC,6EAA6E,CAAC;KAC1F,cAAc,CAAC,sBAAsB,EAAE,2CAA2C,CAAC;KACnF,MAAM,CAAC,uBAAuB,EAAE,gCAAgC,CAAC;KACjE,MAAM,CAAC,2BAA2B,EAAE,kDAAkD,CAAC;KACvF,MAAM,CAAC,YAAY,EAAE,gEAAgE,CAAC,CAAC;AAE5F,MAAM,IAAI,GAAG,CAAC,GAAU,EAAS,EAAE;IAC/B,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IACvC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC,CAAC;AAEF;;;;;GAKG;AACH,SAAS,GAAG,CAAC,MAA8D;IACvE,OAAO,CAAC,GAAG,IAAe,EAAE,EAAE;QAC1B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QAC3E,MAAM,CAAC,OAAO,CAAC,IAAI,EAAc,EAAE,GAAG,WAAW,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnE,CAAC,CAAC;AACN,CAAC;AAED,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,WAAW,CAAC,qCAAqC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,uBAAS,CAAC,CAAC,CAAC;AACxG,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,WAAW,CAAC,4BAA4B,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,sBAAQ,CAAC,CAAC,CAAC;AACpG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,qBAAO,CAAC,CAAC,CAAC;AACzF,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,wBAAU,CAAC,CAAC,CAAC;AAClG,OAAO,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,WAAW,CAAC,0BAA0B,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,yBAAW,CAAC,CAAC,CAAC;AAC/G,OAAO,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC,WAAW,CAAC,8BAA8B,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,4BAAc,CAAC,CAAC,CAAC;AACzH,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,uBAAS,CAAC,CAAC,CAAC;AACvF,OAAO;KACF,OAAO,CAAC,4BAA4B,CAAC;KACrC,WAAW,CAAC,uCAAuC,CAAC;KACpD,MAAM,CAAC,sBAAsB,EAAE,kBAAkB,EAAE,EAAE,CAAC;KACtD,MAAM,CAAC,CAAC,IAAY,EAAE,QAAgB,EAAE,OAA2B,EAAE,EAAE;IACpE,IAAA,qBAAO,EAAC,OAAO,CAAC,IAAI,EAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAClF,CAAC,CAAC,CAAC;AACP,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,wBAAU,CAAC,CAAC,CAAC;AAC3F,OAAO,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC,WAAW,CAAC,sCAAsC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,4BAAc,CAAC,CAAC,CAAC;AAE/H,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC"}

package/dist/commands.d.ts

@@ -0,0 +1,21 @@
+import { type ClientSession } from "node-opcua-client";
+/** Connection + identity options shared by every command. */
+export interface GlobalOpts {
+    endpoint: string;
+    username?: string;
+    password?: string;
+    /** Connect without security (None/None) instead of SignAndEncrypt/Basic256Sha256. */
+    insecure?: boolean;
+}
+/** Connect, run `fn` in a session, then tear everything down. */
+export declare function withSession<T>(opts: GlobalOpts, fn: (session: ClientSession) => Promise<T>): Promise<T>;
+export declare function listRoles(opts: GlobalOpts): Promise<void>;
+export declare function showRole(opts: GlobalOpts, name: string): Promise<void>;
+export declare function addRole(opts: GlobalOpts, name: string): Promise<void>;
+export declare function removeRole(opts: GlobalOpts, name: string): Promise<void>;
+export declare function addIdentity(opts: GlobalOpts, roleName: string, userName: string): Promise<void>;
+export declare function removeIdentity(opts: GlobalOpts, roleName: string, userName: string): Promise<void>;
+export declare function listUsers(opts: GlobalOpts): Promise<void>;
+export declare function addUser(opts: GlobalOpts, userName: string, password: string, roles: string[]): Promise<void>;
+export declare function removeUser(opts: GlobalOpts, userName: string): Promise<void>;
+export declare function changePassword(opts: GlobalOpts, oldPassword: string, newPassword: string): Promise<void>;

package/dist/commands.js

@@ -0,0 +1,176 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.withSession = withSession;
+exports.listRoles = listRoles;
+exports.showRole = showRole;
+exports.addRole = addRole;
+exports.removeRole = removeRole;
+exports.addIdentity = addIdentity;
+exports.removeIdentity = removeIdentity;
+exports.listUsers = listUsers;
+exports.addUser = addUser;
+exports.removeUser = removeUser;
+exports.changePassword = changePassword;
+/**
+ * @module node-opcua-role-set-admin
+ *
+ * The connection helper and command actions behind the `role-set-admin` CLI,
+ * built on `ClientRoleSet` / `ClientUserManagement`. Exported so they can also be
+ * driven programmatically.
+ */
+const node_fs_1 = require("node:fs");
+const node_os_1 = __importDefault(require("node:os"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_opcua_certificate_manager_1 = require("node-opcua-certificate-manager");
+const node_opcua_client_1 = require("node-opcua-client");
+const node_opcua_role_set_client_1 = require("node-opcua-role-set-client");
+const node_opcua_status_code_1 = require("node-opcua-status-code");
+const node_opcua_types_1 = require("node-opcua-types");
+const userNameRule = (userName) => new node_opcua_types_1.IdentityMappingRuleType({ criteriaType: node_opcua_types_1.IdentityCriteriaType.UserName, criteria: userName });
+/**
+ * Resolve the password: use `--password` if given, otherwise prompt for it with
+ * hidden input (so it never lands in shell history or the process list). A
+ * non-interactive run without `--password` is an error.
+ */
+async function resolvePassword(opts) {
+    if (opts.username === undefined || opts.password !== undefined) {
+        return opts.password; // anonymous, or password already supplied
+    }
+    if (!process.stdin.isTTY) {
+        throw new Error(`password required for '${opts.username}': pass --password or run in an interactive terminal`);
+    }
+    // @inquirer/prompts is ESM-only; load it lazily so this CommonJS module can use it.
+    const { password } = await import("@inquirer/prompts");
+    return password({ message: `Password for ${opts.username}:`, mask: "*" });
+}
+/** Connect, run `fn` in a session, then tear everything down. */
+async function withSession(opts, fn) {
+    const password = await resolvePassword(opts);
+    const secure = !opts.insecure;
+    const pkiRoot = node_path_1.default.join(node_os_1.default.tmpdir(), `role-set-admin-${process.pid}`);
+    const clientCertificateManager = new node_opcua_certificate_manager_1.OPCUACertificateManager({
+        rootFolder: pkiRoot,
+        automaticallyAcceptUnknownCertificate: true
+    });
+    await clientCertificateManager.initialize();
+    const client = node_opcua_client_1.OPCUAClient.create({
+        endpointMustExist: false,
+        securityMode: secure ? node_opcua_client_1.MessageSecurityMode.SignAndEncrypt : node_opcua_client_1.MessageSecurityMode.None,
+        securityPolicy: secure ? node_opcua_client_1.SecurityPolicy.Basic256Sha256 : node_opcua_client_1.SecurityPolicy.None,
+        clientCertificateManager
+    });
+    await client.connect(opts.endpoint);
+    try {
+        const userIdentity = opts.username !== undefined
+            ? { type: node_opcua_client_1.UserTokenType.UserName, userName: opts.username, password: password ?? "" }
+            : undefined;
+        const session = await client.createSession(userIdentity);
+        try {
+            return await fn(session);
+        }
+        finally {
+            await session.close();
+        }
+    }
+    finally {
+        await client.disconnect();
+        await clientCertificateManager.dispose();
+        await node_fs_1.promises.rm(pkiRoot, { recursive: true, force: true }).catch(() => undefined);
+    }
+}
+/** Print a StatusCode result and mark the process failed if it is not Good. */
+function reportStatus(label, statusCode) {
+    const ok = statusCode === node_opcua_status_code_1.StatusCodes.Good;
+    console.log(`${ok ? "✓" : "✗"} ${label}: ${statusCode.name}`);
+    if (!ok)
+        process.exitCode = 1;
+}
+async function getRoleOrThrow(roleSet, name) {
+    const role = await roleSet.getRole(name);
+    if (!role)
+        throw new Error(`role '${name}' not found`);
+    return role;
+}
+async function listRoles(opts) {
+    await withSession(opts, async (session) => {
+        const roleSet = new node_opcua_role_set_client_1.ClientRoleSet(session);
+        for (const role of await roleSet.getRoles()) {
+            const identities = await role.readIdentities();
+            const who = identities.map((i) => i.criteria).join(", ") || "—";
+            console.log(`${role.roleName.padEnd(20)} ${role.roleNodeId.toString().padEnd(18)} identities: ${who}`);
+        }
+    });
+}
+async function showRole(opts, name) {
+    await withSession(opts, async (session) => {
+        const role = await getRoleOrThrow(new node_opcua_role_set_client_1.ClientRoleSet(session), name);
+        console.log(`Role ${role.roleName} (${role.roleNodeId.toString()})`);
+        const identities = await role.readIdentities();
+        if (identities.length === 0) {
+            console.log("  (no identities)");
+        }
+        for (const i of identities) {
+            console.log(`  - ${node_opcua_types_1.IdentityCriteriaType[i.criteriaType]}: ${i.criteria}`);
+        }
+    });
+}
+async function addRole(opts, name) {
+    await withSession(opts, async (session) => {
+        const { statusCode, roleNodeId } = await new node_opcua_role_set_client_1.ClientRoleSet(session).addRole(name);
+        reportStatus(`AddRole '${name}'${roleNodeId ? ` -> ${roleNodeId.toString()}` : ""}`, statusCode);
+    });
+}
+async function removeRole(opts, name) {
+    await withSession(opts, async (session) => {
+        const roleSet = new node_opcua_role_set_client_1.ClientRoleSet(session);
+        const role = await getRoleOrThrow(roleSet, name);
+        reportStatus(`RemoveRole '${name}'`, (await roleSet.removeRole(role.roleNodeId)).statusCode);
+    });
+}
+async function addIdentity(opts, roleName, userName) {
+    await withSession(opts, async (session) => {
+        const role = await getRoleOrThrow(new node_opcua_role_set_client_1.ClientRoleSet(session), roleName);
+        reportStatus(`AddIdentity ${userName} -> ${roleName}`, (await role.addIdentity(userNameRule(userName))).statusCode);
+    });
+}
+async function removeIdentity(opts, roleName, userName) {
+    await withSession(opts, async (session) => {
+        const role = await getRoleOrThrow(new node_opcua_role_set_client_1.ClientRoleSet(session), roleName);
+        reportStatus(`RemoveIdentity ${userName} from ${roleName}`, (await role.removeIdentity(userNameRule(userName))).statusCode);
+    });
+}
+async function listUsers(opts) {
+    await withSession(opts, async (session) => {
+        for (const u of await new node_opcua_role_set_client_1.ClientUserManagement(session).readUsers()) {
+            console.log(`${(u.userName ?? "").padEnd(20)} config=${u.userConfiguration} ${u.description ?? ""}`);
+        }
+    });
+}
+async function addUser(opts, userName, password, roles) {
+    await withSession(opts, async (session) => {
+        const um = new node_opcua_role_set_client_1.ClientUserManagement(session);
+        const addStatus = (await um.addUser(userName, password, node_opcua_types_1.UserConfigurationMask.None, "")).statusCode;
+        reportStatus(`AddUser '${userName}'`, addStatus);
+        if (addStatus !== node_opcua_status_code_1.StatusCodes.Good)
+            return;
+        const roleSet = new node_opcua_role_set_client_1.ClientRoleSet(session);
+        for (const roleName of roles) {
+            const role = await getRoleOrThrow(roleSet, roleName);
+            reportStatus(`  + identity ${userName} -> ${roleName}`, (await role.addIdentity(userNameRule(userName))).statusCode);
+        }
+    });
+}
+async function removeUser(opts, userName) {
+    await withSession(opts, async (session) => {
+        reportStatus(`RemoveUser '${userName}'`, (await new node_opcua_role_set_client_1.ClientUserManagement(session).removeUser(userName)).statusCode);
+    });
+}
+async function changePassword(opts, oldPassword, newPassword) {
+    await withSession(opts, async (session) => {
+        reportStatus("ChangePassword", (await new node_opcua_role_set_client_1.ClientUserManagement(session).changePassword(oldPassword, newPassword)).statusCode);
+    });
+}
+//# sourceMappingURL=commands.js.map

package/dist/commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../source/commands.ts"],"names":[],"mappings":";;;;;AA8CA,kCAiCC;AAeD,8BASC;AAED,4BAYC;AAED,0BAKC;AAED,gCAMC;AAED,kCAKC;AAED,wCAKC;AAED,8BAMC;AAED,0BAYC;AAED,gCAIC;AAED,wCAOC;AAvLD;;;;;;GAMG;AACH,qCAAyC;AACzC,sDAAyB;AACzB,0DAA6B;AAC7B,mFAAyE;AACzE,yDAAwH;AACxH,2EAAiF;AACjF,mEAAsE;AACtE,uDAAwG;AAWxG,MAAM,YAAY,GAAG,CAAC,QAAgB,EAAE,EAAE,CACtC,IAAI,0CAAuB,CAAC,EAAE,YAAY,EAAE,uCAAoB,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;AAErG;;;;GAIG;AACH,KAAK,UAAU,eAAe,CAAC,IAAgB;IAC3C,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC7D,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,0CAA0C;IACpE,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,QAAQ,sDAAsD,CAAC,CAAC;IACnH,CAAC;IACD,oFAAoF;IACpF,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACvD,OAAO,QAAQ,CAAC,EAAE,OAAO,EAAE,gBAAgB,IAAI,CAAC,QAAQ,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,iEAAiE;AAC1D,KAAK,UAAU,WAAW,CAAI,IAAgB,EAAE,EAA0C;IAC7F,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;IAC9B,MAAM,OAAO,GAAG,mBAAI,CAAC,IAAI,CAAC,iBAAE,CAAC,MAAM,EAAE,EAAE,kBAAkB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACxE,MAAM,wBAAwB,GAAG,IAAI,wDAAuB,CAAC;QACzD,UAAU,EAAE,OAAO;QACnB,qCAAqC,EAAE,IAAI;KAC9C,CAAC,CAAC;IACH,MAAM,wBAAwB,CAAC,UAAU,EAAE,CAAC;IAE5C,MAAM,MAAM,GAAG,+BAAW,CAAC,MAAM,CAAC;QAC9B,iBAAiB,EAAE,KAAK;QACxB,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,uCAAmB,CAAC,cAAc,CAAC,CAAC,CAAC,uCAAmB,CAAC,IAAI;QACpF,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,kCAAc,CAAC,cAAc,CAAC,CAAC,CAAC,kCAAc,CAAC,IAAI;QAC5E,wBAAwB;KAC3B,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,CAAC;QACD,MAAM,YAAY,GACd,IAAI,CAAC,QAAQ,KAAK,SAAS;YACvB,CAAC,CAAC,EAAE,IAAI,EAAE,iCAAa,CAAC,QAAiB,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,IAAI,EAAE,EAAE;YAC9F,CAAC,CAAC,SAAS,CAAC;QACpB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QACzD,IAAI,CAAC;YACD,OAAO,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;gBAAS,CAAC;YACP,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QAC1B,CAAC;IACL,CAAC;YAAS,CAAC;QACP,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;QAC1B,MAAM,wBAAwB,CAAC,OAAO,EAAE,CAAC;QACzC,MAAM,kBAAE,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAClF,CAAC;AACL,CAAC;AAED,+EAA+E;AAC/E,SAAS,YAAY,CAAC,KAAa,EAAE,UAAsB;IACvD,MAAM,EAAE,GAAG,UAAU,KAAK,oCAAW,CAAC,IAAI,CAAC;IAC3C,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,KAAK,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9D,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AAClC,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,OAAsB,EAAE,IAAY;IAC9D,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,aAAa,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC;AAChB,CAAC;AAEM,KAAK,UAAU,SAAS,CAAC,IAAgB;IAC5C,MAAM,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACtC,MAAM,OAAO,GAAG,IAAI,0CAAa,CAAC,OAAO,CAAC,CAAC;QAC3C,KAAK,MAAM,IAAI,IAAI,MAAM,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC1C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAC/C,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC;YAChE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,gBAAgB,GAAG,EAAE,CAAC,CAAC;QAC3G,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC;AAEM,KAAK,UAAU,QAAQ,CAAC,IAAgB,EAAE,IAAY;IACzD,MAAM,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACtC,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,0CAAa,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACrE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC/C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACrC,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,OAAO,uCAAoB,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9E,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC;AAEM,KAAK,UAAU,OAAO,CAAC,IAAgB,EAAE,IAAY;IACxD,MAAM,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACtC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,MAAM,IAAI,0CAAa,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClF,YAAY,CAAC,YAAY,IAAI,IAAI,UAAU,CAAC,CAAC,CAAC,OAAO,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC;IACrG,CAAC,CAAC,CAAC;AACP,CAAC;AAEM,KAAK,UAAU,UAAU,CAAC,IAAgB,EAAE,IAAY;IAC3D,MAAM,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACtC,MAAM,OAAO,GAAG,IAAI,0CAAa,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACjD,YAAY,CAAC,eAAe,IAAI,GAAG,EAAE,CAAC,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACjG,CAAC,CAAC,CAAC;AACP,CAAC;AAEM,KAAK,UAAU,WAAW,CAAC,IAAgB,EAAE,QAAgB,EAAE,QAAgB;IAClF,MAAM,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACtC,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,0CAAa,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;QACxE,YAAY,CAAC,eAAe,QAAQ,OAAO,QAAQ,EAAE,EAAE,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACxH,CAAC,CAAC,CAAC;AACP,CAAC;AAEM,KAAK,UAAU,cAAc,CAAC,IAAgB,EAAE,QAAgB,EAAE,QAAgB;IACrF,MAAM,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACtC,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,0CAAa,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;QACxE,YAAY,CAAC,kBAAkB,QAAQ,SAAS,QAAQ,EAAE,EAAE,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAChI,CAAC,CAAC,CAAC;AACP,CAAC;AAEM,KAAK,UAAU,SAAS,CAAC,IAAgB;IAC5C,MAAM,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACtC,KAAK,MAAM,CAAC,IAAI,MAAM,IAAI,iDAAoB,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC;YAClE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,iBAAiB,IAAI,CAAC,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC;QACzG,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC;AAEM,KAAK,UAAU,OAAO,CAAC,IAAgB,EAAE,QAAgB,EAAE,QAAgB,EAAE,KAAe;IAC/F,MAAM,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACtC,MAAM,EAAE,GAAG,IAAI,iDAAoB,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,SAAS,GAAG,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,wCAAqB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;QACpG,YAAY,CAAC,YAAY,QAAQ,GAAG,EAAE,SAAS,CAAC,CAAC;QACjD,IAAI,SAAS,KAAK,oCAAW,CAAC,IAAI;YAAE,OAAO;QAC3C,MAAM,OAAO,GAAG,IAAI,0CAAa,CAAC,OAAO,CAAC,CAAC;QAC3C,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACrD,YAAY,CAAC,gBAAgB,QAAQ,OAAO,QAAQ,EAAE,EAAE,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACzH,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC;AAEM,KAAK,UAAU,UAAU,CAAC,IAAgB,EAAE,QAAgB;IAC/D,MAAM,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACtC,YAAY,CAAC,eAAe,QAAQ,GAAG,EAAE,CAAC,MAAM,IAAI,iDAAoB,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACxH,CAAC,CAAC,CAAC;AACP,CAAC;AAEM,KAAK,UAAU,cAAc,CAAC,IAAgB,EAAE,WAAmB,EAAE,WAAmB;IAC3F,MAAM,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACtC,YAAY,CACR,gBAAgB,EAChB,CAAC,MAAM,IAAI,iDAAoB,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,UAAU,CAChG,CAAC;IACN,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * @module node-opcua-role-set-admin
+ *
+ * Programmatic API behind the `role-set-admin` CLI. Import these to script the
+ * same RoleSet / User Management administration from your own code.
+ */
+export { addIdentity, addRole, addUser, changePassword, type GlobalOpts, listRoles, listUsers, removeIdentity, removeRole, removeUser, showRole, withSession } from "./commands.js";

package/dist/index.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.withSession = exports.showRole = exports.removeUser = exports.removeRole = exports.removeIdentity = exports.listUsers = exports.listRoles = exports.changePassword = exports.addUser = exports.addRole = exports.addIdentity = void 0;
+/**
+ * @module node-opcua-role-set-admin
+ *
+ * Programmatic API behind the `role-set-admin` CLI. Import these to script the
+ * same RoleSet / User Management administration from your own code.
+ */
+var commands_js_1 = require("./commands.js");
+Object.defineProperty(exports, "addIdentity", { enumerable: true, get: function () { return commands_js_1.addIdentity; } });
+Object.defineProperty(exports, "addRole", { enumerable: true, get: function () { return commands_js_1.addRole; } });
+Object.defineProperty(exports, "addUser", { enumerable: true, get: function () { return commands_js_1.addUser; } });
+Object.defineProperty(exports, "changePassword", { enumerable: true, get: function () { return commands_js_1.changePassword; } });
+Object.defineProperty(exports, "listRoles", { enumerable: true, get: function () { return commands_js_1.listRoles; } });
+Object.defineProperty(exports, "listUsers", { enumerable: true, get: function () { return commands_js_1.listUsers; } });
+Object.defineProperty(exports, "removeIdentity", { enumerable: true, get: function () { return commands_js_1.removeIdentity; } });
+Object.defineProperty(exports, "removeRole", { enumerable: true, get: function () { return commands_js_1.removeRole; } });
+Object.defineProperty(exports, "removeUser", { enumerable: true, get: function () { return commands_js_1.removeUser; } });
+Object.defineProperty(exports, "showRole", { enumerable: true, get: function () { return commands_js_1.showRole; } });
+Object.defineProperty(exports, "withSession", { enumerable: true, get: function () { return commands_js_1.withSession; } });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../source/index.ts"],"names":[],"mappings":";;;AAAA;;;;;GAKG;AACH,6CAauB;AAZnB,0GAAA,WAAW,OAAA;AACX,sGAAA,OAAO,OAAA;AACP,sGAAA,OAAO,OAAA;AACP,6GAAA,cAAc,OAAA;AAEd,wGAAA,SAAS,OAAA;AACT,wGAAA,SAAS,OAAA;AACT,6GAAA,cAAc,OAAA;AACd,yGAAA,UAAU,OAAA;AACV,yGAAA,UAAU,OAAA;AACV,uGAAA,QAAQ,OAAA;AACR,0GAAA,WAAW,OAAA"}

package/package.json

@@ -0,0 +1,53 @@
+{
+    "name": "node-opcua-role-set-admin",
+    "version": "2.174.0",
+    "description": "pure nodejs OPCUA SDK - role-set-admin CLI to administer RoleSet & User Management (OPC 10000-18)",
+    "scripts": {
+        "build": "tsc -b",
+        "clean": "npx rimraf -g node_modules dist *.tsbuildinfo",
+        "role-set-admin": "tsx source/cli.ts"
+    },
+    "main": "./dist/index.js",
+    "types": "./dist/index.d.ts",
+    "bin": {
+        "role-set-admin": "./dist/cli.js"
+    },
+    "devEngines": {
+        "node": ">=18.x",
+        "npm": ">=10.x"
+    },
+    "dependencies": {
+        "@inquirer/prompts": "8.5.2",
+        "commander": "^12.1.0",
+        "node-opcua-certificate-manager": "2.174.0",
+        "node-opcua-client": "2.174.0",
+        "node-opcua-role-set-client": "2.174.0",
+        "node-opcua-status-code": "2.173.0",
+        "node-opcua-types": "2.174.0"
+    },
+    "devDependencies": {
+        "tsx": "^4.22.4"
+    },
+    "author": "Etienne Rossignon",
+    "license": "MIT",
+    "repository": {
+        "type": "git",
+        "url": "git://github.com/node-opcua/node-opcua.git"
+    },
+    "keywords": [
+        "OPCUA",
+        "opcua",
+        "m2m",
+        "iot",
+        "opc ua",
+        "internet of things",
+        "role",
+        "rbac",
+        "cli"
+    ],
+    "homepage": "http://node-opcua.github.io/",
+    "files": [
+        "dist",
+        "source"
+    ]
+}

package/source/cli.ts

@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+/**
+ * @module node-opcua-role-set-admin
+ *
+ * `role-set-admin` — administer the RoleSet & User Management (OPC 10000-18) of
+ * any OPC UA server over a real session.
+ */
+import { Command } from "commander";
+import {
+    addIdentity,
+    addRole,
+    addUser,
+    changePassword,
+    type GlobalOpts,
+    listRoles,
+    listUsers,
+    removeIdentity,
+    removeRole,
+    removeUser,
+    showRole
+} from "./commands.js";
+
+const program = new Command()
+    .name("role-set-admin")
+    .description("Administer the RoleSet & User Management of an OPC UA server (OPC 10000-18)")
+    .requiredOption("-e, --endpoint <url>", "OPC UA endpoint, e.g. opc.tcp://host:4840")
+    .option("-u, --username <name>", "user name (omit for anonymous)")
+    .option("-p, --password <password>", "password (prompted with hidden input if omitted)")
+    .option("--insecure", "connect without security (None/None) instead of SignAndEncrypt");
+
+const fail = (err: Error): never => {
+    console.error(`error: ${err.message}`);
+    process.exit(1);
+};
+
+/**
+ * Adapt one of the {@link GlobalOpts}-first command actions to a commander
+ * handler. commander appends an options object (for commands with options) and
+ * the `Command` itself after the declared positionals — we keep only the leading
+ * string positionals and read the global options off the root program.
+ */
+function run(action: (opts: GlobalOpts, ...args: string[]) => Promise<void>) {
+    return (...args: unknown[]) => {
+        const positionals = args.filter((a): a is string => typeof a === "string");
+        action(program.opts<GlobalOpts>(), ...positionals).catch(fail);
+    };
+}
+
+program.command("list-roles").description("list all Roles and their identities").action(run(listRoles));
+program.command("show-role <name>").description("show one Role's identities").action(run(showRole));
+program.command("add-role <name>").description("add a custom Role").action(run(addRole));
+program.command("remove-role <name>").description("remove a custom Role").action(run(removeRole));
+program.command("add-identity <role> <user>").description("map a UserName to a Role").action(run(addIdentity));
+program.command("remove-identity <role> <user>").description("unmap a UserName from a Role").action(run(removeIdentity));
+program.command("list-users").description("list managed users").action(run(listUsers));
+program
+    .command("add-user <user> <password>")
+    .description("add a user, optionally granting Roles")
+    .option("-r, --role <name...>", "Role(s) to grant", [])
+    .action((user: string, password: string, cmdOpts: { role: string[] }) => {
+        addUser(program.opts<GlobalOpts>(), user, password, cmdOpts.role).catch(fail);
+    });
+program.command("remove-user <user>").description("remove a user").action(run(removeUser));
+program.command("change-password <old> <new>").description("change the connected user's password").action(run(changePassword));
+
+program.parse(process.argv);

package/source/commands.ts

@@ -0,0 +1,184 @@
+/**
+ * @module node-opcua-role-set-admin
+ *
+ * The connection helper and command actions behind the `role-set-admin` CLI,
+ * built on `ClientRoleSet` / `ClientUserManagement`. Exported so they can also be
+ * driven programmatically.
+ */
+import { promises as fs } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { OPCUACertificateManager } from "node-opcua-certificate-manager";
+import { type ClientSession, MessageSecurityMode, OPCUAClient, SecurityPolicy, UserTokenType } from "node-opcua-client";
+import { ClientRoleSet, ClientUserManagement } from "node-opcua-role-set-client";
+import { type StatusCode, StatusCodes } from "node-opcua-status-code";
+import { IdentityCriteriaType, IdentityMappingRuleType, UserConfigurationMask } from "node-opcua-types";
+
+/** Connection + identity options shared by every command. */
+export interface GlobalOpts {
+    endpoint: string;
+    username?: string;
+    password?: string;
+    /** Connect without security (None/None) instead of SignAndEncrypt/Basic256Sha256. */
+    insecure?: boolean;
+}
+
+const userNameRule = (userName: string) =>
+    new IdentityMappingRuleType({ criteriaType: IdentityCriteriaType.UserName, criteria: userName });
+
+/**
+ * Resolve the password: use `--password` if given, otherwise prompt for it with
+ * hidden input (so it never lands in shell history or the process list). A
+ * non-interactive run without `--password` is an error.
+ */
+async function resolvePassword(opts: GlobalOpts): Promise<string | undefined> {
+    if (opts.username === undefined || opts.password !== undefined) {
+        return opts.password; // anonymous, or password already supplied
+    }
+    if (!process.stdin.isTTY) {
+        throw new Error(`password required for '${opts.username}': pass --password or run in an interactive terminal`);
+    }
+    // @inquirer/prompts is ESM-only; load it lazily so this CommonJS module can use it.
+    const { password } = await import("@inquirer/prompts");
+    return password({ message: `Password for ${opts.username}:`, mask: "*" });
+}
+
+/** Connect, run `fn` in a session, then tear everything down. */
+export async function withSession<T>(opts: GlobalOpts, fn: (session: ClientSession) => Promise<T>): Promise<T> {
+    const password = await resolvePassword(opts);
+    const secure = !opts.insecure;
+    const pkiRoot = path.join(os.tmpdir(), `role-set-admin-${process.pid}`);
+    const clientCertificateManager = new OPCUACertificateManager({
+        rootFolder: pkiRoot,
+        automaticallyAcceptUnknownCertificate: true
+    });
+    await clientCertificateManager.initialize();
+
+    const client = OPCUAClient.create({
+        endpointMustExist: false,
+        securityMode: secure ? MessageSecurityMode.SignAndEncrypt : MessageSecurityMode.None,
+        securityPolicy: secure ? SecurityPolicy.Basic256Sha256 : SecurityPolicy.None,
+        clientCertificateManager
+    });
+    await client.connect(opts.endpoint);
+    try {
+        const userIdentity =
+            opts.username !== undefined
+                ? { type: UserTokenType.UserName as const, userName: opts.username, password: password ?? "" }
+                : undefined;
+        const session = await client.createSession(userIdentity);
+        try {
+            return await fn(session);
+        } finally {
+            await session.close();
+        }
+    } finally {
+        await client.disconnect();
+        await clientCertificateManager.dispose();
+        await fs.rm(pkiRoot, { recursive: true, force: true }).catch(() => undefined);
+    }
+}
+
+/** Print a StatusCode result and mark the process failed if it is not Good. */
+function reportStatus(label: string, statusCode: StatusCode): void {
+    const ok = statusCode === StatusCodes.Good;
+    console.log(`${ok ? "✓" : "✗"} ${label}: ${statusCode.name}`);
+    if (!ok) process.exitCode = 1;
+}
+
+async function getRoleOrThrow(roleSet: ClientRoleSet, name: string) {
+    const role = await roleSet.getRole(name);
+    if (!role) throw new Error(`role '${name}' not found`);
+    return role;
+}
+
+export async function listRoles(opts: GlobalOpts): Promise<void> {
+    await withSession(opts, async (session) => {
+        const roleSet = new ClientRoleSet(session);
+        for (const role of await roleSet.getRoles()) {
+            const identities = await role.readIdentities();
+            const who = identities.map((i) => i.criteria).join(", ") || "—";
+            console.log(`${role.roleName.padEnd(20)} ${role.roleNodeId.toString().padEnd(18)} identities: ${who}`);
+        }
+    });
+}
+
+export async function showRole(opts: GlobalOpts, name: string): Promise<void> {
+    await withSession(opts, async (session) => {
+        const role = await getRoleOrThrow(new ClientRoleSet(session), name);
+        console.log(`Role ${role.roleName} (${role.roleNodeId.toString()})`);
+        const identities = await role.readIdentities();
+        if (identities.length === 0) {
+            console.log("  (no identities)");
+        }
+        for (const i of identities) {
+            console.log(`  - ${IdentityCriteriaType[i.criteriaType]}: ${i.criteria}`);
+        }
+    });
+}
+
+export async function addRole(opts: GlobalOpts, name: string): Promise<void> {
+    await withSession(opts, async (session) => {
+        const { statusCode, roleNodeId } = await new ClientRoleSet(session).addRole(name);
+        reportStatus(`AddRole '${name}'${roleNodeId ? ` -> ${roleNodeId.toString()}` : ""}`, statusCode);
+    });
+}
+
+export async function removeRole(opts: GlobalOpts, name: string): Promise<void> {
+    await withSession(opts, async (session) => {
+        const roleSet = new ClientRoleSet(session);
+        const role = await getRoleOrThrow(roleSet, name);
+        reportStatus(`RemoveRole '${name}'`, (await roleSet.removeRole(role.roleNodeId)).statusCode);
+    });
+}
+
+export async function addIdentity(opts: GlobalOpts, roleName: string, userName: string): Promise<void> {
+    await withSession(opts, async (session) => {
+        const role = await getRoleOrThrow(new ClientRoleSet(session), roleName);
+        reportStatus(`AddIdentity ${userName} -> ${roleName}`, (await role.addIdentity(userNameRule(userName))).statusCode);
+    });
+}
+
+export async function removeIdentity(opts: GlobalOpts, roleName: string, userName: string): Promise<void> {
+    await withSession(opts, async (session) => {
+        const role = await getRoleOrThrow(new ClientRoleSet(session), roleName);
+        reportStatus(`RemoveIdentity ${userName} from ${roleName}`, (await role.removeIdentity(userNameRule(userName))).statusCode);
+    });
+}
+
+export async function listUsers(opts: GlobalOpts): Promise<void> {
+    await withSession(opts, async (session) => {
+        for (const u of await new ClientUserManagement(session).readUsers()) {
+            console.log(`${(u.userName ?? "").padEnd(20)} config=${u.userConfiguration} ${u.description ?? ""}`);
+        }
+    });
+}
+
+export async function addUser(opts: GlobalOpts, userName: string, password: string, roles: string[]): Promise<void> {
+    await withSession(opts, async (session) => {
+        const um = new ClientUserManagement(session);
+        const addStatus = (await um.addUser(userName, password, UserConfigurationMask.None, "")).statusCode;
+        reportStatus(`AddUser '${userName}'`, addStatus);
+        if (addStatus !== StatusCodes.Good) return;
+        const roleSet = new ClientRoleSet(session);
+        for (const roleName of roles) {
+            const role = await getRoleOrThrow(roleSet, roleName);
+            reportStatus(`  + identity ${userName} -> ${roleName}`, (await role.addIdentity(userNameRule(userName))).statusCode);
+        }
+    });
+}
+
+export async function removeUser(opts: GlobalOpts, userName: string): Promise<void> {
+    await withSession(opts, async (session) => {
+        reportStatus(`RemoveUser '${userName}'`, (await new ClientUserManagement(session).removeUser(userName)).statusCode);
+    });
+}
+
+export async function changePassword(opts: GlobalOpts, oldPassword: string, newPassword: string): Promise<void> {
+    await withSession(opts, async (session) => {
+        reportStatus(
+            "ChangePassword",
+            (await new ClientUserManagement(session).changePassword(oldPassword, newPassword)).statusCode
+        );
+    });
+}

package/source/index.ts

@@ -0,0 +1,20 @@
+/**
+ * @module node-opcua-role-set-admin
+ *
+ * Programmatic API behind the `role-set-admin` CLI. Import these to script the
+ * same RoleSet / User Management administration from your own code.
+ */
+export {
+    addIdentity,
+    addRole,
+    addUser,
+    changePassword,
+    type GlobalOpts,
+    listRoles,
+    listUsers,
+    removeIdentity,
+    removeRole,
+    removeUser,
+    showRole,
+    withSession
+} from "./commands.js";