node-opcua-role-set-server 2.174.0

package/dist/install_role_set.js

@@ -0,0 +1,308 @@
+"use strict";
+/**
+ * @module node-opcua-role-set-server
+ *
+ * Install RoleSet management on an OPC UA server.
+ *
+ * This function is designed to be called **after** the server has started
+ * (when the address space is available). It:
+ *   - Creates an InMemoryIdentityMappingStore (optionally loaded from disk)
+ *   - Registers a RoleSetResolver on server.roleResolvers
+ *   - Binds AddIdentity / RemoveIdentity on each Role and keeps the Identities
+ *     Property in sync with the store
+ *   - Binds AddRole / RemoveRole (OPC 10000-18 §4.2): custom Roles are created
+ *     as `ns=1;g=<uuid>` instances of RoleType (collision-proof, stable when
+ *     persisted); well-known Roles cannot be removed.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.installRoleSet = installRoleSet;
+const node_crypto_1 = require("node:crypto");
+const node_opcua_constants_1 = require("node-opcua-constants");
+const node_opcua_data_model_1 = require("node-opcua-data-model");
+const node_opcua_nodeid_1 = require("node-opcua-nodeid");
+const node_opcua_role_set_common_1 = require("node-opcua-role-set-common");
+const node_opcua_status_code_1 = require("node-opcua-status-code");
+const node_opcua_types_1 = require("node-opcua-types");
+const node_opcua_variant_1 = require("node-opcua-variant");
+const audit_js_1 = require("./audit.js");
+const bind_restriction_methods_js_1 = require("./bind_restriction_methods.js");
+const bind_role_methods_js_1 = require("./bind_role_methods.js");
+const harden_js_1 = require("./harden.js");
+const role_set_resolver_js_1 = require("./role_set_resolver.js");
+const security_checks_js_1 = require("./security_checks.js");
+const variant_args_js_1 = require("./variant_args.js");
+const UA_NAMESPACE_URI = "http://opcfoundation.org/UA/";
+/** Iterate the Role components of a RoleSet (UAObjects of type RoleType). */
+function forEachRole(roleSet, fn) {
+    for (const c of roleSet.getComponents()) {
+        if (c.nodeClass !== node_opcua_data_model_1.NodeClass.Object)
+            continue;
+        const obj = c;
+        if (obj.typeDefinitionObj.browseName.name !== "RoleType")
+            continue;
+        fn(obj);
+    }
+}
+/** True for the standard well-known Roles (ns=0 numeric NodeIds, OPC 10000-3). */
+function isWellKnownRoleNodeId(nodeId) {
+    if (nodeId.namespace !== 0 || nodeId.identifierType !== node_opcua_nodeid_1.NodeIdType.NUMERIC) {
+        return false;
+    }
+    const values = Object.values(node_opcua_role_set_common_1.WellKnownRoles).filter((v) => typeof v === "number");
+    return values.includes(nodeId.value);
+}
+/** The BrowseNames of the standard well-known Roles (OPC 10000-3). */
+const WELL_KNOWN_ROLE_NAMES = new Set(Object.keys(node_opcua_role_set_common_1.WellKnownRoles).filter((k) => Number.isNaN(Number(k))));
+/**
+ * Install RoleSet management on an OPC UA server. Call this **after**
+ * `server.start()` so the address space is available.
+ */
+async function installRoleSet(server, options) {
+    const addressSpace = server.engine.addressSpace;
+    if (!addressSpace) {
+        throw new Error("installRoleSet: address space is not available. Call this after server.start().");
+    }
+    const roleSet = addressSpace.findNode(node_opcua_constants_1.ObjectIds.Server_ServerCapabilities_RoleSet);
+    if (!roleSet) {
+        throw new Error("installRoleSet: RoleSet node (i=15606) not found in address space.");
+    }
+    // The consolidated archive is owned either by a shared coordinator (when also
+    // installing user management into the same file) or created from the path here.
+    const persistence = options?.persistence ??
+        (options?.persistencePath ? new node_opcua_role_set_common_1.ArchiveStore(options.persistencePath, { secret: options.persistenceSecret }) : undefined);
+    // Load the whole configuration from the single consolidated archive (if any).
+    const archive = persistence ? await persistence.load() : undefined;
+    const store = options?.store ?? new node_opcua_role_set_common_1.InMemoryIdentityMappingStore();
+    (0, node_opcua_role_set_common_1.identitiesFromBase64)(store, archive?.identities);
+    const restrictionStore = new node_opcua_role_set_common_1.InMemoryRoleRestrictionStore();
+    if (archive?.restrictions) {
+        (0, node_opcua_role_set_common_1.deserializeRestrictions)(restrictionStore, archive.restrictions);
+    }
+    const resolver = new role_set_resolver_js_1.RoleSetResolver(store, restrictionStore);
+    server.roleResolvers ??= [];
+    server.roleResolvers.push(resolver);
+    function refreshIdentities(role) {
+        role.identities.setValueFromSource({
+            dataType: node_opcua_variant_1.DataType.ExtensionObject,
+            value: store.getIdentitiesForRole(role.nodeId)
+        });
+    }
+    /** Refresh a Role's Applications/Endpoints restriction variables from the store. */
+    function refreshRestrictions(role) {
+        role.applications?.setValueFromSource({
+            dataType: node_opcua_variant_1.DataType.String,
+            arrayType: node_opcua_variant_1.VariantArrayType.Array,
+            value: restrictionStore.getApplications(role.nodeId)
+        });
+        role.applicationsExclude?.setValueFromSource({
+            dataType: node_opcua_variant_1.DataType.Boolean,
+            value: restrictionStore.getApplicationsExclude(role.nodeId)
+        });
+        role.endpoints?.setValueFromSource({
+            dataType: node_opcua_variant_1.DataType.ExtensionObject,
+            arrayType: node_opcua_variant_1.VariantArrayType.Array,
+            value: restrictionStore.getEndpoints(role.nodeId).map((e) => new node_opcua_types_1.EndpointType(e))
+        });
+        role.endpointsExclude?.setValueFromSource({
+            dataType: node_opcua_variant_1.DataType.Boolean,
+            value: restrictionStore.getEndpointsExclude(role.nodeId)
+        });
+    }
+    const customRoles = [];
+    // Register the sections we own; the coordinator gathers these (plus any users
+    // registered by installUserManagement) and rewrites the one file atomically.
+    persistence?.setIdentitiesProvider(() => (0, node_opcua_role_set_common_1.identitiesToBase64)(store));
+    persistence?.setRolesProvider(() => customRoles);
+    persistence?.setRestrictionsProvider(() => (0, node_opcua_role_set_common_1.serializeRestrictions)(restrictionStore));
+    /** Snapshot every store into the single consolidated archive (atomic write). */
+    async function persist() {
+        await persistence?.save();
+    }
+    /** Refresh every Role's variables and persist the whole configuration. */
+    const afterMutation = async () => {
+        forEachRole(roleSet, (role) => {
+            refreshIdentities(role);
+            refreshRestrictions(role);
+        });
+        await persist();
+    };
+    // Raise a RoleMappingRuleChangedAuditEventType on the Server object (§4.5).
+    // The IdentityMappingRule carries no secret, so it is included.
+    const serverObject = addressSpace.rootFolder?.objects?.server;
+    const raiseRoleMappingAudit = (audit) => {
+        (0, audit_js_1.raiseAuditMethodEvent)(serverObject, "RoleMappingRuleChangedAuditEventType", {
+            sourceNode: audit.roleNodeId,
+            sourceName: `Method/${audit.method}`,
+            methodId: audit.methodNodeId,
+            clientUserId: audit.userName,
+            status: audit.statusCode === node_opcua_status_code_1.StatusCodes.Good,
+            message: `${audit.method} on role ${audit.roleNodeId.toString()} by '${audit.userName}' → ${audit.statusCode.name}`,
+            inputArguments: audit.inputArguments
+        });
+    };
+    const methodOptions = { store, onMutation: afterMutation, onAudit: raiseRoleMappingAudit };
+    const addIdentityHandler = (0, bind_role_methods_js_1.makeAddIdentityHandler)(methodOptions);
+    const removeIdentityHandler = (0, bind_role_methods_js_1.makeRemoveIdentityHandler)(methodOptions);
+    const restrictionMethodOptions = {
+        restrictionStore,
+        onMutation: afterMutation,
+        onAudit: raiseRoleMappingAudit
+    };
+    const addApplicationHandler = (0, bind_restriction_methods_js_1.makeAddApplicationHandler)(restrictionMethodOptions);
+    const removeApplicationHandler = (0, bind_restriction_methods_js_1.makeRemoveApplicationHandler)(restrictionMethodOptions);
+    const addEndpointHandler = (0, bind_restriction_methods_js_1.makeAddEndpointHandler)(restrictionMethodOptions);
+    const removeEndpointHandler = (0, bind_restriction_methods_js_1.makeRemoveEndpointHandler)(restrictionMethodOptions);
+    /** Bind the identity + restriction Methods on a Role and seed its variables. */
+    function bindRoleMethods(role) {
+        refreshIdentities(role);
+        refreshRestrictions(role);
+        role.addIdentity?.bindMethod(addIdentityHandler);
+        role.removeIdentity?.bindMethod(removeIdentityHandler);
+        role.addApplication?.bindMethod(addApplicationHandler);
+        role.removeApplication?.bindMethod(removeApplicationHandler);
+        role.addEndpoint?.bindMethod(addEndpointHandler);
+        role.removeEndpoint?.bindMethod(removeEndpointHandler);
+        hardenRole(role);
+    }
+    /**
+     * Hide a Role's sensitive Properties and configuration Methods from
+     * non-admin Browse and require an encrypted channel (§4.4.1). The Role node
+     * itself stays browsable so the RoleSet hierarchy remains visible.
+     */
+    function hardenRole(role) {
+        (0, harden_js_1.hardenAdminOnly)(role.identities);
+        (0, harden_js_1.hardenAdminOnly)(role.applications);
+        (0, harden_js_1.hardenAdminOnly)(role.applicationsExclude);
+        (0, harden_js_1.hardenAdminOnly)(role.endpoints);
+        (0, harden_js_1.hardenAdminOnly)(role.endpointsExclude);
+        (0, harden_js_1.hardenAdminOnly)(role.addIdentity);
+        (0, harden_js_1.hardenAdminOnly)(role.removeIdentity);
+        (0, harden_js_1.hardenAdminOnly)(role.addApplication);
+        (0, harden_js_1.hardenAdminOnly)(role.removeApplication);
+        (0, harden_js_1.hardenAdminOnly)(role.addEndpoint);
+        (0, harden_js_1.hardenAdminOnly)(role.removeEndpoint);
+    }
+    /** Create a RoleType instance (with the configuration Methods) and bind it. */
+    const createRoleNode = (roleName, browseNameNamespace, nodeId) => {
+        const roleType = addressSpace.findObjectType("RoleType");
+        if (!roleType) {
+            throw new Error("installRoleSet: RoleType ObjectType not found");
+        }
+        const role = roleType.instantiate({
+            browseName: { name: roleName, namespaceIndex: browseNameNamespace },
+            componentOf: roleSet,
+            nodeId,
+            optionals: [
+                "AddIdentity",
+                "RemoveIdentity",
+                "AddApplication",
+                "RemoveApplication",
+                "AddEndpoint",
+                "RemoveEndpoint",
+                "Applications",
+                "ApplicationsExclude",
+                "Endpoints",
+                "EndpointsExclude"
+            ]
+        });
+        bindRoleMethods(role);
+        return role;
+    };
+    // Recreate persisted custom Roles before binding the standard ones.
+    for (const def of archive?.roles ?? []) {
+        const nodeId = (0, node_opcua_nodeid_1.resolveNodeId)(def.nodeId);
+        const nsIndex = def.namespaceUri ? ensureNamespace(addressSpace, def.namespaceUri) : addressSpace.getOwnNamespace().index;
+        if (!addressSpace.findNode(nodeId)) {
+            createRoleNode(def.roleName, nsIndex, nodeId);
+        }
+        customRoles.push(def);
+    }
+    // Bind the configuration Methods on every current Role and seed its variables.
+    forEachRole(roleSet, bindRoleMethods);
+    // AddRole (§4.2.2)
+    const addRoleHandler = async function (inputArguments, context) {
+        const insecure = (0, security_checks_js_1.checkEncryptedChannel)(context);
+        if (insecure)
+            return insecure;
+        const denied = (0, security_checks_js_1.checkSecurityAdminAccess)(context);
+        if (denied)
+            return denied;
+        const roleName = (0, variant_args_js_1.asString)(inputArguments[0]);
+        if (!roleName) {
+            return { statusCode: node_opcua_status_code_1.StatusCodes.BadInvalidArgument };
+        }
+        // A custom Role must not impersonate a well-known Role (which already
+        // exists in ns=0); reject the name in any namespace (§4.2.2).
+        if (WELL_KNOWN_ROLE_NAMES.has(roleName)) {
+            return { statusCode: node_opcua_status_code_1.StatusCodes.BadAlreadyExists };
+        }
+        const namespaceUri = (0, variant_args_js_1.asString)(inputArguments[1]) ?? "";
+        const browseNameNamespace = namespaceUri && namespaceUri !== UA_NAMESPACE_URI
+            ? ensureNamespace(addressSpace, namespaceUri)
+            : namespaceUri === UA_NAMESPACE_URI
+                ? 0
+                : addressSpace.getOwnNamespace().index;
+        // The RoleName must be unique within the RoleSet (§4.2.2). We check by
+        // name across *all* namespaces (not just name+namespace) so a custom Role
+        // can never duplicate the name of any existing Role — well-known or custom.
+        const exists = roleSet.getComponents().some((c) => c.browseName.name === roleName);
+        if (exists) {
+            return { statusCode: node_opcua_status_code_1.StatusCodes.BadAlreadyExists };
+        }
+        // GUID NodeId in the server's own namespace (collision-proof, persisted)
+        const nodeId = new node_opcua_nodeid_1.NodeId(node_opcua_nodeid_1.NodeIdType.GUID, (0, node_crypto_1.randomUUID)().toUpperCase(), addressSpace.getOwnNamespace().index);
+        createRoleNode(roleName, browseNameNamespace, nodeId);
+        customRoles.push({ nodeId: nodeId.toString(), roleName, namespaceUri });
+        await persist();
+        return {
+            statusCode: node_opcua_status_code_1.StatusCodes.Good,
+            outputArguments: [{ dataType: node_opcua_variant_1.DataType.NodeId, value: nodeId }]
+        };
+    };
+    // RemoveRole (§4.2.3)
+    const removeRoleHandler = async function (inputArguments, context) {
+        const insecure = (0, security_checks_js_1.checkEncryptedChannel)(context);
+        if (insecure)
+            return insecure;
+        const denied = (0, security_checks_js_1.checkSecurityAdminAccess)(context);
+        if (denied)
+            return denied;
+        const roleNodeId = inputArguments[0]?.value;
+        if (!(roleNodeId instanceof node_opcua_nodeid_1.NodeId)) {
+            return { statusCode: node_opcua_status_code_1.StatusCodes.BadInvalidArgument };
+        }
+        // Well-known Roles are required by the Server and cannot be removed (§4.3)
+        if (isWellKnownRoleNodeId(roleNodeId)) {
+            return { statusCode: node_opcua_status_code_1.StatusCodes.BadRequestNotAllowed };
+        }
+        const node = addressSpace.findNode(roleNodeId);
+        if (node?.typeDefinitionObj?.browseName.name !== "RoleType") {
+            return { statusCode: node_opcua_status_code_1.StatusCodes.BadNodeIdUnknown };
+        }
+        // remove the node, its identity mappings and the persisted definition
+        for (const rule of store.getIdentitiesForRole(roleNodeId)) {
+            store.removeIdentity(roleNodeId, rule);
+        }
+        addressSpace.deleteNode(roleNodeId);
+        const idx = customRoles.findIndex((r) => (0, node_opcua_nodeid_1.sameNodeId)((0, node_opcua_nodeid_1.resolveNodeId)(r.nodeId), roleNodeId));
+        if (idx >= 0)
+            customRoles.splice(idx, 1);
+        await persist();
+        return { statusCode: node_opcua_status_code_1.StatusCodes.Good };
+    };
+    if (roleSet.addRole) {
+        roleSet.addRole.bindMethod(addRoleHandler);
+        (0, harden_js_1.hardenAdminOnly)(roleSet.addRole);
+    }
+    if (roleSet.removeRole) {
+        roleSet.removeRole.bindMethod(removeRoleHandler);
+        (0, harden_js_1.hardenAdminOnly)(roleSet.removeRole);
+    }
+    return { store, restrictionStore, resolver };
+}
+/** Resolve a namespace URI to its index, registering it if necessary. */
+function ensureNamespace(addressSpace, namespaceUri) {
+    const idx = addressSpace.getNamespaceIndex(namespaceUri);
+    return idx >= 0 ? idx : addressSpace.registerNamespace(namespaceUri).index;
+}
+//# sourceMappingURL=install_role_set.js.map

package/dist/install_role_set.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install_role_set.js","sourceRoot":"","sources":["../source/install_role_set.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;AA8HH,wCAuRC;AAnZD,6CAAyC;AAEzC,+DAAiD;AACjD,iEAAkD;AAClD,yDAAkF;AAClF,2EAYoC;AAEpC,mEAAqD;AACrD,uDAAgD;AAEhD,2DAAgE;AAChE,yCAAmD;AACnD,+EAMuC;AACvC,iEAKgC;AAChC,2CAA8C;AAC9C,iEAAyD;AACzD,6DAAuF;AACvF,uDAA6C;AAE7C,MAAM,gBAAgB,GAAG,8BAA8B,CAAC;AAKxD,6EAA6E;AAC7E,SAAS,WAAW,CAAC,OAAkB,EAAE,EAA0B;IAC/D,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC,CAAC,SAAS,KAAK,iCAAS,CAAC,MAAM;YAAE,SAAS;QAC/C,MAAM,GAAG,GAAG,CAAa,CAAC;QAC1B,IAAI,GAAG,CAAC,iBAAiB,CAAC,UAAU,CAAC,IAAI,KAAK,UAAU;YAAE,SAAS;QACnE,EAAE,CAAC,GAAa,CAAC,CAAC;IACtB,CAAC;AACL,CAAC;AAED,kFAAkF;AAClF,SAAS,qBAAqB,CAAC,MAAc;IACzC,IAAI,MAAM,CAAC,SAAS,KAAK,CAAC,IAAI,MAAM,CAAC,cAAc,KAAK,8BAAU,CAAC,OAAO,EAAE,CAAC;QACzE,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,2CAAc,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IAC/F,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAe,CAAC,CAAC;AACnD,CAAC;AAED,sEAAsE;AACtE,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,2CAAc,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAqD1G;;;GAGG;AACI,KAAK,UAAU,cAAc,CAAC,MAAyB,EAAE,OAA+B;IAC3F,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;IAChD,IAAI,CAAC,YAAY,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACvG,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,gCAAS,CAAC,iCAAiC,CAAqB,CAAC;IACvG,IAAI,CAAC,OAAO,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IAC1F,CAAC;IAED,8EAA8E;IAC9E,gFAAgF;IAChF,MAAM,WAAW,GACb,OAAO,EAAE,WAAW;QACpB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,yCAAY,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAE9H,8EAA8E;IAC9E,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAEnE,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,IAAI,yDAA4B,EAAE,CAAC;IACnE,IAAA,iDAAoB,EAAC,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IAEjD,MAAM,gBAAgB,GAAG,IAAI,yDAA4B,EAAE,CAAC;IAC5D,IAAI,OAAO,EAAE,YAAY,EAAE,CAAC;QACxB,IAAA,oDAAuB,EAAC,gBAAgB,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,sCAAe,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IAC9D,MAAM,CAAC,aAAa,KAAK,EAAE,CAAC;IAC5B,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEpC,SAAS,iBAAiB,CAAC,IAAY;QACnC,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC;YAC/B,QAAQ,EAAE,6BAAQ,CAAC,eAAe;YAClC,KAAK,EAAE,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC;SACjD,CAAC,CAAC;IACP,CAAC;IAED,oFAAoF;IACpF,SAAS,mBAAmB,CAAC,IAAY;QACrC,IAAI,CAAC,YAAY,EAAE,kBAAkB,CAAC;YAClC,QAAQ,EAAE,6BAAQ,CAAC,MAAM;YACzB,SAAS,EAAE,qCAAgB,CAAC,KAAK;YACjC,KAAK,EAAE,gBAAgB,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;SACvD,CAAC,CAAC;QACH,IAAI,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;YACzC,QAAQ,EAAE,6BAAQ,CAAC,OAAO;YAC1B,KAAK,EAAE,gBAAgB,CAAC,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC;SAC9D,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,EAAE,kBAAkB,CAAC;YAC/B,QAAQ,EAAE,6BAAQ,CAAC,eAAe;YAClC,SAAS,EAAE,qCAAgB,CAAC,KAAK;YACjC,KAAK,EAAE,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,+BAAY,CAAC,CAAC,CAAC,CAAC;SACpF,CAAC,CAAC;QACH,IAAI,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;YACtC,QAAQ,EAAE,6BAAQ,CAAC,OAAO;YAC1B,KAAK,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC;SAC3D,CAAC,CAAC;IACP,CAAC;IAED,MAAM,WAAW,GAAoB,EAAE,CAAC;IAExC,8EAA8E;IAC9E,6EAA6E;IAC7E,WAAW,EAAE,qBAAqB,CAAC,GAAG,EAAE,CAAC,IAAA,+CAAkB,EAAC,KAAK,CAAC,CAAC,CAAC;IACpE,WAAW,EAAE,gBAAgB,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC;IACjD,WAAW,EAAE,uBAAuB,CAAC,GAAG,EAAE,CAAC,IAAA,kDAAqB,EAAC,gBAAgB,CAAC,CAAC,CAAC;IAEpF,gFAAgF;IAChF,KAAK,UAAU,OAAO;QAClB,MAAM,WAAW,EAAE,IAAI,EAAE,CAAC;IAC9B,CAAC;IAED,0EAA0E;IAC1E,MAAM,aAAa,GAAG,KAAK,IAAI,EAAE;QAC7B,WAAW,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YAC1B,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACxB,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,EAAE,CAAC;IACpB,CAAC,CAAC;IAEF,4EAA4E;IAC5E,gEAAgE;IAChE,MAAM,YAAY,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC;IAC9D,MAAM,qBAAqB,GAAG,CAAC,KAAkC,EAAQ,EAAE;QACvE,IAAA,gCAAqB,EAAC,YAAY,EAAE,sCAAsC,EAAE;YACxE,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,UAAU,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE;YACpC,QAAQ,EAAE,KAAK,CAAC,YAAY;YAC5B,YAAY,EAAE,KAAK,CAAC,QAAQ;YAC5B,MAAM,EAAE,KAAK,CAAC,UAAU,KAAK,oCAAW,CAAC,IAAI;YAC7C,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,YAAY,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,KAAK,CAAC,QAAQ,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE;YACnH,cAAc,EAAE,KAAK,CAAC,cAAc;SACvC,CAAC,CAAC;IACP,CAAC,CAAC;IAEF,MAAM,aAAa,GAA2B,EAAE,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACnH,MAAM,kBAAkB,GAAG,IAAA,6CAAsB,EAAC,aAAa,CAAC,CAAC;IACjE,MAAM,qBAAqB,GAAG,IAAA,gDAAyB,EAAC,aAAa,CAAC,CAAC;IAEvE,MAAM,wBAAwB,GAAkC;QAC5D,gBAAgB;QAChB,UAAU,EAAE,aAAa;QACzB,OAAO,EAAE,qBAAqB;KACjC,CAAC;IACF,MAAM,qBAAqB,GAAG,IAAA,uDAAyB,EAAC,wBAAwB,CAAC,CAAC;IAClF,MAAM,wBAAwB,GAAG,IAAA,0DAA4B,EAAC,wBAAwB,CAAC,CAAC;IACxF,MAAM,kBAAkB,GAAG,IAAA,oDAAsB,EAAC,wBAAwB,CAAC,CAAC;IAC5E,MAAM,qBAAqB,GAAG,IAAA,uDAAyB,EAAC,wBAAwB,CAAC,CAAC;IAElF,gFAAgF;IAChF,SAAS,eAAe,CAAC,IAAY;QACjC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACxB,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC;QACjD,IAAI,CAAC,cAAc,EAAE,UAAU,CAAC,qBAAqB,CAAC,CAAC;QACvD,IAAI,CAAC,cAAc,EAAE,UAAU,CAAC,qBAAqB,CAAC,CAAC;QACvD,IAAI,CAAC,iBAAiB,EAAE,UAAU,CAAC,wBAAwB,CAAC,CAAC;QAC7D,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC;QACjD,IAAI,CAAC,cAAc,EAAE,UAAU,CAAC,qBAAqB,CAAC,CAAC;QACvD,UAAU,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAED;;;;OAIG;IACH,SAAS,UAAU,CAAC,IAAY;QAC5B,IAAA,2BAAe,EAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjC,IAAA,2BAAe,EAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACnC,IAAA,2BAAe,EAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC1C,IAAA,2BAAe,EAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChC,IAAA,2BAAe,EAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACvC,IAAA,2BAAe,EAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAClC,IAAA,2BAAe,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACrC,IAAA,2BAAe,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACrC,IAAA,2BAAe,EAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACxC,IAAA,2BAAe,EAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAClC,IAAA,2BAAe,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACzC,CAAC;IAED,+EAA+E;IAC/E,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAE,mBAA2B,EAAE,MAAc,EAAU,EAAE;QAC7F,MAAM,QAAQ,GAAG,YAAY,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,CAAC;YAC9B,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,mBAAmB,EAAE;YACnE,WAAW,EAAE,OAAO;YACpB,MAAM;YACN,SAAS,EAAE;gBACP,aAAa;gBACb,gBAAgB;gBAChB,gBAAgB;gBAChB,mBAAmB;gBACnB,aAAa;gBACb,gBAAgB;gBAChB,cAAc;gBACd,qBAAqB;gBACrB,WAAW;gBACX,kBAAkB;aACrB;SACJ,CAAW,CAAC;QACb,eAAe,CAAC,IAAI,CAAC,CAAC;QACtB,OAAO,IAAI,CAAC;IAChB,CAAC,CAAC;IAEF,oEAAoE;IACpE,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,IAAA,iCAAa,EAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC,YAAY,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,eAAe,EAAE,CAAC,KAAK,CAAC;QAC1H,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACjC,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAClD,CAAC;QACD,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,+EAA+E;IAC/E,WAAW,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAEtC,mBAAmB;IACnB,MAAM,cAAc,GAAG,KAAK,WAExB,cAAyB,EACzB,OAAwB;QAExB,MAAM,QAAQ,GAAG,IAAA,0CAAqB,EAAC,OAAO,CAAC,CAAC;QAChD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAA,6CAAwB,EAAC,OAAO,CAAC,CAAC;QACjD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,QAAQ,GAAG,IAAA,0BAAQ,EAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,kBAAkB,EAAE,CAAC;QAC1D,CAAC;QACD,sEAAsE;QACtE,8DAA8D;QAC9D,IAAI,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,gBAAgB,EAAE,CAAC;QACxD,CAAC;QACD,MAAM,YAAY,GAAG,IAAA,0BAAQ,EAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACvD,MAAM,mBAAmB,GACrB,YAAY,IAAI,YAAY,KAAK,gBAAgB;YAC7C,CAAC,CAAC,eAAe,CAAC,YAAY,EAAE,YAAY,CAAC;YAC7C,CAAC,CAAC,YAAY,KAAK,gBAAgB;gBACjC,CAAC,CAAC,CAAC;gBACH,CAAC,CAAC,YAAY,CAAC,eAAe,EAAE,CAAC,KAAK,CAAC;QAEjD,uEAAuE;QACvE,0EAA0E;QAC1E,4EAA4E;QAC5E,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QACnF,IAAI,MAAM,EAAE,CAAC;YACT,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,gBAAgB,EAAE,CAAC;QACxD,CAAC;QAED,yEAAyE;QACzE,MAAM,MAAM,GAAG,IAAI,0BAAM,CAAC,8BAAU,CAAC,IAAI,EAAE,IAAA,wBAAU,GAAE,CAAC,WAAW,EAAE,EAAE,YAAY,CAAC,eAAe,EAAE,CAAC,KAAK,CAAC,CAAC;QAC7G,cAAc,CAAC,QAAQ,EAAE,mBAAmB,EAAE,MAAM,CAAC,CAAC;QAEtD,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QACxE,MAAM,OAAO,EAAE,CAAC;QAEhB,OAAO;YACH,UAAU,EAAE,oCAAW,CAAC,IAAI;YAC5B,eAAe,EAAE,CAAC,EAAE,QAAQ,EAAE,6BAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;SAClE,CAAC;IACN,CAAC,CAAC;IAEF,sBAAsB;IACtB,MAAM,iBAAiB,GAAG,KAAK,WAE3B,cAAyB,EACzB,OAAwB;QAExB,MAAM,QAAQ,GAAG,IAAA,0CAAqB,EAAC,OAAO,CAAC,CAAC;QAChD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAA,6CAAwB,EAAC,OAAO,CAAC,CAAC;QACjD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,UAAU,GAAG,cAAc,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;QAC5C,IAAI,CAAC,CAAC,UAAU,YAAY,0BAAM,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,kBAAkB,EAAE,CAAC;QAC1D,CAAC;QACD,2EAA2E;QAC3E,IAAI,qBAAqB,CAAC,UAAU,CAAC,EAAE,CAAC;YACpC,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,oBAAoB,EAAE,CAAC;QAC5D,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAkB,CAAC;QAChE,IAAI,IAAI,EAAE,iBAAiB,EAAE,UAAU,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC1D,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,gBAAgB,EAAE,CAAC;QACxD,CAAC;QAED,sEAAsE;QACtE,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,oBAAoB,CAAC,UAAU,CAAC,EAAE,CAAC;YACxD,KAAK,CAAC,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAC3C,CAAC;QACD,YAAY,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,8BAAU,EAAC,IAAA,iCAAa,EAAC,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;QAC1F,IAAI,GAAG,IAAI,CAAC;YAAE,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAEzC,MAAM,OAAO,EAAE,CAAC;QAChB,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,IAAI,EAAE,CAAC;IAC5C,CAAC,CAAC;IAEF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,CAAC,OAAoB,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;QACzD,IAAA,2BAAe,EAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACpB,OAAO,CAAC,UAAuB,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;QAC/D,IAAA,2BAAe,EAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC;AACjD,CAAC;AAED,yEAAyE;AACzE,SAAS,eAAe,CAAC,YAA2B,EAAE,YAAoB;IACtE,MAAM,GAAG,GAAG,YAAY,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;IACzD,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC;AAC/E,CAAC"}

package/dist/install_user_management.d.ts

@@ -0,0 +1,68 @@
+/**
+ * @module node-opcua-role-set-server
+ *
+ * Install User Management (OPC 10000-18 §5) on an OPC UA server.
+ *
+ * Binds the AddUser / ModifyUser / RemoveUser / ChangePassword Methods of the
+ * standard `UserManagement` Object (i=24290, ComponentOf ServerConfiguration)
+ * to an {@link InMemoryUserManagementStore}, keeps the `Users` Property in sync
+ * with the store, and publishes the password policy via `PasswordLength` /
+ * `PasswordOptions`.
+ */
+import type { IAddressSpace } from "node-opcua-address-space";
+import type { NodeId } from "node-opcua-nodeid";
+import { ArchiveStore, type IUserManagementStore, type PasswordPolicy } from "node-opcua-role-set-common";
+export interface InstallUserManagementOptions {
+    /** Password policy published via PasswordLength / PasswordOptions and enforced by the store. */
+    policy?: PasswordPolicy;
+    /**
+     * Existing user store to bind the Methods to. When omitted a new
+     * {@link InMemoryUserManagementStore} is created. Inject a shared store when
+     * the same store also backs the server `userManager`
+     * (see `createUserManager`).
+     */
+    store?: IUserManagementStore;
+    /**
+     * A shared {@link ArchiveStore} coordinating one consolidated file across
+     * `installRoleSet` and `installUserManagement`. Pass the **same** instance to
+     * both so users (salted scrypt hashes) live in the same archive as the role
+     * config; install order does not matter (unregistered sections are preserved).
+     * When omitted, an internal one is created from `persistencePath`.
+     */
+    persistence?: ArchiveStore;
+    /** Path to a users-only archive (used when no shared {@link persistence} is given). */
+    persistencePath?: string;
+    /** Encrypt the users-only archive at rest (see `installRoleSet`'s `persistenceSecret`). */
+    persistenceSecret?: string;
+}
+export interface InstallUserManagementResult {
+    store: IUserManagementStore;
+}
+/** A live session as seen by {@link IServerForUserManagement} — enough to identify and close it. */
+export interface IActiveSession {
+    readonly authenticationToken: NodeId;
+    /** The activated user-identity token (a {@link UserNameIdentityToken} for username logins). */
+    readonly userIdentityToken?: unknown;
+}
+/**
+ * Minimal server shape: access to the address space, and — optionally — to the
+ * live sessions so a disabled/removed user's sessions can be terminated
+ * (§5.2.6-7). When `getSessions`/`closeSession` are absent (e.g. a bare test
+ * double) the feature is silently skipped. The real `OPCUAServer`'s engine
+ * provides both.
+ */
+export interface IServerForUserManagement {
+    engine: {
+        addressSpace: IAddressSpace | null;
+        getSessions?(): IActiveSession[];
+        closeSession?(authenticationToken: NodeId, deleteSubscriptions: boolean, reason: string): void;
+    };
+}
+/**
+ * Install User Management on an OPC UA server.
+ *
+ * Call this **after** the server has started and the address space is
+ * available (the standard nodeset must be loaded so the `UserManagement`
+ * Object exists).
+ */
+export declare function installUserManagement(server: IServerForUserManagement, options?: InstallUserManagementOptions): Promise<InstallUserManagementResult>;

package/dist/install_user_management.js

@@ -0,0 +1,158 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.installUserManagement = installUserManagement;
+const node_opcua_constants_1 = require("node-opcua-constants");
+const node_opcua_role_set_common_1 = require("node-opcua-role-set-common");
+const node_opcua_status_code_1 = require("node-opcua-status-code");
+const node_opcua_types_1 = require("node-opcua-types");
+const node_opcua_variant_1 = require("node-opcua-variant");
+const audit_js_1 = require("./audit.js");
+const bind_user_management_js_1 = require("./bind_user_management.js");
+const harden_js_1 = require("./harden.js");
+/** PasswordOptionsMask bit values (OPC 10000-18 §5.2.2). */
+const PasswordOptions = {
+    RequiresUpperCaseCharacters: 1 << 5,
+    RequiresLowerCaseCharacters: 1 << 6,
+    RequiresDigitCharacters: 1 << 7,
+    RequiresSpecialCharacters: 1 << 8
+};
+/**
+ * Build a "close every active session of this user" function from the server's
+ * engine, or `undefined` if the engine does not expose session control. Closing
+ * deletes the user's subscriptions too — a deactivated user keeps nothing live.
+ */
+function makeSessionCloser(engine) {
+    const { getSessions, closeSession } = engine;
+    if (!getSessions || !closeSession)
+        return undefined;
+    return (userName) => {
+        let closed = 0;
+        // snapshot first: closeSession mutates the engine's session map
+        for (const session of getSessions.call(engine)) {
+            const token = session.userIdentityToken;
+            if (token instanceof node_opcua_types_1.UserNameIdentityToken && token.userName === userName) {
+                closeSession.call(engine, session.authenticationToken, /* deleteSubscriptions */ true, "Terminated");
+                closed += 1;
+            }
+        }
+        return closed;
+    };
+}
+function passwordOptionsMask(policy) {
+    let mask = 0;
+    if (policy.requireUpperCase)
+        mask |= PasswordOptions.RequiresUpperCaseCharacters;
+    if (policy.requireLowerCase)
+        mask |= PasswordOptions.RequiresLowerCaseCharacters;
+    if (policy.requireDigit)
+        mask |= PasswordOptions.RequiresDigitCharacters;
+    if (policy.requireSpecial)
+        mask |= PasswordOptions.RequiresSpecialCharacters;
+    return mask;
+}
+/**
+ * Install User Management on an OPC UA server.
+ *
+ * Call this **after** the server has started and the address space is
+ * available (the standard nodeset must be loaded so the `UserManagement`
+ * Object exists).
+ */
+async function installUserManagement(server, options) {
+    const addressSpace = server.engine.addressSpace;
+    if (!addressSpace) {
+        throw new Error("installUserManagement: address space is not available. Call this after server.start().");
+    }
+    const userManagement = addressSpace.findNode(node_opcua_constants_1.ObjectIds.UserManagement);
+    if (!userManagement) {
+        throw new Error("installUserManagement: UserManagement Object (i=24290) not found in address space.");
+    }
+    const policy = options?.policy ?? {};
+    const store = options?.store ?? new node_opcua_role_set_common_1.InMemoryUserManagementStore(policy);
+    // Consolidated-archive coordination: hydrate persisted users (salted hashes)
+    // and register the `users` section so a shared coordinator persists them
+    // alongside the role configuration.
+    const persistence = options?.persistence ??
+        (options?.persistencePath ? new node_opcua_role_set_common_1.ArchiveStore(options.persistencePath, { secret: options.persistenceSecret }) : undefined);
+    if (persistence && store.importUsers) {
+        const archive = await persistence.load();
+        if (archive?.users)
+            store.importUsers(archive.users);
+    }
+    const exportUsers = store.exportUsers?.bind(store);
+    if (persistence && exportUsers) {
+        persistence.setUsersProvider(() => exportUsers());
+    }
+    const usersVar = addressSpace.findNode(node_opcua_constants_1.VariableIds.UserManagement_Users);
+    function refreshUsers() {
+        usersVar?.setValueFromSource({
+            dataType: node_opcua_variant_1.DataType.ExtensionObject,
+            arrayType: node_opcua_variant_1.VariantArrayType.Array,
+            value: store.getUsers().map((u) => new node_opcua_types_1.UserManagementDataType({
+                userName: u.userName,
+                userConfiguration: u.userConfiguration,
+                description: u.description
+            }))
+        });
+    }
+    // Raise an AuditUpdateMethodEventType on the Server object for each managed
+    // user-management call — WITHOUT any password (only who/what/whom/result).
+    const serverObject = addressSpace.rootFolder?.objects?.server;
+    const closeSessionsForUser = makeSessionCloser(server.engine);
+    const methodOptions = {
+        store,
+        onMutation: async () => {
+            refreshUsers();
+            await persistence?.save();
+        },
+        onUserDeactivated: closeSessionsForUser
+            ? (userName) => {
+                const closed = closeSessionsForUser(userName);
+                if (closed > 0) {
+                    (0, audit_js_1.raiseAuditMethodEvent)(serverObject, "AuditUpdateMethodEventType", {
+                        sourceNode: userManagement.nodeId,
+                        sourceName: "Method/UserDeactivated",
+                        clientUserId: userName,
+                        status: true,
+                        message: `terminated ${closed} active session(s) of deactivated user '${userName}'`
+                    });
+                }
+            }
+            : undefined,
+        onAudit: (audit) => {
+            (0, audit_js_1.raiseAuditMethodEvent)(serverObject, "AuditUpdateMethodEventType", {
+                sourceNode: userManagement.nodeId,
+                sourceName: `Method/${audit.method}`,
+                methodId: audit.methodNodeId,
+                clientUserId: audit.callerUserName,
+                status: audit.statusCode === node_opcua_status_code_1.StatusCodes.Good,
+                message: `${audit.method}('${audit.targetUserName}') by '${audit.callerUserName}' → ${audit.statusCode.name}`
+                // NOTE: inputArguments deliberately omitted — they contain passwords
+            });
+        }
+    };
+    // Bind and harden the Methods: the three administrative Methods (and the
+    // Users list, which reveals account names) are SecurityAdmin-only over an
+    // encrypted channel; ChangePassword stays callable by any authenticated user
+    // but still requires encryption (§4.4.1 / §5.2.8).
+    (0, harden_js_1.hardenAdminOnly)(bindMethod(addressSpace, node_opcua_constants_1.MethodIds.UserManagement_AddUser, (0, bind_user_management_js_1.makeAddUserHandler)(methodOptions)));
+    (0, harden_js_1.hardenAdminOnly)(bindMethod(addressSpace, node_opcua_constants_1.MethodIds.UserManagement_ModifyUser, (0, bind_user_management_js_1.makeModifyUserHandler)(methodOptions)));
+    (0, harden_js_1.hardenAdminOnly)(bindMethod(addressSpace, node_opcua_constants_1.MethodIds.UserManagement_RemoveUser, (0, bind_user_management_js_1.makeRemoveUserHandler)(methodOptions)));
+    (0, harden_js_1.hardenEncryptedOnly)(bindMethod(addressSpace, node_opcua_constants_1.MethodIds.UserManagement_ChangePassword, (0, bind_user_management_js_1.makeChangePasswordHandler)(methodOptions)));
+    (0, harden_js_1.hardenAdminOnly)(usersVar);
+    // Publish the password policy and the initial (empty) user list.
+    const lengthVar = addressSpace.findNode(node_opcua_constants_1.VariableIds.UserManagement_PasswordLength);
+    lengthVar?.setValueFromSource({
+        dataType: node_opcua_variant_1.DataType.ExtensionObject,
+        value: new node_opcua_types_1.Range({ low: policy.minLength ?? 0, high: policy.maxLength ?? 0 })
+    });
+    const optionsVar = addressSpace.findNode(node_opcua_constants_1.VariableIds.UserManagement_PasswordOptions);
+    optionsVar?.setValueFromSource({ dataType: node_opcua_variant_1.DataType.UInt32, value: passwordOptionsMask(policy) });
+    refreshUsers();
+    return { store };
+}
+function bindMethod(addressSpace, methodNodeId, handler) {
+    const method = addressSpace.findNode(methodNodeId);
+    method?.bindMethod(handler);
+    return method;
+}
+//# sourceMappingURL=install_user_management.js.map

package/dist/install_user_management.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install_user_management.js","sourceRoot":"","sources":["../source/install_user_management.ts"],"names":[],"mappings":";;AAiIA,sDA8GC;AAnOD,+DAAyE;AAEzE,2EAKoC;AACpC,mEAAqD;AACrD,uDAAwF;AACxF,2DAAgE;AAChE,yCAAmD;AACnD,uEAMmC;AACnC,2CAAmE;AAEnE,4DAA4D;AAC5D,MAAM,eAAe,GAAG;IACpB,2BAA2B,EAAE,CAAC,IAAI,CAAC;IACnC,2BAA2B,EAAE,CAAC,IAAI,CAAC;IACnC,uBAAuB,EAAE,CAAC,IAAI,CAAC;IAC/B,yBAAyB,EAAE,CAAC,IAAI,CAAC;CAC3B,CAAC;AAoDX;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,MAA0C;IACjE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;IAC7C,IAAI,CAAC,WAAW,IAAI,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IACpD,OAAO,CAAC,QAAgB,EAAU,EAAE;QAChC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,gEAAgE;QAChE,KAAK,MAAM,OAAO,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,iBAAiB,CAAC;YACxC,IAAI,KAAK,YAAY,wCAAqB,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACxE,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,mBAAmB,EAAE,yBAAyB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;gBACrG,MAAM,IAAI,CAAC,CAAC;YAChB,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC,CAAC;AACN,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAsB;IAC/C,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,MAAM,CAAC,gBAAgB;QAAE,IAAI,IAAI,eAAe,CAAC,2BAA2B,CAAC;IACjF,IAAI,MAAM,CAAC,gBAAgB;QAAE,IAAI,IAAI,eAAe,CAAC,2BAA2B,CAAC;IACjF,IAAI,MAAM,CAAC,YAAY;QAAE,IAAI,IAAI,eAAe,CAAC,uBAAuB,CAAC;IACzE,IAAI,MAAM,CAAC,cAAc;QAAE,IAAI,IAAI,eAAe,CAAC,yBAAyB,CAAC;IAC7E,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,qBAAqB,CACvC,MAAgC,EAChC,OAAsC;IAEtC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;IAChD,IAAI,CAAC,YAAY,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;IAC9G,CAAC;IAED,MAAM,cAAc,GAAG,YAAY,CAAC,QAAQ,CAAC,gCAAS,CAAC,cAAc,CAAoB,CAAC;IAC1F,IAAI,CAAC,cAAc,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,oFAAoF,CAAC,CAAC;IAC1G,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,IAAI,wDAA2B,CAAC,MAAM,CAAC,CAAC;IAExE,6EAA6E;IAC7E,yEAAyE;IACzE,oCAAoC;IACpC,MAAM,WAAW,GACb,OAAO,EAAE,WAAW;QACpB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,yCAAY,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC9H,IAAI,WAAW,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC;QACzC,IAAI,OAAO,EAAE,KAAK;YAAE,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,WAAW,IAAI,WAAW,EAAE,CAAC;QAC7B,WAAW,CAAC,gBAAgB,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,kCAAW,CAAC,oBAAoB,CAAsB,CAAC;IAC9F,SAAS,YAAY;QACjB,QAAQ,EAAE,kBAAkB,CAAC;YACzB,QAAQ,EAAE,6BAAQ,CAAC,eAAe;YAClC,SAAS,EAAE,qCAAgB,CAAC,KAAK;YACjC,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,GAAG,CACvB,CAAC,CAAC,EAAE,EAAE,CACF,IAAI,yCAAsB,CAAC;gBACvB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,iBAAiB,EAAE,CAAC,CAAC,iBAAiB;gBACtC,WAAW,EAAE,CAAC,CAAC,WAAW;aAC7B,CAAC,CACT;SACJ,CAAC,CAAC;IACP,CAAC;IAED,4EAA4E;IAC5E,2EAA2E;IAC3E,MAAM,YAAY,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC;IAC9D,MAAM,oBAAoB,GAAG,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,aAAa,GAA8B;QAC7C,KAAK;QACL,UAAU,EAAE,KAAK,IAAI,EAAE;YACnB,YAAY,EAAE,CAAC;YACf,MAAM,WAAW,EAAE,IAAI,EAAE,CAAC;QAC9B,CAAC;QACD,iBAAiB,EAAE,oBAAoB;YACnC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE;gBACT,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;gBAC9C,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;oBACb,IAAA,gCAAqB,EAAC,YAAY,EAAE,4BAA4B,EAAE;wBAC9D,UAAU,EAAE,cAAc,CAAC,MAAM;wBACjC,UAAU,EAAE,wBAAwB;wBACpC,YAAY,EAAE,QAAQ;wBACtB,MAAM,EAAE,IAAI;wBACZ,OAAO,EAAE,cAAc,MAAM,2CAA2C,QAAQ,GAAG;qBACtF,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;YACH,CAAC,CAAC,SAAS;QACf,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,IAAA,gCAAqB,EAAC,YAAY,EAAE,4BAA4B,EAAE;gBAC9D,UAAU,EAAE,cAAc,CAAC,MAAM;gBACjC,UAAU,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE;gBACpC,QAAQ,EAAE,KAAK,CAAC,YAAY;gBAC5B,YAAY,EAAE,KAAK,CAAC,cAAc;gBAClC,MAAM,EAAE,KAAK,CAAC,UAAU,KAAK,oCAAW,CAAC,IAAI;gBAC7C,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,cAAc,UAAU,KAAK,CAAC,cAAc,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE;gBAC7G,qEAAqE;aACxE,CAAC,CAAC;QACP,CAAC;KACJ,CAAC;IAEF,yEAAyE;IACzE,0EAA0E;IAC1E,6EAA6E;IAC7E,mDAAmD;IACnD,IAAA,2BAAe,EAAC,UAAU,CAAC,YAAY,EAAE,gCAAS,CAAC,sBAAsB,EAAE,IAAA,4CAAkB,EAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IAC/G,IAAA,2BAAe,EAAC,UAAU,CAAC,YAAY,EAAE,gCAAS,CAAC,yBAAyB,EAAE,IAAA,+CAAqB,EAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IACrH,IAAA,2BAAe,EAAC,UAAU,CAAC,YAAY,EAAE,gCAAS,CAAC,yBAAyB,EAAE,IAAA,+CAAqB,EAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IACrH,IAAA,+BAAmB,EACf,UAAU,CAAC,YAAY,EAAE,gCAAS,CAAC,6BAA6B,EAAE,IAAA,mDAAyB,EAAC,aAAa,CAAC,CAAC,CAC9G,CAAC;IACF,IAAA,2BAAe,EAAC,QAAQ,CAAC,CAAC;IAE1B,iEAAiE;IACjE,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,kCAAW,CAAC,6BAA6B,CAAsB,CAAC;IACxG,SAAS,EAAE,kBAAkB,CAAC;QAC1B,QAAQ,EAAE,6BAAQ,CAAC,eAAe;QAClC,KAAK,EAAE,IAAI,wBAAK,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC;KAChF,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,YAAY,CAAC,QAAQ,CAAC,kCAAW,CAAC,8BAA8B,CAAsB,CAAC;IAC1G,UAAU,EAAE,kBAAkB,CAAC,EAAE,QAAQ,EAAE,6BAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAElG,YAAY,EAAE,CAAC;IAEf,OAAO,EAAE,KAAK,EAAE,CAAC;AACrB,CAAC;AAED,SAAS,UAAU,CACf,YAA2B,EAC3B,YAAoB,EACpB,OAA8C;IAE9C,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAoB,CAAC;IACtE,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IAC5B,OAAO,MAAM,CAAC;AAClB,CAAC"}

package/dist/role_set_resolver.d.ts

@@ -0,0 +1,23 @@
+/**
+ * @module node-opcua-role-set-server
+ *
+ * IRoleResolver adapter backed by an IIdentityMappingStore, optionally enforcing
+ * per-Role application/endpoint restrictions (OPC 10000-18 §4.4.1).
+ */
+import type { NodeId } from "node-opcua-nodeid";
+import type { AnyUserIdentityToken, IIdentityMappingStore, IRoleRestrictionStore, ResolutionContext } from "node-opcua-role-set-common";
+/**
+ * Adapts an {@link IIdentityMappingStore} (and an optional
+ * {@link IRoleRestrictionStore}) to the `IRoleResolver` contract so it can be
+ * registered on `OPCUAServer.roleResolvers`.
+ *
+ * A Role is granted when the UserIdentityToken matches **and** — if a
+ * restriction store is provided and a resolution context is available — the
+ * Session's application/endpoint comply with the Role's restrictions.
+ */
+export declare class RoleSetResolver {
+    private readonly store;
+    private readonly restrictionStore?;
+    constructor(store: IIdentityMappingStore, restrictionStore?: IRoleRestrictionStore | undefined);
+    resolveRoles(userIdentityToken: AnyUserIdentityToken, context?: ResolutionContext): NodeId[];
+}

package/dist/role_set_resolver.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RoleSetResolver = void 0;
+/**
+ * Adapts an {@link IIdentityMappingStore} (and an optional
+ * {@link IRoleRestrictionStore}) to the `IRoleResolver` contract so it can be
+ * registered on `OPCUAServer.roleResolvers`.
+ *
+ * A Role is granted when the UserIdentityToken matches **and** — if a
+ * restriction store is provided and a resolution context is available — the
+ * Session's application/endpoint comply with the Role's restrictions.
+ */
+class RoleSetResolver {
+    store;
+    restrictionStore;
+    constructor(store, restrictionStore) {
+        this.store = store;
+        this.restrictionStore = restrictionStore;
+    }
+    resolveRoles(userIdentityToken, context) {
+        const roles = this.store.resolveRoles(userIdentityToken);
+        if (!this.restrictionStore || !context) {
+            return roles;
+        }
+        const restrictionStore = this.restrictionStore;
+        return roles.filter((roleId) => restrictionStore.complies(roleId, context));
+    }
+}
+exports.RoleSetResolver = RoleSetResolver;
+//# sourceMappingURL=role_set_resolver.js.map

package/dist/role_set_resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role_set_resolver.js","sourceRoot":"","sources":["../source/role_set_resolver.ts"],"names":[],"mappings":";;;AAcA;;;;;;;;GAQG;AACH,MAAa,eAAe;IAEH;IACA;IAFrB,YACqB,KAA4B,EAC5B,gBAAwC;QADxC,UAAK,GAAL,KAAK,CAAuB;QAC5B,qBAAgB,GAAhB,gBAAgB,CAAwB;IAC1D,CAAC;IAEG,YAAY,CAAC,iBAAuC,EAAE,OAA2B;QACpF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,OAAO,EAAE,CAAC;YACrC,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC;QAC/C,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAChF,CAAC;CACJ;AAdD,0CAcC"}

package/dist/security_checks.d.ts

@@ -0,0 +1,25 @@
+/**
+ * @module node-opcua-role-set-server
+ *
+ * Shared authorization checks for the RoleType and UserManagement Methods
+ * (OPC 10000-18 §4.4 / §5.2): all require the SecurityAdmin Role and an
+ * encrypted SecureChannel.
+ */
+import type { ISessionContext } from "node-opcua-address-space-base";
+import type { CallMethodResultOptions } from "node-opcua-service-call";
+/**
+ * Verify the calling session holds the SecurityAdmin role.
+ * @returns a `Bad_UserAccessDenied` denial, or `null` if authorized.
+ */
+export declare function checkSecurityAdminAccess(context: ISessionContext): CallMethodResultOptions | null;
+/**
+ * Verify the call arrives over an encrypted (SignAndEncrypt) SecureChannel
+ * (OPC 10000-18 — `Bad_SecurityModeInsufficient`).
+ *
+ * When the channel security mode cannot be determined (e.g. an in-process
+ * `PseudoSession` with no channel), the check is skipped — such sessions are
+ * inherently local/trusted. Remote sessions always expose a channel mode.
+ *
+ * @returns a denial result, or `null` if the channel is acceptable.
+ */
+export declare function checkEncryptedChannel(context: ISessionContext): CallMethodResultOptions | null;