node-opcua-role-set-server 2.174.0

package/dist/security_checks.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkSecurityAdminAccess = checkSecurityAdminAccess;
+exports.checkEncryptedChannel = checkEncryptedChannel;
+const node_opcua_nodeid_1 = require("node-opcua-nodeid");
+const node_opcua_role_set_common_1 = require("node-opcua-role-set-common");
+const node_opcua_status_code_1 = require("node-opcua-status-code");
+const node_opcua_types_1 = require("node-opcua-types");
+/**
+ * Verify the calling session holds the SecurityAdmin role.
+ * @returns a `Bad_UserAccessDenied` denial, or `null` if authorized.
+ */
+function checkSecurityAdminAccess(context) {
+    const roles = context.getCurrentUserRoles();
+    const hasSecurityAdmin = roles.some((r) => (0, node_opcua_nodeid_1.sameNodeId)(r, node_opcua_role_set_common_1.WellKnownRoleIds.SecurityAdmin));
+    if (!hasSecurityAdmin) {
+        return { statusCode: node_opcua_status_code_1.StatusCodes.BadUserAccessDenied };
+    }
+    return null;
+}
+/**
+ * Verify the call arrives over an encrypted (SignAndEncrypt) SecureChannel
+ * (OPC 10000-18 — `Bad_SecurityModeInsufficient`).
+ *
+ * When the channel security mode cannot be determined (e.g. an in-process
+ * `PseudoSession` with no channel), the check is skipped — such sessions are
+ * inherently local/trusted. Remote sessions always expose a channel mode.
+ *
+ * @returns a denial result, or `null` if the channel is acceptable.
+ */
+function checkEncryptedChannel(context) {
+    const securityMode = context.session?.channel?.securityMode;
+    if (securityMode === undefined) {
+        return null; // mode unknown (in-process) → cannot enforce
+    }
+    if (securityMode !== node_opcua_types_1.MessageSecurityMode.SignAndEncrypt) {
+        return { statusCode: node_opcua_status_code_1.StatusCodes.BadSecurityModeInsufficient };
+    }
+    return null;
+}
+//# sourceMappingURL=security_checks.js.map

package/dist/security_checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security_checks.js","sourceRoot":"","sources":["../source/security_checks.ts"],"names":[],"mappings":";;AAkBA,4DAOC;AAYD,sDASC;AAtCD,yDAA+C;AAC/C,2EAA8D;AAE9D,mEAAqD;AACrD,uDAAuD;AAEvD;;;GAGG;AACH,SAAgB,wBAAwB,CAAC,OAAwB;IAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC;IAC5C,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,8BAAU,EAAC,CAAC,EAAE,6CAAgB,CAAC,aAAa,CAAC,CAAC,CAAC;IAC1F,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACpB,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,mBAAmB,EAAE,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,qBAAqB,CAAC,OAAwB;IAC1D,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC;IAC5D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC,CAAC,6CAA6C;IAC9D,CAAC;IACD,IAAI,YAAY,KAAK,sCAAmB,CAAC,cAAc,EAAE,CAAC;QACtD,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,2BAA2B,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC"}

package/dist/user_management_user_manager.d.ts

@@ -0,0 +1,37 @@
+import { type NodeId, type NodeIdLike } from "node-opcua-nodeid";
+import type { IIdentityMappingStore, IUserManagementStore } from "node-opcua-role-set-common";
+import { type StatusCode } from "node-opcua-status-code";
+import { type IdentityMappingRuleType } from "node-opcua-types";
+/** The subset of the ServerSession that `isValidUser` is bound to (`this`). */
+interface SessionThis {
+    getSessionId?(): NodeId;
+    /** Set so ActivateSession returns Good_PasswordChangeRequired (node-opcua-server). */
+    passwordChangeRequired?: boolean;
+}
+export interface IManagedUserManager {
+    /** Validate credentials (sync). Returns true for Good and Good_PasswordChangeRequired. */
+    isValidUser(this: SessionThis, userName: string, password: string): boolean;
+    /** Resolve the Roles granted to a user (only Anonymous while a change is required). */
+    getUserRoles(userName: string): NodeId[];
+    /**
+     * The IdentityMappingRules configured for a Role. The server core binds each
+     * Role's `Identities` Property to this, so it stays in sync with the same
+     * identity store that drives {@link getUserRoles} — one source of truth.
+     */
+    getIdentitiesForRole(role: NodeId): IdentityMappingRuleType[];
+    /**
+     * StatusCode recorded at activation for the given session — `Good`,
+     * `Good_PasswordChangeRequired`, or a `Bad_*` code. Pass the SessionId the
+     * client holds (`clientSession.sessionId`). `undefined` if never activated.
+     */
+    getSessionAuthStatus(sessionId: NodeIdLike): StatusCode | undefined;
+    /** StatusCode of the last authentication for each user (convenience). */
+    readonly lastAuthStatus: ReadonlyMap<string, StatusCode>;
+}
+/**
+ * Create a server `userManager` backed by the given user store. Roles are
+ * resolved from `identityStore` (a UserName identity rule per user); while a
+ * user must change the password, only the Anonymous Role is granted.
+ */
+export declare function createUserManager(userStore: IUserManagementStore, identityStore: IIdentityMappingStore): IManagedUserManager;
+export {};

package/dist/user_management_user_manager.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createUserManager = createUserManager;
+/**
+ * @module node-opcua-role-set-server
+ *
+ * Bridges an {@link IUserManagementStore} (and an optional role
+ * {@link IIdentityMappingStore}) to the OPC UA server `userManager` interface so
+ * that CreateSession / ActivateSession authenticate against the managed users.
+ *
+ * It records the StatusCode of the **last authentication** — in particular
+ * `Good_PasswordChangeRequired` for a user that must change the password
+ * (OPC 10000-18 §5.2.8). Because the OPC UA stack does not propagate that code
+ * into the ActivateSession response, the status is recorded here:
+ *  - per **session** ({@link IManagedUserManager.getSessionAuthStatus}),
+ *    keyed by the SessionId the client also holds, so it can be observed in the
+ *    context of the very session that activated;
+ *  - per **user** ({@link IManagedUserManager.lastAuthStatus}) for convenience.
+ *
+ * The server `userManager` invokes `isValidUser` with `this` bound to the
+ * ServerSession, which is how the SessionId is captured (non-breaking).
+ */
+const node_opcua_constants_1 = require("node-opcua-constants");
+const node_opcua_nodeid_1 = require("node-opcua-nodeid");
+const node_opcua_status_code_1 = require("node-opcua-status-code");
+const node_opcua_types_1 = require("node-opcua-types");
+const has = (mask, bit) => (mask & bit) === bit;
+/**
+ * Create a server `userManager` backed by the given user store. Roles are
+ * resolved from `identityStore` (a UserName identity rule per user); while a
+ * user must change the password, only the Anonymous Role is granted.
+ */
+function createUserManager(userStore, identityStore) {
+    const lastAuthStatus = new Map();
+    const statusBySession = new Map();
+    const anonymousOnly = () => [(0, node_opcua_nodeid_1.makeNodeId)(node_opcua_constants_1.WellKnownRoles.Anonymous)];
+    return {
+        lastAuthStatus,
+        getSessionAuthStatus(sessionId) {
+            return statusBySession.get(sessionId.toString());
+        },
+        isValidUser(userName, password) {
+            const result = userStore.authenticate(userName, password);
+            lastAuthStatus.set(userName, result.statusCode);
+            // `this` is the ServerSession; key the status by the SessionId the
+            // client also holds, so the outcome can be observed per session.
+            const sessionId = this?.getSessionId?.();
+            if (sessionId) {
+                statusBySession.set(sessionId.toString(), result.statusCode);
+            }
+            // flag the session so ActivateSession returns Good_PasswordChangeRequired
+            if (this) {
+                this.passwordChangeRequired = result.statusCode === node_opcua_status_code_1.StatusCodes.GoodPasswordChangeRequired;
+            }
+            return result.statusCode === node_opcua_status_code_1.StatusCodes.Good || result.statusCode === node_opcua_status_code_1.StatusCodes.GoodPasswordChangeRequired;
+        },
+        getUserRoles(userName) {
+            const user = userStore.getUsers().find((u) => u.userName === userName);
+            if (user && has(user.userConfiguration, node_opcua_types_1.UserConfigurationMask.MustChangePassword)) {
+                return anonymousOnly();
+            }
+            const token = new node_opcua_types_1.UserNameIdentityToken({ userName });
+            return identityStore.resolveRoles(token);
+        },
+        getIdentitiesForRole(role) {
+            // Backs each Role's `Identities` Property via the server core, from the
+            // same store as getUserRoles — so the two can never drift apart.
+            return identityStore.getIdentitiesForRole(role);
+        }
+    };
+}
+//# sourceMappingURL=user_management_user_manager.js.map

package/dist/user_management_user_manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user_management_user_manager.js","sourceRoot":"","sources":["../source/user_management_user_manager.ts"],"names":[],"mappings":";;AA4DA,8CA2CC;AAvGD;;;;;;;;;;;;;;;;;;GAkBG;AACH,+DAAsD;AACtD,yDAA6E;AAE7E,mEAAsE;AACtE,uDAA8G;AA8B9G,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,GAAW,EAAW,EAAE,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,KAAK,GAAG,CAAC;AAEzE;;;;GAIG;AACH,SAAgB,iBAAiB,CAAC,SAA+B,EAAE,aAAoC;IACnG,MAAM,cAAc,GAAG,IAAI,GAAG,EAAsB,CAAC;IACrD,MAAM,eAAe,GAAG,IAAI,GAAG,EAAsB,CAAC;IACtD,MAAM,aAAa,GAAG,GAAa,EAAE,CAAC,CAAC,IAAA,8BAAU,EAAC,qCAAc,CAAC,SAAS,CAAC,CAAC,CAAC;IAE7E,OAAO;QACH,cAAc;QAEd,oBAAoB,CAAC,SAAqB;YACtC,OAAO,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,WAAW,CAAoB,QAAgB,EAAE,QAAgB;YAC7D,MAAM,MAAM,GAAG,SAAS,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC1D,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YAChD,mEAAmE;YACnE,iEAAiE;YACjE,MAAM,SAAS,GAAG,IAAI,EAAE,YAAY,EAAE,EAAE,CAAC;YACzC,IAAI,SAAS,EAAE,CAAC;gBACZ,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YACjE,CAAC;YACD,0EAA0E;YAC1E,IAAI,IAAI,EAAE,CAAC;gBACP,IAAI,CAAC,sBAAsB,GAAG,MAAM,CAAC,UAAU,KAAK,oCAAW,CAAC,0BAA0B,CAAC;YAC/F,CAAC;YACD,OAAO,MAAM,CAAC,UAAU,KAAK,oCAAW,CAAC,IAAI,IAAI,MAAM,CAAC,UAAU,KAAK,oCAAW,CAAC,0BAA0B,CAAC;QAClH,CAAC;QAED,YAAY,CAAC,QAAgB;YACzB,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;YACvE,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,wCAAqB,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBAChF,OAAO,aAAa,EAAE,CAAC;YAC3B,CAAC;YACD,MAAM,KAAK,GAAyB,IAAI,wCAAqB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC5E,OAAO,aAAa,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;QAED,oBAAoB,CAAC,IAAY;YAC7B,wEAAwE;YACxE,iEAAiE;YACjE,OAAO,aAAa,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;KACJ,CAAC;AACN,CAAC"}

package/dist/variant_args.d.ts

@@ -0,0 +1,13 @@
+/**
+ * @module node-opcua-role-set-server
+ *
+ * Small helpers to read Method input arguments out of a `Variant[]` safely.
+ */
+import type { UserConfigurationMask } from "node-opcua-types";
+import type { Variant } from "node-opcua-variant";
+/** The string value of an argument, or `null` if absent / not a string. */
+export declare function asString(v: Variant | undefined): string | null;
+/** The boolean value of an argument (missing / non-boolean → `false`). */
+export declare function asBoolean(v: Variant | undefined): boolean;
+/** The UserConfigurationMask value of an argument (missing / non-numeric → `0`). */
+export declare function asMask(v: Variant | undefined): UserConfigurationMask;

package/dist/variant_args.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.asString = asString;
+exports.asBoolean = asBoolean;
+exports.asMask = asMask;
+/** The string value of an argument, or `null` if absent / not a string. */
+function asString(v) {
+    return v && typeof v.value === "string" ? v.value : null;
+}
+/** The boolean value of an argument (missing / non-boolean → `false`). */
+function asBoolean(v) {
+    return !!v && v.value === true;
+}
+/** The UserConfigurationMask value of an argument (missing / non-numeric → `0`). */
+function asMask(v) {
+    return (v && typeof v.value === "number" ? v.value : 0);
+}
+//# sourceMappingURL=variant_args.js.map

package/dist/variant_args.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"variant_args.js","sourceRoot":"","sources":["../source/variant_args.ts"],"names":[],"mappings":";;AASA,4BAEC;AAGD,8BAEC;AAGD,wBAEC;AAbD,2EAA2E;AAC3E,SAAgB,QAAQ,CAAC,CAAsB;IAC3C,OAAO,CAAC,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC;AAED,0EAA0E;AAC1E,SAAgB,SAAS,CAAC,CAAsB;IAC5C,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC;AACnC,CAAC;AAED,oFAAoF;AACpF,SAAgB,MAAM,CAAC,CAAsB;IACzC,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAA0B,CAAC;AACrF,CAAC"}

package/package.json

@@ -0,0 +1,54 @@
+{
+    "name": "node-opcua-role-set-server",
+    "version": "2.174.0",
+    "description": "pure nodejs OPCUA SDK - server-side role-set management (OPC 10000-18)",
+    "scripts": {
+        "build": "tsc -b",
+        "lint": "eslint source/**/*.ts",
+        "clean": "npx rimraf -g node_modules dist *.tsbuildinfo",
+        "test": "mocha",
+        "test:check": "tsc --noEmit -p test/tsconfig.json"
+    },
+    "main": "./dist/index.js",
+    "types": "./dist/index.d.ts",
+    "devEngines": {
+        "node": ">=18.x",
+        "npm": ">=10.x"
+    },
+    "dependencies": {
+        "node-opcua-address-space": "2.174.0",
+        "node-opcua-address-space-base": "2.174.0",
+        "node-opcua-constants": "2.174.0",
+        "node-opcua-data-model": "2.174.0",
+        "node-opcua-nodeid": "2.174.0",
+        "node-opcua-role-set-common": "2.174.0",
+        "node-opcua-service-call": "2.174.0",
+        "node-opcua-status-code": "2.173.0",
+        "node-opcua-types": "2.174.0",
+        "node-opcua-variant": "2.174.0"
+    },
+    "devDependencies": {
+        "node-opcua-leak-detector": "2.172.0",
+        "node-opcua-nodesets": "2.174.0"
+    },
+    "author": "Etienne Rossignon",
+    "license": "MIT",
+    "repository": {
+        "type": "git",
+        "url": "git://github.com/node-opcua/node-opcua.git"
+    },
+    "keywords": [
+        "OPCUA",
+        "opcua",
+        "m2m",
+        "iot",
+        "opc ua",
+        "internet of things"
+    ],
+    "homepage": "http://node-opcua.github.io/",
+    "gitHead": "064029878247adf2fa5d14a8124e1930431e2428",
+    "files": [
+        "dist",
+        "source"
+    ]
+}

package/source/audit.ts

@@ -0,0 +1,53 @@
+/**
+ * @module node-opcua-role-set-server
+ *
+ * Shared helper to raise an audit method event (a subtype of
+ * AuditUpdateMethodEventType) on the Server Object.
+ */
+import type { UAObject } from "node-opcua-address-space";
+import { NodeId } from "node-opcua-nodeid";
+import type { Variant } from "node-opcua-variant";
+import { VariantArrayType } from "node-opcua-variant";
+
+export interface AuditMethodEventFields {
+    /** The Node the audited operation acted on (Role / UserManagement Object). */
+    sourceNode: NodeId;
+    /** A short label, e.g. "Method/AddIdentity". */
+    sourceName: string;
+    /** The audited Method NodeId (omit for events not raised from a single Method call). */
+    methodId?: NodeId;
+    /** The Session user who invoked the Method. */
+    clientUserId: string;
+    /** TRUE when the operation succeeded. */
+    status: boolean;
+    /** Human-readable message (must NOT contain secrets such as passwords). */
+    message: string;
+    /**
+     * The Method input arguments — include ONLY when they carry no secret
+     * (e.g. an IdentityMappingRule). Omit for password-bearing Methods.
+     */
+    inputArguments?: Variant[];
+}
+
+/**
+ * Raise `eventType` on the given Server Object with the standard
+ * AuditUpdateMethodEventType fields. No-op if there is no Server Object.
+ */
+export function raiseAuditMethodEvent(serverObject: UAObject | undefined, eventType: string, fields: AuditMethodEventFields): void {
+    if (!serverObject) {
+        return;
+    }
+    serverObject.raiseEvent(eventType, {
+        actionTimeStamp: { dataType: "DateTime", value: new Date() },
+        status: { dataType: "Boolean", value: fields.status },
+        serverId: { dataType: "String", value: "" },
+        clientAuditEntryId: { dataType: "String", value: "" },
+        clientUserId: { dataType: "String", value: fields.clientUserId },
+        sourceNode: { dataType: "NodeId", value: fields.sourceNode },
+        sourceName: { dataType: "String", value: fields.sourceName },
+        methodId: { dataType: "NodeId", value: fields.methodId ?? NodeId.nullNodeId },
+        severity: { dataType: "UInt16", value: 10 },
+        message: { dataType: "LocalizedText", value: fields.message },
+        inputArguments: { dataType: "Variant", arrayType: VariantArrayType.Array, value: fields.inputArguments ?? [] }
+    });
+}

package/source/bind_restriction_methods.ts

@@ -0,0 +1,117 @@
+/**
+ * @module node-opcua-role-set-server
+ *
+ * Method handlers for the RoleType application/endpoint restriction Methods
+ * (OPC 10000-18 §4.4.7-10): AddApplication / RemoveApplication / AddEndpoint /
+ * RemoveEndpoint, backed by an {@link IRoleRestrictionStore}.
+ *
+ * All require the SecurityAdmin Role and an encrypted channel, and raise a
+ * RoleMappingRuleChangedAuditEventType (§4.5, reusing the same audit hook as the
+ * identity Methods).
+ */
+import type { ISessionContext, UAMethod } from "node-opcua-address-space-base";
+import type { NodeId } from "node-opcua-nodeid";
+import type { EndpointCriteria, IRoleRestrictionStore } from "node-opcua-role-set-common";
+import type { CallMethodResultOptions } from "node-opcua-service-call";
+import { type StatusCode, StatusCodes } from "node-opcua-status-code";
+import { EndpointType } from "node-opcua-types";
+import type { Variant } from "node-opcua-variant";
+import type { RoleMappingRuleChangedAudit } from "./bind_role_methods.js";
+import { checkEncryptedChannel, checkSecurityAdminAccess } from "./security_checks.js";
+import { asString } from "./variant_args.js";
+
+export interface BindRestrictionMethodsOptions {
+    restrictionStore: IRoleRestrictionStore;
+    /** Called after every successful mutation so the caller can persist / refresh. */
+    onMutation?: () => Promise<void>;
+    /** Called after an authorized attempt to raise an audit event. */
+    onAudit?: (audit: RoleMappingRuleChangedAudit) => void;
+}
+
+function endpointFromArg(v: Variant | undefined): EndpointCriteria | null {
+    if (!v || !(v.value instanceof EndpointType)) {
+        return null;
+    }
+    const e = v.value;
+    return {
+        endpointUrl: e.endpointUrl ?? undefined,
+        securityMode: e.securityMode,
+        securityPolicyUri: e.securityPolicyUri ?? undefined,
+        transportProfileUri: e.transportProfileUri ?? undefined
+    };
+}
+
+/**
+ * Build a handler that, after the SecurityAdmin + encrypted-channel checks,
+ * applies `mutate` to the Role's restrictions, persists, and audits.
+ */
+function makeRestrictionHandler(
+    options: BindRestrictionMethodsOptions,
+    method: RoleMappingRuleChangedAudit["method"],
+    mutate: (roleNodeId: NodeId, inputArguments: Variant[]) => StatusCode | null
+) {
+    const { onMutation, onAudit } = options;
+    return async function (this: UAMethod, inputArguments: Variant[], context: ISessionContext): Promise<CallMethodResultOptions> {
+        const insecure = checkEncryptedChannel(context);
+        if (insecure) return insecure;
+        const denied = checkSecurityAdminAccess(context);
+        if (denied) return denied;
+
+        const roleNode = this.parent;
+        if (!roleNode) {
+            return { statusCode: StatusCodes.BadInternalError };
+        }
+        const statusCode = mutate(roleNode.nodeId, inputArguments);
+        if (statusCode === null) {
+            return { statusCode: StatusCodes.BadInvalidArgument };
+        }
+        if (statusCode === StatusCodes.Good && onMutation) {
+            await onMutation();
+        }
+        onAudit?.({
+            method,
+            roleNodeId: roleNode.nodeId,
+            methodNodeId: this.nodeId,
+            userName: context.getUserName(),
+            inputArguments,
+            statusCode
+        });
+        return { statusCode };
+    };
+}
+
+/** AddApplication (§4.4.7). */
+export function makeAddApplicationHandler(options: BindRestrictionMethodsOptions) {
+    return makeRestrictionHandler(options, "AddApplication", (roleNodeId, args) => {
+        const uri = asString(args[0]);
+        if (uri === null) return null;
+        return options.restrictionStore.addApplication(roleNodeId, uri) ? StatusCodes.Good : StatusCodes.BadAlreadyExists;
+    });
+}
+
+/** RemoveApplication (§4.4.8). */
+export function makeRemoveApplicationHandler(options: BindRestrictionMethodsOptions) {
+    return makeRestrictionHandler(options, "RemoveApplication", (roleNodeId, args) => {
+        const uri = asString(args[0]);
+        if (uri === null) return null;
+        return options.restrictionStore.removeApplication(roleNodeId, uri) ? StatusCodes.Good : StatusCodes.BadNotFound;
+    });
+}
+
+/** AddEndpoint (§4.4.9). */
+export function makeAddEndpointHandler(options: BindRestrictionMethodsOptions) {
+    return makeRestrictionHandler(options, "AddEndpoint", (roleNodeId, args) => {
+        const endpoint = endpointFromArg(args[0]);
+        if (endpoint === null) return null;
+        return options.restrictionStore.addEndpoint(roleNodeId, endpoint) ? StatusCodes.Good : StatusCodes.BadAlreadyExists;
+    });
+}
+
+/** RemoveEndpoint (§4.4.10). */
+export function makeRemoveEndpointHandler(options: BindRestrictionMethodsOptions) {
+    return makeRestrictionHandler(options, "RemoveEndpoint", (roleNodeId, args) => {
+        const endpoint = endpointFromArg(args[0]);
+        if (endpoint === null) return null;
+        return options.restrictionStore.removeEndpoint(roleNodeId, endpoint) ? StatusCodes.Good : StatusCodes.BadNotFound;
+    });
+}

package/source/bind_role_methods.ts

@@ -0,0 +1,196 @@
+/**
+ * @module node-opcua-role-set-server
+ *
+ * Method handlers for RoleType AddIdentity / RemoveIdentity
+ * and RoleSetType AddRole / RemoveRole.
+ *
+ * Each handler follows the OPC UA method binding pattern:
+ *   - `this` is the UAMethod node
+ *   - `inputArguments` is Variant[]
+ *   - `context` is ISessionContext
+ *   - returns Promise<CallMethodResultOptions>
+ */
+import type { ISessionContext, UAMethod } from "node-opcua-address-space-base";
+import type { NodeId } from "node-opcua-nodeid";
+import { sameNodeId } from "node-opcua-nodeid";
+import { type IIdentityMappingStore, WellKnownRoleIds } from "node-opcua-role-set-common";
+import type { CallMethodResultOptions } from "node-opcua-service-call";
+import { type StatusCode, StatusCodes } from "node-opcua-status-code";
+import { IdentityCriteriaType, IdentityMappingRuleType } from "node-opcua-types";
+import type { Variant } from "node-opcua-variant";
+import { checkEncryptedChannel, checkSecurityAdminAccess } from "./security_checks.js";
+
+/**
+ * Well-known Roles whose mapping rules a Server shall not allow to be
+ * changed (OPC 10000-18 §4.3): Anonymous, AuthenticatedUser and
+ * TrustedApplication. (TrustedApplication has no constant in this build and
+ * is matched by NodeId when present.)
+ */
+function isImmutableRole(roleId: NodeId): boolean {
+    return sameNodeId(roleId, WellKnownRoleIds.Anonymous) || sameNodeId(roleId, WellKnownRoleIds.AuthenticatedUser);
+}
+
+/**
+ * Administrative Roles to which weak (Anonymous / AuthenticatedUser) identity
+ * rules must not be added (OPC 10000-18 §4.4.5: a Server should refuse to add
+ * an ANONYMOUS_5 rule to Roles with administrator privileges).
+ */
+function isPrivilegedRole(roleId: NodeId): boolean {
+    return sameNodeId(roleId, WellKnownRoleIds.SecurityAdmin) || sameNodeId(roleId, WellKnownRoleIds.ConfigureAdmin);
+}
+
+/** True for weak criteria that must not be granted to administrative Roles. */
+function isWeakCriteria(criteriaType: IdentityCriteriaType): boolean {
+    return criteriaType === IdentityCriteriaType.Anonymous || criteriaType === IdentityCriteriaType.AuthenticatedUser;
+}
+
+/**
+ * Extract the IdentityMappingRuleType from the first input argument.
+ */
+function extractIdentityRule(inputArguments: Variant[]): IdentityMappingRuleType | null {
+    if (!inputArguments || inputArguments.length < 1) {
+        return null;
+    }
+    const value = inputArguments[0].value;
+    if (value instanceof IdentityMappingRuleType) {
+        return value;
+    }
+    return null;
+}
+
+/**
+ * Details of an identity-mapping change, passed to {@link BindRoleMethodsOptions.onAudit}
+ * so the caller can raise a `RoleMappingRuleChangedAuditEventType` (OPC 10000-18 §4.5).
+ * Raised for every authorized attempt — both successful updates and refusals
+ * (e.g. immutable Role, duplicate) — with the resulting `statusCode`.
+ */
+export interface RoleMappingRuleChangedAudit {
+    method: "AddIdentity" | "RemoveIdentity" | "AddApplication" | "RemoveApplication" | "AddEndpoint" | "RemoveEndpoint";
+    roleNodeId: NodeId;
+    methodNodeId: NodeId;
+    userName: string;
+    inputArguments: Variant[];
+    statusCode: StatusCode;
+}
+
+export interface BindRoleMethodsOptions {
+    store: IIdentityMappingStore;
+    /** Called after every mutation (add/remove) so the caller can persist. */
+    onMutation?: () => Promise<void>;
+    /** Called after an authorized AddIdentity/RemoveIdentity attempt to raise an audit event. */
+    onAudit?: (audit: RoleMappingRuleChangedAudit) => void;
+}
+
+/**
+ * Create an AddIdentity method handler bound to the given store.
+ * The handler extracts the role NodeId from its parent Role object.
+ */
+export function makeAddIdentityHandler(options: BindRoleMethodsOptions) {
+    const { store, onMutation, onAudit } = options;
+
+    return async function _addIdentity(
+        this: UAMethod,
+        inputArguments: Variant[],
+        context: ISessionContext
+    ): Promise<CallMethodResultOptions> {
+        // 1. The SecureChannel must be encrypted
+        const insecure = checkEncryptedChannel(context);
+        if (insecure) return insecure;
+
+        // 2. Security check
+        const denied = checkSecurityAdminAccess(context);
+        if (denied) return denied;
+
+        // 3. Extract the rule from input
+        const rule = extractIdentityRule(inputArguments);
+        if (!rule) {
+            return { statusCode: StatusCodes.BadInvalidArgument };
+        }
+
+        // 4. The parent of this method is the Role object
+        const roleNode = this.parent;
+        if (!roleNode) {
+            return { statusCode: StatusCodes.BadInternalError };
+        }
+
+        // 5-7. Compute the outcome of the authorized rule-change attempt
+        let statusCode: StatusCode;
+        if (isImmutableRole(roleNode.nodeId)) {
+            // well-known immutable Roles cannot be changed (§4.3)
+            statusCode = StatusCodes.BadRequestNotAllowed;
+        } else if (isWeakCriteria(rule.criteriaType) && isPrivilegedRole(roleNode.nodeId)) {
+            // refuse weak (Anonymous/AuthenticatedUser) rules on administrative Roles (§4.4.5)
+            statusCode = StatusCodes.BadRequestNotAllowed;
+        } else {
+            // duplicate rule is reported as Bad_AlreadyExists
+            statusCode = store.addIdentity(roleNode.nodeId, rule) ? StatusCodes.Good : StatusCodes.BadAlreadyExists;
+        }
+
+        if (statusCode === StatusCodes.Good && onMutation) {
+            await onMutation();
+        }
+        onAudit?.({
+            method: "AddIdentity",
+            roleNodeId: roleNode.nodeId,
+            methodNodeId: this.nodeId,
+            userName: context.getUserName(),
+            inputArguments,
+            statusCode
+        });
+        return { statusCode };
+    };
+}
+
+/**
+ * Create a RemoveIdentity method handler bound to the given store.
+ */
+export function makeRemoveIdentityHandler(options: BindRoleMethodsOptions) {
+    const { store, onMutation, onAudit } = options;
+
+    return async function _removeIdentity(
+        this: UAMethod,
+        inputArguments: Variant[],
+        context: ISessionContext
+    ): Promise<CallMethodResultOptions> {
+        // 1. The SecureChannel must be encrypted
+        const insecure = checkEncryptedChannel(context);
+        if (insecure) return insecure;
+
+        // 2. Security check
+        const denied = checkSecurityAdminAccess(context);
+        if (denied) return denied;
+
+        // 3. Extract the rule from input
+        const rule = extractIdentityRule(inputArguments);
+        if (!rule) {
+            return { statusCode: StatusCodes.BadInvalidArgument };
+        }
+
+        // 4. The parent of this method is the Role object
+        const roleNode = this.parent;
+        if (!roleNode) {
+            return { statusCode: StatusCodes.BadInternalError };
+        }
+
+        // 5-6. Compute the outcome of the authorized rule-change attempt
+        let statusCode: StatusCode;
+        if (isImmutableRole(roleNode.nodeId)) {
+            statusCode = StatusCodes.BadRequestNotAllowed;
+        } else {
+            statusCode = store.removeIdentity(roleNode.nodeId, rule) ? StatusCodes.Good : StatusCodes.BadNoMatch;
+        }
+
+        if (statusCode === StatusCodes.Good && onMutation) {
+            await onMutation();
+        }
+        onAudit?.({
+            method: "RemoveIdentity",
+            roleNodeId: roleNode.nodeId,
+            methodNodeId: this.nodeId,
+            userName: context.getUserName(),
+            inputArguments,
+            statusCode
+        });
+        return { statusCode };
+    };
+}