node-opcua-role-set-server 2.183.1 → 2.184.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/audit.d.ts +1 -0
- package/dist/audit.d.ts.map +1 -0
- package/dist/audit.js +5 -8
- package/dist/audit.js.map +1 -1
- package/dist/bind_restriction_methods.d.ts +1 -0
- package/dist/bind_restriction_methods.d.ts.map +1 -0
- package/dist/bind_restriction_methods.js +20 -26
- package/dist/bind_restriction_methods.js.map +1 -1
- package/dist/bind_role_methods.d.ts +1 -0
- package/dist/bind_role_methods.d.ts.map +1 -0
- package/dist/bind_role_methods.js +26 -30
- package/dist/bind_role_methods.js.map +1 -1
- package/dist/bind_user_management.d.ts +1 -0
- package/dist/bind_user_management.d.ts.map +1 -0
- package/dist/bind_user_management.js +40 -46
- package/dist/bind_user_management.js.map +1 -1
- package/dist/harden.d.ts +1 -0
- package/dist/harden.d.ts.map +1 -0
- package/dist/harden.js +7 -11
- package/dist/harden.js.map +1 -1
- package/dist/index.d.ts +1 -0
- package/dist/index.d.ts.map +1 -0
- package/dist/index.js +10 -31
- package/dist/index.js.map +1 -1
- package/dist/install_role_based_security.d.ts +1 -0
- package/dist/install_role_based_security.d.ts.map +1 -0
- package/dist/install_role_based_security.js +17 -20
- package/dist/install_role_based_security.js.map +1 -1
- package/dist/install_role_set.d.ts +1 -0
- package/dist/install_role_set.d.ts.map +1 -0
- package/dist/install_role_set.js +80 -83
- package/dist/install_role_set.js.map +1 -1
- package/dist/install_user_management.d.ts +1 -0
- package/dist/install_user_management.d.ts.map +1 -0
- package/dist/install_user_management.js +30 -33
- package/dist/install_user_management.js.map +1 -1
- package/dist/role_set_resolver.d.ts +1 -0
- package/dist/role_set_resolver.d.ts.map +1 -0
- package/dist/role_set_resolver.js +1 -5
- package/dist/role_set_resolver.js.map +1 -1
- package/dist/security_checks.d.ts +1 -0
- package/dist/security_checks.d.ts.map +1 -0
- package/dist/security_checks.js +10 -14
- package/dist/security_checks.js.map +1 -1
- package/dist/user_management_user_manager.d.ts +1 -0
- package/dist/user_management_user_manager.d.ts.map +1 -0
- package/dist/user_management_user_manager.js +10 -13
- package/dist/user_management_user_manager.js.map +1 -1
- package/dist/variant_args.d.ts +1 -0
- package/dist/variant_args.d.ts.map +1 -0
- package/dist/variant_args.js +3 -8
- package/dist/variant_args.js.map +1 -1
- package/package.json +17 -16
package/dist/audit.d.ts
CHANGED
|
@@ -31,3 +31,4 @@ export interface AuditMethodEventFields {
|
|
|
31
31
|
* AuditUpdateMethodEventType fields. No-op if there is no Server Object.
|
|
32
32
|
*/
|
|
33
33
|
export declare function raiseAuditMethodEvent(serverObject: UAObject | undefined, eventType: string, fields: AuditMethodEventFields): void;
|
|
34
|
+
//# sourceMappingURL=audit.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../source/audit.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAGlD,MAAM,WAAW,sBAAsB;IACnC,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,wFAAwF;IACxF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB,yCAAyC;IACzC,MAAM,EAAE,OAAO,CAAC;IAChB,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC;CAC9B;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,QAAQ,GAAG,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,GAAG,IAAI,CAiBjI"}
|
package/dist/audit.js
CHANGED
|
@@ -1,13 +1,10 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
exports.raiseAuditMethodEvent = raiseAuditMethodEvent;
|
|
4
|
-
const node_opcua_nodeid_1 = require("node-opcua-nodeid");
|
|
5
|
-
const node_opcua_variant_1 = require("node-opcua-variant");
|
|
1
|
+
import { NodeId } from "node-opcua-nodeid";
|
|
2
|
+
import { VariantArrayType } from "node-opcua-variant";
|
|
6
3
|
/**
|
|
7
4
|
* Raise `eventType` on the given Server Object with the standard
|
|
8
5
|
* AuditUpdateMethodEventType fields. No-op if there is no Server Object.
|
|
9
6
|
*/
|
|
10
|
-
function raiseAuditMethodEvent(serverObject, eventType, fields) {
|
|
7
|
+
export function raiseAuditMethodEvent(serverObject, eventType, fields) {
|
|
11
8
|
if (!serverObject) {
|
|
12
9
|
return;
|
|
13
10
|
}
|
|
@@ -19,10 +16,10 @@ function raiseAuditMethodEvent(serverObject, eventType, fields) {
|
|
|
19
16
|
clientUserId: { dataType: "String", value: fields.clientUserId },
|
|
20
17
|
sourceNode: { dataType: "NodeId", value: fields.sourceNode },
|
|
21
18
|
sourceName: { dataType: "String", value: fields.sourceName },
|
|
22
|
-
methodId: { dataType: "NodeId", value: fields.methodId ??
|
|
19
|
+
methodId: { dataType: "NodeId", value: fields.methodId ?? NodeId.nullNodeId },
|
|
23
20
|
severity: { dataType: "UInt16", value: 10 },
|
|
24
21
|
message: { dataType: "LocalizedText", value: fields.message },
|
|
25
|
-
inputArguments: { dataType: "Variant", arrayType:
|
|
22
|
+
inputArguments: { dataType: "Variant", arrayType: VariantArrayType.Array, value: fields.inputArguments ?? [] }
|
|
26
23
|
});
|
|
27
24
|
}
|
|
28
25
|
//# sourceMappingURL=audit.js.map
|
package/dist/audit.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"audit.js","sourceRoot":"","sources":["../source/audit.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"audit.js","sourceRoot":"","sources":["../source/audit.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAsBtD;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,YAAkC,EAAE,SAAiB,EAAE,MAA8B;IACvH,IAAI,CAAC,YAAY,EAAE,CAAC;QAChB,OAAO;IACX,CAAC;IACD,YAAY,CAAC,UAAU,CAAC,SAAS,EAAE;QAC/B,eAAe,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,EAAE;QAC5D,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE;QACrD,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE;QAC3C,kBAAkB,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE;QACrD,YAAY,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE;QAChE,UAAU,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE;QAC5D,UAAU,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE;QAC5D,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,UAAU,EAAE;QAC7E,QAAQ,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE;QAC3C,OAAO,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE;QAC7D,cAAc,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,cAAc,IAAI,EAAE,EAAE;KACjH,CAAC,CAAC;AACP,CAAC"}
|
|
@@ -29,3 +29,4 @@ export declare function makeRemoveApplicationHandler(options: BindRestrictionMet
|
|
|
29
29
|
export declare function makeAddEndpointHandler(options: BindRestrictionMethodsOptions): (this: UAMethod, inputArguments: Variant[], context: ISessionContext) => Promise<CallMethodResultOptions>;
|
|
30
30
|
/** RemoveEndpoint (§4.4.10). */
|
|
31
31
|
export declare function makeRemoveEndpointHandler(options: BindRestrictionMethodsOptions): (this: UAMethod, inputArguments: Variant[], context: ISessionContext) => Promise<CallMethodResultOptions>;
|
|
32
|
+
//# sourceMappingURL=bind_restriction_methods.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"bind_restriction_methods.d.ts","sourceRoot":"","sources":["../source/bind_restriction_methods.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AAE/E,OAAO,KAAK,EAAoB,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAC1F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAGvE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AAI1E,MAAM,WAAW,6BAA6B;IAC1C,gBAAgB,EAAE,qBAAqB,CAAC;IACxC,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,kEAAkE;IAClE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,2BAA2B,KAAK,IAAI,CAAC;CAC1D;AAsDD,+BAA+B;AAC/B,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,6BAA6B,UA9B/C,QAAQ,kBAAkB,OAAO,EAAE,WAAW,eAAe,KAAG,OAAO,CAAC,uBAAuB,CAAC,CAoChI;AAED,kCAAkC;AAClC,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,6BAA6B,UAvClD,QAAQ,kBAAkB,OAAO,EAAE,WAAW,eAAe,KAAG,OAAO,CAAC,uBAAuB,CAAC,CA6ChI;AAED,4BAA4B;AAC5B,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,6BAA6B,UAhD5C,QAAQ,kBAAkB,OAAO,EAAE,WAAW,eAAe,KAAG,OAAO,CAAC,uBAAuB,CAAC,CAsDhI;AAED,gCAAgC;AAChC,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,6BAA6B,UAzD/C,QAAQ,kBAAkB,OAAO,EAAE,WAAW,eAAe,KAAG,OAAO,CAAC,uBAAuB,CAAC,CA+DhI"}
|
|
@@ -1,15 +1,9 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
exports.makeAddEndpointHandler = makeAddEndpointHandler;
|
|
6
|
-
exports.makeRemoveEndpointHandler = makeRemoveEndpointHandler;
|
|
7
|
-
const node_opcua_status_code_1 = require("node-opcua-status-code");
|
|
8
|
-
const node_opcua_types_1 = require("node-opcua-types");
|
|
9
|
-
const security_checks_js_1 = require("./security_checks.js");
|
|
10
|
-
const variant_args_js_1 = require("./variant_args.js");
|
|
1
|
+
import { StatusCodes } from "node-opcua-status-code";
|
|
2
|
+
import { EndpointType } from "node-opcua-types";
|
|
3
|
+
import { checkEncryptedChannel, checkSecurityAdminAccess } from "./security_checks.js";
|
|
4
|
+
import { asString } from "./variant_args.js";
|
|
11
5
|
function endpointFromArg(v) {
|
|
12
|
-
if (!v || !(v.value instanceof
|
|
6
|
+
if (!v || !(v.value instanceof EndpointType)) {
|
|
13
7
|
return null;
|
|
14
8
|
}
|
|
15
9
|
const e = v.value;
|
|
@@ -27,21 +21,21 @@ function endpointFromArg(v) {
|
|
|
27
21
|
function makeRestrictionHandler(options, method, mutate) {
|
|
28
22
|
const { onMutation, onAudit } = options;
|
|
29
23
|
return async function (inputArguments, context) {
|
|
30
|
-
const insecure =
|
|
24
|
+
const insecure = checkEncryptedChannel(context);
|
|
31
25
|
if (insecure)
|
|
32
26
|
return insecure;
|
|
33
|
-
const denied =
|
|
27
|
+
const denied = checkSecurityAdminAccess(context);
|
|
34
28
|
if (denied)
|
|
35
29
|
return denied;
|
|
36
30
|
const roleNode = this.parent;
|
|
37
31
|
if (!roleNode) {
|
|
38
|
-
return { statusCode:
|
|
32
|
+
return { statusCode: StatusCodes.BadInternalError };
|
|
39
33
|
}
|
|
40
34
|
const statusCode = mutate(roleNode.nodeId, inputArguments);
|
|
41
35
|
if (statusCode === null) {
|
|
42
|
-
return { statusCode:
|
|
36
|
+
return { statusCode: StatusCodes.BadInvalidArgument };
|
|
43
37
|
}
|
|
44
|
-
if (statusCode ===
|
|
38
|
+
if (statusCode === StatusCodes.Good && onMutation) {
|
|
45
39
|
await onMutation();
|
|
46
40
|
}
|
|
47
41
|
onAudit?.({
|
|
@@ -56,39 +50,39 @@ function makeRestrictionHandler(options, method, mutate) {
|
|
|
56
50
|
};
|
|
57
51
|
}
|
|
58
52
|
/** AddApplication (§4.4.7). */
|
|
59
|
-
function makeAddApplicationHandler(options) {
|
|
53
|
+
export function makeAddApplicationHandler(options) {
|
|
60
54
|
return makeRestrictionHandler(options, "AddApplication", (roleNodeId, args) => {
|
|
61
|
-
const uri =
|
|
55
|
+
const uri = asString(args[0]);
|
|
62
56
|
if (uri === null)
|
|
63
57
|
return null;
|
|
64
|
-
return options.restrictionStore.addApplication(roleNodeId, uri) ?
|
|
58
|
+
return options.restrictionStore.addApplication(roleNodeId, uri) ? StatusCodes.Good : StatusCodes.BadAlreadyExists;
|
|
65
59
|
});
|
|
66
60
|
}
|
|
67
61
|
/** RemoveApplication (§4.4.8). */
|
|
68
|
-
function makeRemoveApplicationHandler(options) {
|
|
62
|
+
export function makeRemoveApplicationHandler(options) {
|
|
69
63
|
return makeRestrictionHandler(options, "RemoveApplication", (roleNodeId, args) => {
|
|
70
|
-
const uri =
|
|
64
|
+
const uri = asString(args[0]);
|
|
71
65
|
if (uri === null)
|
|
72
66
|
return null;
|
|
73
|
-
return options.restrictionStore.removeApplication(roleNodeId, uri) ?
|
|
67
|
+
return options.restrictionStore.removeApplication(roleNodeId, uri) ? StatusCodes.Good : StatusCodes.BadNotFound;
|
|
74
68
|
});
|
|
75
69
|
}
|
|
76
70
|
/** AddEndpoint (§4.4.9). */
|
|
77
|
-
function makeAddEndpointHandler(options) {
|
|
71
|
+
export function makeAddEndpointHandler(options) {
|
|
78
72
|
return makeRestrictionHandler(options, "AddEndpoint", (roleNodeId, args) => {
|
|
79
73
|
const endpoint = endpointFromArg(args[0]);
|
|
80
74
|
if (endpoint === null)
|
|
81
75
|
return null;
|
|
82
|
-
return options.restrictionStore.addEndpoint(roleNodeId, endpoint) ?
|
|
76
|
+
return options.restrictionStore.addEndpoint(roleNodeId, endpoint) ? StatusCodes.Good : StatusCodes.BadAlreadyExists;
|
|
83
77
|
});
|
|
84
78
|
}
|
|
85
79
|
/** RemoveEndpoint (§4.4.10). */
|
|
86
|
-
function makeRemoveEndpointHandler(options) {
|
|
80
|
+
export function makeRemoveEndpointHandler(options) {
|
|
87
81
|
return makeRestrictionHandler(options, "RemoveEndpoint", (roleNodeId, args) => {
|
|
88
82
|
const endpoint = endpointFromArg(args[0]);
|
|
89
83
|
if (endpoint === null)
|
|
90
84
|
return null;
|
|
91
|
-
return options.restrictionStore.removeEndpoint(roleNodeId, endpoint) ?
|
|
85
|
+
return options.restrictionStore.removeEndpoint(roleNodeId, endpoint) ? StatusCodes.Good : StatusCodes.BadNotFound;
|
|
92
86
|
});
|
|
93
87
|
}
|
|
94
88
|
//# sourceMappingURL=bind_restriction_methods.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"bind_restriction_methods.js","sourceRoot":"","sources":["../source/bind_restriction_methods.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"bind_restriction_methods.js","sourceRoot":"","sources":["../source/bind_restriction_methods.ts"],"names":[],"mappings":"AAeA,OAAO,EAAmB,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAGhD,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACvF,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAU7C,SAAS,eAAe,CAAC,CAAsB;IAC3C,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,YAAY,YAAY,CAAC,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;IAClB,OAAO;QACH,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,SAAS;QACvC,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,IAAI,SAAS;QACnD,mBAAmB,EAAE,CAAC,CAAC,mBAAmB,IAAI,SAAS;KAC1D,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAC3B,OAAsC,EACtC,MAA6C,EAC7C,MAA4E;IAE5E,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IACxC,OAAO,KAAK,WAA2B,cAAyB,EAAE,OAAwB;QACtF,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,MAAM,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,gBAAgB,EAAE,CAAC;QACxD,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QAC3D,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,kBAAkB,EAAE,CAAC;QAC1D,CAAC;QACD,IAAI,UAAU,KAAK,WAAW,CAAC,IAAI,IAAI,UAAU,EAAE,CAAC;YAChD,MAAM,UAAU,EAAE,CAAC;QACvB,CAAC;QACD,OAAO,EAAE,CAAC;YACN,MAAM;YACN,UAAU,EAAE,QAAQ,CAAC,MAAM;YAC3B,YAAY,EAAE,IAAI,CAAC,MAAM;YACzB,QAAQ,EAAE,OAAO,CAAC,WAAW,EAAE;YAC/B,cAAc;YACd,UAAU;SACb,CAAC,CAAC;QACH,OAAO,EAAE,UAAU,EAAE,CAAC;IAC1B,CAAC,CAAC;AACN,CAAC;AAED,+BAA+B;AAC/B,MAAM,UAAU,yBAAyB,CAAC,OAAsC;IAC5E,OAAO,sBAAsB,CAAC,OAAO,EAAE,gBAAgB,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE;QAC1E,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC9B,OAAO,OAAO,CAAC,gBAAgB,CAAC,cAAc,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,gBAAgB,CAAC;IACtH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,kCAAkC;AAClC,MAAM,UAAU,4BAA4B,CAAC,OAAsC;IAC/E,OAAO,sBAAsB,CAAC,OAAO,EAAE,mBAAmB,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE;QAC7E,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC9B,OAAO,OAAO,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC;IACpH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,4BAA4B;AAC5B,MAAM,UAAU,sBAAsB,CAAC,OAAsC;IACzE,OAAO,sBAAsB,CAAC,OAAO,EAAE,aAAa,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE;QACvE,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,gBAAgB,CAAC;IACxH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,gCAAgC;AAChC,MAAM,UAAU,yBAAyB,CAAC,OAAsC;IAC5E,OAAO,sBAAsB,CAAC,OAAO,EAAE,gBAAgB,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE;QAC1E,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,OAAO,CAAC,gBAAgB,CAAC,cAAc,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC;IACtH,CAAC,CAAC,CAAC;AACP,CAAC"}
|
|
@@ -46,3 +46,4 @@ export declare function makeAddIdentityHandler(options: BindRoleMethodsOptions):
|
|
|
46
46
|
* Create a RemoveIdentity method handler bound to the given store.
|
|
47
47
|
*/
|
|
48
48
|
export declare function makeRemoveIdentityHandler(options: BindRoleMethodsOptions): (this: UAMethod, inputArguments: Variant[], context: ISessionContext) => Promise<CallMethodResultOptions>;
|
|
49
|
+
//# sourceMappingURL=bind_role_methods.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"bind_role_methods.d.ts","sourceRoot":"","sources":["../source/bind_role_methods.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAAE,KAAK,qBAAqB,EAAoB,MAAM,4BAA4B,CAAC;AAC1F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,KAAK,UAAU,EAAe,MAAM,wBAAwB,CAAC;AAEtE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAyClD;;;;;GAKG;AACH,MAAM,WAAW,2BAA2B;IACxC,MAAM,EAAE,aAAa,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,mBAAmB,GAAG,aAAa,GAAG,gBAAgB,CAAC;IACrH,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,OAAO,EAAE,CAAC;IAC1B,UAAU,EAAE,UAAU,CAAC;CAC1B;AAED,MAAM,WAAW,sBAAsB;IACnC,KAAK,EAAE,qBAAqB,CAAC;IAC7B,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,6FAA6F;IAC7F,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,2BAA2B,KAAK,IAAI,CAAC;CAC1D;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,sBAAsB,UAIxD,QAAQ,kBACE,OAAO,EAAE,WAChB,eAAe,KACzB,OAAO,CAAC,uBAAuB,CAAC,CA+CtC;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,sBAAsB,UAI3D,QAAQ,kBACE,OAAO,EAAE,WAChB,eAAe,KACzB,OAAO,CAAC,uBAAuB,CAAC,CA0CtC"}
|
|
@@ -1,12 +1,8 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
const node_opcua_role_set_common_1 = require("node-opcua-role-set-common");
|
|
7
|
-
const node_opcua_status_code_1 = require("node-opcua-status-code");
|
|
8
|
-
const node_opcua_types_1 = require("node-opcua-types");
|
|
9
|
-
const security_checks_js_1 = require("./security_checks.js");
|
|
1
|
+
import { sameNodeId } from "node-opcua-nodeid";
|
|
2
|
+
import { WellKnownRoleIds } from "node-opcua-role-set-common";
|
|
3
|
+
import { StatusCodes } from "node-opcua-status-code";
|
|
4
|
+
import { IdentityCriteriaType, IdentityMappingRuleType } from "node-opcua-types";
|
|
5
|
+
import { checkEncryptedChannel, checkSecurityAdminAccess } from "./security_checks.js";
|
|
10
6
|
/**
|
|
11
7
|
* Well-known Roles whose mapping rules a Server shall not allow to be
|
|
12
8
|
* changed (OPC 10000-18 §4.3): Anonymous, AuthenticatedUser and
|
|
@@ -14,7 +10,7 @@ const security_checks_js_1 = require("./security_checks.js");
|
|
|
14
10
|
* is matched by NodeId when present.)
|
|
15
11
|
*/
|
|
16
12
|
function isImmutableRole(roleId) {
|
|
17
|
-
return
|
|
13
|
+
return sameNodeId(roleId, WellKnownRoleIds.Anonymous) || sameNodeId(roleId, WellKnownRoleIds.AuthenticatedUser);
|
|
18
14
|
}
|
|
19
15
|
/**
|
|
20
16
|
* Administrative Roles to which weak (Anonymous / AuthenticatedUser) identity
|
|
@@ -22,11 +18,11 @@ function isImmutableRole(roleId) {
|
|
|
22
18
|
* an ANONYMOUS_5 rule to Roles with administrator privileges).
|
|
23
19
|
*/
|
|
24
20
|
function isPrivilegedRole(roleId) {
|
|
25
|
-
return
|
|
21
|
+
return sameNodeId(roleId, WellKnownRoleIds.SecurityAdmin) || sameNodeId(roleId, WellKnownRoleIds.ConfigureAdmin);
|
|
26
22
|
}
|
|
27
23
|
/** True for weak criteria that must not be granted to administrative Roles. */
|
|
28
24
|
function isWeakCriteria(criteriaType) {
|
|
29
|
-
return criteriaType ===
|
|
25
|
+
return criteriaType === IdentityCriteriaType.Anonymous || criteriaType === IdentityCriteriaType.AuthenticatedUser;
|
|
30
26
|
}
|
|
31
27
|
/**
|
|
32
28
|
* Extract the IdentityMappingRuleType from the first input argument.
|
|
@@ -36,7 +32,7 @@ function extractIdentityRule(inputArguments) {
|
|
|
36
32
|
return null;
|
|
37
33
|
}
|
|
38
34
|
const value = inputArguments[0].value;
|
|
39
|
-
if (value instanceof
|
|
35
|
+
if (value instanceof IdentityMappingRuleType) {
|
|
40
36
|
return value;
|
|
41
37
|
}
|
|
42
38
|
return null;
|
|
@@ -45,42 +41,42 @@ function extractIdentityRule(inputArguments) {
|
|
|
45
41
|
* Create an AddIdentity method handler bound to the given store.
|
|
46
42
|
* The handler extracts the role NodeId from its parent Role object.
|
|
47
43
|
*/
|
|
48
|
-
function makeAddIdentityHandler(options) {
|
|
44
|
+
export function makeAddIdentityHandler(options) {
|
|
49
45
|
const { store, onMutation, onAudit } = options;
|
|
50
46
|
return async function _addIdentity(inputArguments, context) {
|
|
51
47
|
// 1. The SecureChannel must be encrypted
|
|
52
|
-
const insecure =
|
|
48
|
+
const insecure = checkEncryptedChannel(context);
|
|
53
49
|
if (insecure)
|
|
54
50
|
return insecure;
|
|
55
51
|
// 2. Security check
|
|
56
|
-
const denied =
|
|
52
|
+
const denied = checkSecurityAdminAccess(context);
|
|
57
53
|
if (denied)
|
|
58
54
|
return denied;
|
|
59
55
|
// 3. Extract the rule from input
|
|
60
56
|
const rule = extractIdentityRule(inputArguments);
|
|
61
57
|
if (!rule) {
|
|
62
|
-
return { statusCode:
|
|
58
|
+
return { statusCode: StatusCodes.BadInvalidArgument };
|
|
63
59
|
}
|
|
64
60
|
// 4. The parent of this method is the Role object
|
|
65
61
|
const roleNode = this.parent;
|
|
66
62
|
if (!roleNode) {
|
|
67
|
-
return { statusCode:
|
|
63
|
+
return { statusCode: StatusCodes.BadInternalError };
|
|
68
64
|
}
|
|
69
65
|
// 5-7. Compute the outcome of the authorized rule-change attempt
|
|
70
66
|
let statusCode;
|
|
71
67
|
if (isImmutableRole(roleNode.nodeId)) {
|
|
72
68
|
// well-known immutable Roles cannot be changed (§4.3)
|
|
73
|
-
statusCode =
|
|
69
|
+
statusCode = StatusCodes.BadRequestNotAllowed;
|
|
74
70
|
}
|
|
75
71
|
else if (isWeakCriteria(rule.criteriaType) && isPrivilegedRole(roleNode.nodeId)) {
|
|
76
72
|
// refuse weak (Anonymous/AuthenticatedUser) rules on administrative Roles (§4.4.5)
|
|
77
|
-
statusCode =
|
|
73
|
+
statusCode = StatusCodes.BadRequestNotAllowed;
|
|
78
74
|
}
|
|
79
75
|
else {
|
|
80
76
|
// duplicate rule is reported as Bad_AlreadyExists
|
|
81
|
-
statusCode = store.addIdentity(roleNode.nodeId, rule) ?
|
|
77
|
+
statusCode = store.addIdentity(roleNode.nodeId, rule) ? StatusCodes.Good : StatusCodes.BadAlreadyExists;
|
|
82
78
|
}
|
|
83
|
-
if (statusCode ===
|
|
79
|
+
if (statusCode === StatusCodes.Good && onMutation) {
|
|
84
80
|
await onMutation();
|
|
85
81
|
}
|
|
86
82
|
onAudit?.({
|
|
@@ -97,36 +93,36 @@ function makeAddIdentityHandler(options) {
|
|
|
97
93
|
/**
|
|
98
94
|
* Create a RemoveIdentity method handler bound to the given store.
|
|
99
95
|
*/
|
|
100
|
-
function makeRemoveIdentityHandler(options) {
|
|
96
|
+
export function makeRemoveIdentityHandler(options) {
|
|
101
97
|
const { store, onMutation, onAudit } = options;
|
|
102
98
|
return async function _removeIdentity(inputArguments, context) {
|
|
103
99
|
// 1. The SecureChannel must be encrypted
|
|
104
|
-
const insecure =
|
|
100
|
+
const insecure = checkEncryptedChannel(context);
|
|
105
101
|
if (insecure)
|
|
106
102
|
return insecure;
|
|
107
103
|
// 2. Security check
|
|
108
|
-
const denied =
|
|
104
|
+
const denied = checkSecurityAdminAccess(context);
|
|
109
105
|
if (denied)
|
|
110
106
|
return denied;
|
|
111
107
|
// 3. Extract the rule from input
|
|
112
108
|
const rule = extractIdentityRule(inputArguments);
|
|
113
109
|
if (!rule) {
|
|
114
|
-
return { statusCode:
|
|
110
|
+
return { statusCode: StatusCodes.BadInvalidArgument };
|
|
115
111
|
}
|
|
116
112
|
// 4. The parent of this method is the Role object
|
|
117
113
|
const roleNode = this.parent;
|
|
118
114
|
if (!roleNode) {
|
|
119
|
-
return { statusCode:
|
|
115
|
+
return { statusCode: StatusCodes.BadInternalError };
|
|
120
116
|
}
|
|
121
117
|
// 5-6. Compute the outcome of the authorized rule-change attempt
|
|
122
118
|
let statusCode;
|
|
123
119
|
if (isImmutableRole(roleNode.nodeId)) {
|
|
124
|
-
statusCode =
|
|
120
|
+
statusCode = StatusCodes.BadRequestNotAllowed;
|
|
125
121
|
}
|
|
126
122
|
else {
|
|
127
|
-
statusCode = store.removeIdentity(roleNode.nodeId, rule) ?
|
|
123
|
+
statusCode = store.removeIdentity(roleNode.nodeId, rule) ? StatusCodes.Good : StatusCodes.BadNoMatch;
|
|
128
124
|
}
|
|
129
|
-
if (statusCode ===
|
|
125
|
+
if (statusCode === StatusCodes.Good && onMutation) {
|
|
130
126
|
await onMutation();
|
|
131
127
|
}
|
|
132
128
|
onAudit?.({
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"bind_role_methods.js","sourceRoot":"","sources":["../source/bind_role_methods.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"bind_role_methods.js","sourceRoot":"","sources":["../source/bind_role_methods.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAA8B,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAE1F,OAAO,EAAmB,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAEjF,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAEvF;;;;;GAKG;AACH,SAAS,eAAe,CAAC,MAAc;IACnC,OAAO,UAAU,CAAC,MAAM,EAAE,gBAAgB,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,EAAE,gBAAgB,CAAC,iBAAiB,CAAC,CAAC;AACpH,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,MAAc;IACpC,OAAO,UAAU,CAAC,MAAM,EAAE,gBAAgB,CAAC,aAAa,CAAC,IAAI,UAAU,CAAC,MAAM,EAAE,gBAAgB,CAAC,cAAc,CAAC,CAAC;AACrH,CAAC;AAED,+EAA+E;AAC/E,SAAS,cAAc,CAAC,YAAkC;IACtD,OAAO,YAAY,KAAK,oBAAoB,CAAC,SAAS,IAAI,YAAY,KAAK,oBAAoB,CAAC,iBAAiB,CAAC;AACtH,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,cAAyB;IAClD,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACtC,IAAI,KAAK,YAAY,uBAAuB,EAAE,CAAC;QAC3C,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAyBD;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAA+B;IAClE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAE/C,OAAO,KAAK,UAAU,YAAY,CAE9B,cAAyB,EACzB,OAAwB;QAExB,yCAAyC;QACzC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,oBAAoB;QACpB,MAAM,MAAM,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,iCAAiC;QACjC,MAAM,IAAI,GAAG,mBAAmB,CAAC,cAAc,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,kBAAkB,EAAE,CAAC;QAC1D,CAAC;QAED,kDAAkD;QAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,gBAAgB,EAAE,CAAC;QACxD,CAAC;QAED,iEAAiE;QACjE,IAAI,UAAsB,CAAC;QAC3B,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,sDAAsD;YACtD,UAAU,GAAG,WAAW,CAAC,oBAAoB,CAAC;QAClD,CAAC;aAAM,IAAI,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAChF,mFAAmF;YACnF,UAAU,GAAG,WAAW,CAAC,oBAAoB,CAAC;QAClD,CAAC;aAAM,CAAC;YACJ,kDAAkD;YAClD,UAAU,GAAG,KAAK,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,gBAAgB,CAAC;QAC5G,CAAC;QAED,IAAI,UAAU,KAAK,WAAW,CAAC,IAAI,IAAI,UAAU,EAAE,CAAC;YAChD,MAAM,UAAU,EAAE,CAAC;QACvB,CAAC;QACD,OAAO,EAAE,CAAC;YACN,MAAM,EAAE,aAAa;YACrB,UAAU,EAAE,QAAQ,CAAC,MAAM;YAC3B,YAAY,EAAE,IAAI,CAAC,MAAM;YACzB,QAAQ,EAAE,OAAO,CAAC,WAAW,EAAE;YAC/B,cAAc;YACd,UAAU;SACb,CAAC,CAAC;QACH,OAAO,EAAE,UAAU,EAAE,CAAC;IAC1B,CAAC,CAAC;AACN,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAA+B;IACrE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAE/C,OAAO,KAAK,UAAU,eAAe,CAEjC,cAAyB,EACzB,OAAwB;QAExB,yCAAyC;QACzC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,oBAAoB;QACpB,MAAM,MAAM,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,iCAAiC;QACjC,MAAM,IAAI,GAAG,mBAAmB,CAAC,cAAc,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,kBAAkB,EAAE,CAAC;QAC1D,CAAC;QAED,kDAAkD;QAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,gBAAgB,EAAE,CAAC;QACxD,CAAC;QAED,iEAAiE;QACjE,IAAI,UAAsB,CAAC;QAC3B,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACnC,UAAU,GAAG,WAAW,CAAC,oBAAoB,CAAC;QAClD,CAAC;aAAM,CAAC;YACJ,UAAU,GAAG,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC;QACzG,CAAC;QAED,IAAI,UAAU,KAAK,WAAW,CAAC,IAAI,IAAI,UAAU,EAAE,CAAC;YAChD,MAAM,UAAU,EAAE,CAAC;QACvB,CAAC;QACD,OAAO,EAAE,CAAC;YACN,MAAM,EAAE,gBAAgB;YACxB,UAAU,EAAE,QAAQ,CAAC,MAAM;YAC3B,YAAY,EAAE,IAAI,CAAC,MAAM;YACzB,QAAQ,EAAE,OAAO,CAAC,WAAW,EAAE;YAC/B,cAAc;YACd,UAAU;SACb,CAAC,CAAC;QACH,OAAO,EAAE,UAAU,EAAE,CAAC;IAC1B,CAAC,CAAC;AACN,CAAC"}
|
|
@@ -56,3 +56,4 @@ export declare function makeRemoveUserHandler(options: BindUserManagementOptions
|
|
|
56
56
|
* user token (`Bad_InvalidState` otherwise). Does **not** require SecurityAdmin.
|
|
57
57
|
*/
|
|
58
58
|
export declare function makeChangePasswordHandler(options: BindUserManagementOptions): (this: UAMethod, inputArguments: Variant[], context: ISessionContext) => Promise<CallMethodResultOptions>;
|
|
59
|
+
//# sourceMappingURL=bind_user_management.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"bind_user_management.d.ts","sourceRoot":"","sources":["../source/bind_user_management.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,KAAK,UAAU,EAAe,MAAM,wBAAwB,CAAC;AAEtE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAIlD;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAChC,MAAM,EAAE,SAAS,GAAG,YAAY,GAAG,YAAY,GAAG,gBAAgB,CAAC;IACnE,4EAA4E;IAC5E,cAAc,EAAE,MAAM,CAAC;IACvB,+CAA+C;IAC/C,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,UAAU,CAAC;CAC1B;AAED,MAAM,WAAW,yBAAyB;IACtC,KAAK,EAAE,oBAAoB,CAAC;IAC5B,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,sFAAsF;IACtF,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,mBAAmB,KAAK,IAAI,CAAC;IAC/C;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE;AAKD,iDAAiD;AACjD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,UAGvD,QAAQ,kBACE,OAAO,EAAE,WAChB,eAAe,KACzB,OAAO,CAAC,uBAAuB,CAAC,CA2BtC;AAED,mDAAmD;AACnD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,yBAAyB,UAG1D,QAAQ,kBACE,OAAO,EAAE,WAChB,eAAe,KACzB,OAAO,CAAC,uBAAuB,CAAC,CAwCtC;AAED,mDAAmD;AACnD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,yBAAyB,UAG1D,QAAQ,kBACE,OAAO,EAAE,WAChB,eAAe,KACzB,OAAO,CAAC,uBAAuB,CAAC,CAyBtC;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,yBAAyB,UAG9D,QAAQ,kBACE,OAAO,EAAE,WAChB,eAAe,KACzB,OAAO,CAAC,uBAAuB,CAAC,CA6BtC"}
|
|
@@ -1,33 +1,27 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
exports.makeChangePasswordHandler = makeChangePasswordHandler;
|
|
7
|
-
const node_opcua_status_code_1 = require("node-opcua-status-code");
|
|
8
|
-
const node_opcua_types_1 = require("node-opcua-types");
|
|
9
|
-
const security_checks_js_1 = require("./security_checks.js");
|
|
10
|
-
const variant_args_js_1 = require("./variant_args.js");
|
|
11
|
-
const isDisabled = (mask) => (mask & node_opcua_types_1.UserConfigurationMask.Disabled) === node_opcua_types_1.UserConfigurationMask.Disabled;
|
|
1
|
+
import { StatusCodes } from "node-opcua-status-code";
|
|
2
|
+
import { UserConfigurationMask, UserNameIdentityToken } from "node-opcua-types";
|
|
3
|
+
import { checkEncryptedChannel, checkSecurityAdminAccess } from "./security_checks.js";
|
|
4
|
+
import { asBoolean, asMask, asString } from "./variant_args.js";
|
|
5
|
+
const isDisabled = (mask) => (mask & UserConfigurationMask.Disabled) === UserConfigurationMask.Disabled;
|
|
12
6
|
/** Create an AddUser Method handler (§5.2.5). */
|
|
13
|
-
function makeAddUserHandler(options) {
|
|
7
|
+
export function makeAddUserHandler(options) {
|
|
14
8
|
const { store, onMutation, onAudit } = options;
|
|
15
9
|
return async function _addUser(inputArguments, context) {
|
|
16
|
-
const insecure =
|
|
10
|
+
const insecure = checkEncryptedChannel(context);
|
|
17
11
|
if (insecure)
|
|
18
12
|
return insecure;
|
|
19
|
-
const denied =
|
|
13
|
+
const denied = checkSecurityAdminAccess(context);
|
|
20
14
|
if (denied)
|
|
21
15
|
return denied;
|
|
22
|
-
const userName =
|
|
23
|
-
const password =
|
|
16
|
+
const userName = asString(inputArguments[0]);
|
|
17
|
+
const password = asString(inputArguments[1]);
|
|
24
18
|
if (userName === null || password === null) {
|
|
25
|
-
return { statusCode:
|
|
19
|
+
return { statusCode: StatusCodes.BadInvalidArgument };
|
|
26
20
|
}
|
|
27
|
-
const userConfiguration =
|
|
28
|
-
const description =
|
|
21
|
+
const userConfiguration = asMask(inputArguments[2]);
|
|
22
|
+
const description = asString(inputArguments[3]) ?? "";
|
|
29
23
|
const statusCode = await store.addUser(userName, password, userConfiguration, description);
|
|
30
|
-
if (statusCode ===
|
|
24
|
+
if (statusCode === StatusCodes.Good && onMutation) {
|
|
31
25
|
await onMutation();
|
|
32
26
|
}
|
|
33
27
|
onAudit?.({
|
|
@@ -41,30 +35,30 @@ function makeAddUserHandler(options) {
|
|
|
41
35
|
};
|
|
42
36
|
}
|
|
43
37
|
/** Create a ModifyUser Method handler (§5.2.6). */
|
|
44
|
-
function makeModifyUserHandler(options) {
|
|
38
|
+
export function makeModifyUserHandler(options) {
|
|
45
39
|
const { store, onMutation, onAudit, onUserDeactivated } = options;
|
|
46
40
|
return async function _modifyUser(inputArguments, context) {
|
|
47
|
-
const insecure =
|
|
41
|
+
const insecure = checkEncryptedChannel(context);
|
|
48
42
|
if (insecure)
|
|
49
43
|
return insecure;
|
|
50
|
-
const denied =
|
|
44
|
+
const denied = checkSecurityAdminAccess(context);
|
|
51
45
|
if (denied)
|
|
52
46
|
return denied;
|
|
53
|
-
const userName =
|
|
47
|
+
const userName = asString(inputArguments[0]);
|
|
54
48
|
if (userName === null) {
|
|
55
|
-
return { statusCode:
|
|
49
|
+
return { statusCode: StatusCodes.BadInvalidArgument };
|
|
56
50
|
}
|
|
57
|
-
const modifyUserConfiguration =
|
|
58
|
-
const userConfiguration =
|
|
51
|
+
const modifyUserConfiguration = asBoolean(inputArguments[3]);
|
|
52
|
+
const userConfiguration = asMask(inputArguments[4]);
|
|
59
53
|
const statusCode = await store.modifyUser(userName, {
|
|
60
|
-
modifyPassword:
|
|
61
|
-
password:
|
|
54
|
+
modifyPassword: asBoolean(inputArguments[1]),
|
|
55
|
+
password: asString(inputArguments[2]) ?? "",
|
|
62
56
|
modifyUserConfiguration,
|
|
63
57
|
userConfiguration,
|
|
64
|
-
modifyDescription:
|
|
65
|
-
description:
|
|
58
|
+
modifyDescription: asBoolean(inputArguments[5]),
|
|
59
|
+
description: asString(inputArguments[6]) ?? ""
|
|
66
60
|
}, context.getUserName());
|
|
67
|
-
if (statusCode ===
|
|
61
|
+
if (statusCode === StatusCodes.Good) {
|
|
68
62
|
if (onMutation)
|
|
69
63
|
await onMutation();
|
|
70
64
|
// a freshly disabled user must lose any live session, not just be barred from re-login
|
|
@@ -83,21 +77,21 @@ function makeModifyUserHandler(options) {
|
|
|
83
77
|
};
|
|
84
78
|
}
|
|
85
79
|
/** Create a RemoveUser Method handler (§5.2.7). */
|
|
86
|
-
function makeRemoveUserHandler(options) {
|
|
80
|
+
export function makeRemoveUserHandler(options) {
|
|
87
81
|
const { store, onMutation, onAudit, onUserDeactivated } = options;
|
|
88
82
|
return async function _removeUser(inputArguments, context) {
|
|
89
|
-
const insecure =
|
|
83
|
+
const insecure = checkEncryptedChannel(context);
|
|
90
84
|
if (insecure)
|
|
91
85
|
return insecure;
|
|
92
|
-
const denied =
|
|
86
|
+
const denied = checkSecurityAdminAccess(context);
|
|
93
87
|
if (denied)
|
|
94
88
|
return denied;
|
|
95
|
-
const userName =
|
|
89
|
+
const userName = asString(inputArguments[0]);
|
|
96
90
|
if (userName === null) {
|
|
97
|
-
return { statusCode:
|
|
91
|
+
return { statusCode: StatusCodes.BadInvalidArgument };
|
|
98
92
|
}
|
|
99
93
|
const statusCode = store.removeUser(userName, context.getUserName());
|
|
100
|
-
if (statusCode ===
|
|
94
|
+
if (statusCode === StatusCodes.Good) {
|
|
101
95
|
if (onMutation)
|
|
102
96
|
await onMutation();
|
|
103
97
|
// a removed user must lose any live session as well (§5.2.7)
|
|
@@ -120,24 +114,24 @@ function makeRemoveUserHandler(options) {
|
|
|
120
114
|
* Operates on the Session user, requires an encrypted channel and a USERNAME
|
|
121
115
|
* user token (`Bad_InvalidState` otherwise). Does **not** require SecurityAdmin.
|
|
122
116
|
*/
|
|
123
|
-
function makeChangePasswordHandler(options) {
|
|
117
|
+
export function makeChangePasswordHandler(options) {
|
|
124
118
|
const { store, onMutation, onAudit } = options;
|
|
125
119
|
return async function _changePassword(inputArguments, context) {
|
|
126
|
-
const insecure =
|
|
120
|
+
const insecure = checkEncryptedChannel(context);
|
|
127
121
|
if (insecure)
|
|
128
122
|
return insecure;
|
|
129
123
|
const token = context.session?.userIdentityToken;
|
|
130
|
-
if (!(token instanceof
|
|
131
|
-
return { statusCode:
|
|
124
|
+
if (!(token instanceof UserNameIdentityToken)) {
|
|
125
|
+
return { statusCode: StatusCodes.BadInvalidState };
|
|
132
126
|
}
|
|
133
127
|
const userName = token.userName ?? "";
|
|
134
|
-
const oldPassword =
|
|
135
|
-
const newPassword =
|
|
128
|
+
const oldPassword = asString(inputArguments[0]);
|
|
129
|
+
const newPassword = asString(inputArguments[1]);
|
|
136
130
|
if (oldPassword === null || newPassword === null) {
|
|
137
|
-
return { statusCode:
|
|
131
|
+
return { statusCode: StatusCodes.BadInvalidArgument };
|
|
138
132
|
}
|
|
139
133
|
const statusCode = await store.changePassword(userName, oldPassword, newPassword);
|
|
140
|
-
if (statusCode ===
|
|
134
|
+
if (statusCode === StatusCodes.Good && onMutation) {
|
|
141
135
|
await onMutation();
|
|
142
136
|
}
|
|
143
137
|
onAudit?.({
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"bind_user_management.js","sourceRoot":"","sources":["../source/bind_user_management.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"bind_user_management.js","sourceRoot":"","sources":["../source/bind_user_management.ts"],"names":[],"mappings":"AAeA,OAAO,EAAmB,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAEhF,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACvF,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAgChE,MAAM,UAAU,GAAG,CAAC,IAA2B,EAAW,EAAE,CACxD,CAAC,IAAI,GAAG,qBAAqB,CAAC,QAAQ,CAAC,KAAK,qBAAqB,CAAC,QAAQ,CAAC;AAE/E,iDAAiD;AACjD,MAAM,UAAU,kBAAkB,CAAC,OAAkC;IACjE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC/C,OAAO,KAAK,UAAU,QAAQ,CAE1B,cAAyB,EACzB,OAAwB;QAExB,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,MAAM,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,QAAQ,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7C,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACzC,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,kBAAkB,EAAE,CAAC;QAC1D,CAAC;QACD,MAAM,iBAAiB,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,WAAW,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAEtD,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,iBAAiB,EAAE,WAAW,CAAC,CAAC;QAC3F,IAAI,UAAU,KAAK,WAAW,CAAC,IAAI,IAAI,UAAU,EAAE,CAAC;YAChD,MAAM,UAAU,EAAE,CAAC;QACvB,CAAC;QACD,OAAO,EAAE,CAAC;YACN,MAAM,EAAE,SAAS;YACjB,cAAc,EAAE,QAAQ;YACxB,cAAc,EAAE,OAAO,CAAC,WAAW,EAAE;YACrC,YAAY,EAAE,IAAI,CAAC,MAAM;YACzB,UAAU;SACb,CAAC,CAAC;QACH,OAAO,EAAE,UAAU,EAAE,CAAC;IAC1B,CAAC,CAAC;AACN,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,qBAAqB,CAAC,OAAkC;IACpE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAC;IAClE,OAAO,KAAK,UAAU,WAAW,CAE7B,cAAyB,EACzB,OAAwB;QAExB,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,MAAM,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,QAAQ,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,kBAAkB,EAAE,CAAC;QAC1D,CAAC;QACD,MAAM,uBAAuB,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,MAAM,iBAAiB,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,UAAU,CACrC,QAAQ,EACR;YACI,cAAc,EAAE,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;YAC5C,QAAQ,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;YAC3C,uBAAuB;YACvB,iBAAiB;YACjB,iBAAiB,EAAE,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;YAC/C,WAAW,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;SACjD,EACD,OAAO,CAAC,WAAW,EAAE,CACxB,CAAC;QACF,IAAI,UAAU,KAAK,WAAW,CAAC,IAAI,EAAE,CAAC;YAClC,IAAI,UAAU;gBAAE,MAAM,UAAU,EAAE,CAAC;YACnC,uFAAuF;YACvF,IAAI,uBAAuB,IAAI,UAAU,CAAC,iBAAiB,CAAC,IAAI,iBAAiB,EAAE,CAAC;gBAChF,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YACtC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,CAAC;YACN,MAAM,EAAE,YAAY;YACpB,cAAc,EAAE,QAAQ;YACxB,cAAc,EAAE,OAAO,CAAC,WAAW,EAAE;YACrC,YAAY,EAAE,IAAI,CAAC,MAAM;YACzB,UAAU;SACb,CAAC,CAAC;QACH,OAAO,EAAE,UAAU,EAAE,CAAC;IAC1B,CAAC,CAAC;AACN,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,qBAAqB,CAAC,OAAkC;IACpE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAC;IAClE,OAAO,KAAK,UAAU,WAAW,CAE7B,cAAyB,EACzB,OAAwB;QAExB,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,MAAM,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,QAAQ,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,kBAAkB,EAAE,CAAC;QAC1D,CAAC;QACD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;QACrE,IAAI,UAAU,KAAK,WAAW,CAAC,IAAI,EAAE,CAAC;YAClC,IAAI,UAAU;gBAAE,MAAM,UAAU,EAAE,CAAC;YACnC,6DAA6D;YAC7D,IAAI,iBAAiB;gBAAE,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,EAAE,CAAC;YACN,MAAM,EAAE,YAAY;YACpB,cAAc,EAAE,QAAQ;YACxB,cAAc,EAAE,OAAO,CAAC,WAAW,EAAE;YACrC,YAAY,EAAE,IAAI,CAAC,MAAM;YACzB,UAAU;SACb,CAAC,CAAC;QACH,OAAO,EAAE,UAAU,EAAE,CAAC;IAC1B,CAAC,CAAC;AACN,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAkC;IACxE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC/C,OAAO,KAAK,UAAU,eAAe,CAEjC,cAAyB,EACzB,OAAwB;QAExB,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE,iBAAiB,CAAC;QACjD,IAAI,CAAC,CAAC,KAAK,YAAY,qBAAqB,CAAC,EAAE,CAAC;YAC5C,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,eAAe,EAAE,CAAC;QACvD,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;QAEtC,MAAM,WAAW,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,WAAW,GAAG,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YAC/C,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,kBAAkB,EAAE,CAAC;QAC1D,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;QAClF,IAAI,UAAU,KAAK,WAAW,CAAC,IAAI,IAAI,UAAU,EAAE,CAAC;YAChD,MAAM,UAAU,EAAE,CAAC;QACvB,CAAC;QACD,OAAO,EAAE,CAAC;YACN,MAAM,EAAE,gBAAgB;YACxB,cAAc,EAAE,QAAQ;YACxB,cAAc,EAAE,QAAQ;YACxB,YAAY,EAAE,IAAI,CAAC,MAAM;YACzB,UAAU;SACb,CAAC,CAAC;QACH,OAAO,EAAE,UAAU,EAAE,CAAC;IAC1B,CAAC,CAAC;AACN,CAAC"}
|
package/dist/harden.d.ts
CHANGED
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"harden.d.ts","sourceRoot":"","sources":["../source/harden.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAIzD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,CAIvE;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,CAG3E"}
|
package/dist/harden.js
CHANGED
|
@@ -1,28 +1,24 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
exports.hardenAdminOnly = hardenAdminOnly;
|
|
4
|
-
exports.hardenEncryptedOnly = hardenEncryptedOnly;
|
|
5
|
-
const node_opcua_data_model_1 = require("node-opcua-data-model");
|
|
6
|
-
const node_opcua_role_set_common_1 = require("node-opcua-role-set-common");
|
|
1
|
+
import { AccessRestrictionsFlag, allPermissions } from "node-opcua-data-model";
|
|
2
|
+
import { WellKnownRoleIds } from "node-opcua-role-set-common";
|
|
7
3
|
/**
|
|
8
4
|
* Restrict a node to the `SecurityAdmin` Role, reachable only over an encrypted
|
|
9
5
|
* channel — used for the admin-only configuration Methods and the sensitive
|
|
10
6
|
* identity/restriction/user Properties.
|
|
11
7
|
*/
|
|
12
|
-
function hardenAdminOnly(node) {
|
|
8
|
+
export function hardenAdminOnly(node) {
|
|
13
9
|
if (!node)
|
|
14
10
|
return;
|
|
15
|
-
node.setRolePermissions([{ roleId:
|
|
16
|
-
node.setAccessRestrictions(
|
|
11
|
+
node.setRolePermissions([{ roleId: WellKnownRoleIds.SecurityAdmin, permissions: allPermissions }]);
|
|
12
|
+
node.setAccessRestrictions(AccessRestrictionsFlag.EncryptionRequired);
|
|
17
13
|
}
|
|
18
14
|
/**
|
|
19
15
|
* Require an encrypted channel for a node that must stay visible/callable to
|
|
20
16
|
* ordinary authenticated users (e.g. `ChangePassword`, §5.2.8) — no Role
|
|
21
17
|
* restriction, just `EncryptionRequired`.
|
|
22
18
|
*/
|
|
23
|
-
function hardenEncryptedOnly(node) {
|
|
19
|
+
export function hardenEncryptedOnly(node) {
|
|
24
20
|
if (!node)
|
|
25
21
|
return;
|
|
26
|
-
node.setAccessRestrictions(
|
|
22
|
+
node.setAccessRestrictions(AccessRestrictionsFlag.EncryptionRequired);
|
|
27
23
|
}
|
|
28
24
|
//# sourceMappingURL=harden.js.map
|
package/dist/harden.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"harden.js","sourceRoot":"","sources":["../source/harden.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"harden.js","sourceRoot":"","sources":["../source/harden.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAE9D;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAiC;IAC7D,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,IAAI,CAAC,kBAAkB,CAAC,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;IACnG,IAAI,CAAC,qBAAqB,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,CAAC;AAC1E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAiC;IACjE,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,IAAI,CAAC,qBAAqB,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,CAAC;AAC1E,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -11,3 +11,4 @@ export { type InstallUserManagementOptions, type InstallUserManagementResult, ty
|
|
|
11
11
|
export { RoleSetResolver } from "./role_set_resolver.js";
|
|
12
12
|
export { checkEncryptedChannel, checkSecurityAdminAccess } from "./security_checks.js";
|
|
13
13
|
export { createUserManager, type IManagedUserManager } from "./user_management_user_manager.js";
|
|
14
|
+
//# sourceMappingURL=index.d.ts.map
|