node-opcua-server-configuration 2.163.1 → 2.165.0

package/dist/server/push_certificate_manager/create_signing_request.js

@@ -0,0 +1,108 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { CertificateManager } from "node-opcua-certificate-manager";
+import { convertPEMtoDER, exploreCertificate, readCertificate } from "node-opcua-crypto";
+import { checkDebugFlag, make_debugLog, make_errorLog, make_warningLog } from "node-opcua-debug";
+import { NodeId, resolveNodeId, sameNodeId } from "node-opcua-nodeid";
+import { StatusCodes } from "node-opcua-status-code";
+import { subjectToString } from "./subject_to_string.js";
+import { resolveCertificateGroupContext } from "./util.js";
+const warningLog = make_warningLog("ServerConfiguration");
+const errorLog = make_errorLog("ServerConfiguration");
+const debugLog = make_debugLog("ServerConfiguration");
+const doDebug = checkDebugFlag("ServerConfiguration");
+export async function executeCreateSigningRequest(serverImpl, certificateGroupId, certificateTypeId, subjectName, regeneratePrivateKey, nonce) {
+    // Resolve context using our util
+    const context = resolveCertificateGroupContext(serverImpl, certificateGroupId);
+    if (context.statusCode.isNotGood() || !context.certificateManager) {
+        doDebug && debugLog(" cannot find group ", certificateGroupId);
+        return { statusCode: StatusCodes.BadInvalidArgument };
+    }
+    const { certificateManager, allowedTypes } = context;
+    // Validate Certificate Type
+    if (certificateTypeId) {
+        let typeNodeId;
+        if (typeof certificateTypeId === "string") {
+            if (certificateTypeId !== "") {
+                try {
+                    typeNodeId = resolveNodeId(certificateTypeId);
+                }
+                catch {
+                    warningLog("Invalid certificateTypeId string:", certificateTypeId);
+                    return { statusCode: StatusCodes.BadInvalidArgument };
+                }
+                if (!sameNodeId(typeNodeId, NodeId.nullNodeId)) {
+                    const isValidType = allowedTypes?.some((t) => sameNodeId(t, typeNodeId));
+                    if (!isValidType) {
+                        warningLog("certificateTypeId is not in the allowed types for this certificate group:", certificateTypeId);
+                        return { statusCode: StatusCodes.BadNotSupported };
+                    }
+                }
+            }
+        }
+        else {
+            typeNodeId = certificateTypeId;
+            if (!sameNodeId(typeNodeId, NodeId.nullNodeId)) {
+                const isValidType = allowedTypes?.some((t) => sameNodeId(t, typeNodeId));
+                if (!isValidType) {
+                    warningLog("certificateTypeId is not in the allowed types for this certificate group:", certificateTypeId);
+                    return { statusCode: StatusCodes.BadNotSupported };
+                }
+            }
+        }
+    }
+    // Resolve Subject Name
+    if (!subjectName) {
+        const currentCertificateFilename = path.join(certificateManager.rootDir, "own/certs/certificate.pem");
+        try {
+            const certificate = readCertificate(currentCertificateFilename);
+            const e = exploreCertificate(certificate);
+            subjectName = subjectToString(e.tbsCertificate.subject);
+            warningLog("reusing existing certificate subjectName = ", subjectName);
+        }
+        catch (err) {
+            errorLog("Cannot find existing certificate to extract subjectName", currentCertificateFilename, ":", err.message);
+            return { statusCode: StatusCodes.BadInvalidState };
+        }
+    }
+    if (typeof subjectName !== "string") {
+        return { statusCode: StatusCodes.BadInternalError };
+    }
+    // Regenerate Private Key Logic
+    if (regeneratePrivateKey) {
+        if (!nonce || nonce.length < 32) {
+            warningLog("nonce should be provided when regeneratePrivateKey is set, and length shall be at least 32 bytes");
+            return { statusCode: StatusCodes.BadInvalidArgument };
+        }
+        const volatileTmp = await serverImpl.fileTransactionManager.getTmpDir();
+        const tmpPKI = path.join(volatileTmp, `pki${crypto.randomUUID()}`);
+        const tempCertificateManager = new CertificateManager({
+            keySize: certificateManager.keySize,
+            location: tmpPKI
+        });
+        doDebug && debugLog("generating a new private key ...");
+        await tempCertificateManager.initialize();
+        serverImpl.tmpCertificateManager = tempCertificateManager;
+        const generatedPrivateKeyPEM = await fs.promises.readFile(tempCertificateManager.privateKey, "utf8");
+        await serverImpl.fileTransactionManager.stageFile(certificateManager.privateKey, generatedPrivateKeyPEM, "utf8");
+        serverImpl.fileTransactionManager.addCleanupTask(async () => {
+            await tempCertificateManager.dispose();
+            serverImpl.tmpCertificateManager = undefined;
+        });
+    }
+    const options = {
+        applicationUri: serverImpl.applicationUri,
+        subject: subjectName
+    };
+    const activeCertificateManager = serverImpl.tmpCertificateManager || certificateManager;
+    await activeCertificateManager.initialize();
+    const csrFile = await activeCertificateManager.createCertificateRequest(options);
+    const csrPEM = await fs.promises.readFile(csrFile, "utf8");
+    const certificateSigningRequest = convertPEMtoDER(csrPEM);
+    return {
+        certificateSigningRequest,
+        statusCode: StatusCodes.Good
+    };
+}
+//# sourceMappingURL=create_signing_request.js.map

package/dist/server/push_certificate_manager/create_signing_request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create_signing_request.js","sourceRoot":"","sources":["../../../source/server/push_certificate_manager/create_signing_request.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,eAAe,EAAsB,kBAAkB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAC7G,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEtE,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAIrD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,8BAA8B,EAAE,MAAM,WAAW,CAAC;AAE3D,MAAM,UAAU,GAAG,eAAe,CAAC,qBAAqB,CAAC,CAAC;AAC1D,MAAM,QAAQ,GAAG,aAAa,CAAC,qBAAqB,CAAC,CAAC;AACtD,MAAM,QAAQ,GAAG,aAAa,CAAC,qBAAqB,CAAC,CAAC;AACtD,MAAM,OAAO,GAAG,cAAc,CAAC,qBAAqB,CAAC,CAAC;AAEtD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC7C,UAAiD,EACjD,kBAAmC,EACnC,iBAAkC,EAClC,WAA2C,EAC3C,oBAA8B,EAC9B,KAAc;IAEd,iCAAiC;IACjC,MAAM,OAAO,GAAG,8BAA8B,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;IAC/E,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAChE,OAAO,IAAI,QAAQ,CAAC,qBAAqB,EAAE,kBAAkB,CAAC,CAAC;QAC/D,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,kBAAkB,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;IAErD,4BAA4B;IAC5B,IAAI,iBAAiB,EAAE,CAAC;QACpB,IAAI,UAAkB,CAAC;QACvB,IAAI,OAAO,iBAAiB,KAAK,QAAQ,EAAE,CAAC;YACxC,IAAI,iBAAiB,KAAK,EAAE,EAAE,CAAC;gBAC3B,IAAI,CAAC;oBACD,UAAU,GAAG,aAAa,CAAC,iBAAiB,CAAC,CAAC;gBAClD,CAAC;gBAAC,MAAM,CAAC;oBACL,UAAU,CAAC,mCAAmC,EAAE,iBAAiB,CAAC,CAAC;oBACnE,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,kBAAkB,EAAE,CAAC;gBAC1D,CAAC;gBACD,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC7C,MAAM,WAAW,GAAG,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;oBACzE,IAAI,CAAC,WAAW,EAAE,CAAC;wBACf,UAAU,CAAC,2EAA2E,EAAE,iBAAiB,CAAC,CAAC;wBAC3G,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,eAAe,EAAE,CAAC;oBACvD,CAAC;gBACL,CAAC;YACL,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,UAAU,GAAG,iBAAiB,CAAC;YAC/B,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7C,MAAM,WAAW,GAAG,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;gBACzE,IAAI,CAAC,WAAW,EAAE,CAAC;oBACf,UAAU,CAAC,2EAA2E,EAAE,iBAAiB,CAAC,CAAC;oBAC3G,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,eAAe,EAAE,CAAC;gBACvD,CAAC;YACL,CAAC;QACL,CAAC;IACL,CAAC;IAED,uBAAuB;IACvB,IAAI,CAAC,WAAW,EAAE,CAAC;QACf,MAAM,0BAA0B,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAC;QACtG,IAAI,CAAC;YACD,MAAM,WAAW,GAAG,eAAe,CAAC,0BAA0B,CAAC,CAAC;YAChE,MAAM,CAAC,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;YAC1C,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC,OAAyC,CAAC,CAAC;YAC1F,UAAU,CAAC,6CAA6C,EAAE,WAAW,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,QAAQ,CACJ,yDAAyD,EACzD,0BAA0B,EAC1B,GAAG,EACF,GAAa,CAAC,OAAO,CACzB,CAAC;YACF,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,eAAe,EAAE,CAAC;QACvD,CAAC;IACL,CAAC;IAED,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,gBAAgB,EAAE,CAAC;IACxD,CAAC;IAED,+BAA+B;IAC/B,IAAI,oBAAoB,EAAE,CAAC;QACvB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAC9B,UAAU,CAAC,kGAAkG,CAAC,CAAC;YAC/G,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,kBAAkB,EAAE,CAAC;QAC1D,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,sBAAsB,CAAC,SAAS,EAAE,CAAC;QACxE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAEnE,MAAM,sBAAsB,GAAG,IAAI,kBAAkB,CAAC;YAClD,OAAO,EAAE,kBAAkB,CAAC,OAAO;YACnC,QAAQ,EAAE,MAAM;SACnB,CAAC,CAAC;QAEH,OAAO,IAAI,QAAQ,CAAC,kCAAkC,CAAC,CAAC;QACxD,MAAM,sBAAsB,CAAC,UAAU,EAAE,CAAC;QAE1C,UAAU,CAAC,qBAAqB,GAAG,sBAAsB,CAAC;QAE1D,MAAM,sBAAsB,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,sBAAsB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACrG,MAAM,UAAU,CAAC,sBAAsB,CAAC,SAAS,CAAC,kBAAkB,CAAC,UAAU,EAAE,sBAAsB,EAAE,MAAM,CAAC,CAAC;QAEjH,UAAU,CAAC,sBAAsB,CAAC,cAAc,CAAC,KAAK,IAAI,EAAE;YACxD,MAAM,sBAAsB,CAAC,OAAO,EAAE,CAAC;YACvC,UAAU,CAAC,qBAAqB,GAAG,SAAS,CAAC;QACjD,CAAC,CAAC,CAAC;IACP,CAAC;IAED,MAAM,OAAO,GAAG;QACZ,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,OAAO,EAAE,WAAW;KACvB,CAAC;IAEF,MAAM,wBAAwB,GAAG,UAAU,CAAC,qBAAqB,IAAI,kBAAkB,CAAC;IAExF,MAAM,wBAAwB,CAAC,UAAU,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACjF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC3D,MAAM,yBAAyB,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAE1D,OAAO;QACH,yBAAyB;QACzB,UAAU,EAAE,WAAW,CAAC,IAAI;KAC/B,CAAC;AACN,CAAC"}

package/dist/server/push_certificate_manager/get_rejected_list.d.ts

@@ -0,0 +1,3 @@
+import type { GetRejectedListResult } from "../../push_certificate_manager.js";
+import type { PushCertificateManagerInternalContext } from "./internal_context.js";
+export declare function executeGetRejectedList(serverImpl: PushCertificateManagerInternalContext): Promise<GetRejectedListResult>;

package/dist/server/push_certificate_manager/get_rejected_list.js

@@ -0,0 +1,46 @@
+import fs from "node:fs";
+import path from "node:path";
+import { convertPEMtoDER } from "node-opcua-crypto";
+import { StatusCodes } from "node-opcua-status-code";
+async function extractRejectedList(group, certificateList) {
+    if (!group) {
+        return;
+    }
+    const rejectedFolder = path.join(group.rootDir, "rejected");
+    try {
+        const files = await fs.promises.readdir(rejectedFolder);
+        const promises = [];
+        for (const certFile of files) {
+            promises.push(fs.promises.stat(path.join(rejectedFolder, certFile)));
+        }
+        const stats = await Promise.all(promises);
+        for (let i = 0; i < stats.length; i++) {
+            certificateList.push({
+                filename: path.join(rejectedFolder, files[i]),
+                stat: stats[i]
+            });
+        }
+    }
+    catch (_err) {
+        // Directory might not exist yet, ignore
+    }
+}
+export async function executeGetRejectedList(serverImpl) {
+    const list = [];
+    await extractRejectedList(serverImpl.applicationGroup, list);
+    await extractRejectedList(serverImpl.userTokenGroup, list);
+    await extractRejectedList(serverImpl.httpsGroup, list);
+    // sort list from newer file to older file
+    list.sort((a, b) => b.stat.mtime.getTime() - a.stat.mtime.getTime());
+    const promises = [];
+    for (const item of list) {
+        promises.push(fs.promises.readFile(item.filename, "utf8"));
+    }
+    const certificatesPEM = await Promise.all(promises);
+    const certificates = certificatesPEM.map(convertPEMtoDER);
+    return {
+        certificates,
+        statusCode: StatusCodes.Good
+    };
+}
+//# sourceMappingURL=get_rejected_list.js.map

package/dist/server/push_certificate_manager/get_rejected_list.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get_rejected_list.js","sourceRoot":"","sources":["../../../source/server/push_certificate_manager/get_rejected_list.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAWrD,KAAK,UAAU,mBAAmB,CAAC,KAAqC,EAAE,eAA2B;IACjG,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,OAAO;IACX,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC5D,IAAI,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAExD,MAAM,QAAQ,GAAwB,EAAE,CAAC;QACzC,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAE1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACpC,eAAe,CAAC,IAAI,CAAC;gBACjB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC7C,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;aACjB,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAAC,OAAO,IAAI,EAAE,CAAC;QACZ,wCAAwC;IAC5C,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,UAAiD;IAC1F,MAAM,IAAI,GAAe,EAAE,CAAC;IAE5B,MAAM,mBAAmB,CAAC,UAAU,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;IAC7D,MAAM,mBAAmB,CAAC,UAAU,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IAC3D,MAAM,mBAAmB,CAAC,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAEvD,0CAA0C;IAC1C,IAAI,CAAC,IAAI,CAAC,CAAC,CAAW,EAAE,CAAW,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAEzF,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,eAAe,GAAa,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAE9D,MAAM,YAAY,GAAa,eAAe,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAEpE,OAAO;QACH,YAAY;QACZ,UAAU,EAAE,WAAW,CAAC,IAAI;KAC/B,CAAC;AACN,CAAC"}

package/dist/server/push_certificate_manager/internal_context.d.ts

@@ -0,0 +1,35 @@
+import type { CertificateManager } from "node-opcua-certificate-manager";
+import type { NodeId } from "node-opcua-nodeid";
+import { FileTransactionManager } from "../file_transaction_manager.js";
+export type ActionQueue = (() => Promise<void>)[];
+export interface IPushCertificateManagerServer {
+    applicationGroup?: CertificateManager;
+    userTokenGroup?: CertificateManager;
+    httpsGroup?: CertificateManager;
+    applicationUri: string;
+    getCertificateManager(groupName: string): CertificateManager | null;
+    getCertificateTypes(groupName: string): NodeId[] | undefined;
+    emit(eventName: string | symbol, ...args: unknown[]): boolean;
+}
+export declare class PushCertificateManagerInternalContext {
+    private readonly server;
+    readonly map: {
+        [key: string]: CertificateManager;
+    };
+    readonly certificateTypes: {
+        [key: string]: NodeId[];
+    };
+    readonly fileTransactionManager: FileTransactionManager;
+    tmpCertificateManager?: CertificateManager;
+    actionQueue: ActionQueue;
+    operationInProgress: boolean;
+    constructor(server: IPushCertificateManagerServer);
+    get applicationGroup(): CertificateManager | undefined;
+    get userTokenGroup(): CertificateManager | undefined;
+    get httpsGroup(): CertificateManager | undefined;
+    get applicationUri(): string;
+    getCertificateManager(groupName: string): CertificateManager | null;
+    getCertificateTypes(groupName: string): NodeId[] | undefined;
+    emit(eventName: string | symbol, ...args: unknown[]): boolean;
+    dispose(): Promise<void>;
+}

package/dist/server/push_certificate_manager/internal_context.js

@@ -0,0 +1,45 @@
+import { FileTransactionManager } from "../file_transaction_manager.js";
+export class PushCertificateManagerInternalContext {
+    server;
+    map = {};
+    certificateTypes = {};
+    fileTransactionManager = new FileTransactionManager();
+    tmpCertificateManager;
+    actionQueue = [];
+    operationInProgress = false;
+    constructor(server) {
+        this.server = server;
+    }
+    get applicationGroup() {
+        return this.server.applicationGroup;
+    }
+    get userTokenGroup() {
+        return this.server.userTokenGroup;
+    }
+    get httpsGroup() {
+        return this.server.httpsGroup;
+    }
+    get applicationUri() {
+        return this.server.applicationUri;
+    }
+    getCertificateManager(groupName) {
+        return this.server.getCertificateManager(groupName);
+    }
+    getCertificateTypes(groupName) {
+        return this.server.getCertificateTypes(groupName);
+    }
+    emit(eventName, ...args) {
+        return this.server.emit(eventName, ...args);
+    }
+    async dispose() {
+        if (this.tmpCertificateManager) {
+            await this.tmpCertificateManager.dispose();
+            this.tmpCertificateManager = undefined;
+        }
+        if (this.fileTransactionManager) {
+            await this.fileTransactionManager.abortTransaction();
+        }
+        this.actionQueue.length = 0;
+    }
+}
+//# sourceMappingURL=internal_context.js.map

package/dist/server/push_certificate_manager/internal_context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal_context.js","sourceRoot":"","sources":["../../../source/server/push_certificate_manager/internal_context.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAexE,MAAM,OAAO,qCAAqC;IAQjB;IAPb,GAAG,GAA0C,EAAE,CAAC;IAChD,gBAAgB,GAAgC,EAAE,CAAC;IACnD,sBAAsB,GAAG,IAAI,sBAAsB,EAAE,CAAC;IAC/D,qBAAqB,CAAsB;IAC3C,WAAW,GAAgB,EAAE,CAAC;IAC9B,mBAAmB,GAAG,KAAK,CAAC;IAEnC,YAA6B,MAAqC;QAArC,WAAM,GAAN,MAAM,CAA+B;IAAG,CAAC;IAEtE,IAAI,gBAAgB;QAChB,OAAO,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC;IACxC,CAAC;IACD,IAAI,cAAc;QACd,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;IACtC,CAAC;IACD,IAAI,UAAU;QACV,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;IAClC,CAAC;IACD,IAAI,cAAc;QACd,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;IACtC,CAAC;IAED,qBAAqB,CAAC,SAAiB;QACnC,OAAO,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;IACxD,CAAC;IACD,mBAAmB,CAAC,SAAiB;QACjC,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,SAA0B,EAAE,GAAG,IAAe;QAC/C,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,CAAC;IAChD,CAAC;IAEM,KAAK,CAAC,OAAO;QAChB,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC7B,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,CAAC;YAC3C,IAAI,CAAC,qBAAqB,GAAG,SAAS,CAAC;QAC3C,CAAC;QAED,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC9B,MAAM,IAAI,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,CAAC;QACzD,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;IAChC,CAAC;CACJ"}

package/dist/server/push_certificate_manager/subject_to_string.d.ts

@@ -0,0 +1,3 @@
+import type { DirectoryName } from "node-opcua-crypto/web";
+import type { SubjectOptions } from "node-opcua-pki";
+export declare function subjectToString(subject: SubjectOptions & DirectoryName): string;

package/dist/server/push_certificate_manager/subject_to_string.js

@@ -0,0 +1,27 @@
+export function subjectToString(subject) {
+    let s = "";
+    if (subject.commonName)
+        s += `/CN=${subject.commonName}`;
+    if (subject.country)
+        s += `/C=${subject.country}`;
+    if (subject.countryName)
+        s += `/C=${subject.countryName}`;
+    if (subject.domainComponent)
+        s += `/DC=${subject.domainComponent}`;
+    if (subject.locality)
+        s += `/L=${subject.locality}`;
+    if (subject.localityName)
+        s += `/L=${subject.localityName}`;
+    if (subject.organization)
+        s += `/O=${subject.organization}`;
+    if (subject.organizationName)
+        s += `/O=${subject.organizationName}`;
+    if (subject.organizationUnitName)
+        s += `/OU=${subject.organizationUnitName}`;
+    if (subject.state)
+        s += `/ST=${subject.state}`;
+    if (subject.stateOrProvinceName)
+        s += `/ST=${subject.stateOrProvinceName}`;
+    return s;
+}
+//# sourceMappingURL=subject_to_string.js.map

package/dist/server/push_certificate_manager/subject_to_string.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subject_to_string.js","sourceRoot":"","sources":["../../../source/server/push_certificate_manager/subject_to_string.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,eAAe,CAAC,OAAuC;IACnE,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,IAAI,OAAO,CAAC,UAAU;QAAE,CAAC,IAAI,OAAO,OAAO,CAAC,UAAU,EAAE,CAAC;IAEzD,IAAI,OAAO,CAAC,OAAO;QAAE,CAAC,IAAI,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;IAClD,IAAI,OAAO,CAAC,WAAW;QAAE,CAAC,IAAI,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC;IAE1D,IAAI,OAAO,CAAC,eAAe;QAAE,CAAC,IAAI,OAAO,OAAO,CAAC,eAAe,EAAE,CAAC;IAEnE,IAAI,OAAO,CAAC,QAAQ;QAAE,CAAC,IAAI,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;IACpD,IAAI,OAAO,CAAC,YAAY;QAAE,CAAC,IAAI,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;IAE5D,IAAI,OAAO,CAAC,YAAY;QAAE,CAAC,IAAI,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;IAC5D,IAAI,OAAO,CAAC,gBAAgB;QAAE,CAAC,IAAI,MAAM,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAEpE,IAAI,OAAO,CAAC,oBAAoB;QAAE,CAAC,IAAI,OAAO,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAE7E,IAAI,OAAO,CAAC,KAAK;QAAE,CAAC,IAAI,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC;IAC/C,IAAI,OAAO,CAAC,mBAAmB;QAAE,CAAC,IAAI,OAAO,OAAO,CAAC,mBAAmB,EAAE,CAAC;IAE3E,OAAO,CAAC,CAAC;AACb,CAAC"}

package/dist/server/push_certificate_manager/update_certificate.d.ts

@@ -0,0 +1,5 @@
+import type { ByteString } from "node-opcua-basic-types";
+import type { NodeId } from "node-opcua-nodeid";
+import type { UpdateCertificateResult } from "../../push_certificate_manager.js";
+import type { PushCertificateManagerInternalContext } from "./internal_context.js";
+export declare function executeUpdateCertificate(serverImpl: PushCertificateManagerInternalContext, certificateGroupId: NodeId | string, certificateTypeId: NodeId | string, certificate: Buffer, issuerCertificates: ByteString[], privateKeyFormat?: string, privateKey?: Buffer | string): Promise<UpdateCertificateResult>;

package/dist/server/push_certificate_manager/update_certificate.js

@@ -0,0 +1,134 @@
+import fs from "node:fs";
+import path from "node:path";
+import { assert } from "node-opcua-assert";
+import { readPrivateKey } from "node-opcua-crypto";
+import { certificateMatchesPrivateKey, coercePEMorDerToPrivateKey, coercePrivateKeyPem, makeSHA1Thumbprint, toPem } from "node-opcua-crypto/web";
+import { checkDebugFlag, make_debugLog, make_warningLog } from "node-opcua-debug";
+import { StatusCodes } from "node-opcua-status-code";
+import { validateCertificateAndChain } from "../certificate_validation.js";
+import { resolveCertificateGroupContext, validateCertificateType } from "./util.js";
+const warningLog = make_warningLog("ServerConfiguration");
+const debugLog = make_debugLog("ServerConfiguration");
+const doDebug = checkDebugFlag("ServerConfiguration");
+// Helper: Stage issuer certificates to temporary files
+async function preInstallIssuerCertificates(serverImpl, certificateManager, issuerCertificates) {
+    if (issuerCertificates && issuerCertificates.length > 0) {
+        const issuerFolder = certificateManager.issuersCertFolder;
+        await fs.promises.mkdir(issuerFolder, { recursive: true });
+        for (let i = 0; i < issuerCertificates.length; i++) {
+            const issuerCert = issuerCertificates[i];
+            const thumbprint = makeSHA1Thumbprint(issuerCert).toString("hex");
+            const finalIssuerFileDER = path.join(issuerFolder, `issuer_${thumbprint}.der`);
+            const finalIssuerFilePEM = path.join(issuerFolder, `issuer_${thumbprint}.pem`);
+            const issuerCertPEM = toPem(issuerCert, "CERTIFICATE");
+            await serverImpl.fileTransactionManager.stageFile(finalIssuerFileDER, issuerCert);
+            await serverImpl.fileTransactionManager.stageFile(finalIssuerFilePEM, issuerCertPEM, "utf-8");
+            doDebug && debugLog(`Staged issuer certificate ${i + 1}/${issuerCertificates.length}: ${thumbprint}`);
+        }
+    }
+}
+// Helper: Stage main certificate to temporary files
+async function preInstallCertificate(serverImpl, certificateManager, certificate) {
+    const certFolder = certificateManager.ownCertFolder;
+    const destDER = path.join(certFolder, "certificate.der");
+    const destPEM = path.join(certFolder, "certificate.pem");
+    const certificatePEM = toPem(certificate, "CERTIFICATE");
+    await serverImpl.fileTransactionManager.stageFile(destDER, certificate);
+    await serverImpl.fileTransactionManager.stageFile(destPEM, certificatePEM, "utf-8");
+}
+// Helper: Stage private key to temporary file
+async function preInstallPrivateKey(serverImpl, certificateManager, privateKeyFormat, privateKey) {
+    assert(privateKeyFormat.toUpperCase() === "PEM");
+    if (privateKey) {
+        const privateKeyObj = coercePEMorDerToPrivateKey(privateKey);
+        const privateKeyPEM = coercePrivateKeyPem(privateKeyObj);
+        await serverImpl.fileTransactionManager.stageFile(certificateManager.privateKey, privateKeyPEM, "utf-8");
+    }
+}
+// Main Execute Function
+export async function executeUpdateCertificate(serverImpl, certificateGroupId, certificateTypeId, certificate, issuerCertificates, privateKeyFormat, privateKey) {
+    if (serverImpl.operationInProgress) {
+        return { statusCode: StatusCodes.BadTooManyOperations, applyChangesRequired: false };
+    }
+    serverImpl.operationInProgress = true;
+    try {
+        const context = resolveCertificateGroupContext(serverImpl, certificateGroupId);
+        if (context.statusCode.isNotGood() || !context.certificateManager) {
+            debugLog(" cannot find group ", certificateGroupId);
+            return { statusCode: StatusCodes.BadInvalidArgument, applyChangesRequired: false };
+        }
+        const { certificateManager, allowedTypes } = context;
+        if (!validateCertificateType(certificate, certificateTypeId, allowedTypes ?? [], warningLog)) {
+            warningLog(`Certificate type ${certificateTypeId} does not match expected certificateTypeId \n allowed types: ${allowedTypes?.map((t) => t.toString()).join(", ")} \n certificate: ${certificate.toString("base64")}`);
+            return { statusCode: StatusCodes.BadCertificateInvalid, applyChangesRequired: false };
+        }
+        const isApplicationGroup = certificateManager === serverImpl.applicationGroup;
+        const validationResult = await validateCertificateAndChain(certificateManager, isApplicationGroup, certificate, issuerCertificates);
+        if (validationResult.statusCode !== StatusCodes.Good) {
+            await serverImpl.fileTransactionManager.abortTransaction();
+            return { statusCode: validationResult.statusCode, applyChangesRequired: false };
+        }
+        doDebug && debugLog(" updateCertificate ", makeSHA1Thumbprint(certificate).toString("hex"));
+        const hasPrivateKeyFormat = privateKeyFormat !== undefined && privateKeyFormat !== null && privateKeyFormat !== "";
+        const hasPrivateKey = privateKey !== undefined &&
+            privateKey !== null &&
+            privateKey !== "" &&
+            !(privateKey instanceof Buffer && privateKey.length === 0);
+        if (hasPrivateKeyFormat !== hasPrivateKey) {
+            warningLog("privateKeyFormat and privateKey must both be provided or both be omitted");
+            await serverImpl.fileTransactionManager.abortTransaction();
+            return { statusCode: StatusCodes.BadInvalidArgument, applyChangesRequired: false };
+        }
+        if (!hasPrivateKeyFormat && !hasPrivateKey) {
+            const privateKeyObj = readPrivateKey(serverImpl.tmpCertificateManager ? serverImpl.tmpCertificateManager.privateKey : certificateManager.privateKey);
+            if (!certificateMatchesPrivateKey(certificate, privateKeyObj)) {
+                warningLog("certificate doesn't match privateKey");
+                await serverImpl.fileTransactionManager.abortTransaction();
+                return { statusCode: StatusCodes.BadSecurityChecksFailed, applyChangesRequired: false };
+            }
+            await preInstallIssuerCertificates(serverImpl, certificateManager, issuerCertificates);
+            await preInstallCertificate(serverImpl, certificateManager, certificate);
+            serverImpl.emit("certificateUpdated", certificateGroupId, certificate);
+            return { statusCode: StatusCodes.Good, applyChangesRequired: true };
+        }
+        else {
+            if (privateKeyFormat !== "PEM" && privateKeyFormat !== "PFX") {
+                warningLog(` the private key format is invalid privateKeyFormat =${privateKeyFormat}`);
+                await serverImpl.fileTransactionManager.abortTransaction();
+                return { statusCode: StatusCodes.BadNotSupported, applyChangesRequired: false };
+            }
+            if (privateKeyFormat !== "PEM") {
+                warningLog(`in NodeOPCUA we only support PEM for the moment privateKeyFormat =${privateKeyFormat}`);
+                await serverImpl.fileTransactionManager.abortTransaction();
+                return { statusCode: StatusCodes.BadNotSupported, applyChangesRequired: false };
+            }
+            let privateKeyObj;
+            let tempPrivateKey = privateKey;
+            if (tempPrivateKey instanceof Buffer || typeof tempPrivateKey === "string") {
+                if (tempPrivateKey instanceof Buffer) {
+                    assert(privateKeyFormat === "PEM");
+                    tempPrivateKey = tempPrivateKey.toString("utf-8");
+                }
+                privateKeyObj = coercePEMorDerToPrivateKey(tempPrivateKey);
+            }
+            if (!privateKeyObj) {
+                await serverImpl.fileTransactionManager.abortTransaction();
+                return { statusCode: StatusCodes.BadNotSupported, applyChangesRequired: false };
+            }
+            if (!certificateMatchesPrivateKey(certificate, privateKeyObj)) {
+                warningLog("certificate doesn't match privateKey");
+                await serverImpl.fileTransactionManager.abortTransaction();
+                return { statusCode: StatusCodes.BadSecurityChecksFailed, applyChangesRequired: false };
+            }
+            await preInstallPrivateKey(serverImpl, certificateManager, privateKeyFormat, tempPrivateKey);
+            await preInstallIssuerCertificates(serverImpl, certificateManager, issuerCertificates);
+            await preInstallCertificate(serverImpl, certificateManager, certificate);
+            serverImpl.emit("certificateUpdated", certificateGroupId, certificate);
+            return { statusCode: StatusCodes.Good, applyChangesRequired: true };
+        }
+    }
+    finally {
+        serverImpl.operationInProgress = false;
+    }
+}
+//# sourceMappingURL=update_certificate.js.map

package/dist/server/push_certificate_manager/update_certificate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update_certificate.js","sourceRoot":"","sources":["../../../source/server/push_certificate_manager/update_certificate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAG3C,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EACH,4BAA4B,EAC5B,0BAA0B,EAC1B,mBAAmB,EACnB,kBAAkB,EAElB,KAAK,EACR,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAElF,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAGrD,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAE3E,OAAO,EAAE,8BAA8B,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAEpF,MAAM,UAAU,GAAG,eAAe,CAAC,qBAAqB,CAAC,CAAC;AAC1D,MAAM,QAAQ,GAAG,aAAa,CAAC,qBAAqB,CAAC,CAAC;AACtD,MAAM,OAAO,GAAG,cAAc,CAAC,qBAAqB,CAAC,CAAC;AAEtD,uDAAuD;AACvD,KAAK,UAAU,4BAA4B,CACvC,UAAiD,EACjD,kBAAsC,EACtC,kBAA4C;IAE5C,IAAI,kBAAkB,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,MAAM,YAAY,GAAG,kBAAkB,CAAC,iBAAiB,CAAC;QAC1D,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE3D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,kBAAkB,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACjD,MAAM,UAAU,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;YACzC,MAAM,UAAU,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAElE,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,UAAU,MAAM,CAAC,CAAC;YAC/E,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,UAAU,MAAM,CAAC,CAAC;YAC/E,MAAM,aAAa,GAAG,KAAK,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;YAEvD,MAAM,UAAU,CAAC,sBAAsB,CAAC,SAAS,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC;YAClF,MAAM,UAAU,CAAC,sBAAsB,CAAC,SAAS,CAAC,kBAAkB,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;YAE9F,OAAO,IAAI,QAAQ,CAAC,6BAA6B,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC,CAAC;QAC1G,CAAC;IACL,CAAC;AACL,CAAC;AAED,oDAAoD;AACpD,KAAK,UAAU,qBAAqB,CAChC,UAAiD,EACjD,kBAAsC,EACtC,WAAmB;IAEnB,MAAM,UAAU,GAAG,kBAAkB,CAAC,aAAa,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;IACzD,MAAM,cAAc,GAAG,KAAK,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAEzD,MAAM,UAAU,CAAC,sBAAsB,CAAC,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACxE,MAAM,UAAU,CAAC,sBAAsB,CAAC,SAAS,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC;AACxF,CAAC;AAED,8CAA8C;AAC9C,KAAK,UAAU,oBAAoB,CAC/B,UAAiD,EACjD,kBAAsC,EACtC,gBAAwB,EACxB,UAAuC;IAEvC,MAAM,CAAC,gBAAgB,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;IAEjD,IAAI,UAAU,EAAE,CAAC;QACb,MAAM,aAAa,GAAG,0BAA0B,CAAC,UAA6B,CAAC,CAAC;QAChF,MAAM,aAAa,GAAG,mBAAmB,CAAC,aAAa,CAAC,CAAC;QACzD,MAAM,UAAU,CAAC,sBAAsB,CAAC,SAAS,CAAC,kBAAkB,CAAC,UAAU,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IAC7G,CAAC;AACL,CAAC;AAED,wBAAwB;AACxB,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC1C,UAAiD,EACjD,kBAAmC,EACnC,iBAAkC,EAClC,WAAmB,EACnB,kBAAgC,EAChC,gBAAyB,EACzB,UAA4B;IAE5B,IAAI,UAAU,CAAC,mBAAmB,EAAE,CAAC;QACjC,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,oBAAoB,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;IACzF,CAAC;IAED,UAAU,CAAC,mBAAmB,GAAG,IAAI,CAAC;IACtC,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,8BAA8B,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;QAC/E,IAAI,OAAO,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;YAChE,QAAQ,CAAC,qBAAqB,EAAE,kBAAkB,CAAC,CAAC;YACpD,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,kBAAkB,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;QACvF,CAAC;QAED,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;QAErD,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,iBAAiB,EAAE,YAAY,IAAI,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC;YAC3F,UAAU,CACN,oBAAoB,iBAAiB,gEAAgE,YAAY,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAC7M,CAAC;YACF,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,qBAAqB,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;QAC1F,CAAC;QAED,MAAM,kBAAkB,GAAG,kBAAkB,KAAK,UAAU,CAAC,gBAAgB,CAAC;QAC9E,MAAM,gBAAgB,GAAG,MAAM,2BAA2B,CACtD,kBAA6C,EAC7C,kBAAkB,EAClB,WAAW,EACX,kBAAkB,CACrB,CAAC;QAEF,IAAI,gBAAgB,CAAC,UAAU,KAAK,WAAW,CAAC,IAAI,EAAE,CAAC;YACnD,MAAM,UAAU,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,CAAC;YAC3D,OAAO,EAAE,UAAU,EAAE,gBAAgB,CAAC,UAAU,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;QACpF,CAAC;QAED,OAAO,IAAI,QAAQ,CAAC,qBAAqB,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAE5F,MAAM,mBAAmB,GAAG,gBAAgB,KAAK,SAAS,IAAI,gBAAgB,KAAK,IAAI,IAAI,gBAAgB,KAAK,EAAE,CAAC;QACnH,MAAM,aAAa,GACf,UAAU,KAAK,SAAS;YACxB,UAAU,KAAK,IAAI;YACnB,UAAU,KAAK,EAAE;YACjB,CAAC,CAAC,UAAU,YAAY,MAAM,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;QAE/D,IAAI,mBAAmB,KAAK,aAAa,EAAE,CAAC;YACxC,UAAU,CAAC,0EAA0E,CAAC,CAAC;YACvF,MAAM,UAAU,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,CAAC;YAC3D,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,kBAAkB,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;QACvF,CAAC;QAED,IAAI,CAAC,mBAAmB,IAAI,CAAC,aAAa,EAAE,CAAC;YACzC,MAAM,aAAa,GAAG,cAAc,CAChC,UAAU,CAAC,qBAAqB,CAAC,CAAC,CAAC,UAAU,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC,UAAU,CACjH,CAAC;YAEF,IAAI,CAAC,4BAA4B,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE,CAAC;gBAC5D,UAAU,CAAC,sCAAsC,CAAC,CAAC;gBACnD,MAAM,UAAU,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,CAAC;gBAC3D,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,uBAAuB,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;YAC5F,CAAC;YAED,MAAM,4BAA4B,CAAC,UAAU,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;YACvF,MAAM,qBAAqB,CAAC,UAAU,EAAE,kBAAkB,EAAE,WAAW,CAAC,CAAC;YACzE,UAAU,CAAC,IAAI,CAAC,oBAAoB,EAAE,kBAAkB,EAAE,WAAW,CAAC,CAAC;YACvE,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC;QACxE,CAAC;aAAM,CAAC;YACJ,IAAI,gBAAgB,KAAK,KAAK,IAAI,gBAAgB,KAAK,KAAK,EAAE,CAAC;gBAC3D,UAAU,CAAC,wDAAwD,gBAAgB,EAAE,CAAC,CAAC;gBACvF,MAAM,UAAU,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,CAAC;gBAC3D,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,eAAe,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;YACpF,CAAC;YACD,IAAI,gBAAgB,KAAK,KAAK,EAAE,CAAC;gBAC7B,UAAU,CAAC,qEAAqE,gBAAgB,EAAE,CAAC,CAAC;gBACpG,MAAM,UAAU,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,CAAC;gBAC3D,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,eAAe,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;YACpF,CAAC;YAED,IAAI,aAAqC,CAAC;YAC1C,IAAI,cAAc,GAAG,UAAU,CAAC;YAEhC,IAAI,cAAc,YAAY,MAAM,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;gBACzE,IAAI,cAAc,YAAY,MAAM,EAAE,CAAC;oBACnC,MAAM,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC;oBACnC,cAAc,GAAG,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBACtD,CAAC;gBACD,aAAa,GAAG,0BAA0B,CAAC,cAAc,CAAC,CAAC;YAC/D,CAAC;YAED,IAAI,CAAC,aAAa,EAAE,CAAC;gBACjB,MAAM,UAAU,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,CAAC;gBAC3D,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,eAAe,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;YACpF,CAAC;YAED,IAAI,CAAC,4BAA4B,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE,CAAC;gBAC5D,UAAU,CAAC,sCAAsC,CAAC,CAAC;gBACnD,MAAM,UAAU,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,CAAC;gBAC3D,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,uBAAuB,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;YAC5F,CAAC;YAED,MAAM,oBAAoB,CAAC,UAAU,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC;YAC7F,MAAM,4BAA4B,CAAC,UAAU,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;YACvF,MAAM,qBAAqB,CAAC,UAAU,EAAE,kBAAkB,EAAE,WAAW,CAAC,CAAC;YAEzE,UAAU,CAAC,IAAI,CAAC,oBAAoB,EAAE,kBAAkB,EAAE,WAAW,CAAC,CAAC;YACvE,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC;QACxE,CAAC;IACL,CAAC;YAAS,CAAC;QACP,UAAU,CAAC,mBAAmB,GAAG,KAAK,CAAC;IAC3C,CAAC;AACL,CAAC"}

package/dist/server/push_certificate_manager/util.d.ts

@@ -0,0 +1,29 @@
+import type { CertificateManager } from "node-opcua-certificate-manager";
+import { NodeId } from "node-opcua-nodeid";
+import { type StatusCode } from "node-opcua-status-code";
+import type { PushCertificateManagerInternalContext } from "./internal_context.js";
+/**
+ * Find the name of a certificate group based on its NodeId.
+ * @param certificateGroupNodeId The NodeId of the certificate group
+ * @returns The name of the certificate group (e.g. "DefaultApplicationGroup") or empty string if not recognized
+ */
+export declare function findCertificateGroupName(certificateGroupNodeId: NodeId | string): string;
+/**
+ * Validate that the certificate type matches the expected type from certificateTypeId
+ *
+ * @param certificate The certificate to validate
+ * @param certificateTypeId The NodeId of the expected certificate type
+ * @param allowedTypes The list of allowed certificate types for this group
+ * @param warningLog Function to log warnings
+ * @returns true if valid or if validation is not applicable
+ */
+export declare function validateCertificateType(certificate: Buffer, certificateTypeId: NodeId | string, allowedTypes: NodeId[], warningLog: (msg: string, ...args: unknown[]) => void): boolean;
+export interface ResolvedGroupContext {
+    statusCode: StatusCode;
+    certificateManager?: CertificateManager;
+    allowedTypes?: NodeId[];
+}
+/**
+ * Resolves the CertificateManager and its allowed types for a given certificate group
+ */
+export declare function resolveCertificateGroupContext(serverImpl: PushCertificateManagerInternalContext, certificateGroupId: NodeId | string): ResolvedGroupContext;

package/dist/server/push_certificate_manager/util.js

@@ -0,0 +1,117 @@
+import { NodeId, resolveNodeId, sameNodeId } from "node-opcua-nodeid";
+import { StatusCodes } from "node-opcua-status-code";
+import { eccCertificateTypesArray, rsaCertificateTypesArray } from "../../clientTools/certificate_types.js";
+import { getCertificateKeyType } from "../../clientTools/get_certificate_key_type.js";
+const defaultApplicationGroup = resolveNodeId("ServerConfiguration_CertificateGroups_DefaultApplicationGroup");
+const defaultHttpsGroup = resolveNodeId("ServerConfiguration_CertificateGroups_DefaultHttpsGroup");
+const defaultUserTokenGroup = resolveNodeId("ServerConfiguration_CertificateGroups_DefaultUserTokenGroup");
+/**
+ * Find the name of a certificate group based on its NodeId.
+ * @param certificateGroupNodeId The NodeId of the certificate group
+ * @returns The name of the certificate group (e.g. "DefaultApplicationGroup") or empty string if not recognized
+ */
+export function findCertificateGroupName(certificateGroupNodeId) {
+    // Convert string to NodeId if needed to check for null NodeId
+    let nodeId;
+    if (typeof certificateGroupNodeId === "string") {
+        try {
+            nodeId = resolveNodeId(certificateGroupNodeId);
+        }
+        catch {
+            // Invalid NodeId string - treat as literal group name
+            return certificateGroupNodeId;
+        }
+    }
+    else {
+        nodeId = certificateGroupNodeId;
+    }
+    // Check if it's null NodeId or DefaultApplicationGroup
+    if (sameNodeId(nodeId, NodeId.nullNodeId) || sameNodeId(nodeId, defaultApplicationGroup)) {
+        return "DefaultApplicationGroup";
+    }
+    if (sameNodeId(nodeId, defaultHttpsGroup)) {
+        return "DefaultHttpsGroup";
+    }
+    if (sameNodeId(nodeId, defaultUserTokenGroup)) {
+        return "DefaultUserTokenGroup";
+    }
+    // If it's a valid NodeId but not recognized, return empty string
+    // If it was originally a string (and not a standard group), return the string as group name
+    return typeof certificateGroupNodeId === "string" ? certificateGroupNodeId : "";
+}
+/**
+ * Validate that the certificate type matches the expected type from certificateTypeId
+ *
+ * @param certificate The certificate to validate
+ * @param certificateTypeId The NodeId of the expected certificate type
+ * @param allowedTypes The list of allowed certificate types for this group
+ * @param warningLog Function to log warnings
+ * @returns true if valid or if validation is not applicable
+ */
+export function validateCertificateType(certificate, certificateTypeId, allowedTypes, warningLog) {
+    // If certificateTypeId is null or not specified, skip validation
+    if (!certificateTypeId || (certificateTypeId instanceof NodeId && sameNodeId(certificateTypeId, NodeId.nullNodeId))) {
+        return true;
+    }
+    const keyType = getCertificateKeyType(certificate);
+    if (!keyType) {
+        // If we can't determine the key type, allow it (backward compatibility)
+        return true;
+    }
+    // Convert to NodeId if string
+    let typeNodeId;
+    if (typeof certificateTypeId === "string") {
+        try {
+            typeNodeId = resolveNodeId(certificateTypeId);
+        }
+        catch {
+            // Invalid NodeId string, skip validation
+            return true;
+        }
+    }
+    else {
+        typeNodeId = certificateTypeId;
+    }
+    // Check again after conversion - empty string becomes null NodeId
+    if (sameNodeId(typeNodeId, NodeId.nullNodeId)) {
+        return true;
+    }
+    // Check if the certificateTypeId is in the list of allowed types for this group
+    const isAllowed = allowedTypes.some((t) => sameNodeId(t, typeNodeId));
+    if (!isAllowed) {
+        warningLog("Certificate typeId is not in the allowed types for this certificate group:", certificateTypeId);
+        return false;
+    }
+    // Additional validation: check if the certificate's actual key type matches the declared type
+    const isRsaType = rsaCertificateTypesArray.some((t) => sameNodeId(t, typeNodeId));
+    const isEccType = eccCertificateTypesArray.some((t) => sameNodeId(t, typeNodeId));
+    if (keyType === "RSA" && !isRsaType) {
+        warningLog("Certificate has RSA key but certificateTypeId is not an RSA type:", certificateTypeId);
+        return false;
+    }
+    if (keyType === "ECC" && !isEccType) {
+        warningLog("Certificate has ECC key but certificateTypeId is not an ECC type:", certificateTypeId);
+        return false;
+    }
+    return true;
+}
+/**
+ * Resolves the CertificateManager and its allowed types for a given certificate group
+ */
+export function resolveCertificateGroupContext(serverImpl, certificateGroupId) {
+    const groupName = findCertificateGroupName(certificateGroupId);
+    if (!groupName) {
+        return { statusCode: StatusCodes.BadInvalidArgument };
+    }
+    const certificateManager = serverImpl.getCertificateManager(groupName);
+    if (!certificateManager) {
+        return { statusCode: StatusCodes.BadInvalidArgument };
+    }
+    const allowedTypes = serverImpl.getCertificateTypes(groupName);
+    return {
+        statusCode: StatusCodes.Good,
+        certificateManager,
+        allowedTypes
+    };
+}
+//# sourceMappingURL=util.js.map

package/dist/server/push_certificate_manager/util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"util.js","sourceRoot":"","sources":["../../../source/server/push_certificate_manager/util.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAAmB,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACtE,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAC5G,OAAO,EAAE,qBAAqB,EAAE,MAAM,+CAA+C,CAAC;AAGtF,MAAM,uBAAuB,GAAG,aAAa,CAAC,+DAA+D,CAAC,CAAC;AAC/G,MAAM,iBAAiB,GAAG,aAAa,CAAC,yDAAyD,CAAC,CAAC;AACnG,MAAM,qBAAqB,GAAG,aAAa,CAAC,6DAA6D,CAAC,CAAC;AAE3G;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,sBAAuC;IAC5E,8DAA8D;IAC9D,IAAI,MAAc,CAAC;IACnB,IAAI,OAAO,sBAAsB,KAAK,QAAQ,EAAE,CAAC;QAC7C,IAAI,CAAC;YACD,MAAM,GAAG,aAAa,CAAC,sBAAsB,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACL,sDAAsD;YACtD,OAAO,sBAAsB,CAAC;QAClC,CAAC;IACL,CAAC;SAAM,CAAC;QACJ,MAAM,GAAG,sBAAsB,CAAC;IACpC,CAAC;IAED,uDAAuD;IACvD,IAAI,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,EAAE,uBAAuB,CAAC,EAAE,CAAC;QACvF,OAAO,yBAAyB,CAAC;IACrC,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,EAAE,iBAAiB,CAAC,EAAE,CAAC;QACxC,OAAO,mBAAmB,CAAC;IAC/B,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,EAAE,qBAAqB,CAAC,EAAE,CAAC;QAC5C,OAAO,uBAAuB,CAAC;IACnC,CAAC;IAED,iEAAiE;IACjE,4FAA4F;IAC5F,OAAO,OAAO,sBAAsB,KAAK,QAAQ,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;AACpF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACnC,WAAmB,EACnB,iBAAkC,EAClC,YAAsB,EACtB,UAAqD;IAErD,iEAAiE;IACjE,IAAI,CAAC,iBAAiB,IAAI,CAAC,iBAAiB,YAAY,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAClH,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,OAAO,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO,EAAE,CAAC;QACX,wEAAwE;QACxE,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,8BAA8B;IAC9B,IAAI,UAAkB,CAAC;IACvB,IAAI,OAAO,iBAAiB,KAAK,QAAQ,EAAE,CAAC;QACxC,IAAI,CAAC;YACD,UAAU,GAAG,aAAa,CAAC,iBAAiB,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACL,yCAAyC;YACzC,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;SAAM,CAAC;QACJ,UAAU,GAAG,iBAAiB,CAAC;IACnC,CAAC;IAED,kEAAkE;IAClE,IAAI,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,gFAAgF;IAChF,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;IAEtE,IAAI,CAAC,SAAS,EAAE,CAAC;QACb,UAAU,CAAC,4EAA4E,EAAE,iBAAiB,CAAC,CAAC;QAC5G,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,8FAA8F;IAC9F,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;IAClF,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;IAElF,IAAI,OAAO,KAAK,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;QAClC,UAAU,CAAC,mEAAmE,EAAE,iBAAiB,CAAC,CAAC;QACnG,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;QAClC,UAAU,CAAC,mEAAmE,EAAE,iBAAiB,CAAC,CAAC;QACnG,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,OAAO,IAAI,CAAC;AAChB,CAAC;AAQD;;GAEG;AACH,MAAM,UAAU,8BAA8B,CAC1C,UAAiD,EACjD,kBAAmC;IAEnC,MAAM,SAAS,GAAG,wBAAwB,CAAC,kBAAkB,CAAC,CAAC;IAC/D,IAAI,CAAC,SAAS,EAAE,CAAC;QACb,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,kBAAkB,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,kBAAkB,GAAG,UAAU,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;IACvE,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACtB,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,kBAAkB,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,YAAY,GAAG,UAAU,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAE/D,OAAO;QACH,UAAU,EAAE,WAAW,CAAC,IAAI;QAC5B,kBAAkB;QAClB,YAAY;KACf,CAAC;AACN,CAAC"}

package/dist/server/push_certificate_manager_helpers.d.ts

@@ -1,4 +1,7 @@
-import { AddressSpace, UACertificateGroup } from "node-opcua-address-space";
-import { PushCertificateManagerServerOptions } from "./push_certificate_manager_server_impl";
+/**
+ * @module node-opcua-server-configuration
+ */
+import { type AddressSpace, type UACertificateGroup } from "node-opcua-address-space";
+import { type PushCertificateManagerServerOptions } from "./push_certificate_manager_server_impl.js";
 export declare function promoteCertificateGroup(certificateGroup: UACertificateGroup): Promise<void>;
 export declare function installPushCertificateManagement(addressSpace: AddressSpace, options: PushCertificateManagerServerOptions): Promise<void>;