node-opcua-server-configuration 2.98.0 → 2.98.2

package/dist/server/push_certificate_manager_server_impl.d.ts

@@ -0,0 +1,47 @@
+/// <reference types="node" />
+/// <reference types="node" />
+/**
+ * @module node-opcua-server-configuration-server
+ */
+import { EventEmitter } from "events";
+import { SubjectOptions } from "node-opcua-pki";
+import { ByteString } from "node-opcua-basic-types";
+import { DirectoryName } from "node-opcua-crypto/dist/source/asn1";
+import { NodeId } from "node-opcua-nodeid";
+import { CertificateManager } from "node-opcua-certificate-manager";
+import { StatusCode } from "node-opcua-status-code";
+import { CreateSigningRequestResult, GetRejectedListResult, PushCertificateManager, UpdateCertificateResult } from "../push_certificate_manager";
+export interface PushCertificateManagerServerOptions {
+    applicationGroup?: CertificateManager;
+    userTokenGroup?: CertificateManager;
+    httpsGroup?: CertificateManager;
+    applicationUri: string;
+}
+export declare function copyFile(source: string, dest: string): Promise<void>;
+export declare function deleteFile(file: string): Promise<void>;
+export declare function moveFile(source: string, dest: string): Promise<void>;
+export declare function moveFileWithBackup(source: string, dest: string): Promise<void>;
+export declare function subjectToString(subject: SubjectOptions & DirectoryName): string;
+export type ActionQueue = (() => Promise<void>)[];
+export declare class PushCertificateManagerServerImpl extends EventEmitter implements PushCertificateManager {
+    applicationGroup?: CertificateManager;
+    userTokenGroup?: CertificateManager;
+    httpsGroup?: CertificateManager;
+    private readonly _map;
+    private readonly _pendingTasks;
+    private _tmpCertificateManager?;
+    private $$actionQueue;
+    private applicationUri;
+    constructor(options: PushCertificateManagerServerOptions);
+    initialize(): Promise<void>;
+    get supportedPrivateKeyFormats(): string[];
+    getSupportedPrivateKeyFormats(): Promise<string[]>;
+    createSigningRequest(certificateGroupId: NodeId | string, certificateTypeId: NodeId | string, subjectName: string | SubjectOptions | null, regeneratePrivateKey?: boolean, nonce?: Buffer): Promise<CreateSigningRequestResult>;
+    getRejectedList(): Promise<GetRejectedListResult>;
+    updateCertificate(certificateGroupId: NodeId | string, certificateTypeId: NodeId | string, certificate: Buffer, issuerCertificates: ByteString[]): Promise<UpdateCertificateResult>;
+    applyChanges(): Promise<StatusCode>;
+    private getCertificateManager;
+    private addPendingTask;
+    private applyPendingTasks;
+    private flushActionQueue;
+}

package/dist/server/push_certificate_manager_server_impl.js

@@ -0,0 +1,526 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __asyncValues = (this && this.__asyncValues) || function (o) {
+    if (!Symbol.asyncIterator) throw new TypeError("Symbol.asyncIterator is not defined.");
+    var m = o[Symbol.asyncIterator], i;
+    return m ? m.call(o) : (o = typeof __values === "function" ? __values(o) : o[Symbol.iterator](), i = {}, verb("next"), verb("throw"), verb("return"), i[Symbol.asyncIterator] = function () { return this; }, i);
+    function verb(n) { i[n] = o[n] && function (v) { return new Promise(function (resolve, reject) { v = o[n](v), settle(resolve, reject, v.done, v.value); }); }; }
+    function settle(resolve, reject, d, v) { Promise.resolve(v).then(function(v) { resolve({ value: v, done: d }); }, reject); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PushCertificateManagerServerImpl = exports.subjectToString = exports.moveFileWithBackup = exports.moveFile = exports.deleteFile = exports.copyFile = void 0;
+/**
+ * @module node-opcua-server-configuration-server
+ */
+const events_1 = require("events");
+const fs = require("fs");
+const path = require("path");
+const crypto_1 = require("crypto");
+const util_1 = require("util");
+const rimraf = require("rimraf");
+const node_opcua_assert_1 = require("node-opcua-assert");
+const node_opcua_basic_types_1 = require("node-opcua-basic-types");
+const node_opcua_crypto_1 = require("node-opcua-crypto");
+const node_opcua_debug_1 = require("node-opcua-debug");
+const node_opcua_nodeid_1 = require("node-opcua-nodeid");
+const node_opcua_certificate_manager_1 = require("node-opcua-certificate-manager");
+// node 14 onward : import {  readFile, writeFile, readdir } from "fs/promises";
+const { readFile, writeFile, readdir } = fs.promises;
+const debugLog = (0, node_opcua_debug_1.make_debugLog)("ServerConfiguration");
+const errorLog = (0, node_opcua_debug_1.make_errorLog)("ServerConfiguration");
+const warningLog = (0, node_opcua_debug_1.make_warningLog)("ServerConfiguration");
+const doDebug = (0, node_opcua_debug_1.checkDebugFlag)("ServerConfiguration");
+const defaultApplicationGroup = (0, node_opcua_nodeid_1.resolveNodeId)("ServerConfiguration_CertificateGroups_DefaultApplicationGroup");
+const defaultHttpsGroup = (0, node_opcua_nodeid_1.resolveNodeId)("ServerConfiguration_CertificateGroups_DefaultHttpsGroup");
+const defaultUserTokenGroup = (0, node_opcua_nodeid_1.resolveNodeId)("ServerConfiguration_CertificateGroups_DefaultUserTokenGroup");
+function findCertificateGroupName(certificateGroupNodeId) {
+    if (typeof certificateGroupNodeId === "string") {
+        return certificateGroupNodeId;
+    }
+    if ((0, node_opcua_nodeid_1.sameNodeId)(certificateGroupNodeId, node_opcua_nodeid_1.NodeId.nullNodeId) || (0, node_opcua_nodeid_1.sameNodeId)(certificateGroupNodeId, defaultApplicationGroup)) {
+        return "DefaultApplicationGroup";
+    }
+    if ((0, node_opcua_nodeid_1.sameNodeId)(certificateGroupNodeId, defaultHttpsGroup)) {
+        return "DefaultHttpsGroup";
+    }
+    if ((0, node_opcua_nodeid_1.sameNodeId)(certificateGroupNodeId, defaultUserTokenGroup)) {
+        return "DefaultUserTokenGroup";
+    }
+    return "";
+}
+function copyFile(source, dest) {
+    return __awaiter(this, void 0, void 0, function* () {
+        try {
+            debugLog("copying file \n source ", source, "\n =>\n dest ", dest);
+            const sourceExist = fs.existsSync(source);
+            if (sourceExist) {
+                yield fs.promises.copyFile(source, dest);
+            }
+        }
+        catch (err) {
+            errorLog(err);
+        }
+    });
+}
+exports.copyFile = copyFile;
+function deleteFile(file) {
+    return __awaiter(this, void 0, void 0, function* () {
+        try {
+            const exists = yield fs.existsSync(file);
+            if (exists) {
+                debugLog("deleting file ", file);
+                yield fs.promises.unlink(file);
+            }
+        }
+        catch (err) {
+            errorLog(err);
+        }
+    });
+}
+exports.deleteFile = deleteFile;
+function moveFile(source, dest) {
+    return __awaiter(this, void 0, void 0, function* () {
+        debugLog("moving file file \n source ", source, "\n =>\n dest ", dest);
+        try {
+            yield copyFile(source, dest);
+            yield deleteFile(source);
+        }
+        catch (err) {
+            errorLog(err);
+        }
+    });
+}
+exports.moveFile = moveFile;
+function moveFileWithBackup(source, dest) {
+    return __awaiter(this, void 0, void 0, function* () {
+        // let make a copy of the destination file
+        debugLog("moveFileWithBackup file \n source ", source, "\n =>\n dest ", dest);
+        yield copyFile(dest, dest + "_old");
+        yield moveFile(source, dest);
+    });
+}
+exports.moveFileWithBackup = moveFileWithBackup;
+function subjectToString(subject) {
+    let s = "";
+    subject.commonName && (s += `/CN=${subject.commonName}`);
+    subject.country && (s += `/C=${subject.country}`);
+    subject.countryName && (s += `/C=${subject.countryName}`);
+    subject.domainComponent && (s += `/DC=${subject.domainComponent}`);
+    subject.locality && (s += `/L=${subject.locality}`);
+    subject.localityName && (s += `/L=${subject.localityName}`);
+    subject.organization && (s += `/O=${subject.organization}`);
+    subject.organizationName && (s += `/O=${subject.organizationName}`);
+    subject.organizationUnitName && (s += `/OU=${subject.organizationUnitName}`);
+    subject.state && (s += `/ST=${subject.state}`);
+    subject.stateOrProvinceName && (s += `/ST=${subject.stateOrProvinceName}`);
+    return s;
+}
+exports.subjectToString = subjectToString;
+let fileCounter = 0;
+class PushCertificateManagerServerImpl extends events_1.EventEmitter {
+    constructor(options) {
+        super();
+        this._map = {};
+        this._pendingTasks = [];
+        this.$$actionQueue = [];
+        this.applicationUri = options ? options.applicationUri : "";
+        if (options) {
+            this.applicationGroup = options.applicationGroup;
+            this.userTokenGroup = options.userTokenGroup;
+            this.httpsGroup = options.httpsGroup;
+            if (this.userTokenGroup) {
+                this._map.DefaultUserTokenGroup = this.userTokenGroup;
+                // istanbul ignore next
+                if (!(this.userTokenGroup instanceof node_opcua_certificate_manager_1.CertificateManager)) {
+                    errorLog("Expecting this.userTokenGroup to be instanceof CertificateManager :", this.userTokenGroup.constructor.name);
+                    throw new Error("Expecting this.userTokenGroup to be instanceof CertificateManager ");
+                }
+            }
+            if (this.applicationGroup) {
+                this._map.DefaultApplicationGroup = this.applicationGroup;
+                (0, node_opcua_assert_1.assert)(this.applicationGroup instanceof node_opcua_certificate_manager_1.CertificateManager);
+            }
+            if (this.httpsGroup) {
+                this._map.DefaultHttpsGroup = this.httpsGroup;
+                (0, node_opcua_assert_1.assert)(this.httpsGroup instanceof node_opcua_certificate_manager_1.CertificateManager);
+            }
+        }
+    }
+    initialize() {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (this.applicationGroup) {
+                yield this.applicationGroup.initialize();
+            }
+            if (this.userTokenGroup) {
+                yield this.userTokenGroup.initialize();
+            }
+            if (this.httpsGroup) {
+                yield this.httpsGroup.initialize();
+            }
+        });
+    }
+    get supportedPrivateKeyFormats() {
+        return ["PEM"];
+    }
+    getSupportedPrivateKeyFormats() {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.supportedPrivateKeyFormats;
+        });
+    }
+    createSigningRequest(certificateGroupId, certificateTypeId, subjectName, regeneratePrivateKey, nonce) {
+        return __awaiter(this, void 0, void 0, function* () {
+            let certificateManager = this.getCertificateManager(certificateGroupId);
+            if (!certificateManager) {
+                debugLog(" cannot find group ", certificateGroupId);
+                return {
+                    statusCode: node_opcua_basic_types_1.StatusCodes.BadInvalidArgument
+                };
+            }
+            if (!subjectName) {
+                // reuse existing subjectName
+                const currentCertificateFilename = path.join(certificateManager.rootDir, "own/certs/certificate.pem");
+                if (!fs.existsSync(currentCertificateFilename)) {
+                    errorLog("Cannot find existing certificate to extract subjectName", currentCertificateFilename);
+                    return {
+                        statusCode: node_opcua_basic_types_1.StatusCodes.BadInvalidState
+                    };
+                }
+                const certificate = (0, node_opcua_crypto_1.readCertificate)(currentCertificateFilename);
+                const e = (0, node_opcua_crypto_1.exploreCertificate)(certificate);
+                subjectName = subjectToString(e.tbsCertificate.subject);
+                warningLog("reusing existing certificate subjectAltName = ", subjectName);
+            }
+            // todo : at this time regenerate PrivateKey is not supported
+            if (regeneratePrivateKey) {
+                // The Server shall create a new Private Key which it stores until the
+                // matching signed Certificate is uploaded with the UpdateCertificate Method.
+                // Previously created Private Keys may be discarded if UpdateCertificate was not
+                // called before calling this method again.
+                // Additional entropy which the caller shall provide if regeneratePrivateKey is TRUE.
+                // It shall be at least 32 bytes long
+                if (!nonce || nonce.length < 32) {
+                    (0, node_opcua_debug_1.make_warningLog)(" nonce should be provided when regeneratePrivateKey is set, and length shall be greater than 32 bytes");
+                    return {
+                        statusCode: node_opcua_basic_types_1.StatusCodes.BadInvalidArgument
+                    };
+                }
+                const location = path.join(certificateManager.rootDir, "tmp");
+                if (fs.existsSync(location)) {
+                    yield (0, util_1.promisify)(rimraf)(path.join(location));
+                }
+                if (!fs.existsSync(location)) {
+                    yield fs.promises.mkdir(location);
+                }
+                const destCertificateManager = certificateManager;
+                const keySize = certificateManager.keySize; // because keySize is private !
+                certificateManager = new node_opcua_certificate_manager_1.CertificateManager({
+                    keySize,
+                    location
+                });
+                debugLog("generating a new private key ...");
+                yield certificateManager.initialize();
+                this._tmpCertificateManager = certificateManager;
+                this.addPendingTask(() => __awaiter(this, void 0, void 0, function* () {
+                    yield moveFileWithBackup(certificateManager.privateKey, destCertificateManager.privateKey);
+                }));
+                this.addPendingTask(() => __awaiter(this, void 0, void 0, function* () {
+                    yield (0, util_1.promisify)(rimraf)(path.join(location));
+                }));
+            }
+            else {
+                // The Server uses its existing Private Key
+            }
+            if (typeof subjectName !== "string") {
+                return { statusCode: node_opcua_basic_types_1.StatusCodes.BadInternalError };
+            }
+            const options = {
+                applicationUri: this.applicationUri,
+                subject: subjectName
+            };
+            yield certificateManager.initialize();
+            const csrFile = yield certificateManager.createCertificateRequest(options);
+            const csrPEM = yield readFile(csrFile, "utf8");
+            const certificateSigningRequest = (0, node_opcua_crypto_1.convertPEMtoDER)(csrPEM);
+            this.addPendingTask(() => deleteFile(csrFile));
+            return {
+                certificateSigningRequest,
+                statusCode: node_opcua_basic_types_1.StatusCodes.Good
+            };
+        });
+    }
+    getRejectedList() {
+        return __awaiter(this, void 0, void 0, function* () {
+            // rejectedList comes from each group
+            function extractRejectedList(group, certificateList) {
+                return __awaiter(this, void 0, void 0, function* () {
+                    if (!group) {
+                        return;
+                    }
+                    const rejectedFolder = path.join(group.rootDir, "rejected");
+                    const files = yield readdir(rejectedFolder);
+                    const stat = fs.promises.stat;
+                    const promises1 = [];
+                    for (const certFile of files) {
+                        // read date
+                        promises1.push(stat(path.join(rejectedFolder, certFile)));
+                    }
+                    const stats = yield Promise.all(promises1);
+                    for (let i = 0; i < stats.length; i++) {
+                        certificateList.push({
+                            filename: path.join(rejectedFolder, files[i]),
+                            stat: stats[i]
+                        });
+                    }
+                });
+            }
+            const list = [];
+            yield extractRejectedList(this.applicationGroup, list);
+            yield extractRejectedList(this.userTokenGroup, list);
+            yield extractRejectedList(this.httpsGroup, list);
+            // now sort list from newer file to older file
+            list.sort((a, b) => b.stat.mtime.getTime() - a.stat.mtime.getTime());
+            const promises = [];
+            for (const item of list) {
+                promises.push(readFile(item.filename, "utf8"));
+            }
+            const certificatesPEM = yield Promise.all(promises);
+            const certificates = certificatesPEM.map(node_opcua_crypto_1.convertPEMtoDER);
+            return {
+                certificates,
+                statusCode: node_opcua_basic_types_1.StatusCodes.Good
+            };
+        });
+    }
+    // eslint-disable-next-line max-statements
+    updateCertificate(certificateGroupId, certificateTypeId, certificate, issuerCertificates, privateKeyFormat, privateKey) {
+        return __awaiter(this, void 0, void 0, function* () {
+            // Result Code                Description
+            // BadInvalidArgument        The certificateTypeId or certificateGroupId is not valid.
+            // BadCertificateInvalid     The Certificate is invalid or the format is not supported.
+            // BadNotSupported           The PrivateKey is invalid or the format is not supported.
+            // BadUserAccessDenied       The current user does not have the rights required.
+            // BadSecurityChecksFailed   Some failure occurred verifying the integrity of the Certificate.
+            const certificateManager = this.getCertificateManager(certificateGroupId);
+            if (!certificateManager) {
+                debugLog(" cannot find group ", certificateGroupId);
+                return {
+                    statusCode: node_opcua_basic_types_1.StatusCodes.BadInvalidArgument
+                };
+            }
+            function preInstallCertificate(self) {
+                return __awaiter(this, void 0, void 0, function* () {
+                    const certFolder = path.join(certificateManager.rootDir, "own/certs");
+                    const certificateFileDER = path.join(certFolder, `_pending_certificate${fileCounter++}.der`);
+                    const certificateFilePEM = path.join(certFolder, `_pending_certificate${fileCounter++}.pem`);
+                    yield writeFile(certificateFileDER, certificate, "binary");
+                    yield writeFile(certificateFilePEM, (0, node_opcua_crypto_1.toPem)(certificate, "CERTIFICATE"));
+                    const destDER = path.join(certFolder, "certificate.der");
+                    const destPEM = path.join(certFolder, "certificate.pem");
+                    // put existing file in security by backing them up
+                    self.addPendingTask(() => moveFileWithBackup(certificateFileDER, destDER));
+                    self.addPendingTask(() => moveFileWithBackup(certificateFilePEM, destPEM));
+                });
+            }
+            function preInstallPrivateKey(self) {
+                return __awaiter(this, void 0, void 0, function* () {
+                    (0, node_opcua_assert_1.assert)(privateKeyFormat.toUpperCase() === "PEM");
+                    const ownPrivateFolder = path.join(certificateManager.rootDir, "own/private");
+                    const privateKeyFilePEM = path.join(ownPrivateFolder, `_pending_private_key${fileCounter++}.pem`);
+                    const privateKeyPEM = (0, node_opcua_crypto_1.toPem)(privateKey, "RSA PRIVATE KEY");
+                    yield writeFile(privateKeyFilePEM, privateKeyPEM, "utf-8");
+                    self.addPendingTask(() => moveFileWithBackup(privateKeyFilePEM, certificateManager.privateKey));
+                });
+            }
+            // OPC Unified Architecture, Part 12 42 Release 1.04:
+            //
+            // UpdateCertificate is used to update a Certificate for a Server.
+            // There are the following three use cases for this Method:
+            //
+            //  - The new Certificate was created based on a signing request created with the Method
+            //    In this case there is no privateKey provided.
+            //  - A new privateKey and Certificate was created outside the Server and both are updated
+            //    with this Method.
+            //  - A new Certificate was created and signed with the information from the old Certificate.
+            //    In this case there is no privateKey provided.
+            // The Server shall do all normal integrity checks on the Certificate and all of the issuer
+            // Certificates. If errors occur the BadSecurityChecksFailed error is returned.
+            // todo : all normal integrity check on the certificate
+            const certInfo = (0, node_opcua_crypto_1.exploreCertificate)(certificate);
+            const now = new Date();
+            if (certInfo.tbsCertificate.validity.notBefore.getTime() > now.getTime()) {
+                // certificate is not yet valid
+                warningLog("Certificate is not yet valid : not before ", certInfo.tbsCertificate.validity.notBefore.toISOString(), "now = ", now.toISOString());
+                return { statusCode: node_opcua_basic_types_1.StatusCodes.BadSecurityChecksFailed };
+            }
+            if (certInfo.tbsCertificate.validity.notAfter.getTime() < now.getTime()) {
+                // certificate is already out of date
+                warningLog("Certificate is already out of date : not after ", certInfo.tbsCertificate.validity.notAfter.toISOString(), "now = ", now.toISOString());
+                return { statusCode: node_opcua_basic_types_1.StatusCodes.BadSecurityChecksFailed };
+            }
+            // If the Server returns applyChangesRequired=FALSE then it is indicating that it is able to
+            // satisfy the requirements specified for the ApplyChanges Method.
+            debugLog(" updateCertificate ", (0, node_opcua_crypto_1.makeSHA1Thumbprint)(certificate).toString("hex"));
+            if (!privateKeyFormat || !privateKey) {
+                // first of all we need to find the future private key;
+                // this one may have been created during the creation of the certficate signing request
+                // but is not active yet
+                const privateKeyDER = (0, node_opcua_crypto_1.readPrivateKey)(this._tmpCertificateManager ? this._tmpCertificateManager.privateKey : certificateManager.privateKey);
+                // The Server shall report an error if the public key does not match the existing Certificate and
+                // the privateKey was not provided.
+                // privateKey is not provided, so check that the public key matches the existing certificate
+                if (!(0, node_opcua_crypto_1.certificateMatchesPrivateKey)(certificate, privateKeyDER)) {
+                    // certificate doesn't match privateKey
+                    warningLog("certificate doesn't match privateKey");
+                    /* debug code */
+                    const certificatePEM = (0, node_opcua_crypto_1.toPem)(certificate, "CERTIFICATE");
+                    const privateKeyPEM = (0, node_opcua_crypto_1.toPem)(privateKeyDER, "RSA PRIVATE KEY");
+                    const initialBuffer = Buffer.from("Lorem Ipsum");
+                    const encryptedBuffer = (0, node_opcua_crypto_1.publicEncrypt_long)(initialBuffer, certificatePEM, 256, 11);
+                    const decryptedBuffer = (0, node_opcua_crypto_1.privateDecrypt_long)(encryptedBuffer, privateKeyPEM, 256);
+                    console.log(certificatePEM);
+                    console.log(privateKeyPEM);
+                    console.log("decrypted buffer", decryptedBuffer.toString("utf-8"));
+                    return { statusCode: node_opcua_basic_types_1.StatusCodes.BadSecurityChecksFailed };
+                }
+                // a new certificate is provided for us,
+                // we keep our private key
+                // we do this in two stages
+                yield preInstallCertificate(this);
+                return {
+                    statusCode: node_opcua_basic_types_1.StatusCodes.Good
+                };
+            }
+            else if (privateKey) {
+                // a private key has been provided by the caller !
+                if (!privateKeyFormat) {
+                    warningLog("the privateKeyFormat must be specified " + privateKeyFormat);
+                    return { statusCode: node_opcua_basic_types_1.StatusCodes.BadNotSupported };
+                }
+                if (privateKeyFormat !== "PEM" && privateKeyFormat !== "PFX") {
+                    warningLog(" the private key format is invalid privateKeyFormat =" + privateKeyFormat);
+                    return { statusCode: node_opcua_basic_types_1.StatusCodes.BadNotSupported };
+                }
+                if (privateKeyFormat !== "PEM") {
+                    warningLog("in NodeOPCUA we only support PEM for the moment privateKeyFormat =" + privateKeyFormat);
+                    return { statusCode: node_opcua_basic_types_1.StatusCodes.BadNotSupported };
+                }
+                if (privateKey instanceof Buffer || typeof privateKey === "string") {
+                    privateKey = (0, crypto_1.createPrivateKey)(privateKey);
+                }
+                // privateKey is  provided, so check that the public key matches provided private key
+                if (!(0, node_opcua_crypto_1.certificateMatchesPrivateKey)(certificate, privateKey)) {
+                    // certificate doesn't match privateKey
+                    warningLog("certificate doesn't match privateKey");
+                    return { statusCode: node_opcua_basic_types_1.StatusCodes.BadSecurityChecksFailed };
+                }
+                yield preInstallPrivateKey(this);
+                yield preInstallCertificate(this);
+                return {
+                    statusCode: node_opcua_basic_types_1.StatusCodes.Good
+                };
+            }
+            else {
+                // todo !
+                return {
+                    statusCode: node_opcua_basic_types_1.StatusCodes.BadNotSupported
+                };
+            }
+        });
+    }
+    applyChanges() {
+        return __awaiter(this, void 0, void 0, function* () {
+            // ApplyChanges is used to tell the Server to apply any security changes.
+            // This Method should only be called if a previous call to a Method that changed the
+            // configuration returns applyChangesRequired=true.
+            //
+            // If the Server Certificate has changed, Secure Channels using the old Certificate will
+            // eventually be interrupted.
+            this.emit("CertificateAboutToChange", this.$$actionQueue);
+            yield this.flushActionQueue();
+            try {
+                yield this.applyPendingTasks();
+            }
+            catch (err) {
+                debugLog("err ", err);
+                return node_opcua_basic_types_1.StatusCodes.BadInternalError;
+            }
+            this.emit("CertificateChanged", this.$$actionQueue);
+            yield this.flushActionQueue();
+            // The only leeway the Server has is with the timing.
+            // In the best case, the Server can close the TransportConnections for the affected Endpoints and leave any
+            // Subscriptions intact. This should appear no different than a network interruption from the
+            // perspective of the Client. The Client should be prepared to deal with Certificate changes
+            // during its reconnect logic. In the worst case, a full shutdown which affects all connected
+            // Clients will be necessary. In the latter case, the Server shall advertise its intent to interrupt
+            // connections by setting the SecondsTillShutdown and ShutdownReason Properties in the
+            // ServerStatus Variable.
+            // If the Secure Channel being used to call this Method will be affected by the Certificate change
+            // then the Server shall introduce a delay long enough to allow the caller to receive a reply.
+            return node_opcua_basic_types_1.StatusCodes.Good;
+        });
+    }
+    getCertificateManager(certificateGroupId) {
+        const groupName = findCertificateGroupName(certificateGroupId);
+        return this._map[groupName] || null;
+    }
+    addPendingTask(functor) {
+        this._pendingTasks.push(functor);
+    }
+    applyPendingTasks() {
+        var _a, e_1, _b, _c;
+        return __awaiter(this, void 0, void 0, function* () {
+            debugLog("start applyPendingTasks");
+            const promises = [];
+            const t = this._pendingTasks.splice(0);
+            if (false) {
+                try {
+                    // node 10.2 and above
+                    for (var _d = true, t_1 = __asyncValues(t), t_1_1; t_1_1 = yield t_1.next(), _a = t_1_1.done, !_a;) {
+                        _c = t_1_1.value;
+                        _d = false;
+                        try {
+                            const task = _c;
+                            yield task();
+                        }
+                        finally {
+                            _d = true;
+                        }
+                    }
+                }
+                catch (e_1_1) { e_1 = { error: e_1_1 }; }
+                finally {
+                    try {
+                        if (!_d && !_a && (_b = t_1.return)) yield _b.call(t_1);
+                    }
+                    finally { if (e_1) throw e_1.error; }
+                }
+            }
+            else {
+                while (t.length) {
+                    const task = t.shift();
+                    yield task();
+                }
+            }
+            yield Promise.all(promises);
+            debugLog("end applyPendingTasks");
+        });
+    }
+    flushActionQueue() {
+        return __awaiter(this, void 0, void 0, function* () {
+            while (this.$$actionQueue.length) {
+                const first = this.$$actionQueue.pop();
+                yield first();
+            }
+        });
+    }
+}
+exports.PushCertificateManagerServerImpl = PushCertificateManagerServerImpl;
+//# sourceMappingURL=push_certificate_manager_server_impl.js.map

package/dist/server/push_certificate_manager_server_impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"push_certificate_manager_server_impl.js","sourceRoot":"","sources":["../../source/server/push_certificate_manager_server_impl.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;;GAEG;AACH,mCAAsC;AACtC,yBAAyB;AACzB,6BAA6B;AAC7B,mCAAqD;AACrD,+BAAiC;AAEjC,iCAAiC;AAEjC,yDAA2C;AAC3C,mEAAiE;AACjE,yDAW2B;AAI3B,uDAAiG;AACjG,yDAAsE;AACtE,mFAAoE;AAUpE,gFAAgF;AAChF,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC;AAErD,MAAM,QAAQ,GAAG,IAAA,gCAAa,EAAC,qBAAqB,CAAC,CAAC;AACtD,MAAM,QAAQ,GAAG,IAAA,gCAAa,EAAC,qBAAqB,CAAC,CAAC;AACtD,MAAM,UAAU,GAAG,IAAA,kCAAe,EAAC,qBAAqB,CAAC,CAAC;AAC1D,MAAM,OAAO,GAAG,IAAA,iCAAc,EAAC,qBAAqB,CAAC,CAAC;AAEtD,MAAM,uBAAuB,GAAG,IAAA,iCAAa,EAAC,+DAA+D,CAAC,CAAC;AAC/G,MAAM,iBAAiB,GAAG,IAAA,iCAAa,EAAC,yDAAyD,CAAC,CAAC;AACnG,MAAM,qBAAqB,GAAG,IAAA,iCAAa,EAAC,6DAA6D,CAAC,CAAC;AAE3G,SAAS,wBAAwB,CAAC,sBAAuC;IACrE,IAAI,OAAO,sBAAsB,KAAK,QAAQ,EAAE;QAC5C,OAAO,sBAAsB,CAAC;KACjC;IACD,IAAI,IAAA,8BAAU,EAAC,sBAAsB,EAAE,0BAAM,CAAC,UAAU,CAAC,IAAI,IAAA,8BAAU,EAAC,sBAAsB,EAAE,uBAAuB,CAAC,EAAE;QACtH,OAAO,yBAAyB,CAAC;KACpC;IACD,IAAI,IAAA,8BAAU,EAAC,sBAAsB,EAAE,iBAAiB,CAAC,EAAE;QACvD,OAAO,mBAAmB,CAAC;KAC9B;IACD,IAAI,IAAA,8BAAU,EAAC,sBAAsB,EAAE,qBAAqB,CAAC,EAAE;QAC3D,OAAO,uBAAuB,CAAC;KAClC;IACD,OAAO,EAAE,CAAC;AACd,CAAC;AAYD,SAAsB,QAAQ,CAAC,MAAc,EAAE,IAAY;;QACvD,IAAI;YACA,QAAQ,CAAC,yBAAyB,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;YACnE,MAAM,WAAW,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,WAAW,EAAE;gBACb,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;aAC5C;SACJ;QAAC,OAAO,GAAG,EAAE;YACV,QAAQ,CAAC,GAAG,CAAC,CAAC;SACjB;IACL,CAAC;CAAA;AAVD,4BAUC;AAED,SAAsB,UAAU,CAAC,IAAY;;QACzC,IAAI;YACA,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,MAAM,EAAE;gBACR,QAAQ,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;gBACjC,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;aAClC;SACJ;QAAC,OAAO,GAAG,EAAE;YACV,QAAQ,CAAC,GAAG,CAAC,CAAC;SACjB;IACL,CAAC;CAAA;AAVD,gCAUC;AAED,SAAsB,QAAQ,CAAC,MAAc,EAAE,IAAY;;QACvD,QAAQ,CAAC,6BAA6B,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;QACvE,IAAI;YACA,MAAM,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC7B,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;SAC5B;QAAC,OAAO,GAAG,EAAE;YACV,QAAQ,CAAC,GAAG,CAAC,CAAC;SACjB;IACL,CAAC;CAAA;AARD,4BAQC;AAED,SAAsB,kBAAkB,CAAC,MAAc,EAAE,IAAY;;QACjE,0CAA0C;QAC1C,QAAQ,CAAC,oCAAoC,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;QAC9E,MAAM,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAAC,CAAC;QACpC,MAAM,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACjC,CAAC;CAAA;AALD,gDAKC;AAED,SAAgB,eAAe,CAAC,OAAuC;IACnE,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC,IAAI,OAAO,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAEzD,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAClD,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,IAAI,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAE1D,OAAO,CAAC,eAAe,IAAI,CAAC,CAAC,IAAI,OAAO,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAEnE,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IACpD,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC,IAAI,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAE5D,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC,IAAI,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC5D,OAAO,CAAC,gBAAgB,IAAI,CAAC,CAAC,IAAI,MAAM,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAEpE,OAAO,CAAC,oBAAoB,IAAI,CAAC,CAAC,IAAI,OAAO,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IAE7E,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,mBAAmB,IAAI,CAAC,CAAC,IAAI,OAAO,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC;IAE3E,OAAO,CAAC,CAAC;AACb,CAAC;AArBD,0CAqBC;AACD,IAAI,WAAW,GAAG,CAAC,CAAC;AAIpB,MAAa,gCAAiC,SAAQ,qBAAY;IAY9D,YAAY,OAA4C;QACpD,KAAK,EAAE,CAAC;QARK,SAAI,GAA0C,EAAE,CAAC;QACjD,kBAAa,GAAc,EAAE,CAAC;QAEvC,kBAAa,GAAgB,EAAE,CAAC;QAOpC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;QAE5D,IAAI,OAAO,EAAE;YACT,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;YACjD,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;YAC7C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;YACrC,IAAI,IAAI,CAAC,cAAc,EAAE;gBACrB,IAAI,CAAC,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC,cAAc,CAAC;gBAEtD,uBAAuB;gBACvB,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,YAAY,mDAAkB,CAAC,EAAE;oBACtD,QAAQ,CACJ,qEAAqE,EACpE,IAAI,CAAC,cAAsB,CAAC,WAAW,CAAC,IAAI,CAChD,CAAC;oBACF,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;iBACzF;aACJ;YACD,IAAI,IAAI,CAAC,gBAAgB,EAAE;gBACvB,IAAI,CAAC,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC,gBAAgB,CAAC;gBAC1D,IAAA,0BAAM,EAAC,IAAI,CAAC,gBAAgB,YAAY,mDAAkB,CAAC,CAAC;aAC/D;YACD,IAAI,IAAI,CAAC,UAAU,EAAE;gBACjB,IAAI,CAAC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,UAAU,CAAC;gBAC9C,IAAA,0BAAM,EAAC,IAAI,CAAC,UAAU,YAAY,mDAAkB,CAAC,CAAC;aACzD;SACJ;IACL,CAAC;IAEY,UAAU;;YACnB,IAAI,IAAI,CAAC,gBAAgB,EAAE;gBACvB,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,CAAC;aAC5C;YACD,IAAI,IAAI,CAAC,cAAc,EAAE;gBACrB,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,CAAC;aAC1C;YACD,IAAI,IAAI,CAAC,UAAU,EAAE;gBACjB,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;aACtC;QACL,CAAC;KAAA;IAED,IAAW,0BAA0B;QACjC,OAAO,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAEY,6BAA6B;;YACtC,OAAO,IAAI,CAAC,0BAA0B,CAAC;QAC3C,CAAC;KAAA;IAEY,oBAAoB,CAC7B,kBAAmC,EACnC,iBAAkC,EAClC,WAA2C,EAC3C,oBAA8B,EAC9B,KAAc;;YAEd,IAAI,kBAAkB,GAAG,IAAI,CAAC,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;YAExE,IAAI,CAAC,kBAAkB,EAAE;gBACrB,QAAQ,CAAC,qBAAqB,EAAE,kBAAkB,CAAC,CAAC;gBACpD,OAAO;oBACH,UAAU,EAAE,oCAAW,CAAC,kBAAkB;iBAC7C,CAAC;aACL;YAED,IAAI,CAAC,WAAW,EAAE;gBACd,6BAA6B;gBAC7B,MAAM,0BAA0B,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAC;gBACtG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE;oBAC5C,QAAQ,CAAC,yDAAyD,EAAE,0BAA0B,CAAC,CAAC;oBAChG,OAAO;wBACH,UAAU,EAAE,oCAAW,CAAC,eAAe;qBAC1C,CAAC;iBACL;gBACD,MAAM,WAAW,GAAG,IAAA,mCAAe,EAAC,0BAA0B,CAAC,CAAC;gBAChE,MAAM,CAAC,GAAG,IAAA,sCAAkB,EAAC,WAAW,CAAC,CAAC;gBAC1C,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;gBACxD,UAAU,CAAC,gDAAgD,EAAE,WAAW,CAAC,CAAC;aAC7E;YAED,6DAA6D;YAC7D,IAAI,oBAAoB,EAAE;gBACtB,sEAAsE;gBACtE,6EAA6E;gBAC7E,gFAAgF;gBAChF,2CAA2C;gBAE3C,qFAAqF;gBACrF,qCAAqC;gBACrC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE;oBAC7B,IAAA,kCAAe,EACX,uGAAuG,CAC1G,CAAC;oBACF,OAAO;wBACH,UAAU,EAAE,oCAAW,CAAC,kBAAkB;qBAC7C,CAAC;iBACL;gBAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBAC9D,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE;oBACzB,MAAM,IAAA,gBAAS,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;iBAChD;gBACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE;oBAC1B,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;iBACrC;gBAED,MAAM,sBAAsB,GAAG,kBAAkB,CAAC;gBAClD,MAAM,OAAO,GAAI,kBAA0B,CAAC,OAAO,CAAC,CAAC,+BAA+B;gBACpF,kBAAkB,GAAG,IAAI,mDAAkB,CAAC;oBACxC,OAAO;oBACP,QAAQ;iBACX,CAAC,CAAC;gBACH,QAAQ,CAAC,kCAAkC,CAAC,CAAC;gBAC7C,MAAM,kBAAkB,CAAC,UAAU,EAAE,CAAC;gBAEtC,IAAI,CAAC,sBAAsB,GAAG,kBAAkB,CAAC;gBAEjD,IAAI,CAAC,cAAc,CAAC,GAAS,EAAE;oBAC3B,MAAM,kBAAkB,CAAC,kBAAmB,CAAC,UAAU,EAAE,sBAAsB,CAAC,UAAU,CAAC,CAAC;gBAChG,CAAC,CAAA,CAAC,CAAC;gBACH,IAAI,CAAC,cAAc,CAAC,GAAS,EAAE;oBAC3B,MAAM,IAAA,gBAAS,EAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;gBACjD,CAAC,CAAA,CAAC,CAAC;aACN;iBAAM;gBACH,2CAA2C;aAC9C;YAED,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE;gBACjC,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,gBAAgB,EAAE,CAAC;aACvD;YACD,MAAM,OAAO,GAAG;gBACZ,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,OAAO,EAAE,WAAY;aACxB,CAAC;YACF,MAAM,kBAAkB,CAAC,UAAU,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;YAC3E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC/C,MAAM,yBAAyB,GAAG,IAAA,mCAAe,EAAC,MAAM,CAAC,CAAC;YAE1D,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;YAE/C,OAAO;gBACH,yBAAyB;gBACzB,UAAU,EAAE,oCAAW,CAAC,IAAI;aAC/B,CAAC;QACN,CAAC;KAAA;IAEY,eAAe;;YAQxB,qCAAqC;YACrC,SAAe,mBAAmB,CAAC,KAAqC,EAAE,eAA2B;;oBACjG,IAAI,CAAC,KAAK,EAAE;wBACR,OAAO;qBACV;oBACD,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;oBAC5D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC;oBAE5C,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAE9B,MAAM,SAAS,GAAwB,EAAE,CAAC;oBAC1C,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE;wBAC1B,YAAY;wBACZ,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;qBAC7D;oBACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;oBAE3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;wBACnC,eAAe,CAAC,IAAI,CAAC;4BACjB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;4BAC7C,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;yBACjB,CAAC,CAAC;qBACN;gBACL,CAAC;aAAA;YAED,MAAM,IAAI,GAAe,EAAE,CAAC;YAC5B,MAAM,mBAAmB,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;YACvD,MAAM,mBAAmB,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;YACrD,MAAM,mBAAmB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YAEjD,8CAA8C;YAC9C,IAAI,CAAC,IAAI,CAAC,CAAC,CAAW,EAAE,CAAW,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAEzF,MAAM,QAAQ,GAAsB,EAAE,CAAC;YACvC,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE;gBACrB,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;aAClD;YACD,MAAM,eAAe,GAAa,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAE9D,MAAM,YAAY,GAAa,eAAe,CAAC,GAAG,CAAC,mCAAe,CAAC,CAAC;YACpE,OAAO;gBACH,YAAY;gBACZ,UAAU,EAAE,oCAAW,CAAC,IAAI;aAC/B,CAAC;QACN,CAAC;KAAA;IAQD,0CAA0C;IAC7B,iBAAiB,CAC1B,kBAAmC,EACnC,iBAAkC,EAClC,WAAmB,EACnB,kBAAgC,EAChC,gBAAyB,EACzB,UAAyC;;YAEzC,yCAAyC;YACzC,sFAAsF;YACtF,uFAAuF;YACvF,sFAAsF;YACtF,gFAAgF;YAChF,8FAA8F;YAC9F,MAAM,kBAAkB,GAAG,IAAI,CAAC,qBAAqB,CAAC,kBAAkB,CAAE,CAAC;YAE3E,IAAI,CAAC,kBAAkB,EAAE;gBACrB,QAAQ,CAAC,qBAAqB,EAAE,kBAAkB,CAAC,CAAC;gBACpD,OAAO;oBACH,UAAU,EAAE,oCAAW,CAAC,kBAAkB;iBAC7C,CAAC;aACL;YAED,SAAe,qBAAqB,CAAC,IAAsC;;oBACvE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;oBACtE,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,uBAAuB,WAAW,EAAE,MAAM,CAAC,CAAC;oBAC7F,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,uBAAuB,WAAW,EAAE,MAAM,CAAC,CAAC;oBAE7F,MAAM,SAAS,CAAC,kBAAkB,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;oBAC3D,MAAM,SAAS,CAAC,kBAAkB,EAAE,IAAA,yBAAK,EAAC,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;oBAEvE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;oBACzD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;oBAEzD,mDAAmD;oBACnD,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC,CAAC;oBAC3E,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC/E,CAAC;aAAA;YAED,SAAe,oBAAoB,CAAC,IAAsC;;oBACtE,IAAA,0BAAM,EAAC,gBAAiB,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;oBAElD,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;oBAC9E,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,uBAAuB,WAAW,EAAE,MAAM,CAAC,CAAC;oBAElG,MAAM,aAAa,GAAG,IAAA,yBAAK,EAAC,UAAW,EAAE,iBAAiB,CAAC,CAAC;oBAC5D,MAAM,SAAS,CAAC,iBAAiB,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;oBAE3D,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,CAAC,kBAAkB,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC;gBACpG,CAAC;aAAA;YAED,qDAAqD;YACrD,EAAE;YACF,kEAAkE;YAClE,2DAA2D;YAC3D,EAAE;YACF,wFAAwF;YACxF,mDAAmD;YACnD,0FAA0F;YAC1F,uBAAuB;YACvB,6FAA6F;YAC7F,mDAAmD;YAEnD,2FAA2F;YAC3F,+EAA+E;YAC/E,uDAAuD;YACvD,MAAM,QAAQ,GAAG,IAAA,sCAAkB,EAAC,WAAW,CAAC,CAAC;YAEjD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,EAAE;gBACtE,+BAA+B;gBAC/B,UAAU,CACN,4CAA4C,EAC5C,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW,EAAE,EACxD,QAAQ,EACR,GAAG,CAAC,WAAW,EAAE,CACpB,CAAC;gBACF,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,uBAAuB,EAAE,CAAC;aAC9D;YACD,IAAI,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,EAAE;gBACrE,qCAAqC;gBACrC,UAAU,CACN,iDAAiD,EACjD,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,EACvD,QAAQ,EACR,GAAG,CAAC,WAAW,EAAE,CACpB,CAAC;gBACF,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,uBAAuB,EAAE,CAAC;aAC9D;YAED,4FAA4F;YAC5F,kEAAkE;YAElE,QAAQ,CAAC,qBAAqB,EAAE,IAAA,sCAAkB,EAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YAEjF,IAAI,CAAC,gBAAgB,IAAI,CAAC,UAAU,EAAE;gBAClC,uDAAuD;gBACvD,uFAAuF;gBACvF,wBAAwB;gBACxB,MAAM,aAAa,GAAG,IAAA,kCAAc,EAChC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC,UAAU,CACvG,CAAC;gBAEF,iGAAiG;gBACjG,mCAAmC;gBACnC,4FAA4F;gBAC5F,IAAI,CAAC,IAAA,gDAA4B,EAAC,WAAW,EAAE,aAAa,CAAC,EAAE;oBAC3D,uCAAuC;oBACvC,UAAU,CAAC,sCAAsC,CAAC,CAAC;oBACnD,gBAAgB;oBAChB,MAAM,cAAc,GAAG,IAAA,yBAAK,EAAC,WAAW,EAAE,aAAa,CAAC,CAAC;oBACzD,MAAM,aAAa,GAAG,IAAA,yBAAK,EAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;oBAC9D,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;oBACjD,MAAM,eAAe,GAAG,IAAA,sCAAkB,EAAC,aAAa,EAAE,cAAc,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;oBACnF,MAAM,eAAe,GAAG,IAAA,uCAAmB,EAAC,eAAe,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;oBACjF,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;oBAC5B,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;oBAC3B,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;oBACnE,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,uBAAuB,EAAE,CAAC;iBAC9D;gBACD,wCAAwC;gBACxC,0BAA0B;gBAC1B,2BAA2B;gBAC3B,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC;gBAElC,OAAO;oBACH,UAAU,EAAE,oCAAW,CAAC,IAAI;iBAC/B,CAAC;aACL;iBAAM,IAAI,UAAU,EAAE;gBACnB,kDAAkD;gBAClD,IAAI,CAAC,gBAAgB,EAAE;oBACnB,UAAU,CAAC,yCAAyC,GAAG,gBAAgB,CAAC,CAAC;oBACzE,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,eAAe,EAAE,CAAC;iBACtD;gBACD,IAAI,gBAAgB,KAAK,KAAK,IAAI,gBAAgB,KAAK,KAAK,EAAE;oBAC1D,UAAU,CAAC,uDAAuD,GAAG,gBAAgB,CAAC,CAAC;oBACvF,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,eAAe,EAAE,CAAC;iBACtD;gBACD,IAAI,gBAAgB,KAAK,KAAK,EAAE;oBAC5B,UAAU,CAAC,oEAAoE,GAAG,gBAAgB,CAAC,CAAC;oBACpG,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,eAAe,EAAE,CAAC;iBACtD;gBAED,IAAI,UAAU,YAAY,MAAM,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE;oBAChE,UAAU,GAAG,IAAA,yBAAgB,EAAC,UAAU,CAAC,CAAC;iBAC7C;gBACD,qFAAqF;gBACrF,IAAI,CAAC,IAAA,gDAA4B,EAAC,WAAW,EAAE,UAAU,CAAC,EAAE;oBACxD,uCAAuC;oBACvC,UAAU,CAAC,sCAAsC,CAAC,CAAC;oBACnD,OAAO,EAAE,UAAU,EAAE,oCAAW,CAAC,uBAAuB,EAAE,CAAC;iBAC9D;gBAED,MAAM,oBAAoB,CAAC,IAAI,CAAC,CAAC;gBAEjC,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC;gBAElC,OAAO;oBACH,UAAU,EAAE,oCAAW,CAAC,IAAI;iBAC/B,CAAC;aACL;iBAAM;gBACH,SAAS;gBACT,OAAO;oBACH,UAAU,EAAE,oCAAW,CAAC,eAAe;iBAC1C,CAAC;aACL;QACL,CAAC;KAAA;IAEY,YAAY;;YACrB,yEAAyE;YACzE,oFAAoF;YACpF,mDAAmD;YACnD,EAAE;YACF,wFAAwF;YACxF,6BAA6B;YAE7B,IAAI,CAAC,IAAI,CAAC,0BAA0B,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YAC1D,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAE9B,IAAI;gBACA,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;aAClC;YAAC,OAAO,GAAG,EAAE;gBACV,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;gBACtB,OAAO,oCAAW,CAAC,gBAAgB,CAAC;aACvC;YACD,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;YACpD,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAE9B,qDAAqD;YACrD,2GAA2G;YAC3G,6FAA6F;YAC7F,4FAA4F;YAC5F,6FAA6F;YAC7F,oGAAoG;YACpG,sFAAsF;YACtF,yBAAyB;YAEzB,kGAAkG;YAClG,8FAA8F;YAC9F,OAAO,oCAAW,CAAC,IAAI,CAAC;QAC5B,CAAC;KAAA;IAEO,qBAAqB,CAAC,kBAAmC;QAC7D,MAAM,SAAS,GAAG,wBAAwB,CAAC,kBAAkB,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;IACxC,CAAC;IAEO,cAAc,CAAC,OAA4B;QAC/C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAEa,iBAAiB;;;YAC3B,QAAQ,CAAC,yBAAyB,CAAC,CAAC;YACpC,MAAM,QAAQ,GAAoB,EAAE,CAAC;YACrC,MAAM,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAEvC,IAAI,KAAK,EAAE;;oBACP,sBAAsB;oBACtB,KAAyB,eAAA,MAAA,cAAA,CAAC,CAAA,OAAA;wBAAD,iBAAC;wBAAD,WAAC;;4BAAf,MAAM,IAAI,KAAA,CAAA;4BACjB,MAAM,IAAI,EAAE,CAAC;;;;;qBAChB;;;;;;;;;aACJ;iBAAM;gBACH,OAAO,CAAC,CAAC,MAAM,EAAE;oBACb,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,EAAG,CAAC;oBACxB,MAAM,IAAI,EAAE,CAAC;iBAChB;aACJ;YACD,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC5B,QAAQ,CAAC,uBAAuB,CAAC,CAAC;;KACrC;IAEa,gBAAgB;;YAC1B,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE;gBAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,EAAG,CAAC;gBACxC,MAAM,KAAM,EAAE,CAAC;aAClB;QACL,CAAC;KAAA;CACJ;AA5cD,4EA4cC"}

package/dist/server/roles_and_permissions.d.ts

@@ -0,0 +1,3 @@
+import { RolePermissionTypeOptions } from "node-opcua-address-space";
+export declare const rolePermissionRestricted: RolePermissionTypeOptions[];
+export declare const rolePermissionAdminOnly: RolePermissionTypeOptions[];

package/dist/server/roles_and_permissions.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rolePermissionAdminOnly = exports.rolePermissionRestricted = void 0;
+const node_opcua_address_space_1 = require("node-opcua-address-space");
+const node_opcua_data_model_1 = require("node-opcua-data-model");
+exports.rolePermissionRestricted = [
+    {
+        roleId: node_opcua_address_space_1.WellKnownRoles.Anonymous,
+        permissions: node_opcua_address_space_1.PermissionType.Browse,
+    },
+    {
+        roleId: node_opcua_address_space_1.WellKnownRoles.AuthenticatedUser,
+        permissions: node_opcua_address_space_1.PermissionType.Browse,
+    },
+    {
+        roleId: node_opcua_address_space_1.WellKnownRoles.ConfigureAdmin,
+        permissions: (0, node_opcua_data_model_1.makePermissionFlag)("Browse | ReadRolePermissions | Read | ReadHistory | ReceiveEvents")
+    },
+    {
+        roleId: node_opcua_address_space_1.WellKnownRoles.SecurityAdmin,
+        permissions: node_opcua_data_model_1.allPermissions
+    },
+];
+exports.rolePermissionAdminOnly = [
+    {
+        roleId: node_opcua_address_space_1.WellKnownRoles.SecurityAdmin,
+        permissions: node_opcua_data_model_1.allPermissions
+    },
+    /*   {
+           roleId: WellKnownRoles.Anonymous,
+           permissions: PermissionType.Browse
+       },
+       {
+           roleId: WellKnownRoles.AuthenticatedUser,
+           permissions: PermissionType.Browse
+       }
+    */
+];
+//# sourceMappingURL=roles_and_permissions.js.map

package/dist/server/roles_and_permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles_and_permissions.js","sourceRoot":"","sources":["../../source/server/roles_and_permissions.ts"],"names":[],"mappings":";;;AAAA,uEAAqG;AACrG,iEAA2E;AAE9D,QAAA,wBAAwB,GAAgC;IAEjE;QACI,MAAM,EAAE,yCAAc,CAAC,SAAS;QAChC,WAAW,EAAE,yCAAc,CAAC,MAAM;KACrC;IACD;QACI,MAAM,EAAE,yCAAc,CAAC,iBAAiB;QACxC,WAAW,EAAE,yCAAc,CAAC,MAAM;KACrC;IACD;QACI,MAAM,EAAE,yCAAc,CAAC,cAAc;QACrC,WAAW,EAAE,IAAA,0CAAkB,EAAC,mEAAmE,CAAC;KACvG;IACD;QACI,MAAM,EAAE,yCAAc,CAAC,aAAa;QACpC,WAAW,EAAE,sCAAc;KAC9B;CACJ,CAAC;AACW,QAAA,uBAAuB,GAAgC;IAChE;QACI,MAAM,EAAE,yCAAc,CAAC,aAAa;QACpC,WAAW,EAAE,sCAAc;KAC9B;IACJ;;;;;;;;MAQE;CACF,CAAC"}

package/dist/server/tools.d.ts

@@ -0,0 +1,3 @@
+import { ISessionContext } from "node-opcua-address-space";
+export declare function hasExpectedUserAccess(context: ISessionContext): boolean;
+export declare function hasEncryptedChannel(context: ISessionContext): boolean;