node-opcua-server 2.164.2 → 2.165.1

package/dist/base_server.d.ts

@@ -1,13 +1,14 @@
-import { OPCUACertificateManager } from "node-opcua-certificate-manager";
-import { IOPCUASecureObjectOptions, OPCUASecureObject } from "node-opcua-common";
-import { Message, ServerSecureChannelLayer } from "node-opcua-secure-channel";
-import { ApplicationType } from "node-opcua-service-endpoints";
-import { ApplicationDescription } from "node-opcua-service-endpoints";
+/**
+ * @module node-opcua-server
+ */
+import { type OPCUACertificateManager } from "node-opcua-certificate-manager";
+import { type IOPCUASecureObjectOptions, OPCUASecureObject } from "node-opcua-common";
+import type { Message, ServerSecureChannelLayer } from "node-opcua-secure-channel";
+import { ApplicationDescription, ApplicationType } from "node-opcua-service-endpoints";
 import { ServiceFault } from "node-opcua-service-secure-channel";
-import { StatusCode } from "node-opcua-status-code";
-import { ApplicationDescriptionOptions } from "node-opcua-types";
-import { EndpointDescription } from "node-opcua-types";
-import { OPCUAServerEndPoint } from "./server_end_point";
+import { type StatusCode } from "node-opcua-status-code";
+import type { ApplicationDescriptionOptions, EndpointDescription } from "node-opcua-types";
+import type { OPCUAServerEndPoint } from "./server_end_point";
 /**
  *
  */
@@ -31,21 +32,88 @@ export declare class OPCUABaseServer extends OPCUASecureObject {
     endpoints: OPCUAServerEndPoint[];
     readonly serverCertificateManager: OPCUACertificateManager;
     capabilitiesForMDNS: string[];
-    protected _preInitTask: any[];
+    protected _preInitTask: (() => Promise<void>)[];
     protected options: OPCUABaseServerOptions;
     constructor(options?: OPCUABaseServerOptions);
+    /**
+     * Return additional DNS hostnames to include in the self-signed
+     * certificate's SubjectAlternativeName (SAN).
+     *
+     * The base implementation returns an empty array. Subclasses
+     * (e.g. `OPCUAServer`) override this to include hostnames from
+     * `alternateHostname` and `advertisedEndpoints`.
+     *
+     * @internal
+     */
+    protected getConfiguredHostnames(): string[];
+    /**
+     * Return additional IP addresses to include in the self-signed
+     * certificate's SubjectAlternativeName (SAN) iPAddress entries.
+     *
+     * The base implementation returns an empty array. Subclasses
+     * (e.g. `OPCUAServer`) override this to include IP literals
+     * found in `alternateHostname` and `advertisedEndpoints`.
+     *
+     * These IPs are considered **explicitly configured** by the
+     * user and are therefore checked by `checkCertificateSAN()`.
+     * In contrast, auto-detected IPs from `getIpAddresses()` are
+     * included in the certificate at creation time but are NOT
+     * checked later — see `checkCertificateSAN()` for rationale.
+     *
+     * @internal
+     */
+    protected getConfiguredIPs(): string[];
     protected createDefaultCertificate(): Promise<void>;
     initializeCM(): Promise<void>;
+    /**
+     * Compare the current certificate's SAN entries against all
+     * explicitly configured hostnames and IPs, and return any
+     * that are missing.
+     *
+     * Returns an empty array when the certificate covers every
+     * configured hostname and IP.
+     *
+     * **Important — ephemeral IP mitigation:**
+     * Auto-detected IPs (from `getIpAddresses()`) are deliberately
+     * NOT included in this check. Network interfaces are transient
+     * — WiFi IPs change on reconnect, tethering IPs appear/disappear,
+     * VPN adapters come and go. Including them would cause the
+     * `[NODE-OPCUA-W26]` warning to fire on every server restart
+     * whenever the network state differs from when the certificate
+     * was originally created.
+     *
+     * Only **explicitly configured** values are checked:
+     * - Hostnames: FQDN, os.hostname(), `alternateHostname` (non-IP),
+     *   hostnames from `advertisedEndpoints` URLs
+     * - IPs: IP literals from `alternateHostname`, IP literals
+     *   from `advertisedEndpoints` URLs
+     *
+     * The certificate itself still includes auto-detected IPs at
+     * creation time — this is fine because it captures the network
+     * state at that moment. But the *mismatch warning* only fires
+     * for things the user explicitly asked for.
+     */
+    checkCertificateSAN(): string[];
+    /**
+     * Delete the existing self-signed certificate and create a new
+     * one that includes all currently configured hostnames.
+     *
+     * @throws if the current certificate was NOT self-signed
+     *         (i.e. issued by a CA or GDS)
+     */
+    regenerateSelfSignedCertificate(): Promise<void>;
+    private _checkCertificateSanMismatch;
     /**
      * start all registered endPoint, in parallel, and call done when all endPoints are listening.
      */
-    start(done: (err?: Error | null) => void): void;
+    start(): Promise<void>;
+    start(done: () => void): void;
     protected performPreInitialization(): Promise<void>;
     protected startAsync(): Promise<void>;
     /**
      * shutdown all server endPoints
      */
-    shutdown(done: (err?: Error) => void): void;
+    shutdown(done: (err?: Error | null) => void): void;
     shutdownChannels(): Promise<void>;
     shutdownChannels(callback: (err?: Error | null) => void): void;
     /**
@@ -53,15 +121,24 @@ export declare class OPCUABaseServer extends OPCUASecureObject {
      */
     on_request(message: Message, channel: ServerSecureChannelLayer): void;
     /**
-     * @private
+     * Find endpoint descriptions matching a given endpoint URL.
+     *
+     * When `endpointUrl` is provided, only endpoints whose URL matches
+     * (case-insensitive) are returned. When `null` or omitted, all
+     * endpoints from every `OPCUAServerEndPoint` are returned.
+     *
+     * This is the shared resolution path used by both `GetEndpoints`
+     * and `CreateSession` (`validate_security_endpoint`).
+     *
+     * @internal (was _get_endpoints)
      */
-    _get_endpoints(endpointUrl?: string | null): EndpointDescription[];
+    findMatchingEndpoints(endpointUrl?: string | null): EndpointDescription[];
     /**
      * get one of the possible endpointUrl
      */
     getEndpointUrl(): string;
     getDiscoveryUrls(): string[];
-    getServers(channel: ServerSecureChannelLayer): ApplicationDescription[];
+    getServers(_channel: ServerSecureChannelLayer): ApplicationDescription[];
     /**
      * set all the end point into a state where they do not accept further connections
      *
@@ -70,15 +147,15 @@ export declare class OPCUABaseServer extends OPCUASecureObject {
      *
      */
     suspendEndPoints(): Promise<void>;
-    suspendEndPoints(callback: (err?: Error) => void): void;
+    suspendEndPoints(callback: (err?: Error | null) => void): void;
     /**
      * set all the end point into a state where they do accept connections
      * note:
      *    this method is useful for testing purpose
      */
     resumeEndPoints(): Promise<void>;
-    resumeEndPoints(callback: (err?: Error) => void): void;
-    protected prepare(message: Message, channel: ServerSecureChannelLayer): void;
+    resumeEndPoints(callback: (err?: Error | null) => void): void;
+    protected prepare(_message: Message, _channel: ServerSecureChannelLayer): void;
     /**
      * @private
      */

package/dist/base_server.js

@@ -1,43 +1,42 @@
 "use strict";
+/**
+ * @module node-opcua-server
+ */
+// tslint:disable:no-console
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OPCUABaseServer = void 0;
-/**
- * @module node-opcua-server
- */
-// tslint:disable:no-console
-const fs_1 = __importDefault(require("fs"));
-const path_1 = __importDefault(require("path"));
-const os_1 = __importDefault(require("os"));
-const util_1 = require("util");
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_os_1 = __importDefault(require("node:os"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_net_1 = require("node:net");
+const global_mutex_1 = require("@ster5/global-mutex");
 const async_1 = __importDefault(require("async"));
 const chalk_1 = __importDefault(require("chalk"));
 const node_opcua_assert_1 = require("node-opcua-assert");
-const global_mutex_1 = require("@ster5/global-mutex");
 const node_opcua_certificate_manager_1 = require("node-opcua-certificate-manager");
+const node_opcua_client_1 = require("node-opcua-client");
 const node_opcua_common_1 = require("node-opcua-common");
+const web_1 = require("node-opcua-crypto/web");
 const node_opcua_data_model_1 = require("node-opcua-data-model");
 const node_opcua_date_time_1 = require("node-opcua-date-time");
 const node_opcua_debug_1 = require("node-opcua-debug");
-const node_opcua_debug_2 = require("node-opcua-debug");
 const node_opcua_hostname_1 = require("node-opcua-hostname");
 const node_opcua_service_discovery_1 = require("node-opcua-service-discovery");
 const node_opcua_service_endpoints_1 = require("node-opcua-service-endpoints");
-const node_opcua_service_endpoints_2 = require("node-opcua-service-endpoints");
 const node_opcua_service_secure_channel_1 = require("node-opcua-service-secure-channel");
 const node_opcua_status_code_1 = require("node-opcua-status-code");
 const node_opcua_utils_1 = require("node-opcua-utils");
-const node_opcua_client_1 = require("node-opcua-client");
 const doDebug = (0, node_opcua_debug_1.checkDebugFlag)(__filename);
 const debugLog = (0, node_opcua_debug_1.make_debugLog)(__filename);
 const errorLog = (0, node_opcua_debug_1.make_errorLog)(__filename);
-const warningLog = errorLog;
+const warningLog = (0, node_opcua_debug_1.make_warningLog)(__filename);
 const default_server_info = {
     // The globally unique identifier for the application instance. This URI is used as
     // ServerUri in Services if the application is a Server.
-    applicationUri: (0, node_opcua_common_1.makeApplicationUrn)(os_1.default.hostname(), "NodeOPCUA-Server"),
+    applicationUri: (0, node_opcua_common_1.makeApplicationUrn)(node_os_1.default.hostname(), "NodeOPCUA-Server"),
     // The globally unique identifier for the product.
     productUri: "NodeOPCUA-Server",
     // A localized descriptive name for the application.
@@ -93,7 +92,7 @@ class OPCUABaseServer extends node_opcua_common_1.OPCUASecureObject {
         }
         options.privateKeyFile = options.privateKeyFile || options.serverCertificateManager.privateKey;
         options.certificateFile =
-            options.certificateFile || path_1.default.join(options.serverCertificateManager.rootDir, "own/certs/certificate.pem");
+            options.certificateFile || node_path_1.default.join(options.serverCertificateManager.rootDir, "own/certs/certificate.pem");
         super(options);
         this.serverCertificateManager = options.serverCertificateManager;
         this.capabilitiesForMDNS = [];
@@ -105,49 +104,86 @@ class OPCUABaseServer extends node_opcua_common_1.OPCUASecureObject {
             ...options.serverInfo
         };
         serverInfo.applicationName = (0, node_opcua_data_model_1.coerceLocalizedText)(serverInfo.applicationName);
-        this.serverInfo = new node_opcua_service_endpoints_2.ApplicationDescription(serverInfo);
+        this.serverInfo = new node_opcua_service_endpoints_1.ApplicationDescription(serverInfo);
         if (this.serverInfo.applicationName.toString().match(/urn:/)) {
             errorLog("[NODE-OPCUA-E06] application name cannot be a urn", this.serverInfo.applicationName.toString());
         }
-        this.serverInfo.applicationName.locale = this.serverInfo.applicationName?.locale || "en";
-        if (!this.serverInfo.applicationName?.locale) {
+        this.serverInfo.applicationName.locale = this.serverInfo.applicationName.locale || "en";
+        if (!this.serverInfo.applicationName.locale) {
             warningLog("[NODE-OPCUA-W24] the server applicationName must have a valid locale : ", this.serverInfo.applicationName.toString());
         }
         const __applicationUri = serverInfo.applicationUri || "";
-        this.serverInfo.__defineGetter__("applicationUri", () => (0, node_opcua_hostname_1.resolveFullyQualifiedDomainName)(__applicationUri));
+        Object.defineProperty(this.serverInfo, "applicationUri", {
+            get: () => (0, node_opcua_hostname_1.resolveFullyQualifiedDomainName)(__applicationUri),
+            configurable: true
+        });
         this._preInitTask.push(async () => {
-            const fqdn = await (0, node_opcua_hostname_1.extractFullyQualifiedDomainName)();
+            await (0, node_opcua_hostname_1.extractFullyQualifiedDomainName)();
         });
         this._preInitTask.push(async () => {
             await this.initializeCM();
         });
     }
+    /**
+     * Return additional DNS hostnames to include in the self-signed
+     * certificate's SubjectAlternativeName (SAN).
+     *
+     * The base implementation returns an empty array. Subclasses
+     * (e.g. `OPCUAServer`) override this to include hostnames from
+     * `alternateHostname` and `advertisedEndpoints`.
+     *
+     * @internal
+     */
+    getConfiguredHostnames() {
+        return [];
+    }
+    /**
+     * Return additional IP addresses to include in the self-signed
+     * certificate's SubjectAlternativeName (SAN) iPAddress entries.
+     *
+     * The base implementation returns an empty array. Subclasses
+     * (e.g. `OPCUAServer`) override this to include IP literals
+     * found in `alternateHostname` and `advertisedEndpoints`.
+     *
+     * These IPs are considered **explicitly configured** by the
+     * user and are therefore checked by `checkCertificateSAN()`.
+     * In contrast, auto-detected IPs from `getIpAddresses()` are
+     * included in the certificate at creation time but are NOT
+     * checked later — see `checkCertificateSAN()` for rationale.
+     *
+     * @internal
+     */
+    getConfiguredIPs() {
+        return [];
+    }
     async createDefaultCertificate() {
-        if (fs_1.default.existsSync(this.certificateFile)) {
+        if (node_fs_1.default.existsSync(this.certificateFile)) {
             return;
         }
-        // collect all hostnames
-        const hostnames = [];
-        for (const e of this.endpoints) {
-            for (const ee of e.endpointDescriptions()) {
-                /* to do */
-            }
-        }
         if (!(0, node_opcua_utils_1.checkFileExistsAndIsNotEmpty)(this.certificateFile)) {
-            await (0, global_mutex_1.withLock)({ fileToLock: this.certificateFile + ".mutex" }, async () => {
+            await (0, global_mutex_1.withLock)({ fileToLock: `${this.certificateFile}.mutex` }, async () => {
                 if ((0, node_opcua_utils_1.checkFileExistsAndIsNotEmpty)(this.certificateFile)) {
                     return;
                 }
-                const applicationUri = this.serverInfo.applicationUri;
+                const applicationUri = this.serverInfo.applicationUri || "<missing application uri>";
                 const fqdn = (0, node_opcua_hostname_1.getFullyQualifiedDomainName)();
                 const hostname = (0, node_opcua_hostname_1.getHostname)();
-                const dns = [...new Set([fqdn, hostname])];
+                const dns = [...new Set([fqdn, hostname, ...this.getConfiguredHostnames()])].sort();
+                // Include both auto-detected IPs and explicitly configured IPs.
+                // Auto-detected IPs (getIpAddresses) are ephemeral — they depend on
+                // the current network state (WiFi, tethering, VPN, roaming) and may
+                // change between reboots. They are included here so that the initial
+                // certificate covers the current network configuration, but they are
+                // NOT checked by checkCertificateSAN() to avoid noisy warnings when
+                // the network changes. Only explicitly configured IPs (from
+                // alternateHostname / advertisedEndpoints) are checked at startup.
+                const ip = [...new Set([...(0, node_opcua_hostname_1.getIpAddresses)(), ...this.getConfiguredIPs()])].sort();
                 await this.serverCertificateManager.createSelfSignedCertificate({
                     applicationUri,
                     dns,
-                    // ip: await getIpAddresses(),
+                    ip,
                     outputFile: this.certificateFile,
-                    subject: (0, node_opcua_certificate_manager_1.makeSubject)(this.serverInfo.applicationName.text, hostname),
+                    subject: (0, node_opcua_certificate_manager_1.makeSubject)(this.serverInfo.applicationName.text || "<missing application name>", hostname),
                     startDate: new Date(),
                     validity: 365 * 10 // 10 years
                 });
@@ -159,16 +195,114 @@ class OPCUABaseServer extends node_opcua_common_1.OPCUASecureObject {
         await this.createDefaultCertificate();
         debugLog("privateKey      = ", this.privateKeyFile, this.serverCertificateManager.privateKey);
         debugLog("certificateFile = ", this.certificateFile);
-        await (0, node_opcua_client_1.performCertificateSanityCheck)(this, "server", this.serverCertificateManager, this.serverInfo.applicationUri);
+        this._checkCertificateSanMismatch();
+        await (0, node_opcua_client_1.performCertificateSanityCheck)(this, "server", this.serverCertificateManager, this.serverInfo.applicationUri || "");
     }
     /**
-     * start all registered endPoint, in parallel, and call done when all endPoints are listening.
+     * Compare the current certificate's SAN entries against all
+     * explicitly configured hostnames and IPs, and return any
+     * that are missing.
+     *
+     * Returns an empty array when the certificate covers every
+     * configured hostname and IP.
+     *
+     * **Important — ephemeral IP mitigation:**
+     * Auto-detected IPs (from `getIpAddresses()`) are deliberately
+     * NOT included in this check. Network interfaces are transient
+     * — WiFi IPs change on reconnect, tethering IPs appear/disappear,
+     * VPN adapters come and go. Including them would cause the
+     * `[NODE-OPCUA-W26]` warning to fire on every server restart
+     * whenever the network state differs from when the certificate
+     * was originally created.
+     *
+     * Only **explicitly configured** values are checked:
+     * - Hostnames: FQDN, os.hostname(), `alternateHostname` (non-IP),
+     *   hostnames from `advertisedEndpoints` URLs
+     * - IPs: IP literals from `alternateHostname`, IP literals
+     *   from `advertisedEndpoints` URLs
+     *
+     * The certificate itself still includes auto-detected IPs at
+     * creation time — this is fine because it captures the network
+     * state at that moment. But the *mismatch warning* only fires
+     * for things the user explicitly asked for.
      */
-    start(done) {
-        (0, node_opcua_assert_1.assert)(typeof done === "function");
-        this.startAsync()
-            .then(() => done(null))
-            .catch((err) => done(err));
+    checkCertificateSAN() {
+        const certDer = this.getCertificate();
+        const info = (0, web_1.exploreCertificate)(certDer);
+        const sanDns = info.tbsCertificate.extensions?.subjectAltName?.dNSName || [];
+        const sanIpsHex = info.tbsCertificate.extensions?.subjectAltName?.iPAddress || [];
+        const fqdn = (0, node_opcua_hostname_1.getFullyQualifiedDomainName)();
+        const hostname = (0, node_opcua_hostname_1.getHostname)();
+        const expectedDns = [...new Set([fqdn, hostname, ...this.getConfiguredHostnames()])].sort();
+        // Only check explicitly configured IPs — NOT auto-detected ones.
+        // See JSDoc above for the rationale (ephemeral network interfaces).
+        const expectedIps = [...new Set(this.getConfiguredIPs())].sort();
+        const missingDns = expectedDns.filter((name) => !sanDns.includes(name));
+        // exploreCertificate returns iPAddress entries as hex strings
+        // Only IPv4 addresses can be converted with ipv4ToHex here; IPv6 (and invalid) IPs are skipped.
+        const missingIps = expectedIps.filter((ip) => {
+            const family = (0, node_net_1.isIP)(ip);
+            if (family === 4) {
+                return !sanIpsHex.includes((0, node_opcua_hostname_1.ipv4ToHex)(ip));
+            }
+            // IPv6 or invalid literals are currently not matched against SAN iPAddress entries here.
+            return false;
+        });
+        return [...missingDns, ...missingIps];
+    }
+    /**
+     * Delete the existing self-signed certificate and create a new
+     * one that includes all currently configured hostnames.
+     *
+     * @throws if the current certificate was NOT self-signed
+     *         (i.e. issued by a CA or GDS)
+     */
+    async regenerateSelfSignedCertificate() {
+        // guard: only allow regeneration of self-signed certs
+        const certDer = this.getCertificate();
+        const info = (0, web_1.exploreCertificate)(certDer);
+        const issuer = info.tbsCertificate.issuer;
+        const subject = info.tbsCertificate.subject;
+        const isSelfSigned = issuer.commonName === subject.commonName && issuer.organizationName === subject.organizationName;
+        if (!isSelfSigned) {
+            throw new Error("Cannot regenerate certificate: current certificate is not self-signed (issued by a CA or GDS)");
+        }
+        // delete old cert
+        if (node_fs_1.default.existsSync(this.certificateFile)) {
+            node_fs_1.default.unlinkSync(this.certificateFile);
+        }
+        // recreate with current hostnames
+        await this.createDefaultCertificate();
+        // invalidate cached cert so next getCertificate() reloads from disk
+        const priv = this;
+        priv.$$certificate = null;
+        priv.$$certificateChain = null;
+    }
+    _checkCertificateSanMismatch() {
+        try {
+            const missing = this.checkCertificateSAN();
+            if (missing.length > 0) {
+                warningLog(`[NODE-OPCUA-W26] Certificate SAN is missing the following configured hostnames/IPs: ${missing.join(", ")}. ` +
+                    "Clients with strict certificate validation may reject connections for these entries. " +
+                    "Use server.regenerateSelfSignedCertificate() to fix this.");
+            }
+        }
+        catch (_err) {
+            // ignore errors during SAN check (e.g. cert not yet loaded)
+        }
+    }
+    start(...args) {
+        const callback = args[0];
+        if (!callback || args.length === 0) {
+            return this.startAsync();
+        }
+        else {
+            this.startAsync()
+                .then(() => {
+                callback();
+            })
+                .catch((err) => callback(err));
+        }
     }
     async performPreInitialization() {
         const tasks = this._preInitTask;
@@ -230,6 +364,9 @@ class OPCUABaseServer extends node_opcua_common_1.OPCUASecureObject {
     }
     shutdownChannels(callback) {
         (0, node_opcua_assert_1.assert)(typeof callback === "function");
+        // c8 ignore next
+        if (!callback)
+            throw new Error("thenify is not available");
         debugLog("OPCUABaseServer#shutdownChannels");
         async_1.default.forEach(this.endpoints, (endpoint, inner_callback) => {
             debugLog(" shutting down endpoint ", endpoint.endpointDescriptions()[0].endpointUrl);
@@ -256,7 +393,7 @@ class OPCUABaseServer extends node_opcua_common_1.OPCUASecureObject {
         const request = message.request;
         // install channel._on_response so we can intercept its call and  emit the "response" event.
         if (!channel._on_response) {
-            channel._on_response = (msg, response1 /*, inner_message: Message*/) => {
+            channel._on_response = (_msg, response1 /*, inner_message: Message*/) => {
                 this.emit("response", response1, channel);
             };
         }
@@ -270,13 +407,12 @@ class OPCUABaseServer extends node_opcua_common_1.OPCUASecureObject {
         this.emit("request", request, channel);
         try {
             // handler must be named _on_ActionRequest()
-            const handler = this["_on_" + request.schema.name];
+            const handler = this[`_on_${request.schema.name}`];
             if (typeof handler === "function") {
-                // eslint-disable-next-line prefer-rest-params
-                handler.apply(this, arguments);
+                handler.call(this, message, channel);
             }
             else {
-                errMessage = "[NODE-OPCUA-W07] Unsupported Service : " + request.schema.name;
+                errMessage = `[NODE-OPCUA-W07] Unsupported Service : ${request.schema.name}`;
                 warningLog(errMessage);
                 debugLog(chalk_1.default.red.bold(errMessage));
                 response = makeServiceFault(node_opcua_status_code_1.StatusCodes.BadServiceUnsupported, [errMessage]);
@@ -285,13 +421,13 @@ class OPCUABaseServer extends node_opcua_common_1.OPCUASecureObject {
         }
         catch (err) {
             /* c8 ignore next */
-            const errMessage1 = "[NODE-OPCUA-W08] EXCEPTION CAUGHT WHILE PROCESSING REQUEST !! " + request.schema.name;
+            const errMessage1 = `[NODE-OPCUA-W08] EXCEPTION CAUGHT WHILE PROCESSING REQUEST !! ${request.schema.name}`;
             warningLog(chalk_1.default.red.bold(errMessage1));
             warningLog(request.toString());
-            (0, node_opcua_debug_2.displayTraceFromThisProjectOnly)(err);
+            (0, node_opcua_debug_1.displayTraceFromThisProjectOnly)(err);
             let additional_messages = [];
-            additional_messages.push("EXCEPTION CAUGHT WHILE PROCESSING REQUEST !!! " + request.schema.name);
-            if (util_1.types.isNativeError(err)) {
+            additional_messages.push(`EXCEPTION CAUGHT WHILE PROCESSING REQUEST !!! ${request.schema.name}`);
+            if (err instanceof Error) {
                 additional_messages.push(err.message);
                 if (err.stack) {
                     additional_messages = additional_messages.concat(err.stack.split("\n"));
@@ -302,9 +438,18 @@ class OPCUABaseServer extends node_opcua_common_1.OPCUASecureObject {
         }
     }
     /**
-     * @private
+     * Find endpoint descriptions matching a given endpoint URL.
+     *
+     * When `endpointUrl` is provided, only endpoints whose URL matches
+     * (case-insensitive) are returned. When `null` or omitted, all
+     * endpoints from every `OPCUAServerEndPoint` are returned.
+     *
+     * This is the shared resolution path used by both `GetEndpoints`
+     * and `CreateSession` (`validate_security_endpoint`).
+     *
+     * @internal (was _get_endpoints)
      */
-    _get_endpoints(endpointUrl) {
+    findMatchingEndpoints(endpointUrl) {
         let endpoints = [];
         for (const endPoint of this.endpoints) {
             const ep = endPoint.endpointDescriptions();
@@ -317,15 +462,15 @@ class OPCUABaseServer extends node_opcua_common_1.OPCUASecureObject {
      * get one of the possible endpointUrl
      */
     getEndpointUrl() {
-        return this._get_endpoints()[0].endpointUrl;
+        return this.findMatchingEndpoints()[0].endpointUrl || "";
     }
     getDiscoveryUrls() {
         const discoveryUrls = this.endpoints.map((e) => {
-            return e.endpointDescriptions()[0].endpointUrl;
+            return e.endpointDescriptions()[0].endpointUrl || "";
         });
         return discoveryUrls;
     }
-    getServers(channel) {
+    getServers(_channel) {
         this.serverInfo.discoveryUrls = this.getDiscoveryUrls();
         const servers = [this.serverInfo];
         return servers;
@@ -350,11 +495,14 @@ class OPCUABaseServer extends node_opcua_common_1.OPCUASecureObject {
         }, (err) => callback(err));
     }
     resumeEndPoints(callback) {
+        // c8 ignore next
+        if (!callback)
+            throw new Error("thenify is not available");
         async_1.default.forEach(this.endpoints, (ep, _inner_callback) => {
             ep.restoreConnection(_inner_callback);
         }, (err) => callback(err));
     }
-    prepare(message, channel) {
+    prepare(_message, _channel) {
         /* empty */
     }
     /**
@@ -376,10 +524,10 @@ class OPCUABaseServer extends node_opcua_common_1.OPCUASecureObject {
          *                          If the URI is a URL, this URL may have a query string appended.
          *                          The Transport Profiles that support query strings are defined in OPC 10000-7.
          */
-        response.endpoints = this._get_endpoints(null);
-        const e = response.endpoints.map((e) => e.endpointUrl);
+        response.endpoints = this.findMatchingEndpoints(null);
+        const _e = response.endpoints.map((e) => e.endpointUrl);
         if (request.endpointUrl) {
-            const filtered = response.endpoints.filter((endpoint) => endpoint.endpointUrl === request.endpointUrl);
+            const filtered = response.endpoints.filter((endpoint) => (0, node_opcua_utils_1.matchUri)(endpoint.endpointUrl, request.endpointUrl));
             if (filtered.length > 0) {
                 response.endpoints = filtered;
             }
@@ -387,9 +535,8 @@ class OPCUABaseServer extends node_opcua_common_1.OPCUASecureObject {
         response.endpoints = response.endpoints.filter((endpoint) => !endpoint.restricted);
         // apply filters
         if (request.profileUris && request.profileUris.length > 0) {
-            response.endpoints = response.endpoints.filter((endpoint) => {
-                return request.profileUris.indexOf(endpoint.transportProfileUri) >= 0;
-            });
+            const profileUris = request.profileUris;
+            response.endpoints = response.endpoints.filter((endpoint) => profileUris.indexOf(endpoint.transportProfileUri) >= 0);
         }
         // adjust locale on ApplicationName to match requested local or provide
         // a string with neutral locale (locale === null)
@@ -419,13 +566,14 @@ class OPCUABaseServer extends node_opcua_common_1.OPCUASecureObject {
             // apply filters
             // TODO /
             if (request.serverUris && request.serverUris.length > 0) {
+                const serverUris = request.serverUris;
                 // A serverUri matches the applicationUri from the ApplicationDescription define
                 servers = servers.filter((inner_Server) => {
-                    return request.serverUris.indexOf(inner_Server.applicationUri) >= 0;
+                    return serverUris.indexOf(inner_Server.applicationUri) >= 0;
                 });
             }
             function adapt(applicationDescription) {
-                return new node_opcua_service_endpoints_2.ApplicationDescription({
+                return new node_opcua_service_endpoints_1.ApplicationDescription({
                     applicationName: applicationDescription.applicationName,
                     applicationType: applicationDescription.applicationType,
                     applicationUri: applicationDescription.applicationUri,