node-opcua-server 2.166.0 → 2.168.0

package/source/monitored_item.ts

@@ -1,36 +1,36 @@
 /**
  * @module node-opcua-server
  */
-import { EventEmitter } from "events";
+
 import chalk from "chalk";
+import { EventEmitter } from "events";
+import {
+    type AddressSpace,
+    type BaseNode,
+    type IEventData,
+    makeAttributeEventName,
+    SessionContext,
+    type UAVariable
+} from "node-opcua-address-space";
+import type { ISessionContext, UAMethod, UAObject } from "node-opcua-address-space-base";
 import { assert } from "node-opcua-assert";
-import { ISessionContext, UAMethod, UAObject } from "node-opcua-address-space-base";
-import { BaseNode, IEventData, makeAttributeEventName, SessionContext, UAVariable, AddressSpace } from "node-opcua-address-space";
-import { extractEventFields } from "node-opcua-service-filter";
-import { DateTime, UInt32 } from "node-opcua-basic-types";
-import { NodeClass, QualifiedNameOptions } from "node-opcua-data-model";
-import { AttributeIds } from "node-opcua-data-model";
+import type { DateTime, UInt32 } from "node-opcua-basic-types";
+import { AttributeIds, NodeClass, type QualifiedNameOptions } from "node-opcua-data-model";
 import {
     apply_timestamps,
+    coerceTimestampsToReturn,
     DataValue,
     extractRange,
     sameDataValue,
-    coerceTimestampsToReturn,
     sameStatusCode
 } from "node-opcua-data-value";
 import { checkDebugFlag, make_debugLog, make_errorLog, make_warningLog } from "node-opcua-debug";
-import { ExtensionObject } from "node-opcua-extension-object";
-import { NodeId } from "node-opcua-nodeid";
-import { NumericalRange0, NumericRange } from "node-opcua-numeric-range";
+import type { ExtensionObject } from "node-opcua-extension-object";
+import type { NodeId } from "node-opcua-nodeid";
+import { type NumericalRange0, NumericRange } from "node-opcua-numeric-range";
 import { ObjectRegistry } from "node-opcua-object-registry";
-import { EventFilter } from "node-opcua-service-filter";
-import { ReadValueId, TimestampsToReturn } from "node-opcua-service-read";
-import {
-    MonitoredItemModifyResult,
-    MonitoredItemNotification,
-    MonitoringMode,
-    MonitoringParameters
-} from "node-opcua-service-subscription";
+import { EventFilter, extractEventFields } from "node-opcua-service-filter";
+import { ReadValueId, type TimestampsToReturn } from "node-opcua-service-read";
 import {
     DataChangeFilter,
     DataChangeTrigger,
@@ -38,25 +38,28 @@ import {
     isOutsideDeadbandAbsolute,
     isOutsideDeadbandNone,
     isOutsideDeadbandPercent,
-    PseudoRange
+    MonitoredItemModifyResult,
+    MonitoredItemNotification,
+    MonitoringMode,
+    MonitoringParameters,
+    type PseudoRange
 } from "node-opcua-service-subscription";
-import { CallbackT, StatusCode, StatusCodes } from "node-opcua-status-code";
+import { type CallbackT, StatusCode, StatusCodes } from "node-opcua-status-code";
 import {
     DataChangeNotification,
     EventFieldList,
     EventNotificationList,
-    MonitoringFilter,
-    ReadValueIdOptions,
-    SimpleAttributeOperand,
-    SubscriptionDiagnosticsDataType
+    type MonitoringFilter,
+    type ReadValueIdOptions,
+    type SimpleAttributeOperand,
+    type SubscriptionDiagnosticsDataType
 } from "node-opcua-types";
 import { sameVariant, Variant, VariantArrayType } from "node-opcua-variant";
-
+import { checkWhereClauseOnAdressSpace as checkWhereClauseOnAddressSpace } from "./filter/check_where_clause_on_address_space";
 import { appendToTimer, removeFromTimer } from "./node_sampler";
+import type { SamplingFunc } from "./sampling_func";
+import type { MonitoredItemBase } from "./server_subscription";
 import { validateFilter } from "./validate_filter";
-import { checkWhereClauseOnAdressSpace as checkWhereClauseOnAddressSpace } from "./filter/check_where_clause_on_address_space";
-import { SamplingFunc } from "./sampling_func";
-import { MonitoredItemBase } from "./server_subscription";
 
 const errorLog = make_errorLog(__filename);
 
@@ -100,8 +103,8 @@ function _adjust_queue_size(queueSize: number): number {
 
 function _validate_parameters(monitoringParameters: any) {
     // xx assert(options instanceof MonitoringParameters);
-    assert(Object.prototype.hasOwnProperty.call(monitoringParameters, "clientHandle"));
-    assert(Object.prototype.hasOwnProperty.call(monitoringParameters, "samplingInterval"));
+    assert(Object.hasOwn(monitoringParameters, "clientHandle"));
+    assert(Object.hasOwn(monitoringParameters, "samplingInterval"));
     assert(isFinite(monitoringParameters.clientHandle));
     assert(isFinite(monitoringParameters.samplingInterval));
     assert(typeof monitoringParameters.discardOldest === "boolean");
@@ -394,10 +397,11 @@ export class MonitoredItem extends EventEmitter implements MonitoredItemBase {
     public overflow: boolean;
     public oldDataValue: DataValue;
 
-
     #monitoringMode: MonitoringMode = MonitoringMode.Invalid;
 
-    public get monitoringMode() { return this.#monitoringMode; }
+    public get monitoringMode() {
+        return this.#monitoringMode;
+    }
 
     public timestampsToReturn: TimestampsToReturn;
     public itemToMonitor: any;
@@ -424,7 +428,7 @@ export class MonitoredItem extends EventEmitter implements MonitoredItemBase {
     constructor(options: MonitoredItemOptions) {
         super();
 
-        assert(Object.prototype.hasOwnProperty.call(options, "monitoredItemId"));
+        assert(Object.hasOwn(options, "monitoredItemId"));
         assert(!options.monitoringMode, "use setMonitoring mode explicitly to activate the monitored item");
 
         options.itemToMonitor = options.itemToMonitor || defaultItemToMonitor;
@@ -470,7 +474,6 @@ export class MonitoredItem extends EventEmitter implements MonitoredItemBase {
     }
 
     public setMonitoringMode(monitoringMode: MonitoringMode): StatusCode {
-
         if (monitoringMode === this.monitoringMode) {
             // nothing to do
             return StatusCodes.BadNothingToDo;
@@ -480,7 +483,6 @@ export class MonitoredItem extends EventEmitter implements MonitoredItemBase {
         }
         const old_monitoringMode = this.monitoringMode;
 
-
         if (monitoringMode === MonitoringMode.Disabled) {
             this.#monitoringMode = monitoringMode;
             this._stop_sampling();
@@ -1200,7 +1202,7 @@ export class MonitoredItem extends EventEmitter implements MonitoredItemBase {
     }
 
     private _setOverflowBit(notification: any) {
-        if (Object.prototype.hasOwnProperty.call(notification, "value")) {
+        if (Object.hasOwn(notification, "value")) {
             assert(notification.value.statusCode.equals(StatusCodes.Good));
             notification.value.statusCode = StatusCode.makeStatusCode(
                 notification.value.statusCode,
@@ -1301,11 +1303,11 @@ export class MonitoredItem extends EventEmitter implements MonitoredItemBase {
         ) {
             throw new Error(
                 "dataValue.value.value cannot be the same object twice! " +
-                this.node!.browseName.toString() +
-                " " +
-                dataValue.toString() +
-                "  " +
-                chalk.cyan(this.oldDataValue.toString())
+                    this.node!.browseName.toString() +
+                    " " +
+                    dataValue.toString() +
+                    "  " +
+                    chalk.cyan(this.oldDataValue.toString())
             );
         }
 

package/source/node_sampler.ts

@@ -9,14 +9,14 @@ import { hrtime } from "node-opcua-utils";
 const debugLog = make_debugLog(__filename);
 const doDebug = checkDebugFlag(__filename);
 
-import { MonitoredItem } from "./monitored_item";
+import type { MonitoredItem } from "./monitored_item";
 
 interface ITimer {
-    _samplingId: NodeJS.Timeout | false,
-    monitoredItems: Record<string,any>,
+    _samplingId: NodeJS.Timeout | false;
+    monitoredItems: Record<string, any>;
     monitoredItemsCount: number;
-    }
-const timers: Record<string,ITimer> = {};
+}
+const timers: Record<string, ITimer> = {};
 const NS_PER_SEC = 1e9;
 
 interface MonitoredItemPriv {
@@ -24,7 +24,7 @@ interface MonitoredItemPriv {
 }
 function sampleMonitoredItem(monitoredItem: MonitoredItem) {
     const _monitoredItem = monitoredItem as unknown as MonitoredItemPriv;
-    
+
     if (monitoredItem.monitoringMode === MonitoringMode.Disabled) {
         return;
     }
@@ -50,7 +50,7 @@ export function appendToTimer(monitoredItem: MonitoredItem): string {
             const start = doDebug ? hrtime() : undefined;
             let counter = 0;
             for (const m in _t.monitoredItems) {
-                if (Object.prototype.hasOwnProperty.call(_t.monitoredItems, m)) {
+                if (Object.hasOwn(_t.monitoredItems, m)) {
                     sampleMonitoredItem(_t.monitoredItems[m]);
                     counter++;
                 }
@@ -60,9 +60,7 @@ export function appendToTimer(monitoredItem: MonitoredItem): string {
                 const elapsed = hrtime(start);
                 debugLog(
                     `Sampler ${samplingInterval}  ms : Benchmark took ${(
-                        (elapsed[0] * NS_PER_SEC + elapsed[1]) /
-                        1000 /
-                        1000.0
+                        (elapsed[0] * NS_PER_SEC + elapsed[1]) / 1000 / 1000.0
                     ).toFixed(3)} milliseconds for ${counter} elements`
                 );
             }
@@ -91,7 +89,7 @@ export function removeFromTimer(monitoredItem: MonitoredItem): void {
     _t.monitoredItemsCount--;
     assert(_t.monitoredItemsCount >= 0);
     if (_t.monitoredItemsCount === 0) {
-        if (_t._samplingId !==false) {
+        if (_t._samplingId !== false) {
             clearInterval(_t._samplingId);
         }
         delete timers[key];

package/source/opcua_server.ts

@@ -36,8 +36,8 @@ import {
 import { assert } from "node-opcua-assert";
 import type { ByteString, UAString } from "node-opcua-basic-types";
 import { getDefaultCertificateManager, type OPCUACertificateManager } from "node-opcua-certificate-manager";
-import { ServerState } from "node-opcua-common";
-import { type Certificate, exploreCertificate, type Nonce } from "node-opcua-crypto/web";
+import { SecretHolder, ServerState } from "node-opcua-common";
+import { type Certificate, combine_der, exploreCertificate, type Nonce } from "node-opcua-crypto/web";
 import {
     AttributeIds,
     filterDiagnosticOperationLevel,
@@ -149,6 +149,7 @@ import { DataType, type Variant, VariantArrayType } from "node-opcua-variant";
 import { withCallback } from "thenify-ex";
 
 import { OPCUABaseServer, type OPCUABaseServerOptions } from "./base_server";
+import { extractPasswordFromDecryptedBlob } from "./extract_password_from_blob";
 import { Factory } from "./factory";
 import type { IChannelData } from "./i_channel_data";
 import type { IRegisterServerManager } from "./i_register_server_manager";
@@ -158,9 +159,15 @@ import { RegisterServerManager } from "./register_server_manager";
 import { RegisterServerManagerHidden } from "./register_server_manager_hidden";
 import { RegisterServerManagerMDNSONLY } from "./register_server_manager_mdns_only";
 import type { SamplingFunc } from "./sampling_func";
-import { extractPasswordFromDecryptedBlob } from "./extract_password_from_blob";
 import type { ServerCapabilitiesOptions } from "./server_capabilities";
-import { type AdvertisedEndpoint, type EndpointDescriptionEx, type IServerTransportSettings, OPCUAServerEndPoint, normalizeAdvertisedEndpoints, parseOpcTcpUrl } from "./server_end_point";
+import {
+    type AdvertisedEndpoint,
+    type EndpointDescriptionEx,
+    type IServerTransportSettings,
+    normalizeAdvertisedEndpoints,
+    OPCUAServerEndPoint,
+    parseOpcTcpUrl
+} from "./server_end_point";
 import { type ClosingReason, type CreateSessionOption, ServerEngine } from "./server_engine";
 import type { ServerSession } from "./server_session";
 import type { CreateMonitoredItemHook, DeleteMonitoredItemHook, Subscription } from "./server_subscription";
@@ -951,10 +958,64 @@ export interface OPCUAServerOptions extends OPCUABaseServerOptions, OPCUAServerE
 }
 
 const g_requestExactEndpointUrl = !!process.env.NODEOPCUA_SERVER_REQUEST_EXACT_ENDPOINT_URL;
-/**
- *
- */
-export class OPCUAServer extends OPCUABaseServer {
+export interface OPCUAServerEvents {
+    /** event raised when a new session is created */
+    create_session: [session: ServerSession];
+    /** event raised when a session is activated */
+    session_activated: [session: ServerSession, userIdentityToken: UserIdentityToken];
+    /** event raised when a session is closed */
+    session_closed: [session: ServerSession, deleteSubscriptions: boolean];
+    /** event raised after the server address space has been initialized */
+    post_initialize: [];
+    /**
+     * emitted when the server is trying to register with the LDS
+     * but the connection has failed (backoff signal)
+     */
+    serverRegistrationPending: [];
+    /** event raised when server has been successfully registered on the LDS */
+    serverRegistered: [];
+    /** event raised when server registration has been successfully renewed on the LDS */
+    serverRegistrationRenewed: [];
+    /** event raised when server has been successfully unregistered from the LDS */
+    serverUnregistered: [];
+    /** event raised after the server has raised an OPCUA event toward a client */
+    event: [eventData: unknown];
+    /**
+     * event raised when the server receives a request from a connected client.
+     * Useful for trace/diagnostics.
+     */
+    request: [request: Request, channel: ServerSecureChannelLayer];
+    /**
+     * event raised when the server sends a response to a connected client.
+     * Useful for trace/diagnostics.
+     */
+    response: [response: Response, channel: ServerSecureChannelLayer];
+    /**
+     * event raised when a new secure channel transport is initialized (HEL/ACK complete).
+     * Note: securityPolicy and securityMode are NOT yet established at this point.
+     * Use "channelSecured" for post-handshake notifications.
+     */
+    newChannel: [channel: ServerSecureChannelLayer, endpoint: OPCUAServerEndPoint];
+    /**
+     * event raised when a secure channel has completed the OpenSecureChannel handshake.
+     * At this point securityPolicy, securityMode, and clientCertificate are available.
+     */
+    channelSecured: [channel: ServerSecureChannelLayer, endpoint: OPCUAServerEndPoint];
+    /** event raised when a secure channel is closed */
+    closeChannel: [channel: ServerSecureChannelLayer, endpoint: OPCUAServerEndPoint];
+    /**
+     * event raised when the server refused a TCP connection from a client
+     * (for instance because too many connections)
+     */
+    connectionRefused: [socketData: ISocketData, endpoint: OPCUAServerEndPoint];
+    /**
+     * event raised when an OpenSecureChannel has failed,
+     * e.g. invalid certificate or malformed message
+     */
+    openSecureChannelFailure: [socketData: ISocketData, channelData: IChannelData, endpoint: OPCUAServerEndPoint];
+}
+
+export class OPCUAServer extends OPCUABaseServer<OPCUAServerEvents> {
     public engine!: ServerEngine;
     public registerServerMethod: RegisterServerMethod;
     public discoveryServerEndpointUrl!: string;
@@ -2113,7 +2174,7 @@ export class OPCUAServer extends OPCUABaseServer {
             // If the securityPolicyUri is None and none of the UserTokenPolicies requires
             // encryption, the Server shall not send an ApplicationInstanceCertificate and the Client
             // shall ignore the ApplicationInstanceCertificate.
-            serverCertificate: hasEncryption ? serverCertificateChain : undefined,
+            serverCertificate: hasEncryption && serverCertificateChain.length > 0 ? combine_der(serverCertificateChain) : undefined,
 
             // The endpoints provided by the server.
             // The Server shall return a set of EndpointDescriptions available for the serverUri
@@ -3769,6 +3830,15 @@ export class OPCUAServer extends OPCUABaseServer {
             serverInfo: this.serverInfo,
             transportSettings: serverOptions.transportSettings
         });
+
+        // SecretHolder reads certificateFile/privateKeyFile from `this`
+        // on each access, so it follows Object.defineProperty redirects
+        // (e.g. from push cert management) automatically.
+        // Note: creates a cycle (server → endpoint → SecretHolder → server)
+        // which is harmless — V8 mark-and-sweep handles it, and
+        // endpoint.dispose() breaks it by replacing #certProvider.
+        endPoint.setCertificateProvider(new SecretHolder(this));
+
         return endPoint;
     }
 
@@ -3818,7 +3888,7 @@ export class OPCUAServer extends OPCUABaseServer {
             // xx                hostname,
             resourcePath: serverOption.resourcePath || "",
 
-            advertisedEndpoints: endpointOptions.advertisedEndpoints,
+            advertisedEndpoints: endpointOptions.advertisedEndpoints
 
             // TODO  userTokenTypes: endpointOptions.userTokenTypes || undefined,
 
@@ -3832,89 +3902,6 @@ export class OPCUAServer extends OPCUABaseServer {
         await this.userCertificateManager.initialize();
     }
 
-    public on(event: "create_session", eventHandler: (session: ServerSession) => void): this;
-
-    public on(event: "session_activated", eventHandler: (session: ServerSession) => void): this;
-
-    public on(event: "session_closed", eventHandler: (session: ServerSession, reason: string) => void): this;
-
-    public on(event: "post_initialize", eventHandler: () => void): this;
-
-    /**
-     * emitted when the server is trying to registered the LDS
-     * but when the connection to the lds has failed
-     * serverRegistrationPending is sent when the backoff signal of the
-     * connection process is raised
-     * @event serverRegistrationPending
-     */
-    public on(event: "serverRegistrationPending", eventHandler: () => void): this;
-
-    /**
-     * event raised when server  has been successfully registered on the local discovery server
-     * @event serverRegistered
-     */
-    public on(event: "serverRegistered", eventHandler: () => void): this;
-
-    /**
-     * event raised when server registration has been successfully renewed on the local discovery server
-     * @event serverRegistered
-     */
-    public on(event: "serverRegistrationRenewed", eventHandler: () => void): this;
-
-    /**
-     * event raised when server  has been successfully unregistered from the local discovery server
-     * @event serverUnregistered
-     */
-    public on(event: "serverUnregistered", eventHandler: () => void): this;
-
-    /**
-     * event raised after the server has raised an OPCUA event toward a client
-     */
-    public on(event: "event", eventHandler: (eventData: unknown) => void): this;
-
-    /**
-     * event raised when the server received a request from one of its connected client.
-     * useful for trace purpose.
-     */
-    public on(event: "request", eventHandler: (request: Request, channel: ServerSecureChannelLayer) => void): this;
-
-    /**
-     * event raised when the server send an response to a request to one of its connected client.
-     * useful for trace purpose.
-     */
-    public on(event: "response", eventHandler: (request: Response, channel: ServerSecureChannelLayer) => void): this;
-
-    /**
-     * event raised when a new secure channel is opened
-     */
-    public on(event: "newChannel", eventHandler: (channel: ServerSecureChannelLayer, endpoint: OPCUAServerEndPoint) => void): this;
-
-    /**
-     * event raised when a new secure channel is closed
-     */
-    public on(
-        event: "closeChannel",
-        eventHandler: (channel: ServerSecureChannelLayer, endpoint: OPCUAServerEndPoint) => void
-    ): this;
-
-    /**
-     * event raised when the server refused a tcp connection from a client. ( for instance because too any connections)
-     */
-    public on(event: "connectionRefused", eventHandler: (socketData: ISocketData, endpoint: OPCUAServerEndPoint) => void): this;
-
-    /**
-     * event raised when a OpenSecureChannel has failed, it could be a invalid certificate or malformed message
-     */
-    public on(
-        event: "openSecureChannelFailure",
-        eventHandler: (socketData: ISocketData, channelData: IChannelData, endpoint: OPCUAServerEndPoint) => void
-    ): this;
-
-    public on(event: string, eventHandler: (...args: unknown[]) => void): this;
-    // biome-ignore lint/suspicious/noExplicitAny: must match EventEmitter.on() signature
-    public on(event: string, eventHandler: (...args: any[]) => void): this {
-        return super.on(event, eventHandler);
-    }
 }
 
 const userIdentityTokenPasswordRemoved = (userIdentityToken?: UserIdentityToken): UserIdentityToken => {
@@ -4047,7 +4034,7 @@ export interface RaiseEventAuditActivateSessionEventData extends RaiseEventAudit
 }
 
 // tslint:disable:no-empty-interface
-export interface RaiseEventTransitionEventData extends RaiseEventData { }
+export interface RaiseEventTransitionEventData extends RaiseEventData {}
 
 export interface RaiseEventAuditUrlMismatchEventTypeData extends RaiseEventData {
     endpointUrl: PseudoVariantString;
@@ -4077,7 +4064,7 @@ export interface RaiseAuditCertificateDataMismatchEventData extends RaiseAuditCe
      */
     invalidUri: PseudoVariantString;
 }
-export interface RaiseAuditCertificateUntrustedEventData extends RaiseAuditCertificateEventData { }
+export interface RaiseAuditCertificateUntrustedEventData extends RaiseAuditCertificateEventData {}
 /**
  * This EventType inherits all Properties of the AuditCertificateEventType.
  *
@@ -4089,7 +4076,7 @@ export interface RaiseAuditCertificateUntrustedEventData extends RaiseAuditCerti
  * There are no additional Properties defined for this EventType.
  *
  */
-export interface RaiseAuditCertificateExpiredEventData extends RaiseAuditCertificateEventData { }
+export interface RaiseAuditCertificateExpiredEventData extends RaiseAuditCertificateEventData {}
 /**
  * This EventType inherits all Properties of the AuditCertificateEventType.
  *
@@ -4099,7 +4086,7 @@ export interface RaiseAuditCertificateExpiredEventData extends RaiseAuditCertifi
  *
  * There are no additional Properties defined for this EventType.
  */
-export interface RaiseAuditCertificateInvalidEventData extends RaiseAuditCertificateEventData { }
+export interface RaiseAuditCertificateInvalidEventData extends RaiseAuditCertificateEventData {}
 /**
  * This EventType inherits all Properties of the AuditCertificateEventType.
  *
@@ -4109,7 +4096,7 @@ export interface RaiseAuditCertificateInvalidEventData extends RaiseAuditCertifi
  * If a trust chain is involved then the certificate that failed in the trust chain should be described.
  * There are no additional Properties defined for this EventType.
  */
-export interface RaiseAuditCertificateUntrustedEventData extends RaiseAuditCertificateEventData { }
+export interface RaiseAuditCertificateUntrustedEventData extends RaiseAuditCertificateEventData {}
 /**
  * This EventType inherits all Properties of the AuditCertificateEventType.
  *
@@ -4132,7 +4119,7 @@ export interface RaiseAuditCertificateRevokedEventData extends RaiseAuditCertifi
  *
  * There are no additional Properties defined for this EventType
  */
-export interface RaiseAuditCertificateMismatchEventData extends RaiseAuditCertificateEventData { }
+export interface RaiseAuditCertificateMismatchEventData extends RaiseAuditCertificateEventData {}
 
 const opts = { multiArgs: false };
 OPCUAServer.prototype.initialize = withCallback(OPCUAServer.prototype.initialize, opts);