feat(cli): browse/search/verify-endpoint/cert-trust commands — actor parity (arch-review C4)

Claude-Session: https://claude.ai/code/session_01MtdgwpEeCUn6cUA5f1LMPj
2026-07-10 05:51:49 -04:00
parent d8a39f3c35
commit 433c6db4ec
5 changed files with 522 additions and 1 deletions
@@ -936,6 +936,93 @@ scadabridge --url <url> data-connection delete --id <int>
 |--------|----------|-------------|
 | `--id` | yes | Data connection ID |

+#### `data-connection browse`
+
+Browse the immediate children of an OPC UA node on the live server backing a site data connection. `--site` routes the command to the target site. Designer role.
+
+```sh
+scadabridge --url <url> data-connection browse --site <identifier> --connection <name> [--node-id <nodeId>]
+```
+
+| Option | Required | Description |
+|--------|----------|-------------|
+| `--site` | yes | Target site identifier |
+| `--connection` | yes | Data connection name |
+| `--node-id` | no | Parent node id to browse (server root / ObjectsFolder if omitted) |
+
+#### `data-connection search`
+
+Bounded recursive search of an OPC UA address space (substring on DisplayName / root-relative path). Designer role.
+
+```sh
+scadabridge --url <url> data-connection search --site <identifier> --connection <name> --query <text> [--max-depth <int>] [--max-results <int>]
+```
+
+| Option | Required | Description |
+|--------|----------|-------------|
+| `--site` | yes | Target site identifier |
+| `--connection` | yes | Data connection name |
+| `--query` | yes | Case-insensitive substring matched on DisplayName and root-relative path |
+| `--max-depth` | no | Maximum levels below the root to descend (default 5) |
+| `--max-results` | no | Maximum number of matches to return (default 100) |
+
+#### `data-connection verify-endpoint`
+
+Probe an endpoint configuration on a site without persisting it (read-only; never trusts the server certificate). The endpoint JSON is read verbatim from `--config-file`. Designer role.
+
+```sh
+scadabridge --url <url> data-connection verify-endpoint --site <identifier> --protocol <string> --config-file <path> [--connection <name>]
+```
+
+| Option | Required | Description |
+|--------|----------|-------------|
+| `--site` | yes | Target site identifier |
+| `--protocol` | yes | Protocol type (e.g. `OpcUa`) |
+| `--config-file` | yes | Path to the endpoint configuration JSON file (read into `ConfigJson`) |
+| `--connection` | no | Connection name for logging/correlation |
+
+#### `data-connection certs list`
+
+List the certificates in a site's trusted-peer and rejected PKI stores. Admin role.
+
+```sh
+scadabridge --url <url> data-connection certs list --site <identifier> [--connection <name>]
+```
+
+| Option | Required | Description |
+|--------|----------|-------------|
+| `--site` | yes | Target site identifier |
+| `--connection` | no | Data connection name (contextual; not part of the request) |
+
+#### `data-connection certs trust`
+
+Trust an OPC UA server certificate on every node of a site. The DER file is base64-encoded into the request. Admin role.
+
+```sh
+scadabridge --url <url> data-connection certs trust --site <identifier> --connection <name> --der-file <path> --thumbprint <hex>
+```
+
+| Option | Required | Description |
+|--------|----------|-------------|
+| `--site` | yes | Target site identifier |
+| `--connection` | yes | Data connection the certificate was captured from (correlation) |
+| `--der-file` | yes | Path to the DER-encoded certificate file (base64-encoded into the request) |
+| `--thumbprint` | yes | Certificate thumbprint (store filename key) |
+
+#### `data-connection certs remove`
+
+Remove a trusted OPC UA server certificate from every node of a site, identified by thumbprint. Admin role.
+
+```sh
+scadabridge --url <url> data-connection certs remove --site <identifier> --thumbprint <hex> [--connection <name>]
+```
+
+| Option | Required | Description |
+|--------|----------|-------------|
+| `--site` | yes | Target site identifier |
+| `--thumbprint` | yes | Thumbprint of the certificate to remove |
+| `--connection` | no | Data connection name (contextual; not part of the request) |
+
 ---

 ### `external-system` — Manage external HTTP systems