ScadaBridge/tests/ZB.MOM.WW.ScadaBridge.DataConnectionLayer.Tests/Adapters/SecureOpcUaTestServer.cs

using System.Net;
using System.Net.Sockets;
using System.Security.Cryptography.X509Certificates;
using Opc.Ua;
using Opc.Ua.Configuration;
using Opc.Ua.Identity;
using Opc.Ua.Server;
using Opc.Ua.Server.Hosting;

namespace ZB.MOM.WW.ScadaBridge.DataConnectionLayer.Tests.Adapters;

/// <summary>
/// An in-process OPC Foundation <see cref="StandardServer"/> exposing None, Sign and
/// SignAndEncrypt (Basic256Sha256) endpoints with STRICT client trust
/// (<c>AutoAcceptUntrustedCertificates = false</c>) and its own temp PKI — the Gitea #121
/// counterpart for real mutual-trust tests of <c>RealOpcUaClient</c>.
/// </summary>
internal sealed class SecureOpcUaTestServer : IAsyncDisposable
{
    private readonly ApplicationInstance _app;
    private readonly StandardServer _server;
    private readonly string _pkiRoot;

    private SecureOpcUaTestServer(
        ApplicationInstance app, StandardServer server, string pkiRoot, string url, X509Certificate2 certificate)
    {
        _app = app;
        _server = server;
        _pkiRoot = pkiRoot;
        Url = url;
        Certificate = certificate;
    }

    /// <summary>The endpoint URL (localhost, so the server certificate's domain matches).</summary>
    public string Url { get; }

    /// <summary>The server's application certificate (public part).</summary>
    public X509Certificate2 Certificate { get; }

    /// <summary>Starts a server that trusts exactly <paramref name="trustedClients"/>.</summary>
    /// <param name="trustedClients">Client certificates the server's trusted peer store holds at start.</param>
    /// <returns>The running server.</returns>
    public static Task<SecureOpcUaTestServer> StartAsync(params X509Certificate2[] trustedClients) =>
        StartCoreAsync(apiKey: null, trustedClients);

    /// <summary>
    /// Starts a server that also admits the UserName <c>apikey</c> with exactly
    /// <paramref name="apiKey"/> as its password (ScadaBridge#125), and refuses any other password
    /// with <c>BadIdentityTokenRejected</c> once it has decrypted the token. The UserName token
    /// policy is Basic256Sha256, so the password is encrypted on every channel, None included.
    /// </summary>
    /// <param name="apiKey">The one password the server accepts.</param>
    /// <param name="trustedClients">Client certificates the server's trusted peer store holds at start.</param>
    /// <returns>The running server.</returns>
    public static Task<SecureOpcUaTestServer> StartWithApiKeyAsync(string apiKey, params X509Certificate2[] trustedClients) =>
        StartCoreAsync(apiKey, trustedClients);

    private static async Task<SecureOpcUaTestServer> StartCoreAsync(string? apiKey, X509Certificate2[] trustedClients)
    {
        var pkiRoot = Path.Combine(Path.GetTempPath(), "sb121-server", Guid.NewGuid().ToString("N"));
        var port = FreePort();
        var url = $"opc.tcp://localhost:{port}/sb121";

        // Trust is written BEFORE start, so no test depends on trust-list cache refresh timing.
        var trustedCerts = Path.Combine(pkiRoot, "trusted", "certs");
        Directory.CreateDirectory(trustedCerts);
        foreach (var c in trustedClients)
            await File.WriteAllBytesAsync(Path.Combine(trustedCerts, $"{c.Thumbprint}.der"), c.RawData);

        var telemetry = DefaultTelemetry.Create(_ => { });
        var config = new ApplicationConfiguration(telemetry)
        {
            ApplicationName = "SB121TestServer",
            ApplicationUri = $"urn:localhost:SB121TestServer:{port}",
            ApplicationType = ApplicationType.Server,
            SecurityConfiguration = new SecurityConfiguration
            {
                ApplicationCertificate = new CertificateIdentifier
                {
                    StoreType = CertificateStoreType.Directory,
                    StorePath = Path.Combine(pkiRoot, "own"),
                    SubjectName = "CN=SB121TestServer",
                    CertificateType = ObjectTypeIds.RsaSha256ApplicationCertificateType,
                },
                TrustedPeerCertificates = new CertificateTrustList { StorePath = Path.Combine(pkiRoot, "trusted") },
                TrustedIssuerCertificates = new CertificateTrustList { StorePath = Path.Combine(pkiRoot, "issuers") },
                RejectedCertificateStore = new CertificateTrustList { StorePath = Path.Combine(pkiRoot, "rejected") },
                AutoAcceptUntrustedCertificates = false,
                AddAppCertToTrustedStore = false,
            },
            TransportQuotas = new TransportQuotas { OperationTimeout = 15_000 },
            ServerConfiguration = new ServerConfiguration
            {
                BaseAddresses = [url],
                SecurityPolicies =
                [
                    new ServerSecurityPolicy { SecurityMode = MessageSecurityMode.None, SecurityPolicyUri = SecurityPolicies.None },
                    new ServerSecurityPolicy { SecurityMode = MessageSecurityMode.Sign, SecurityPolicyUri = SecurityPolicies.Basic256Sha256 },
                    new ServerSecurityPolicy { SecurityMode = MessageSecurityMode.SignAndEncrypt, SecurityPolicyUri = SecurityPolicies.Basic256Sha256 },
                ],
                UserTokenPolicies = apiKey is null
                    ? [new UserTokenPolicy(UserTokenType.Anonymous)]
                    : [new UserTokenPolicy(UserTokenType.Anonymous),
                       new UserTokenPolicy(UserTokenType.UserName) { SecurityPolicyUri = SecurityPolicies.Basic256Sha256 }],
            },
        };

        await config.ValidateAsync(ApplicationType.Server);

        var app = new ApplicationInstance(config, telemetry)
        {
            ApplicationName = config.ApplicationName,
            ApplicationType = ApplicationType.Server,
        };
        await app.CheckApplicationInstanceCertificatesAsync(silent: true, lifeTimeInMonths: 12);
        var server = new TestServer(telemetry, apiKey);
        await app.StartAsync(server);

        // SDK 2: the loaded application certificate lives in the certificate manager, not on the identifier.
        using var entry = config.CertificateManager.AcquireApplicationCertificateByType(
            ObjectTypeIds.RsaSha256ApplicationCertificateType)
            ?? throw new InvalidOperationException("The test server has no application certificate.");
        var cert = X509CertificateLoader.LoadCertificate(entry.Certificate.RawData);
        return new SecureOpcUaTestServer(app, server, pkiRoot, url, cert);
    }

    /// <summary>
    /// Sets the server's <c>Server_ServiceLevel</c> (<c>i=2267</c>) — what a redundant server
    /// publishes for its role (ScadaBridge#138: 250/240 Active, 90/50 Warm standby, 1 booting).
    /// </summary>
    /// <param name="level">The ServiceLevel to publish.</param>
    public void SetServiceLevel(byte level) =>
        _server.CurrentInstance.ServerObject.ServiceLevel!.Value = level;

    /// <inheritdoc />
    public async ValueTask DisposeAsync()
    {
        try { await _app.StopAsync(); } catch { /* best-effort */ }
        Certificate.Dispose();
        try { Directory.Delete(_pkiRoot, recursive: true); } catch { /* best-effort */ }
    }

    /// <summary>A <see cref="StandardServer"/> that registers the API-key authenticator before it starts.</summary>
    private sealed class TestServer : StandardServer
    {
        public TestServer(ITelemetryContext telemetry, string? apiKey) : base(telemetry)
        {
            if (apiKey is not null)
                AddPreStartupTask(new RegisterAuthenticator(new ApiKeyAuthenticator(apiKey)));
        }
    }

    private sealed class RegisterAuthenticator(IUserTokenAuthenticator authenticator) : IServerPreStartupTask
    {
        public ValueTask OnServerStartingAsync(IServerContext server, CancellationToken cancellationToken = default)
        {
            ((IServerInternal)server).IdentityRegistry.Register(authenticator);
            return ValueTask.CompletedTask;
        }
    }

    private sealed class ApiKeyAuthenticator(string apiKey) : IUserTokenAuthenticator
    {
        public UserTokenType TokenType => UserTokenType.UserName;

        public string? IssuedTokenProfileUri => null;

        public ValueTask<AuthenticationResult> AuthenticateAsync(AuthenticationContext context, CancellationToken ct = default)
        {
            if (context.TokenHandler is not UserNameIdentityTokenHandler userName)
                return ValueTask.FromResult(AuthenticationResult.NotHandled);
            var accepted = userName.UserName == "apikey"
                && userName.DecryptedPassword is { } password
                && System.Text.Encoding.UTF8.GetString(password) == apiKey;
            return ValueTask.FromResult(accepted
                ? AuthenticationResult.Accept(new UserIdentity(userName))
                : AuthenticationResult.Reject(new ServiceResult(StatusCodes.BadIdentityTokenRejected)));
        }
    }

    private static int FreePort()
    {
        var l = new TcpListener(IPAddress.Loopback, 0);
        l.Start();
        var port = ((IPEndPoint)l.LocalEndpoint).Port;
        l.Stop();
        return port;
    }
}