feat(opcuaclient): opt-in server-certificate host-name check; NAT fixture keeps its PKI (#816, #818)

#816 finding: the SDK checks that the server certificate names the host only
when a session is created with checkDomain:true. The driver, the AdminUI
browser and Client.Shared all called the 8-argument
DefaultSessionFactory.CreateAsync, which forwards checkDomain:false — so no
host-name check ever ran (why a trusted NAT cert for *.invalid browsed fine
over an IP in #813). When enabled the SDK (Session.OpenAsync ->
ValidateDomains -> FindDomain) compares ConfiguredEndpoint.EndpointUrl.IdnHost
— the CONFIGURED host, because OpcUaEndpointSelection/EndpointSelector
rewrote the advertised one — against the cert's DNS/IP SANs; secured
sessions only, and the auto-accept handler accepts a mismatch.

Policy: certificateValidation.validateServerHostName, tri-state. Unset =
OpcUaCertificateValidationOptions.DefaultValidateServerHostName = false, the
pre-#816 behaviour, so nothing changes on upgrade; true = validate the
configured host; false = explicit NAT/port-publish opt-out. Threaded into the
driver, the AdminUI browser (same JSON) and the AdminUI form (a select that
keeps "unset" unset), Client.Shared ConnectionSettings.ValidateServerHostName
and the CLI --validate-host-name. A driver refusal names the opt-out.

#818: the NAT fixture's /app/pki is on the opc-plc-nat-pki volume (verified:
same thumbprint across --force-recreate), its PUBLIC cert is committed as
Docker/nat/opc-plc-nat-server.der, and NatPublishedEndpointBrowseTests run
every secure browse on a throwaway PKI (internal browser seam): refusal with
nothing trusted, positive with the cert trusted (unset/false host check), and
a BadCertificateHostNameInvalid refusal with the check on. The trusted cert is
OPCUA_NAT_SERVER_CERT or the committed one (skip on thumbprint mismatch);
OPCUA_NAT_SERVER_CERT_TRUSTED is retired. CI exports its throwaway NAT
container's public cert. ServerHostNameValidationTests pin the driver against
the plain opc-plc. MIN_EXECUTED not raised (needs a hosted run): +6 in
v2-integration (440 -> 446), documented in scripts/ci/README.md.

tests/Client/ZB.MOM.WW.OtOpcUa.Client.CLI.Tests/CommandBaseTests.cs

@@ -38,6 +38,22 @@ public class CommandBaseTests
         settings.AutoAcceptCertificates.ShouldBeTrue();
     }
 
+    /// <summary>Gitea #816: --validate-host-name maps to the server host-name check, which is off without it.</summary>
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task ValidateHostNameOption_MapsToConnectionSettings(bool flag)
+    {
+        var fakeService = new FakeOpcUaClientService();
+        var factory = new FakeOpcUaClientServiceFactory(fakeService);
+        var command = new ConnectCommand(factory) { Url = "opc.tcp://localhost:4840", ValidateHostName = flag };
+
+        using var console = TestConsoleHelper.CreateConsole();
+        await command.ExecuteAsync(console);
+
+        fakeService.LastConnectionSettings!.ValidateServerHostName.ShouldBe(flag);
+    }
+
     /// <summary>Verifies that encrypt option maps to SignAndEncrypt.</summary>
     [Fact]
     public async Task SecurityOption_Encrypt_MapsToSignAndEncrypt()

tests/Client/ZB.MOM.WW.OtOpcUa.Client.Shared.Tests/Fakes/FakeSessionFactory.cs

@@ -14,6 +14,8 @@ internal sealed class FakeSessionFactory : ISessionFactory
     public bool ThrowOnCreate { get; set; }
     /// <summary>Gets the endpoint URL from the last CreateSessionAsync call.</summary>
     public string? LastEndpointUrl { get; private set; }
+    /// <summary>Gets the host-name-validation flag from the last CreateSessionAsync call (#816).</summary>
+    public bool? LastValidateServerHostName { get; private set; }
 
     /// <summary>
     /// Optional gate that, when set, blocks <see cref="CreateSessionAsync" /> until completed.
@@ -33,14 +35,16 @@ internal sealed class FakeSessionFactory : ISessionFactory
     /// <param name="sessionName">The session name.</param>
     /// <param name="sessionTimeoutMs">The session timeout in milliseconds.</param>
     /// <param name="identity">The user identity.</param>
+    /// <param name="validateServerHostName">The SDK checkDomain flag (#816).</param>
     /// <param name="ct">Cancellation token.</param>
     /// <returns>A task containing the session adapter.</returns>
     public async Task<ISessionAdapter> CreateSessionAsync(
         ApplicationConfiguration config, EndpointDescription endpoint, string sessionName,
-        uint sessionTimeoutMs, UserIdentity identity, CancellationToken ct)
+        uint sessionTimeoutMs, UserIdentity identity, bool validateServerHostName, CancellationToken ct)
     {
         CreateCallCount++;
         LastEndpointUrl = endpoint.EndpointUrl ?? string.Empty;
+        LastValidateServerHostName = validateServerHostName;
 
         // One-shot: the gate holds only the call that observed it, so a later call (e.g. a user's Connect while a
         // failover is held) runs freely.

tests/Client/ZB.MOM.WW.OtOpcUa.Client.Shared.Tests/OpcUaClientServiceTests.cs

@@ -55,6 +55,25 @@ public class OpcUaClientServiceTests : IDisposable
         _service.CurrentConnectionInfo.ShouldBe(info);
     }
 
+    /// <summary>
+    /// Gitea #816: the host-name check reaches the session factory (the SDK's checkDomain) — off by default, the
+    /// pre-#816 behaviour — and survives the per-endpoint settings copy the connect path makes.
+    /// </summary>
+    [Theory]
+    [InlineData(null)]
+    [InlineData(true)]
+    [InlineData(false)]
+    public async Task ConnectAsync_threads_ValidateServerHostName_to_the_session(bool? validate)
+    {
+        var settings = ValidSettings();
+        if (validate is { } v) settings.ValidateServerHostName = v;
+
+        await _service.ConnectAsync(settings, TestContext.Current.CancellationToken);
+
+        _sessionFactory.LastValidateServerHostName.ShouldBe(validate ?? false);
+        _configFactory.LastSettings!.ValidateServerHostName.ShouldBe(validate ?? false);
+    }
+
     /// <summary>
     /// Verifies that invalid connection settings fail validation before any OPC UA session is created.
     /// </summary>