feat(opcuaclient-browser): real AttributesAsync + certificate-auth browse (R06:O-5)

- AttributesAsync was a stub returning nothing; it now reads NodeClass / DisplayName / DataType / ValueRank / UserAccessLevel in one request and maps them through UpstreamAttributeMapping, the same mapping discovery registers with (moved into the shared .Session leaf; the driver forwards to it). Objects have no value attributes. - Certificate auth was refused "in v1". The browse now builds its identity through OpcUaUserIdentityFactory (shared .Session leaf, the driver forwards to it), including the secret: resolution of Password / UserCertificatePassword through the host's ISecretResolver (optional ctor param, DI-injected). Fail-closed: a secret: ref with no store throws instead of being sent as the literal (the browse used to send a secret: Password verbatim). The identity is built before any network I/O. Refs #743 Claude-Session: https://claude.ai/code/session_01Ub9hGmYLQvn9XETzw7CMsT
2026-10-22 15:33:08 -04:00
parent d98f4a5bf1
commit fcdc44f9f7
11 changed files with 492 additions and 134 deletions
@@ -54,10 +54,64 @@ internal sealed class OpcUaClientBrowseSession : IBrowseSession
    }

    /// <inheritdoc />
-    public Task<IReadOnlyList<AttributeInfo>> AttributesAsync(string nodeId, CancellationToken cancellationToken)
+    // R06:O-5 — reads the node's NodeClass / DisplayName / DataType / ValueRank / UserAccessLevel in one request and
+    // maps them through the same UpstreamAttributeMapping the runtime driver's discovery registers with, so the
+    // side-panel shows what a browse-commit would author. An Object (folder) has no value attributes → empty.
+    // Throws ArgumentException when nodeId cannot be resolved against the live session's namespace table.
+    public async Task<IReadOnlyList<AttributeInfo>> AttributesAsync(string nodeId, CancellationToken cancellationToken)
    {
+        ObjectDisposedException.ThrowIf(_disposed, this);
+        if (!NamespaceMap.TryResolve(_session, nodeId, out var resolved))
+            throw new ArgumentException(
+                $"Cannot resolve NodeId '{nodeId}' against the live session.", nameof(nodeId));
+
+        uint[] attributeIds =
+        [
+            Attributes.NodeClass, Attributes.DisplayName, Attributes.DataType, Attributes.ValueRank,
+            Attributes.UserAccessLevel,
+        ];
+        var toRead = new ReadValueIdCollection(attributeIds.Length);
+        foreach (var id in attributeIds) toRead.Add(new ReadValueId { NodeId = resolved, AttributeId = id });
+
+        DataValueCollection values;
+        await _gate.WaitAsync(cancellationToken).ConfigureAwait(false);
+        try
+        {
+            var resp = await _session.ReadAsync(
+                requestHeader: null,
+                maxAge: 0,
+                timestampsToReturn: TimestampsToReturn.Neither,
+                nodesToRead: toRead,
+                ct: cancellationToken).ConfigureAwait(false);
+            values = resp?.Results ?? [];
+        }
+        finally
+        {
+            _gate.Release();
+        }
        LastUsedUtc = DateTime.UtcNow;
-        return Task.FromResult<IReadOnlyList<AttributeInfo>>(Array.Empty<AttributeInfo>());
+
+        DataValue? At(int i) => i < values.Count && StatusCode.IsGood(values[i].StatusCode)
+            ? values[i] : null;
+
+        var nodeClass = At(0)?.Value is int nc ? (NodeClass)nc : NodeClass.Unspecified;
+        if (nodeClass != NodeClass.Variable) return Array.Empty<AttributeInfo>();
+
+        var name = (At(1)?.Value as LocalizedText)?.Text ?? resolved.ToString() ?? nodeId;
+        var dataType = At(2)?.Value is NodeId dt
+            ? UpstreamAttributeMapping.MapDataType(dt)
+            : ZB.MOM.WW.OtOpcUa.Core.Abstractions.DriverDataType.String;
+        var valueRank = At(3)?.Value is int vr ? vr : ValueRanks.Scalar;
+        var access = At(4)?.Value is byte ab ? ab : (byte)0;
+
+        return
+        [
+            new AttributeInfo(
+                Name: name,
+                DriverDataType: dataType.ToString(),
+                IsArray: UpstreamAttributeMapping.IsArray(valueRank),
+                SecurityClass: UpstreamAttributeMapping.MapAccessLevel(access).ToString()),
+        ];
    }

    /// <summary>Issue a single-level Browse (plus continuation-point follow-ups) under the
@@ -7,7 +7,8 @@ using Opc.Ua.Client;
 using Opc.Ua.Configuration;
 using ZB.MOM.WW.OtOpcUa.Commons.Browsing;
 using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
-using ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient;  // OpcUaClientDriverOptions + NamespaceMap
+using ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient;  // OpcUaClientDriverOptions + NamespaceMap + OpcUaUserIdentityFactory
+using ZB.MOM.WW.Secrets.Abstractions;

 namespace ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser;

@@ -33,12 +34,19 @@ public sealed class OpcUaClientDriverBrowser : IDriverBrowser
    };

    private readonly ILogger<OpcUaClientDriverBrowser> _logger;
+    private readonly ISecretResolver? _secretResolver;

    /// <summary>Creates a new browser. Logger defaults to NullLogger when not supplied.</summary>
    /// <param name="logger">Optional logger; defaults to <see cref="NullLogger{T}"/>.</param>
-    public OpcUaClientDriverBrowser(ILogger<OpcUaClientDriverBrowser>? logger = null)
+    /// <param name="secretResolver">
+    ///     The host's shared secret resolver (DI-injected where one is registered), used to resolve
+    ///     <c>secret:</c>-prefixed <c>Password</c> / <c>UserCertificatePassword</c> exactly as the runtime driver does.
+    ///     Null ⇒ a <c>secret:</c> ref fails closed (it is never sent as the literal).
+    /// </param>
+    public OpcUaClientDriverBrowser(ILogger<OpcUaClientDriverBrowser>? logger = null, ISecretResolver? secretResolver = null)
    {
        _logger = logger ?? NullLogger<OpcUaClientDriverBrowser>.Instance;
+        _secretResolver = secretResolver;
    }

    /// <inheritdoc />
@@ -58,9 +66,10 @@ public sealed class OpcUaClientDriverBrowser : IDriverBrowser
        if (string.IsNullOrWhiteSpace(endpoint))
            throw new InvalidOperationException("OpcUaClient browser requires EndpointUrl or EndpointUrls[0].");

-        if (opts.AuthType == OpcUaAuthType.Certificate)
-            throw new InvalidOperationException(
-                "Browser does not support OpcUaAuthType.Certificate in v1; use Anonymous or Username.");
+        // R06:O-5 — Certificate auth is supported: the identity is built (and any secret: credential resolved) by the
+        // same factory the runtime driver uses, BEFORE any network I/O, so a bad certificate path / password fails fast
+        // with its own message.
+        var identity = await BuildBrowseUserIdentityAsync(opts, _secretResolver, cancellationToken).ConfigureAwait(false);

        if (opts.AutoAcceptCertificates)
            _logger.LogWarning(
@@ -70,7 +79,6 @@ public sealed class OpcUaClientDriverBrowser : IDriverBrowser
                endpoint);

        var appConfig = await BuildBrowseAppConfigurationAsync(cancellationToken).ConfigureAwait(false);
-        var identity = BuildBrowseUserIdentity(opts);

        var perEndpointBudget = TimeSpan.FromSeconds(
            Math.Clamp(opts.PerEndpointConnectTimeout.TotalSeconds, 5, 30));
@@ -175,16 +183,20 @@ public sealed class OpcUaClientDriverBrowser : IDriverBrowser
        return config;
    }

-    /// <summary>Build the OPC UA user identity from the form's auth fields.</summary>
+    /// <summary>
+    ///     Build the OPC UA user identity from the form's auth fields — Anonymous, Username or Certificate — through
+    ///     the factory the runtime driver uses, after resolving any <c>secret:</c>-prefixed credential (fail-closed).
+    /// </summary>
    /// <param name="opts">Driver options carrying the form's auth fields.</param>
-    private static UserIdentity BuildBrowseUserIdentity(OpcUaClientDriverOptions opts) => opts.AuthType switch
+    /// <param name="secretResolver">The secret store, or null when none is available.</param>
+    /// <param name="ct">Cancellation token for the secret resolution.</param>
+    /// <returns>The identity the browse session activates with.</returns>
+    internal static async Task<UserIdentity> BuildBrowseUserIdentityAsync(
+        OpcUaClientDriverOptions opts, ISecretResolver? secretResolver, CancellationToken ct)
    {
-        OpcUaAuthType.Anonymous => new UserIdentity(new AnonymousIdentityToken()),
-        OpcUaAuthType.Username => new UserIdentity(
-            opts.Username ?? string.Empty,
-            System.Text.Encoding.UTF8.GetBytes(opts.Password ?? string.Empty)),
-        _ => new UserIdentity(new AnonymousIdentityToken()),
-    };
+        var resolved = await OpcUaUserIdentityFactory.ResolveSecretRefsAsync(opts, secretResolver, ct).ConfigureAwait(false);
+        return OpcUaUserIdentityFactory.Build(resolved);
+    }

    /// <summary>Select the endpoint matching the requested SecurityPolicy + SecurityMode pair.</summary>
    /// <param name="appConfig">Application configuration used by the discovery client.</param>
@@ -0,0 +1,115 @@
+using Opc.Ua;
+using ZB.MOM.WW.Secrets.Abstractions;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient;
+
+/// <summary>
+///     The ONE place the OpcUaClient user identity is built from <see cref="OpcUaClientDriverOptions"/> — shared by
+///     the runtime driver's session open and the AdminUI live browse, so a certificate-authenticated upstream is
+///     browsable with exactly the credentials the deployed driver will present. Includes the <c>secret:</c>
+///     resolution of the two credential fields (fail-closed).
+/// </summary>
+public static class OpcUaUserIdentityFactory
+{
+    private const string SecretPrefix = "secret:";
+
+    /// <summary>
+    ///     Build the user-identity token from options whose credential fields are already resolved plaintext
+    ///     (see <see cref="ResolveSecretRefsAsync"/>).
+    /// </summary>
+    /// <param name="options">Driver options containing authentication configuration.</param>
+    /// <returns>The constructed <see cref="UserIdentity"/> for session activation.</returns>
+    public static UserIdentity Build(OpcUaClientDriverOptions options) =>
+        options.AuthType switch
+        {
+            OpcUaAuthType.Anonymous => new UserIdentity(new AnonymousIdentityToken()),
+            OpcUaAuthType.Username => new UserIdentity(
+                options.Username ?? string.Empty,
+                System.Text.Encoding.UTF8.GetBytes(options.Password ?? string.Empty)),
+            OpcUaAuthType.Certificate => FromCertificate(options),
+            _ => new UserIdentity(new AnonymousIdentityToken()),
+        };
+
+    /// <summary>
+    ///     Build a <see cref="UserIdentity"/> carrying a client user-authentication certificate loaded from
+    ///     <see cref="OpcUaClientDriverOptions.UserCertificatePath"/>. Fails fast if the path is missing, the file
+    ///     doesn't exist, or the certificate lacks a private key (required to sign the user-token challenge).
+    /// </summary>
+    /// <param name="options">Driver options containing certificate configuration.</param>
+    /// <returns>The certificate-backed <see cref="UserIdentity"/>.</returns>
+    public static UserIdentity FromCertificate(OpcUaClientDriverOptions options)
+    {
+        if (string.IsNullOrWhiteSpace(options.UserCertificatePath))
+            throw new InvalidOperationException(
+                "OpcUaAuthType.Certificate requires OpcUaClientDriverOptions.UserCertificatePath to be set.");
+        if (!File.Exists(options.UserCertificatePath))
+            throw new FileNotFoundException(
+                $"User certificate not found at '{options.UserCertificatePath}'.",
+                options.UserCertificatePath);
+
+        // X509CertificateLoader (new in .NET 9) is the only non-obsolete way to load a PFX
+        // since the legacy X509Certificate2 ctors are marked obsolete on net10.
+        var cert = System.Security.Cryptography.X509Certificates.X509CertificateLoader
+            .LoadPkcs12FromFile(options.UserCertificatePath, options.UserCertificatePassword);
+
+        if (!cert.HasPrivateKey)
+            throw new InvalidOperationException(
+                $"User certificate at '{options.UserCertificatePath}' has no private key — " +
+                "the private key is required to sign the OPC UA user-token challenge at session activation.");
+
+        return new UserIdentity(cert);
+    }
+
+    /// <summary>
+    ///     Return a copy of <paramref name="options"/> with any <c>secret:</c>-prefixed
+    ///     <see cref="OpcUaClientDriverOptions.Password"/> / <see cref="OpcUaClientDriverOptions.UserCertificatePassword"/>
+    ///     resolved through <paramref name="resolver"/>. Non-secret / null / empty fields pass through unchanged (the
+    ///     reference-equal original is returned when nothing changed). Fail-closed: an absent secret, or a
+    ///     <c>secret:</c> ref with no resolver available, throws rather than sending the literal as a credential.
+    /// </summary>
+    /// <param name="options">The raw options (credential fields may carry <c>secret:</c> refs).</param>
+    /// <param name="resolver">The shared secret resolver, or null when none is available.</param>
+    /// <param name="ct">Cancellation token.</param>
+    /// <returns>An options copy whose credential fields carry resolved plaintext.</returns>
+    public static async Task<OpcUaClientDriverOptions> ResolveSecretRefsAsync(
+        OpcUaClientDriverOptions options, ISecretResolver? resolver, CancellationToken ct)
+    {
+        ArgumentNullException.ThrowIfNull(options);
+
+        var password = await ResolveFieldAsync(options.Password, nameof(options.Password), resolver, ct)
+            .ConfigureAwait(false);
+        var certPassword = await ResolveFieldAsync(
+            options.UserCertificatePassword, nameof(options.UserCertificatePassword), resolver, ct)
+            .ConfigureAwait(false);
+
+        if (ReferenceEquals(password, options.Password)
+            && ReferenceEquals(certPassword, options.UserCertificatePassword))
+        {
+            return options;
+        }
+
+        return options with { Password = password, UserCertificatePassword = certPassword };
+    }
+
+    private static async Task<string?> ResolveFieldAsync(
+        string? value, string fieldName, ISecretResolver? resolver, CancellationToken ct)
+    {
+        if (string.IsNullOrEmpty(value)
+            || !value.StartsWith(SecretPrefix, StringComparison.OrdinalIgnoreCase))
+        {
+            return value;
+        }
+
+        var name = value[SecretPrefix.Length..];
+        if (resolver is null)
+            throw new InvalidOperationException(
+                $"OpcUaClientDriverOptions.{fieldName}='{value}' references secret '{name}', but no secret store is " +
+                "available here (fail-closed).");
+        var resolved = await resolver.GetAsync(new SecretName(name), ct).ConfigureAwait(false);
+        return !string.IsNullOrEmpty(resolved)
+            ? resolved
+            : throw new InvalidOperationException(
+                $"OpcUaClientDriverOptions.{fieldName}='{value}' resolves secret '{name}', but it is " +
+                "absent from the store (fail-closed).");
+    }
+}
@@ -0,0 +1,65 @@
+using Opc.Ua;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient;
+
+/// <summary>
+///     The ONE mapping from an upstream variable's OPC UA attributes (DataType, ValueRank, AccessLevel) to the
+///     driver-agnostic shape — shared by the runtime driver's discovery enrichment and the AdminUI live browse
+///     side-panel, so the picker shows exactly what a browse-commit / discovery would register.
+/// </summary>
+public static class UpstreamAttributeMapping
+{
+    /// <summary>
+    ///     Map an upstream OPC UA built-in DataType NodeId (via <c>DataTypeIds.*</c>) to a
+    ///     <see cref="DriverDataType"/>. Unknown / custom types fall through to
+    ///     <see cref="DriverDataType.String"/> which is the safest passthrough for
+    ///     Variant-wrapped structs + enums + extension objects.
+    /// </summary>
+    /// <param name="dataType">The OPC UA data type NodeId to map.</param>
+    /// <returns>The mapped <see cref="DriverDataType"/>.</returns>
+    public static DriverDataType MapDataType(NodeId dataType)
+    {
+        if (dataType == DataTypeIds.Boolean) return DriverDataType.Boolean;
+        // SByte (signed 8-bit) shares Int16 — DriverDataType has no narrower signed type.
+        // Byte (unsigned 8-bit) belongs in the unsigned family → UInt16, not Int16
+        // (mapping an unsigned 0-255 type onto Int16 misrepresents type metadata and
+        // confuses range/validation logic keyed off DriverDataType).
+        if (dataType == DataTypeIds.SByte || dataType == DataTypeIds.Int16) return DriverDataType.Int16;
+        if (dataType == DataTypeIds.Byte || dataType == DataTypeIds.UInt16) return DriverDataType.UInt16;
+        if (dataType == DataTypeIds.Int32) return DriverDataType.Int32;
+        if (dataType == DataTypeIds.UInt32) return DriverDataType.UInt32;
+        if (dataType == DataTypeIds.Int64) return DriverDataType.Int64;
+        if (dataType == DataTypeIds.UInt64) return DriverDataType.UInt64;
+        if (dataType == DataTypeIds.Float) return DriverDataType.Float32;
+        if (dataType == DataTypeIds.Double) return DriverDataType.Float64;
+        if (dataType == DataTypeIds.String) return DriverDataType.String;
+        if (dataType == DataTypeIds.DateTime || dataType == DataTypeIds.UtcTime)
+            return DriverDataType.DateTime;
+        return DriverDataType.String;
+    }
+
+    /// <summary>
+    ///     Map an OPC UA AccessLevel/UserAccessLevel attribute value (<c>AccessLevels</c> bitmask) to a
+    ///     <see cref="SecurityClassification"/>: CurrentWrite-capable variables surface as
+    ///     <see cref="SecurityClassification.Operate"/>; read-only as <see cref="SecurityClassification.ViewOnly"/>.
+    /// </summary>
+    /// <param name="accessLevel">The OPC UA access level bitmask.</param>
+    /// <returns>The mapped security classification.</returns>
+    public static SecurityClassification MapAccessLevel(byte accessLevel)
+    {
+        const byte CurrentWrite = 2; // AccessLevels.CurrentWrite = 0x02
+        return (accessLevel & CurrentWrite) != 0
+            ? SecurityClassification.Operate
+            : SecurityClassification.ViewOnly;
+    }
+
+    /// <summary>
+    ///     OPC UA Part 3 ValueRank: -3 ScalarOrOneDimension, -2 Any, -1 Scalar, 0 OneOrMoreDimensions, 1 OneDimension,
+    ///     &gt;1 N dimensions. Anything &gt;= 0 is an array; -3 / -2 are conservatively scalar until the upstream variable
+    ///     carries a concrete dimensioned rank.
+    /// </summary>
+    /// <param name="valueRank">The ValueRank attribute.</param>
+    /// <returns>Whether the variable is exposed as an array.</returns>
+    public static bool IsArray(int valueRank) => valueRank >= 0;
+}
@@ -11,8 +11,9 @@
    </PropertyGroup>
    <!--
        The live-OPC-UA-session layer of the OpcUaClient driver: everything the driver AND the AdminUI's
-        browser both need that is typed in ISession / NodeId / NamespaceTable. Today that is exactly
-        NamespaceMap.
+        browser both need that is typed in ISession / NodeId / NamespaceTable / UserIdentity: NamespaceMap,
+        UpstreamAttributeMapping (DataType/AccessLevel/ValueRank -> driver shape) and OpcUaUserIdentityFactory
+        (credential secret: resolution + the SDK UserIdentity, incl. certificate auth).

        WHY IT IS NOT IN .Contracts. It used to be, and .Contracts therefore carried
        OPCFoundation.NetStandard.Opc.Ua.Client. When G-7 wired OpcUaClientTagDefinitionFactory.Inspect into
@@ -35,6 +36,10 @@
    -->
    <ItemGroup>
        <PackageReference Include="OPCFoundation.NetStandard.Opc.Ua.Client" />
+        <!-- OpcUaUserIdentityFactory: the secret: resolution of the credential fields feeding the SDK UserIdentity is
+             shared by the driver and the AdminUI browse (review 2026-10-21 O-5), so the browse presents exactly the
+             credentials the deployed driver will. Abstractions only (one interface + a name type). -->
+        <PackageReference Include="ZB.MOM.WW.Secrets.Abstractions" />
    </ItemGroup>
    <ItemGroup>
        <!-- RawTagEntry (the v3 authored-tag identity NamespaceMap indexes) lives in the Core.Abstractions
@@ -967,15 +967,7 @@ public sealed class OpcUaClientDriver : IDriver, ITagDiscovery, IReadable, IWrit
    /// <param name="options">Driver options containing authentication configuration.</param>
    /// <returns>The constructed <see cref="UserIdentity"/> for session activation.</returns>
    internal static UserIdentity BuildUserIdentity(OpcUaClientDriverOptions options) =>
-        options.AuthType switch
-        {
-            OpcUaAuthType.Anonymous => new UserIdentity(new AnonymousIdentityToken()),
-            OpcUaAuthType.Username => new UserIdentity(
-                options.Username ?? string.Empty,
-                System.Text.Encoding.UTF8.GetBytes(options.Password ?? string.Empty)),
-            OpcUaAuthType.Certificate => BuildCertificateIdentity(options),
-            _ => new UserIdentity(new AnonymousIdentityToken()),
-        };
+        OpcUaUserIdentityFactory.Build(options);

    /// <summary>
    ///     Open a session against a single endpoint URL. Bounded by
@@ -1095,30 +1087,8 @@ public sealed class OpcUaClientDriver : IDriver, ITagDiscovery, IReadable, IWrit
    /// </summary>
    /// <param name="options">Driver options containing certificate configuration.</param>
    /// <returns>The certificate-backed <see cref="UserIdentity"/>.</returns>
-    internal static UserIdentity BuildCertificateIdentity(OpcUaClientDriverOptions options)
-    {
-        if (string.IsNullOrWhiteSpace(options.UserCertificatePath))
-            throw new InvalidOperationException(
-                "OpcUaAuthType.Certificate requires OpcUaClientDriverOptions.UserCertificatePath to be set.");
-        if (!System.IO.File.Exists(options.UserCertificatePath))
-            throw new System.IO.FileNotFoundException(
-                $"User certificate not found at '{options.UserCertificatePath}'.",
-                options.UserCertificatePath);
-
-        // X509CertificateLoader (new in .NET 9) is the only non-obsolete way to load a PFX
-        // since the legacy X509Certificate2 ctors are marked obsolete on net10. Passes the
-        // password through verbatim; PEM files with external keys fall back to
-        // LoadCertificateFromFile which picks up the adjacent .key if present.
-        var cert = System.Security.Cryptography.X509Certificates.X509CertificateLoader
-            .LoadPkcs12FromFile(options.UserCertificatePath, options.UserCertificatePassword);
-
-        if (!cert.HasPrivateKey)
-            throw new InvalidOperationException(
-                $"User certificate at '{options.UserCertificatePath}' has no private key — " +
-                "the private key is required to sign the OPC UA user-token challenge at session activation.");
-
-        return new UserIdentity(cert);
-    }
+    internal static UserIdentity BuildCertificateIdentity(OpcUaClientDriverOptions options) =>
+        OpcUaUserIdentityFactory.FromCertificate(options);

    /// <summary>Convert a driver <see cref="OpcUaSecurityPolicy"/> to the OPC UA policy URI.</summary>
    /// <param name="policy">The driver security policy to map.</param>
@@ -1804,7 +1774,7 @@ public sealed class OpcUaClientDriver : IDriver, ITagDiscovery, IReadable, IWrit
            // array dimension). -3 ScalarOrOneDimension and -2 Any are conservatively treated
            // as scalar — array-of-one is exposed as scalar to the local address space until
            // the upstream variable carries a concrete dimensioned rank.
-            var isArray = valueRank >= 0;
+            var isArray = UpstreamAttributeMapping.IsArray(valueRank);
            var access = StatusCode.IsGood(accessDv.StatusCode) && accessDv.Value is byte ab ? ab : (byte)0;
            var securityClass = MapAccessLevelToSecurityClass(access);
            var historizing = StatusCode.IsGood(histDv.StatusCode) && histDv.Value is bool b && b;
@@ -1842,26 +1812,8 @@ public sealed class OpcUaClientDriver : IDriver, ITagDiscovery, IReadable, IWrit
    /// </summary>
    /// <param name="dataType">The OPC UA data type NodeId to map.</param>
    /// <returns>The mapped <see cref="DriverDataType"/>.</returns>
-    internal static DriverDataType MapUpstreamDataType(NodeId dataType)
-    {
-        if (dataType == DataTypeIds.Boolean) return DriverDataType.Boolean;
-        // SByte (signed 8-bit) shares Int16 — DriverDataType has no narrower signed type.
-        // Byte (unsigned 8-bit) belongs in the unsigned family → UInt16, not Int16
-        // (mapping an unsigned 0-255 type onto Int16 misrepresents type metadata and
-        // confuses range/validation logic keyed off DriverDataType).
-        if (dataType == DataTypeIds.SByte || dataType == DataTypeIds.Int16) return DriverDataType.Int16;
-        if (dataType == DataTypeIds.Byte || dataType == DataTypeIds.UInt16) return DriverDataType.UInt16;
-        if (dataType == DataTypeIds.Int32) return DriverDataType.Int32;
-        if (dataType == DataTypeIds.UInt32) return DriverDataType.UInt32;
-        if (dataType == DataTypeIds.Int64) return DriverDataType.Int64;
-        if (dataType == DataTypeIds.UInt64) return DriverDataType.UInt64;
-        if (dataType == DataTypeIds.Float) return DriverDataType.Float32;
-        if (dataType == DataTypeIds.Double) return DriverDataType.Float64;
-        if (dataType == DataTypeIds.String) return DriverDataType.String;
-        if (dataType == DataTypeIds.DateTime || dataType == DataTypeIds.UtcTime)
-            return DriverDataType.DateTime;
-        return DriverDataType.String;
-    }
+    internal static DriverDataType MapUpstreamDataType(NodeId dataType) =>
+        UpstreamAttributeMapping.MapDataType(dataType);

    /// <summary>
    ///     Map an OPC UA AccessLevel/UserAccessLevel attribute value (<c>AccessLevels</c>
@@ -1871,13 +1823,8 @@ public sealed class OpcUaClientDriver : IDriver, ITagDiscovery, IReadable, IWrit
    /// </summary>
    /// <param name="accessLevel">The OPC UA access level bitmask.</param>
    /// <returns>The mapped security classification.</returns>
-    internal static SecurityClassification MapAccessLevelToSecurityClass(byte accessLevel)
-    {
-        const byte CurrentWrite = 2; // AccessLevels.CurrentWrite = 0x02
-        return (accessLevel & CurrentWrite) != 0
-            ? SecurityClassification.Operate
-            : SecurityClassification.ViewOnly;
-    }
+    internal static SecurityClassification MapAccessLevelToSecurityClass(byte accessLevel) =>
+        UpstreamAttributeMapping.MapAccessLevel(accessLevel);

    // ---- ISubscribable ----

@@ -21,8 +21,6 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient;
 /// </remarks>
 internal static class OpcUaClientSecretResolution
 {
-    private const string SecretPrefix = "secret:";
-
    /// <summary>
    ///     Return a copy of <paramref name="options"/> with any <c>secret:</c>-prefixed
    ///     <see cref="OpcUaClientDriverOptions.Password"/> /
@@ -37,54 +35,12 @@ internal static class OpcUaClientSecretResolution
    /// <exception cref="InvalidOperationException">
    ///     A <c>secret:</c> ref names a secret that is absent/tombstoned in the store (fail-closed).
    /// </exception>
-    internal static async Task<OpcUaClientDriverOptions> ResolveSecretRefsAsync(
+    internal static Task<OpcUaClientDriverOptions> ResolveSecretRefsAsync(
        OpcUaClientDriverOptions options, ISecretResolver resolver, CancellationToken ct)
    {
        ArgumentNullException.ThrowIfNull(options);
        ArgumentNullException.ThrowIfNull(resolver);
-
-        var password = await ResolveFieldAsync(options.Password, nameof(options.Password), resolver, ct)
-            .ConfigureAwait(false);
-        var certPassword = await ResolveFieldAsync(
-            options.UserCertificatePassword, nameof(options.UserCertificatePassword), resolver, ct)
-            .ConfigureAwait(false);
-
-        // Only re-materialize when something actually changed — a `with` on the reference-equal
-        // strings is harmless, but skipping it keeps the common (no-secret) case allocation-free.
-        if (ReferenceEquals(password, options.Password)
-            && ReferenceEquals(certPassword, options.UserCertificatePassword))
-        {
-            return options;
-        }
-
-        return options with { Password = password, UserCertificatePassword = certPassword };
-    }
-
-    /// <summary>
-    ///     Resolve a single credential field. Null/empty or non-<c>secret:</c> values pass through
-    ///     unchanged (the reference-equal original is returned). A <c>secret:NAME</c> value is
-    ///     resolved through <paramref name="resolver"/> and is fail-closed when the secret is absent.
-    /// </summary>
-    /// <param name="value">The raw field value (may be a <c>secret:</c> ref).</param>
-    /// <param name="fieldName">The field name, used in the fail-closed exception message.</param>
-    /// <param name="resolver">The shared secret resolver.</param>
-    /// <param name="ct">Cancellation token for the async resolution.</param>
-    /// <returns>The resolved plaintext, or the original value when it is not a <c>secret:</c> ref.</returns>
-    private static async Task<string?> ResolveFieldAsync(
-        string? value, string fieldName, ISecretResolver resolver, CancellationToken ct)
-    {
-        if (string.IsNullOrEmpty(value)
-            || !value.StartsWith(SecretPrefix, StringComparison.OrdinalIgnoreCase))
-        {
-            return value;
-        }
-
-        var name = value[SecretPrefix.Length..];
-        var resolved = await resolver.GetAsync(new SecretName(name), ct).ConfigureAwait(false);
-        return !string.IsNullOrEmpty(resolved)
-            ? resolved
-            : throw new InvalidOperationException(
-                $"OpcUaClientDriverOptions.{fieldName}='{value}' resolves secret '{name}', but it is " +
-                "absent from the store (fail-closed).");
+        // One authority, shared with the AdminUI live browse (Driver.OpcUaClient.Session).
+        return OpcUaUserIdentityFactory.ResolveSecretRefsAsync(options, resolver, ct);
    }
 }