refactor(mqtt): .Browser references .Driver — extract the client-options builder so the layering exception can go #512

New Issue

2026-07-27T13:50:30-04:00

dohertj2 commented

2026-07-27 13:50:30 -04:00

ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Browser.csproj carries a ProjectReference to
Driver.Mqtt (line 44) in addition to .Contracts. Every other driver's .Browser depends on
.Contracts only.

Why it was accepted. The browser needs to open its own broker connection, which means building MQTTnet
client options with the same TLS / CA-pinning / auth semantics the driver uses. Reusing
MqttConnection.BuildClientOptions was judged better than duplicating security-relevant TLS and CA-pin logic
in a second place, where the two copies would drift and one of them would drift open. The exception is
documented rather than silent.

Clean fix. Extract the pure options-building function to .Contracts (it is transport-free — it maps
MqttDriverOptions to client options; it does not connect), leaving MqttConnection as the only thing that
owns a live client. Then drop the .Driver reference from .Browser.

Guard against the wrong fix: do not resolve this by copy-pasting the TLS setup into the browser. The
duplication is the actual hazard the exception was taken to avoid.

Acceptance. .Browser references .Contracts only; one implementation of the TLS/CA-pin options builder
exists in the tree; the live browse suite still connects over TLS with CA pinning (both the pinned-good and
pinned-wrong cases).

`ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Browser.csproj` carries a `ProjectReference` to **`Driver.Mqtt`** (line 44) in addition to `.Contracts`. Every other driver's `.Browser` depends on `.Contracts` only. **Why it was accepted.** The browser needs to open its own broker connection, which means building MQTTnet client options with the same TLS / CA-pinning / auth semantics the driver uses. Reusing `MqttConnection.BuildClientOptions` was judged better than duplicating security-relevant TLS and CA-pin logic in a second place, where the two copies would drift and one of them would drift *open*. The exception is documented rather than silent. **Clean fix.** Extract the pure options-building function to `.Contracts` (it is transport-free — it maps `MqttDriverOptions` to client options; it does not connect), leaving `MqttConnection` as the only thing that owns a live client. Then drop the `.Driver` reference from `.Browser`. **Guard against the wrong fix:** do not resolve this by copy-pasting the TLS setup into the browser. The duplication is the actual hazard the exception was taken to avoid. **Acceptance.** `.Browser` references `.Contracts` only; one implementation of the TLS/CA-pin options builder exists in the tree; the live browse suite still connects over TLS with CA pinning (both the pinned-good and pinned-wrong cases).

dohertj2 added the driver/mqtt label 2026-07-27 13:50:30 -04:00

dohertj2 referenced this issue from a commit

2026-07-27 13:52:13 -04:00

docs(drivers): un-stale the MQTT README rows + track every known gap as an issue

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: dohertj2/lmxopcua#512

refactor(mqtt): .Browser references .Driver — extract the client-options builder so the layering exception can go #512

refactor(mqtt): `.Browser` references `.Driver` — extract the client-options builder so the layering exception can go #512