lmxopcua/src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/OpcUaApplicationHost.cs

using System.Text;
using Microsoft.Extensions.Logging;
using Opc.Ua;
using Opc.Ua.Configuration;
using Opc.Ua.Identity;
using Opc.Ua.Server;
using ZB.MOM.WW.OtOpcUa.Core.Authorization;
using ZB.MOM.WW.OtOpcUa.OpcUaServer.Security;

namespace ZB.MOM.WW.OtOpcUa.OpcUaServer;

/// <summary>
/// Transport-security profile served by the OPC UA endpoint. F13b ships the three baseline
/// profiles defined by docs/security.md; the remaining Aes128/Aes256 variants can be added
/// later by extending <see cref="OpcUaSecurityProfile.PolicyUri"/>+<see cref="OpcUaSecurityProfile.Mode"/>
/// — the wiring in <c>BuildConfigurationAsync</c> is profile-agnostic.
/// </summary>
public enum OpcUaSecurityProfile
{
    /// <summary>No signing or encryption. Dev / isolated networks only.</summary>
    None,
    /// <summary>Basic256Sha256 + Sign. Messages signed, payload visible on the wire.</summary>
    Basic256Sha256Sign,
    /// <summary>Basic256Sha256 + SignAndEncrypt. Full transport protection.</summary>
    Basic256Sha256SignAndEncrypt,
}

/// <summary>Configuration options for OPC UA application hosting.</summary>
public sealed class OpcUaApplicationHostOptions
{
    /// <summary>Gets or sets the application name (default "OtOpcUa").</summary>
    public string ApplicationName { get; set; } = "OtOpcUa";

    /// <summary>Gets or sets the application URI (default "urn:OtOpcUa").</summary>
    public string ApplicationUri { get; set; } = "urn:OtOpcUa";

    /// <summary>Gets or sets the product URI (default "https://zb.com/otopcua").</summary>
    public string ProductUri { get; set; } = "https://zb.com/otopcua";

    /// <summary>Listening port for the binary endpoint (default 4840).</summary>
    public int OpcUaPort { get; set; } = 4840;

    /// <summary>Hostname or IP advertised in endpoint descriptions.</summary>
    public string PublicHostname { get; set; } = "0.0.0.0";

    /// <summary>Application config XML path; when set, loaded instead of building from defaults.</summary>
    public string? ApplicationConfigPath { get; set; }

    /// <summary>
    /// Root of the application's PKI hierarchy. Sub-stores (<c>own</c>, <c>issuer</c>,
    /// <c>trusted</c>, <c>rejected</c>) are created under this path on first start. Defaults
    /// to "pki" (relative to the host's working directory) to keep dev flows identical to v1.
    /// </summary>
    public string PkiStoreRoot { get; set; } = "pki";

    /// <summary>
    ///     Whether anonymous sessions may connect at all. When <see langword="false"/> the
    ///     Anonymous token policy is not advertised AND anonymous activation is rejected, so a client
    ///     must present an API key.
    /// </summary>
    /// <remarks>
    ///     <para>
    ///         <b>Defaults to <see langword="true"/> deliberately, which preserves today's behaviour.</b>
    ///         Flipping the default would silently deny every client that has no key the moment this
    ///         code deploys — including ScadaBridge's Data Connection Layer, which consumes this address
    ///         space from another repo. Turning it off is the deployment-time decision that makes keys
    ///         mandatory, and it belongs in the rollout once keys have been issued.
    ///     </para>
    ///     <para>
    ///         Note this controls <i>admission</i>, not authority. An admitted anonymous session is a
    ///         normal principal (<c>anonymous</c>) whose grants come from <c>NodeAcl</c> rows naming it,
    ///         exactly like a key's principal — there is no anonymous bypass branch in the evaluator.
    ///         When a wired data-plane authorizer is enabled, per-node ACL checks apply to anonymous
    ///         sessions, including reads. Reads denied by the node manager return <c>BadUserAccessDenied</c>.
    ///         With the authorizer disabled or not wired, reads retain the legacy behaviour without
    ///         per-node ACL enforcement.
    ///     </para>
    /// </remarks>
    public bool AllowAnonymous { get; set; } = true;

    /// <summary>
    /// Transport-security profiles exposed by the server. The SDK publishes one endpoint
    /// descriptor per profile and clients choose at session open. Default = all three
    /// baseline profiles (None + Basic256Sha256 in both modes); production deployments
    /// typically drop None.
    /// </summary>
    public IList<OpcUaSecurityProfile> EnabledSecurityProfiles { get; set; } = new List<OpcUaSecurityProfile>
    {
        OpcUaSecurityProfile.None,
        OpcUaSecurityProfile.Basic256Sha256Sign,
        OpcUaSecurityProfile.Basic256Sha256SignAndEncrypt,
    };

    /// <summary>
    /// When true, unknown client certificates are auto-added to the trusted store on first
    /// connection. Convenient for dev; should be false in production (operators promote via
    /// the Admin UI). Has no effect on <c>None</c> endpoints, which don't exchange certs.
    /// </summary>
    public bool AutoAcceptUntrustedClientCertificates { get; set; }

    /// <summary>
    /// Peer server URIs published in <c>Server.ServerArray</c> after start, in addition to
    /// the local <see cref="ApplicationUri"/>. Empty by default — set this on warm-redundancy
    /// deployments so OPC UA clients can discover the partner endpoint via the standard
    /// Server.ServerArray property (NodeId i=2254). Order does not matter; the local URI
    /// is always element 0.
    /// </summary>
    public IList<string> PeerApplicationUris { get; set; } = new List<string>();

    /// <summary>
    ///     SDK request-processing and transport quotas (<c>OpcUa:Quotas:*</c>, review 01 P6). The defaults are
    ///     exactly the values that used to be hard-coded (5 / 100 / 200 request threads and queue) and the SDK's
    ///     own transport defaults, so an absent section changes nothing.
    /// </summary>
    public OpcUaQuotaOptions Quotas { get; set; } = new();
}

/// <summary>
///     The <c>OpcUa:Quotas</c> section: the SDK's request-thread / queue ceilings and its transport quotas.
///     Request quotas carry the former hard-coded defaults; a transport quota left <c>null</c> keeps the SDK
///     default (<see cref="TransportQuotas"/>'s constructor values).
/// </summary>
public sealed class OpcUaQuotaOptions
{
    /// <summary>Minimum SDK request-processing threads (default 5).</summary>
    public int MinRequestThreadCount { get; set; } = 5;

    /// <summary>Maximum SDK request-processing threads (default 100).</summary>
    public int MaxRequestThreadCount { get; set; } = 100;

    /// <summary>Requests the SDK queues before refusing with <c>BadTooManyOperations</c> (default 200) — the
    /// burst ceiling review 01 P6 flagged.</summary>
    public int MaxQueuedRequestCount { get; set; } = 200;

    /// <summary>Per-operation timeout in milliseconds; <c>null</c> keeps the SDK default.</summary>
    public int? OperationTimeoutMs { get; set; }

    /// <summary>Largest string the transport decodes; <c>null</c> keeps the SDK default.</summary>
    public int? MaxStringLength { get; set; }

    /// <summary>Largest byte string the transport decodes; <c>null</c> keeps the SDK default.</summary>
    public int? MaxByteStringLength { get; set; }

    /// <summary>Largest array the transport decodes; <c>null</c> keeps the SDK default.</summary>
    public int? MaxArrayLength { get; set; }

    /// <summary>Largest message the transport accepts, in bytes; <c>null</c> keeps the SDK default.</summary>
    public int? MaxMessageSize { get; set; }

    /// <summary>Transport buffer size in bytes; <c>null</c> keeps the SDK default.</summary>
    public int? MaxBufferSize { get; set; }

    /// <summary>Secure-channel lifetime in milliseconds; <c>null</c> keeps the SDK default.</summary>
    public int? ChannelLifetimeMs { get; set; }

    /// <summary>Security-token lifetime in milliseconds; <c>null</c> keeps the SDK default.</summary>
    public int? SecurityTokenLifetimeMs { get; set; }
}

/// <summary>
/// Thin facade over the OPC Foundation .NET Standard SDK's application bootstrap.
/// Owns the <see cref="ApplicationInstance"/> + <see cref="ApplicationConfiguration"/> lifetime,
/// builds the <see cref="ApplicationConfiguration"/> programmatically (security profiles + user
/// token policies + PKI stores), installs an SDK identity-registry authenticator before
/// the <see cref="OtOpcUaSdkServer"/> opens its listeners via
/// <see cref="IOpcUaUserAuthenticator"/>, and publishes the redundancy peer URIs through
/// <c>Server.ServerArray</c>. See <c>docs/OpcUaServer.md</c> and <c>docs/security.md</c>.
/// </summary>
public sealed class OpcUaApplicationHost : IAsyncDisposable
{
    private readonly OpcUaApplicationHostOptions _options;
    private readonly IOpcUaUserAuthenticator _userAuthenticator;
    private readonly ILogger<OpcUaApplicationHost> _logger;
    private ApplicationInstance? _application;
    private StandardServer? _server;
    private readonly ITelemetryContext _telemetry = DefaultTelemetry.Create(_ => { });
    private readonly List<IUserTokenAuthenticator> _identityAuthenticators = [];

    /// <summary>Initializes a new instance of the OPC UA application host.</summary>
    /// <param name="options">The host configuration options.</param>
    /// <param name="logger">The logger for diagnostic output.</param>
    /// <param name="userAuthenticator">An optional user authenticator for UserName tokens; uses null implementation if not provided.</param>
    public OpcUaApplicationHost(
        OpcUaApplicationHostOptions options,
        ILogger<OpcUaApplicationHost> logger,
        IOpcUaUserAuthenticator? userAuthenticator = null)
    {
        _options = options;
        _logger = logger;
        _userAuthenticator = userAuthenticator ?? NullOpcUaUserAuthenticator.Instance;
    }

    /// <summary>Gets the OPC Foundation application instance, or null if not yet started.</summary>
    public ApplicationInstance? ApplicationInstance => _application;

    /// <summary>Gets the OPC UA server instance, or null if not yet started.</summary>
    public StandardServer? Server => _server;

    /// <summary>Starts the OPC UA application and server.</summary>
    /// <param name="server">The standard server instance to start.</param>
    /// <param name="cancellationToken">A cancellation token for the operation.</param>
    /// <returns>A task that represents the asynchronous operation.</returns>
    public async Task StartAsync(StandardServer server, CancellationToken cancellationToken)
    {
        if (server is not OtOpcUaSdkServer sdkServer)
            throw new ArgumentException("The server must support application authentication before its listeners open.", nameof(server));
        _server = server;
        // ApplicationInstance receives the host's ITelemetryContext. DefaultTelemetry.Create wires
        // the SDK's internal logging; an empty builder keeps
        // the SDK's trace off our ILogger (the host keeps its own _logger) — sufficient for the bootstrap.
        _application = new ApplicationInstance(_telemetry)
        {
            ApplicationName = _options.ApplicationName,
            ApplicationType = ApplicationType.Server,
            ConfigSectionName = "OtOpcUa",
        };

        try
        {
            _ = await BuildConfigurationAsync(cancellationToken);
            await EnsureApplicationCertificateAsync(cancellationToken).ConfigureAwait(false);
            AttachUserAuthenticator(sdkServer);
            await _application.StartAsync(server, cancellationToken).ConfigureAwait(false);
            PopulateServerArray();
        }
        catch
        {
            await DisposeAsync().ConfigureAwait(false);
            throw;
        }

        _logger.LogInformation("OPC UA server started on opc.tcp://{Host}:{Port}",
            _options.PublicHostname, _options.OpcUaPort);
    }

    private void AttachUserAuthenticator(OtOpcUaSdkServer server)
    {
        foreach (var type in new[] { UserTokenType.Anonymous, UserTokenType.UserName })
        {
            var adapter = new ApplicationTokenAuthenticator(this, type);
            _identityAuthenticators.Add(adapter);
        }
        server.ConfigureIdentityAuthenticators(_identityAuthenticators);
    }

    private sealed class ApplicationTokenAuthenticator(OpcUaApplicationHost host, UserTokenType tokenType)
        : IUserTokenAuthenticator
    {
        public UserTokenType TokenType => tokenType;
        public string? IssuedTokenProfileUri => null;

        public async ValueTask<AuthenticationResult> AuthenticateAsync(AuthenticationContext context, CancellationToken ct = default)
        {
            ct.ThrowIfCancellationRequested();
            var args = new ImpersonateEventArgs(context.TokenHandler, context.UserTokenPolicy, context.EndpointDescription);
            var peer = (host._server as OtOpcUaSdkServer)?.ActivationPeerAddress;
            // Port zero is only an adapter for the existing IP-budget seam: the SDK exposes no peer port.
            await HandleImpersonationAsync(host._userAuthenticator, args, host._logger, host._options.AllowAnonymous,
                peer is null ? null : new System.Net.IPEndPoint(peer, 0), ct).ConfigureAwait(false);
            return ServiceResult.IsBad(args.IdentityValidationError)
                ? AuthenticationResult.Reject(args.IdentityValidationError)
                : args.Identity is { } identity
                    ? AuthenticationResult.Accept(identity)
                    : AuthenticationResult.Reject(new ServiceResult(StatusCodes.BadIdentityTokenRejected));
        }
    }

    /// <summary>
    /// Publishes <see cref="OpcUaApplicationHostOptions.PeerApplicationUris"/> via the OPC UA
    /// standard <c>Server.ServerArray</c> property (NodeId i=2254) so warm-redundancy clients
    /// can discover the partner endpoint.
    ///
    /// The wire-served value of <c>Server.ServerArray</c> comes from
    /// <see cref="IServerInternal.ServerUris"/> (an <see cref="Opc.Ua.StringTable"/>) via the
    /// SDK's <c>OnReadServerArray</c> callback — writes to
    /// <c>ServerObject.ServerArray.Value</c> are NOT what clients read. The SDK auto-populates
    /// slot 0 with the local <c>ApplicationUri</c> on <c>ApplicationInstance.Start</c>; we
    /// append the configured peers at slots 1, 2, … here.
    ///
    /// The address-space property is also mirrored for in-process readers (the unit-test
    /// observation seam) and as a defensive belt-and-braces measure.
    /// </summary>
    private void PopulateServerArray()
    {
        var internalData = _server?.CurrentInstance;
        if (internalData is null) return;

        // Wire path: append peers to IServerInternal.ServerUris — this is what
        // OnReadServerArray serves to remote clients reading VariableIds.Server_ServerArray.
        var serverUris = internalData.ServerUris;
        var existing = new HashSet<string>(StringComparer.Ordinal);
        for (uint i = 0; i < (uint)serverUris.Count; i++)
        {
            var existingUri = serverUris.GetString(i);
            if (existingUri is not null) existing.Add(existingUri);
        }

        foreach (var peer in _options.PeerApplicationUris)
        {
            if (string.IsNullOrWhiteSpace(peer)) continue;
            if (existing.Contains(peer)) continue;
            serverUris.Append(peer);
            existing.Add(peer);
        }

        // In-process mirror: ServerObject.ServerArray.Value is consulted by some tests and
        // tooling that read the SDK's address-space model directly rather than going through
        // a session. Harmless on the wire (the SDK ignores it) but useful in-VM.
        var serverObject = internalData.ServerObject;
        if (serverObject is not null)
        {
            var uris = new List<string> { _options.ApplicationUri };
            foreach (var peer in _options.PeerApplicationUris)
            {
                if (!string.IsNullOrWhiteSpace(peer) && !uris.Contains(peer))
                    uris.Add(peer);
            }
            serverObject.ServerArray!.Value = (ArrayOf<string>)uris;
        }
    }

    /// <summary>
    /// Pure(-ish) impersonation handler: extracted so unit tests can drive it without booting
    /// the full SDK. Side-effects are confined to mutating <see cref="ImpersonateEventArgs"/>
    /// and logging.
    /// </summary>
    /// <remarks>
    /// The registry path awaits authentication outside the SDK event lock. This synchronous observation
    /// seam remains for existing handler tests; production invokes the asynchronous implementation directly.
    /// </remarks>
    /// <param name="authenticator">The user authenticator to validate credentials.</param>
    /// <param name="args">The impersonation event arguments to process.</param>
    /// <param name="logger">The logger for diagnostic output.</param>
    /// <param name="allowAnonymous">Whether anonymous sessions may connect.</param>
    /// <param name="remoteEndpoint">The activating client's IP endpoint when known (lmxopcua#751), handed to
    /// the authenticator for per-client accounting; null when it could not be resolved.</param>
    internal static void HandleImpersonation(
        IOpcUaUserAuthenticator authenticator,
        ImpersonateEventArgs args,
        ILogger logger,
        bool allowAnonymous = true,
        System.Net.IPEndPoint? remoteEndpoint = null)
        => HandleImpersonationAsync(authenticator, args, logger, allowAnonymous, remoteEndpoint)
            .AsTask().GetAwaiter().GetResult();

    private static async ValueTask HandleImpersonationAsync(
        IOpcUaUserAuthenticator authenticator, ImpersonateEventArgs args, ILogger logger,
        bool allowAnonymous = true, System.Net.IPEndPoint? remoteEndpoint = null,
        CancellationToken cancellationToken = default)
    {
        if (args.UserIdentityTokenHandler.Token is AnonymousIdentityToken anonymousToken)
        {
            await HandleAnonymousImpersonationAsync(authenticator, args, logger, allowAnonymous, anonymousToken, cancellationToken).ConfigureAwait(false);
            return;
        }

        if (args.UserIdentityTokenHandler.Token is not UserNameIdentityToken token)
        {
            // X509 tokens — let the SDK's default validation stand.
            return;
        }

        string password;
        try
        {
            // The SDK UserName token handler exposes decrypted password bytes; decode the wire UTF-8.
            var decryptedBytes = (args.UserIdentityTokenHandler as UserNameIdentityTokenHandler)?.DecryptedPassword;
            password = decryptedBytes is null ? string.Empty : Encoding.UTF8.GetString(decryptedBytes);
        }
        catch (Exception ex)
        {
            logger.LogWarning(ex, "OpcUaApplicationHost: failed to decrypt UserName token");
            args.IdentityValidationError = ServiceResult.Create(StatusCodes.BadIdentityTokenRejected, "UserName token decryption failed");
            return;
        }

        OpcUaUserAuthResult result;
        try
        {
            result = await authenticator
                .AuthenticateUserNameAsync(token.UserName ?? string.Empty, password, remoteEndpoint, cancellationToken)
                .ConfigureAwait(false);
        }
        catch (Exception ex)
        {
            logger.LogError(ex, "OpcUaApplicationHost: UserName authenticator threw for {User}", token.UserName);
            args.IdentityValidationError = ServiceResult.Create(StatusCodes.BadIdentityTokenRejected, "Authentication failed");
            return;
        }

        if (!result.Success)
        {
            logger.LogInformation("OpcUaApplicationHost: UserName auth denied for {User}: {Error}",
                token.UserName, result.Error);
            args.IdentityValidationError = ServiceResult.Create(StatusCodes.BadIdentityTokenRejected, result.Error ?? "Invalid credentials");
            return;
        }

        args.Identity = new RoleCarryingUserIdentity(token, result.Roles, result.Principal, result.ApiKeyId);
        logger.LogInformation("OpcUaApplicationHost: UserName auth granted for {User} as {Principal} ({Roles})",
            token.UserName, result.Principal, string.Join(",", result.Roles));
    }

    /// <summary>
    ///     Admits or rejects an anonymous session, and — when admitted — attaches the roles the
    ///     <c>anonymous</c> principal has been granted.
    /// </summary>
    /// <remarks>
    ///     Previously this path simply returned, leaving the SDK's default identity in place: anonymous
    ///     always connected and carried no roles. Two things change. Anonymous can now be refused
    ///     outright, and when admitted it is a normal principal whose grants come from ACL rows, so it
    ///     can be given read or write like any key. The identity attached is the same
    ///     <see cref="RoleCarryingUserIdentity"/> the UserName path uses, so every downstream gate reads
    ///     it identically and there is no anonymous-shaped branch in any of them.
    /// </remarks>
    private static async ValueTask HandleAnonymousImpersonationAsync(
        IOpcUaUserAuthenticator authenticator,
        ImpersonateEventArgs args,
        ILogger logger,
        bool allowAnonymous,
        AnonymousIdentityToken token, CancellationToken cancellationToken)
    {
        if (!allowAnonymous)
        {
            logger.LogInformation(
                "OpcUaApplicationHost: anonymous session rejected (OpcUa:AllowAnonymous is false)");
            args.IdentityValidationError = ServiceResult.Create(StatusCodes.BadIdentityTokenRejected, "Anonymous access is disabled on this server.");
            return;
        }

        OpcUaUserAuthResult result;
        try
        {
            result = await authenticator.AuthenticateAnonymousAsync(cancellationToken).ConfigureAwait(false);
        }
        catch (Exception ex)
        {
            // Fail closed. An anonymous session whose grants could not be resolved must not fall through
            // to the SDK default identity, because that would silently ADMIT it — the previous
            // behaviour — at exactly the moment we could not determine what it is allowed to do.
            logger.LogError(ex, "OpcUaApplicationHost: anonymous authenticator threw");
            args.IdentityValidationError = ServiceResult.Create(StatusCodes.BadIdentityTokenRejected, "Anonymous access is unavailable.");
            return;
        }

        if (!result.Success)
        {
            logger.LogInformation("OpcUaApplicationHost: anonymous session denied: {Error}", result.Error);
            args.IdentityValidationError = ServiceResult.Create(StatusCodes.BadIdentityTokenRejected, result.Error ?? "Anonymous access is denied.");
            return;
        }

        args.Identity = new RoleCarryingUserIdentity(token, result.Roles, result.Principal, apiKeyId: null);
        logger.LogInformation("OpcUaApplicationHost: anonymous session admitted as {Principal} ({Roles})",
            OpcUaPrincipals.Anonymous,
            result.Roles.Count == 0 ? "no roles" : string.Join(",", result.Roles));
    }

    /// <summary>
    /// Guarantees the application instance certificate exists in <c>{PkiStoreRoot}/own</c>.
    /// The SDK auto-creates a self-signed certificate the first time this is called on a fresh
    /// PKI tree; subsequent boots reuse the existing cert. Replaces v1's manual "you must
    /// pre-create the PKI directory tree" friction. Partial slice of follow-up F13 — the
    /// remaining endpoint-security, user-token validator, and observability wiring stays in
    /// the follow-up queue.
    /// </summary>
    private async Task EnsureApplicationCertificateAsync(CancellationToken cancellationToken)
    {
        // silent: false → SDK logs cert creation events through its own trace plumbing.
        // A null lifetime keeps the SDK default (12 months). Key-size policy comes from the configuration.
        var ok = await _application!.CheckApplicationInstanceCertificatesAsync(
            false, null, cancellationToken).ConfigureAwait(false);
        if (!ok)
        {
            throw new InvalidOperationException(
                $"OPC UA application certificate validation failed for {_options.ApplicationName}. " +
                $"Cert store root: {Path.GetFullPath(_options.PkiStoreRoot)}");
        }
    }

    private async Task<ApplicationConfiguration> BuildConfigurationAsync(CancellationToken ct)
    {
        if (!string.IsNullOrWhiteSpace(_options.ApplicationConfigPath))
        {
            return await _application!.LoadApplicationConfigurationAsync(_options.ApplicationConfigPath, true, ct);
        }

        var serverConfig = new ServerConfiguration
        {
            BaseAddresses = [$"opc.tcp://{_options.PublicHostname}:{_options.OpcUaPort}/OtOpcUa"],
        };
        ApplyRequestQuotas(serverConfig, _options.Quotas);

        serverConfig.SecurityPolicies = BuildSecurityPolicies(_options.EnabledSecurityProfiles).ToArray();
        serverConfig.UserTokenPolicies = BuildUserTokenPolicies(_options.AllowAnonymous).ToArray();

        var config = new ApplicationConfiguration(_telemetry)
        {
            ApplicationName = _options.ApplicationName,
            ApplicationUri = _options.ApplicationUri,
            ProductUri = _options.ProductUri,
            ApplicationType = ApplicationType.Server,
            ServerConfiguration = serverConfig,
            SecurityConfiguration = new SecurityConfiguration
            {
                ApplicationCertificate = new CertificateIdentifier
                {
                    StoreType = "Directory",
                    StorePath = Path.Combine(_options.PkiStoreRoot, "own"),
                    SubjectName = $"CN={_options.ApplicationName}",
                },
                TrustedIssuerCertificates = new CertificateTrustList { StoreType = "Directory", StorePath = Path.Combine(_options.PkiStoreRoot, "issuer") },
                TrustedPeerCertificates = new CertificateTrustList { StoreType = "Directory", StorePath = Path.Combine(_options.PkiStoreRoot, "trusted") },
                RejectedCertificateStore = new CertificateTrustList { StoreType = "Directory", StorePath = Path.Combine(_options.PkiStoreRoot, "rejected") },
                AutoAcceptUntrustedCertificates = _options.AutoAcceptUntrustedClientCertificates,
            },
            TransportQuotas = BuildTransportQuotas(_options.Quotas),
            ClientConfiguration = new ClientConfiguration(),
        };

        // Validation creates the certificate manager before awaiting certificate loads. Give the
        // application ownership first so failed/canceled startup disposes that manager too.
        _application!.ApplicationConfiguration = config;
        await config.ValidateAsync(ApplicationType.Server, ct).ConfigureAwait(false);
        return config;
    }

    /// <summary>
    ///     Applies the request-processing quotas (<c>OpcUa:Quotas:*</c>, review 01 P6 — they were hard-coded at
    ///     5 / 100 / 200) to the SDK server configuration.
    /// </summary>
    /// <param name="serverConfig">The configuration to set.</param>
    /// <param name="quotas">The configured quotas.</param>
    internal static void ApplyRequestQuotas(ServerConfiguration serverConfig, OpcUaQuotaOptions quotas)
    {
        serverConfig.MinRequestThreadCount = quotas.MinRequestThreadCount;
        serverConfig.MaxRequestThreadCount = quotas.MaxRequestThreadCount;
        serverConfig.MaxQueuedRequestCount = quotas.MaxQueuedRequestCount;
    }

    /// <summary>
    ///     Builds the SDK transport quotas from <c>OpcUa:Quotas:*</c>: every member starts at the SDK default and
    ///     only a configured (non-null) value replaces it, so an absent section is byte-identical to the former
    ///     <c>new TransportQuotas()</c>.
    /// </summary>
    /// <param name="quotas">The configured quotas.</param>
    /// <returns>The transport quotas to install.</returns>
    internal static TransportQuotas BuildTransportQuotas(OpcUaQuotaOptions quotas)
    {
        var t = new TransportQuotas();
        if (quotas.OperationTimeoutMs is { } operationTimeout) t.OperationTimeout = operationTimeout;
        if (quotas.MaxStringLength is { } maxString) t.MaxStringLength = maxString;
        if (quotas.MaxByteStringLength is { } maxByteString) t.MaxByteStringLength = maxByteString;
        if (quotas.MaxArrayLength is { } maxArray) t.MaxArrayLength = maxArray;
        if (quotas.MaxMessageSize is { } maxMessage) t.MaxMessageSize = maxMessage;
        if (quotas.MaxBufferSize is { } maxBuffer) t.MaxBufferSize = maxBuffer;
        if (quotas.ChannelLifetimeMs is { } channelLifetime) t.ChannelLifetime = channelLifetime;
        if (quotas.SecurityTokenLifetimeMs is { } tokenLifetime) t.SecurityTokenLifetime = tokenLifetime;
        return t;
    }

    /// <summary>
    /// Maps each configured <see cref="OpcUaSecurityProfile"/> to a SDK
    /// <see cref="ServerSecurityPolicy"/>. Duplicate profiles are silently de-duped because
    /// the SDK rejects duplicate (policy,mode) pairs at <c>Validate</c> time. Empty input
    /// falls back to a single None entry so the server doesn't refuse to start with no
    /// listening endpoints — the misconfiguration is logged and very visible.
    /// </summary>
    /// <param name="profiles">The security profiles to build policies for.</param>
    /// <returns>The SDK security policies for the requested profiles.</returns>
    internal static IEnumerable<ServerSecurityPolicy> BuildSecurityPolicies(IEnumerable<OpcUaSecurityProfile> profiles)
    {
        var seen = new HashSet<OpcUaSecurityProfile>();
        var any = false;
        foreach (var profile in profiles)
        {
            if (!seen.Add(profile)) continue;
            any = true;
            yield return profile switch
            {
                OpcUaSecurityProfile.None => new ServerSecurityPolicy
                {
                    SecurityMode = MessageSecurityMode.None,
                    SecurityPolicyUri = SecurityPolicies.None,
                },
                OpcUaSecurityProfile.Basic256Sha256Sign => new ServerSecurityPolicy
                {
                    SecurityMode = MessageSecurityMode.Sign,
                    SecurityPolicyUri = SecurityPolicies.Basic256Sha256,
                },
                OpcUaSecurityProfile.Basic256Sha256SignAndEncrypt => new ServerSecurityPolicy
                {
                    SecurityMode = MessageSecurityMode.SignAndEncrypt,
                    SecurityPolicyUri = SecurityPolicies.Basic256Sha256,
                },
                _ => throw new InvalidOperationException($"Unknown OpcUaSecurityProfile: {profile}"),
            };
        }
        if (!any)
        {
            yield return new ServerSecurityPolicy
            {
                SecurityMode = MessageSecurityMode.None,
                SecurityPolicyUri = SecurityPolicies.None,
            };
        }
    }

    /// <summary>
    /// Anonymous + UserName token policies. UserName tokens are always SDK-encrypted with
    /// the server certificate (see docs/security.md "UserName token encryption") so the
    /// policy works on None endpoints too. The Host supplies API-key authentication through
    /// <see cref="IOpcUaUserAuthenticator"/>; <see cref="AttachUserAuthenticator"/> installs it in the
    /// SDK identity registry before listeners open. <see cref="HandleImpersonation"/> retains the
    /// application decision seam, and <see cref="NullOpcUaUserAuthenticator"/> denies all
    /// UserName logins when none is registered.
    /// </summary>
    /// <param name="allowAnonymous">Whether the Anonymous policy is advertised.</param>
    /// <returns>The Anonymous and UserName token policies.</returns>
    internal static IEnumerable<UserTokenPolicy> BuildUserTokenPolicies(bool allowAnonymous = true)
    {
        // Withholding the policy is what makes the refusal visible to a client at DISCOVERY rather than
        // only at activation: it simply is not offered an anonymous option. HandleImpersonation still
        // rejects anonymous activation independently, because a client may attempt a token type the
        // endpoint never advertised.
        if (allowAnonymous)
        {
            yield return new UserTokenPolicy(UserTokenType.Anonymous)
            {
                PolicyId = "anonymous",
                SecurityPolicyUri = SecurityPolicies.None,
            };
        }
        yield return new UserTokenPolicy(UserTokenType.UserName)
        {
            PolicyId = "username_basic256sha256",
            SecurityPolicyUri = SecurityPolicies.Basic256Sha256,
        };
    }

    /// <summary>Disposes the application host and cleans up resources.</summary>
    /// <returns>A task that represents the asynchronous operation.</returns>
    public async ValueTask DisposeAsync()
    {
        // Authenticators remain installed until the SDK closes every listener and disposes its registry.
        if (_application is { } application)
        {
            _application = null;
            try { await application.DisposeAsync().ConfigureAwait(false); }
            catch (Exception ex) { _logger.LogWarning(ex, "OpcUaApplicationHost: disposal threw"); }
        }
        _identityAuthenticators.Clear();
        _server = null;
    }
}