Closes task #120 (partial — strict point-check; ancestor-visibility
implication is a follow-up).
Before this commit DriverNodeManager exposed every materialized node to
every browsing session regardless of the user's ACL. Read + Write +
HistoryRead were already gated through AuthorizationGate in Phase 6.2
Stream C core; Browse was the one surface where the session could still
enumerate nodes it had no permission to touch, discovering structure
even when reads failed with BadUserAccessDenied.
Implementation
- New `Browse` override on DriverNodeManager that calls base.Browse
first (lets the stack populate the reference list normally), then
post-filters the IList<ReferenceDescription> so denied nodes are
removed silently. OPC UA convention: Browse filtering is invisible to
the client; no BadUserAccessDenied surfaces.
- Extracted the filter loop into the static internal
`FilterBrowseReferences(references, userIdentity, gate, scopeResolver)`
so the policy is unit-testable without standing up the full OPC UA
server stack.
- Non-string NodeId identifiers (stack-synthesized standard-type
references with numeric identifiers) bypass the gate — only driver-
materialized nodes key into the authz trie.
- When AuthorizationGate or NodeScopeResolver is null, the filter is a
no-op — preserves the pre-Phase-6.2 dispatch path for integration
tests that construct DriverNodeManager without authz.
Tests — 6 new in BrowseGatingTests.cs (gate-null no-op, empty-list
no-op, denied-removed, allowed-passes-through, numeric-id bypass,
lax-mode null-identity keeps references). Server.Tests 257 → 263.
Known follow-up (tracked implicitly under #120 re-scope):
- Ancestor-visibility implication (acl-design.md §Browse line 111): a
user with Read at `Line/Tag` should be able to Browse `Line` even
without an explicit Browse grant. Current filter does a strict
point-check. Proper fix needs TriePermissionEvaluator to expose a
"subtree-has-any-grant" query.
- TranslateBrowsePathsToNodeIds not yet filtered (same extension
pattern; small follow-up).
Docs: v2-release-readiness.md Phase 6.2 Stream C hardening list marks
the Browse bullet struck-through with "Partial" close-out note.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
e8b8541554