Fix Opc.Ua.Client audit findings (security fallback, reconnect, subscriptions, redundancy, browse, files, WebApi)

docs/HighAvailability.md

@@ -453,6 +453,8 @@ ArrayOf<TransferResult> results = await coordinator.TransferActiveSubscriptionsA
     ct);
 ```
 
+A transferred subscription needs a client-side owner on the backup session, otherwise the backup's publish engine sees an unknown `SubscriptionId` and deletes it (or never publishes and it expires). Prepare the backup before the takeover: restore the active client's subscriptions with `ISession.Load` (or add `Subscription` objects whose `TransferId` is the active client's subscription id and whose monitored items carry the same client handles). The coordinator then transfers those through the session, which binds them and resumes publishing; ids without a prepared subscription are still moved with the raw service and are left to the caller.
+
 OPC UA does not standardize how active and backup clients exchange `SessionId` or subscription ids. In this stack the client replica set coordinates through the registered client-side shared store (`AddRedundantClientSharedStore` / `AddRaftClientSharedStore` — a CRDT- or [Raft](https://raft.github.io/)-backed `ISharedKeyValueStore` that the `ClientReplicaCoordinator` consumes).
 
 ## Network redundancy (as per Part 4 §6.6.4)

samples/Reference/ConsoleReferenceClient/UAClient.cs

@@ -240,7 +240,8 @@ public async Task<bool> ConnectAsync(
                                     useSecurity,
                                     m_telemetry,
                                     ct
-                                ).ConfigureAwait(false);
+                                ).ConfigureAwait(false) ??
+                                    throw NoMatchingEndpoint(useSecurity);
                                 connection = null;
                             }
                         } while (connection == null);
@@ -253,7 +254,8 @@ public async Task<bool> ConnectAsync(
                             serverUrl,
                             useSecurity,
                             m_telemetry,
-                            ct).ConfigureAwait(false);
+                            ct).ConfigureAwait(false) ??
+                            throw NoMatchingEndpoint(useSecurity);
                     }
 
                     // Get the endpoint by connecting to server's discovery endpoint.
@@ -322,6 +324,21 @@ public async Task<bool> ConnectAsync(
             }
         }
 
+        /// <summary>
+        /// The error reported when discovery found no endpoint that satisfies
+        /// the security requirement (SelectEndpoint returned null).
+        /// </summary>
+        private static ServiceResultException NoMatchingEndpoint(bool useSecurity)
+        {
+            return useSecurity
+                ? new ServiceResultException(
+                    StatusCodes.BadSecurityPolicyRejected,
+                    "The server offers no secure endpoint supported by this client.")
+                : new ServiceResultException(
+                    StatusCodes.BadNotFound,
+                    "The server offers no matching endpoint.");
+        }
+
         private ValueTask<IUserIdentity> CreateUserIdentityAsync(
             EndpointDescription endpointDescription,
             CancellationToken ct)

src/Opc.Ua.Client.ComplexTypes/Types/UnionComplexType.cs

@@ -138,13 +138,15 @@ public override void Decode(IDecoder decoder)
             bool isJsonDecoder = decoder.EncodingType == EncodingType.Json;
             if (unionSelector == 0 && isJsonDecoder)
             {
+                // The Verbose JSON encoding writes no SwitchField, so the
+                // selector has to be recovered from the member name. Every
+                // union field is a candidate: union fields are never
+                // IsOptional (Part 3 §8.51), so filtering by it left the list
+                // empty and every such union decoded as null.
                 var fields = new List<string>();
                 foreach (ComplexTypePropertyInfo property in GetPropertyEnumerator())
                 {
-                    if (property.IsOptional)
-                    {
-                        fields.Add(property.Name);
-                    }
+                    fields.Add(property.Name);
                 }
 
                 unionSelector = decoder.ReadSwitchField(fields, out _);

src/Opc.Ua.Client/AliasNames/AliasNameClientErrors.cs

@@ -55,8 +55,12 @@ public static Exception Translate(
                         : string.Empty) +
                     ".");
             }
+            // BadMethodInvalid is what a server returns when the type-level
+            // MethodId is called on a category that does not expose the
+            // (optional) method (Part 4 §5.12.2.4), so it means "not supported".
             if (code == StatusCodes.BadNotSupported ||
-                code == StatusCodes.BadNotImplemented)
+                code == StatusCodes.BadNotImplemented ||
+                code == StatusCodes.BadMethodInvalid)
             {
                 return new NotSupportedException(
                     $"OPC UA Part 17 {operation} is not supported by this " +

src/Opc.Ua.Client/AliasNames/AliasNameResolver.cs

@@ -31,6 +31,7 @@
 using System.Collections.Generic;
 using System.Threading;
 using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
 using Opc.Ua.Client.AliasNames.Refresh;
 
 namespace Opc.Ua.Client.AliasNames
@@ -81,6 +82,8 @@ public AliasNameResolver(
             Options = (options ?? new AliasNameResolverOptions()).Clone();
             m_strategy = Options.RefreshStrategy
                 ?? BuildBuiltInStrategy(Options);
+            m_logger = client.Session.MessageContext.Telemetry
+                .CreateLogger<AliasNameResolver>();
         }
 
         /// <summary>The wrapped <see cref="AliasNameClient"/>.</summary>
@@ -104,7 +107,19 @@ public async Task EnsureLoadedAsync(CancellationToken ct = default)
             {
                 return;
             }
-            await EnsureStrategyStartedAsync(ct).ConfigureAwait(false);
+            try
+            {
+                await EnsureStrategyStartedAsync(ct).ConfigureAwait(false);
+            }
+            catch (Exception ex) when (ex is not OperationCanceledException ||
+                !ct.IsCancellationRequested)
+            {
+                // The refresh strategy only drives invalidation; a server that
+                // rejects its subscription (or lacks the optional LastChange)
+                // must not make alias resolution fail. Run degraded (manual
+                // refresh) and retry the start on the next load.
+                m_logger.AliasRefreshStrategyStartFailed(ex, m_strategy.GetType().Name);
+            }
             await RefreshAsync(ct).ConfigureAwait(false);
         }
 
@@ -391,10 +406,29 @@ private static void PopulateFromNonVerbose(
                     arr[i] = a.ReferencedNodes[i];
                     reverse[arr[i]] = key;
                 }
-                forward[key] = arr;
+                forward[key] = Merge(forward, key, arr);
             }
         }
 
+        /// <summary>
+        /// The cache is keyed by <see cref="QualifiedName.Name"/> only, but
+        /// FindAlias may legally return the same name more than once (other
+        /// namespace, or defined in several sub-categories). Append the
+        /// targets of a repeated name instead of replacing the earlier ones.
+        /// </summary>
+        /// <typeparam name="T">The element type of the cached arrays.</typeparam>
+        private static T[] Merge<T>(Dictionary<string, T[]> map, string key, T[] values)
+        {
+            if (!map.TryGetValue(key, out T[]? existing) || existing.Length == 0)
+            {
+                return values;
+            }
+            var merged = new T[existing.Length + values.Length];
+            Array.Copy(existing, merged, existing.Length);
+            Array.Copy(values, 0, merged, existing.Length, values.Length);
+            return merged;
+        }
+
         private static void PopulateFromVerbose(
             IReadOnlyList<AliasNameVerboseDataType> aliases,
             Dictionary<string, ExpandedNodeId[]> forward,
@@ -413,14 +447,17 @@ private static void PopulateFromVerbose(
                     uris[i] = i < a.ServerUris.Count ? a.ServerUris[i] : null;
                     reverse[arr[i]] = key;
                 }
-                forward[key] = arr;
-                serverUris[key] = uris;
+                // Merge both maps the same way so the ServerUris stay
+                // parallel to the targets.
+                forward[key] = Merge(forward, key, arr);
+                serverUris[key] = Merge(serverUris, key, uris);
             }
         }
 
         private readonly SemaphoreSlim m_semaphore = new(1, 1);
         private readonly SemaphoreSlim m_strategyStartLock = new(1, 1);
         private readonly IAliasNameRefreshStrategy m_strategy;
+        private readonly ILogger m_logger;
 
         private Dictionary<string, ExpandedNodeId[]> m_forward
             = new(StringComparer.Ordinal);
@@ -446,4 +483,18 @@ private Dictionary<string, ExpandedNodeId[]> m_forward
         private long m_invalidationGeneration;
         private int m_strategyStarted;
     }
+
+    /// <summary>
+    /// Source-generated logging for <see cref="AliasNameResolver"/>.
+    /// </summary>
+    internal static partial class AliasNameResolverLog
+    {
+        [LoggerMessage(EventId = ClientEventIds.AliasNameResolver + 0, Level = LogLevel.Warning,
+            Message = "Alias refresh strategy {Strategy} failed to start; resolving without " +
+                "automatic invalidation and retrying the start on the next load.")]
+        public static partial void AliasRefreshStrategyStartFailed(
+            this ILogger logger,
+            Exception exception,
+            string strategy);
+    }
 }