Repository navigation
GDS: pin SecurityAdmin-only delivery of ApplicationRegistrationChangedAuditEvents; document CTT defect C57 - #4693
Conversation
…dAuditEvents; document CTT C57 Since #4675 the server enforces ReceiveEvents on the EventType node (OPC 10000-3 8.55). The GDS NodeSet grants it on ApplicationRegistrationChangedAuditEventType (AuditEventDefaultPermissions) only to SecurityAdmin, so a DiscoveryAdmin that calls RegisterApplication, UpdateApplication or UnregisterApplication no longer receives the audit events. CTT GDS Application Directory 011/018/028 subscribe as the DiscoveryAdmin user and fail since; documented as CTT defect C57. The new test calls the three Methods as DiscoveryAdmin and asserts that a SecurityAdmin subscriber on Server.EventNotifier receives all three audit events with SourceNode = Directory, and that a DiscoveryAdmin subscriber receives none. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
Copilot review overview
🟢 Approval recommended
The behavior is adequately tested and documented, with only a minor class-sealing convention issue.
Review effort: Balanced
Findings: 1
Open (1)
What changed in this PR
Adds regression coverage confirming GDS registration audit events are delivered only to SecurityAdmin sessions and documents CTT defect C57.
Changes:
- Tests Register, Update, and Unregister audit-event delivery by role.
- Documents the required CTT session correction.
| File | Description |
|---|---|
tests/Opc.Ua.Gds.Tests/GdsApplicationRegistrationAuditEventTests.cs |
Adds role-based audit-event integration coverage. |
plans/ctt-issues.md |
Documents CTT defect C57 and its workaround. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Code coverage✅ Coverage gate passed.
Coverage is above the recorded baseline - consider ratcheting Thresholds live in |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #4693 +/- ##
==========================================
- Coverage 82.82% 82.82% -0.01%
==========================================
Files 2262 2262
Lines 344638 344638
Branches 60051 60051
==========================================
- Hits 285448 285441 -7
- Misses 39161 39169 +8
+ Partials 20029 20028 -1
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|

Description
CTT 1.05.513 (patched scripts) GDS Application Directory
011.js,018.jsand028.jsfail on master (fa06c66) with "Step 3: Did not receive any Events after calling Publish." and passed on efad0dd.Root cause
7212607 (#4675, Part 3 compliance), not #4668. Since #4675 the server enforces
ReceiveEventson the EventType node (OPC 10000-3 §8.55: a Client only receives an Event if it has ReceiveEvents on its EventType and SourceNode). The GDS NodeSet grants it onApplicationRegistrationChangedAuditEventType(AuditEventDefaultPermissions) only to SecurityAdmin. The CTT test cases subscribe on the Session of the GDSAdministrativeUser, a DiscoveryAdmin, so the server correctly withholds the events. The audit events are still raised and delivered: the RegisterApplication change toOnCallAsyncin #4668 does not affect them.This is a CTT defect, so the server is unchanged. It is documented as C57 in
plans/ctt-issues.mdand filed as Mantis 11482. The fix is for the scripts to subscribe on a second Session of the CU'sSecurityAdminUser.Changes
tests/Opc.Ua.Gds.Tests/GdsApplicationRegistrationAuditEventTests.cs(new): a DiscoveryAdmin calls RegisterApplication, UpdateApplication and UnregisterApplication. A SecurityAdmin subscriber onServer.EventNotifiermust receive all threeApplicationRegistrationChangedAuditEvents withSourceNode= Directory and the matchingMethodId. A DiscoveryAdmin subscriber must receive none of them.plans/ctt-issues.md: C57 (Mantis 11482).Verification
sysadminfor the event subscription), compared with efad0dd using the unpatched scripts:🤖 Generated with Claude Code