node-opcua / node-opcua / 26028346020

92%

Build Type

push

github

Committed by erossignon

Commit Message

chore: use randomBytes from node-opcua-utils everywhere

Convention: in node-opcua, `randomBytes` is imported from
`node-opcua-utils`, never from `node:crypto` or `crypto`. The utils
package provides Node and browser implementations behind one API, so
the same import works in both runtimes and any future swap of the
CSPRNG primitive happens in one place.

Sweeps every active call site:
- Source (browser-bundle critical): node-opcua-client (opcua_client_impl,
  inline require in client_base_impl), node-opcua-secure-channel (client
  + server secure-channel layers).
- Source (server-side, consistency): node-opcua-address-space,
  node-opcua-server (opcua_server + server_session),
  node-opcua-server-configuration/file_transaction_manager.
- Tests: node-opcua-basic-types, node-opcua-file-transfer,
  node-opcua-end2end-test (2 files), node-opcua-secure-channel (2
  files), node-opcua-server, node-opcua-server-configuration (2 files).

Adds `node-opcua-utils` to dependencies where missing:
- node-opcua-server-configuration: runtime dep + tsconfig project ref.
- node-opcua-basic-types, node-opcua-file-transfer, node-opcua-end2end-test:
  devDependency (test-only usage).

Remaining `randomBytes from "node:crypto"` is a single line: the
re-export in `packages/node-opcua-utils/source/random_bytes.ts`. That's
the canonical chokepoint.

Follow-up: codify the convention with a Biome/ESLint `no-restricted-imports`
rule against `randomBytes` from `node:crypto`/`crypto`.

Verification:
- All affected source-side packages build clean.
- `pnpm --filter node-opcua-client-browser run test:e2e`: 1 passing.
- `pnpm --filter node-opcua-client-browser run test:unit`: 21 passing.

Coverage Stats

18431 of 21732 branches covered (84.81%)

10 of 10 new or added lines in 7 files covered. (100.0%)

5 existing lines in 1 file now uncovered.

164018 of 178200 relevant lines covered (92.04%)

433826.33 hits per line