[DOC] rel v4.1.0

Author: GianfriAur

.github/workflows/tests.yml

@@ -31,7 +31,7 @@ jobs:
 
       - name: Start OPC UA test servers
         id: opcua
-        uses: php-opcua/uanetstandard-test-suite@v1.0.0
+        uses: php-opcua/uanetstandard-test-suite@v1.1.0
 
       - name: Run tests
         env:

CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## [4.1.0] - 2026-04-13
+
+### Added
+
+- **ECC security policy support.** The daemon and `ManagedClient` now support the 4 new Elliptic Curve Cryptography policies introduced in `opcua-client` v4.1.0:
+  - `SecurityPolicy::EccNistP256` (NIST P-256, AES-128-CBC, SHA-256)
+  - `SecurityPolicy::EccNistP384` (NIST P-384, AES-256-CBC, SHA-384)
+  - `SecurityPolicy::EccBrainpoolP256r1` (Brainpool P-256, AES-128-CBC, SHA-256)
+  - `SecurityPolicy::EccBrainpoolP384r1` (Brainpool P-384, AES-256-CBC, SHA-384)
+  - No code changes required — ECC policies work transparently via `SecurityPolicy::from()` and `ClientBuilder`. ECC certificates are auto-generated when no client certificate is provided. Username/password authentication uses the `EccEncryptedSecret` protocol automatically.
+  - **ECC disclaimer:** No commercial OPC UA vendor supports ECC endpoints yet. This implementation is tested exclusively against the OPC Foundation's UA-.NETStandard reference stack.
+
+### Changed
+
+- Bumped minimum `php-opcua/opcua-client` dependency from `^4.0` to `^4.1`.
+- Security support expanded from 6 to **10 policies** (6 RSA + 4 ECC).
+- Updated CI test server suite from `php-opcua/uanetstandard-test-suite@v1.0.0` to `@v1.1.0`.
+- Updated documentation (README, doc/, llms.txt, llms-full.txt, llms-skills.md) to reflect ECC support and add ECC examples.
+
 ## [4.0.3] - 2026-04-08
 
 ### Added

README.md

@@ -200,14 +200,26 @@ $client = new ManagedClient(
     authToken: trim(file_get_contents('/etc/opcua/daemon.token')),
 );
 
+// RSA security
 $client->setSecurityPolicy(SecurityPolicy::Basic256Sha256);
 $client->setSecurityMode(SecurityMode::SignAndEncrypt);
 $client->setClientCertificate('/certs/client.pem', '/certs/client.key');
 $client->setUserCredentials('operator', 'secret');
 $client->connect('opc.tcp://192.168.1.100:4840');
 ```
 
-> **Tip:** Skip `setClientCertificate()` and a self-signed cert gets auto-generated in memory — perfect for quick tests or servers with auto-accept.
+```php
+// ECC security (auto-generated ECC certificate)
+$client = new ManagedClient();
+$client->setSecurityPolicy(SecurityPolicy::EccNistP256);
+$client->setSecurityMode(SecurityMode::SignAndEncrypt);
+$client->setUserCredentials('operator', 'secret');
+$client->connect('opc.tcp://192.168.1.100:4840');
+```
+
+> **Tip:** Skip `setClientCertificate()` and a self-signed cert gets auto-generated in memory (RSA for RSA policies, ECC for ECC policies) — perfect for quick tests or servers with auto-accept.
+
+> **ECC disclaimer:** ECC security policies (`EccNistP256`, `EccNistP384`, `EccBrainpoolP256r1`, `EccBrainpoolP384r1`) are fully implemented and tested against the OPC Foundation's UA-.NETStandard reference stack. However, no commercial OPC UA vendor supports ECC endpoints yet.
 
 ## How It Works
 
@@ -254,7 +266,7 @@ Request N:                       [read 5ms]           → total ~5ms
 | **Transfer & Recovery** | `transferSubscriptions()` and `republish()` for session migration |
 | **PSR-3 Logging** | Optional structured logging via any PSR-3 logger |
 | **PSR-16 Cache** | Cache management forwarded to daemon — `invalidateCache()`, `flushCache()` |
-| **Security** | 6 policies, 3 auth modes, IPC authentication, method whitelist |
+| **Security** | 10 policies (RSA + ECC), 3 auth modes, IPC authentication, method whitelist |
 | **Auto-Retry** | Automatic reconnect on connection failures |
 | **Auto-Batching** | Transparent batching for `readMulti()`/`writeMulti()` |
 | **Auto-Publish** | Daemon automatically calls `publish()` for sessions with subscriptions and dispatches PSR-14 events |
@@ -287,7 +299,7 @@ The daemon implements multiple layers of security hardening:
 
 - **IPC authentication** — shared-secret token validated with timing-safe `hash_equals()`
 - **Socket permissions** — `0600` by default (owner-only)
-- **Method whitelist** — only 37 documented OPC UA operations allowed via `query`
+- **Method whitelist** — only 45 documented OPC UA operations allowed via `query`
 - **Credential protection** — passwords and private key paths stripped immediately after connection
 - **Session limits** — configurable maximum to prevent resource exhaustion
 - **Certificate path restrictions** — `--allowed-cert-dirs` constrains certificate directories
@@ -342,7 +354,7 @@ OPCUA_AUTH_TOKEN=$(cat /etc/opcua/daemon.token) php bin/opcua-session-manager \
 ./vendor/bin/pest tests/Integration/ --group=integration   # integration only
 ```
 
-380+ tests (unit + integration). Integration tests run against [uanetstandard-test-suite](https://github.com/php-opcua/uanetstandard-test-suite) — a Docker-based OPC UA environment built on the OPC Foundation's UA-.NETStandard reference implementation — covering browse, read/write, subscriptions, method calls, path resolution, connection state, security, type serialization, session persistence, session recovery, and all v4.0.0 DTOs.
+456+ tests (unit + integration). Integration tests run against [uanetstandard-test-suite](https://github.com/php-opcua/uanetstandard-test-suite) — a Docker-based OPC UA environment built on the OPC Foundation's UA-.NETStandard reference implementation — covering browse, read/write, subscriptions, method calls, path resolution, connection state, security, type serialization, session persistence, session recovery, and all v4.0.0 DTOs.
 
 > **Note on coverage:** `SessionManagerDaemon` is excluded from coverage reports because it runs as a separate long-lived process (ReactPHP event loop). PHP coverage tools (pcov, xdebug) only instrument the test runner process — they cannot track code executing inside a subprocess started via `proc_open()`. The daemon is fully tested by the integration suite, which starts a real daemon, sends IPC commands, and verifies responses. This is a known limitation shared by other daemon-based PHP packages (Laravel Horizon, Symfony Messenger, RoadRunner workers).
 

ROADMAP.md

@@ -1,6 +1,6 @@
 # Roadmap
 
-## v4.1.0
+## v4.2.0
 
 ### Features
 
@@ -12,6 +12,13 @@
 - [ ] Config object — replace the `$config` associative array passed through IPC with a typed `SessionConfig` DTO for type safety
 - [ ] CommandHandler method dispatch — replace the growing `match` block in `deserializeParams()` with a registry pattern for cleaner extensibility
 
+## Completed in v4.1.0
+
+- [x] **ECC security policy support** — all daemon operations work with `ECC_nistP256`, `ECC_nistP384`, `ECC_brainpoolP256r1`, `ECC_brainpoolP384r1` (auto-generated ECC certificates, EccEncryptedSecret for username/password)
+- [x] Bumped `php-opcua/opcua-client` dependency from `^4.0` to `^4.1`
+- [x] Security support expanded from 6 to **10 policies** (6 RSA + 4 ECC)
+- [x] Updated all documentation (README, doc/, llms.txt, llms-full.txt, llms-skills.md)
+
 ## Completed in v4.0.0
 
 - [x] Trust store support — certificate trust store for managing trusted/rejected certificates

composer.json

@@ -31,7 +31,7 @@
   ],
   "require": {
     "php": "^8.2",
-    "php-opcua/opcua-client": "^4.0",
+    "php-opcua/opcua-client": "^4.1",
     "react/event-loop": "^1.5",
     "react/socket": "^1.16",
     "psr/log": "^3.0",

doc/01-introduction.md

@@ -57,7 +57,7 @@ $client->disconnect();
 | **Session** | Persistence across requests, automatic cleanup, graceful shutdown |
 | **OPC UA** | Browse, read, write, method calls, subscriptions, history, path resolution, type discovery |
 | **API** | String NodeIds, fluent builders, typed DTO returns, auto-retry, auto-batching |
-| **Security** | 6 policies, 3 auth modes, IPC auth token, method whitelist, credential stripping |
+| **Security** | 10 policies (RSA + ECC), 3 auth modes, IPC auth token, method whitelist, credential stripping |
 | **Integrations** | PSR-3 logging, PSR-16 cache, transfer & recovery |
 
 ## Architecture

doc/05-managed-client.md

@@ -49,11 +49,17 @@ $client->setDefaultBrowseMaxDepth(20);      // recursive browse depth
 use PhpOpcua\Client\Security\SecurityPolicy;
 use PhpOpcua\Client\Security\SecurityMode;
 
+// RSA security
 $client->setSecurityPolicy(SecurityPolicy::Basic256Sha256);
 $client->setSecurityMode(SecurityMode::SignAndEncrypt);
 $client->setClientCertificate('/certs/client.pem', '/certs/client.key', '/certs/ca.pem');
 $client->setUserCredentials('operator', 'secret');
 $client->setUserCertificate('/certs/user.pem', '/certs/user.key');
+
+// ECC security (auto-generated ECC certificate, no setClientCertificate needed)
+$client->setSecurityPolicy(SecurityPolicy::EccNistP256);
+$client->setSecurityMode(SecurityMode::SignAndEncrypt);
+$client->setUserCredentials('operator', 'secret');
 ```
 
 ### Logging

doc/06-ipc-protocol.md

@@ -101,6 +101,21 @@ Create a new session.
 }
 ```
 
+ECC example (no certificate paths needed — auto-generated):
+
+```json
+{
+  "command": "open",
+  "endpointUrl": "opc.tcp://localhost:4840",
+  "config": {
+    "securityPolicy": "http://opcfoundation.org/UA/SecurityPolicy#ECC_nistP256",
+    "securityMode": 3,
+    "username": "admin",
+    "password": "secret"
+  }
+}
+```
+
 ```json
 {"success": true, "data": {"sessionId": "a1b2c3d4..."}}
 ```

doc/09-examples.md

@@ -145,6 +145,7 @@ $client = new ManagedClient(
     authToken: trim(file_get_contents('/etc/opcua/daemon.token')),
 );
 
+// RSA security
 $client->setSecurityPolicy(SecurityPolicy::Basic256Sha256);
 $client->setSecurityMode(SecurityMode::SignAndEncrypt);
 $client->setClientCertificate('/certs/client.pem', '/certs/client.key', '/certs/ca.pem');
@@ -155,6 +156,28 @@ $value = $client->read('ns=2;i=1001');
 echo $value->getValue();
 ```
 
+### ECC Security
+
+```php
+use PhpOpcua\Client\Security\SecurityPolicy;
+use PhpOpcua\Client\Security\SecurityMode;
+use PhpOpcua\SessionManager\Client\ManagedClient;
+
+$client = new ManagedClient(
+    socketPath: '/var/run/opcua-session-manager.sock',
+    authToken: trim(file_get_contents('/etc/opcua/daemon.token')),
+);
+
+// ECC security — no setClientCertificate needed, auto-generated
+$client->setSecurityPolicy(SecurityPolicy::EccNistP256);
+$client->setSecurityMode(SecurityMode::SignAndEncrypt);
+$client->setUserCredentials('operator', 'secret');
+$client->connect('opc.tcp://192.168.1.100:4840');
+
+$value = $client->read('ns=2;i=1001');
+echo $value->getValue();
+```
+
 ## Session Persistence Across Requests
 
 ```php

llms-full.txt

@@ -158,9 +158,9 @@ $client->setTimeout(10.0);
 $client->setAutoRetry(3);
 $client->setBatchSize(50);
 $client->setDefaultBrowseMaxDepth(20);
-$client->setSecurityPolicy(SecurityPolicy::Basic256Sha256);
+$client->setSecurityPolicy(SecurityPolicy::Basic256Sha256); // or EccNistP256, EccNistP384, EccBrainpoolP256r1, EccBrainpoolP384r1
 $client->setSecurityMode(SecurityMode::SignAndEncrypt);
-$client->setClientCertificate('/certs/client.pem', '/certs/client.key', '/certs/ca.pem');
+$client->setClientCertificate('/certs/client.pem', '/certs/client.key', '/certs/ca.pem'); // optional for ECC — auto-generated
 $client->setUserCredentials('operator', 'secret');
 $client->setUserCertificate('/certs/user.pem', '/certs/user.key');
 $client->setLogger($logger);