feat(gateway): Basic256Sha256 + channel>session lifetime (1879)

ingestor/connection/security.py

@@ -0,0 +1,17 @@
+from asyncua.crypto.security_policies import SecurityPolicyBasic256Sha256
+
+SESSION_TIMEOUT_MS = 600_000  # 10 min; tune per server (Samarco: long sessions degrade)
+
+
+async def apply_security(client, server_uri, cert_path, private_key_path, server_cert_path):
+    """Apply Basic256Sha256 + certificate auth (1879 §1) and set channel > session
+    lifetime (1879 §3: secure_channel_timeout = session_timeout * 1.25)."""
+    client.application_uri = server_uri
+    await client.set_security(
+        SecurityPolicyBasic256Sha256,
+        certificate=cert_path,
+        private_key=private_key_path,
+        server_certificate=server_cert_path,
+    )
+    client.session_timeout = SESSION_TIMEOUT_MS
+    client.secure_channel_timeout = int(SESSION_TIMEOUT_MS * 1.25)

tests/unit/connection/test_security.py

@@ -0,0 +1,18 @@
+from unittest.mock import AsyncMock, MagicMock
+
+import pytest
+
+from ingestor.connection.security import SESSION_TIMEOUT_MS, apply_security
+
+
+@pytest.mark.asyncio
+async def test_apply_security_sets_sha256_and_channel_lifetime():
+    client = MagicMock()
+    client.set_security = AsyncMock()
+    await apply_security(client, 'urn:x', 'c.pem', 'k.pem', None)
+    assert client.session_timeout == SESSION_TIMEOUT_MS
+    assert client.secure_channel_timeout == int(SESSION_TIMEOUT_MS * 1.25)
+    args, kwargs = client.set_security.call_args
+    from asyncua.crypto.security_policies import SecurityPolicyBasic256Sha256
+
+    assert args[0] is SecurityPolicyBasic256Sha256