Refactor auth and security params into aggregate types

Introduce AuthConfig tagged union (AUTH_ANONYMOUS/AUTH_USER/AUTH_CERT)
and SecurityConfig struct to replace scattered parameters. Add
parseSecurityConfig helper to consolidate duplicated security parsing
across all three programs. Simplify opReadTime by moving all auth
handling into the client config factory functions.

1 files changed, 140 insertions, 66 deletions

diff --git a/src/common.h b/src/common.h
index aff6ff4..b8643d7 100644
--- a/src/common.h
+++ b/src/common.h
@@ -17,6 +17,66 @@
 
 #include "config.h"
 
+/* ========================================================================
+ * Aggregate Types
+ * ======================================================================== */
+
+/**
+ * @brief Session-level authentication mode.
+ */
+typedef enum
+{
+  AUTH_ANONYMOUS,
+  AUTH_USER,
+  AUTH_CERT
+} AuthMode;
+
+/**
+ * @brief Session-level authentication configuration (tagged union).
+ *
+ * AUTH_ANONYMOUS carries no payload.  AUTH_USER carries borrowed pointers
+ * to username/password strings (owned by the Config that was parsed).
+ * AUTH_CERT carries no payload — the application certificate is reused
+ * as the X509 identity token.
+ */
+typedef struct
+{
+  AuthMode mode;
+  union
+  {
+    struct
+    {
+      const char *username;
+      const char *password;
+    } user;
+  };
+} AuthConfig;
+
+/**
+ * @brief Transport-level security configuration.
+ *
+ * Groups the certificate, private key, trust list, security mode, and
+ * security policy URI.  All pointers are borrowed (owned by Config or
+ * returned by loadTrustStore / resolveSecurityPolicyUri).  The caller
+ * must free trustPaths with freeTrustStore() when done.
+ *
+ * securityMode and securityPolicyUri are only meaningful for client
+ * configs; server-side callers may leave them zeroed.
+ */
+typedef struct
+{
+  const char *certPath;
+  const char *keyPath;
+  char **trustPaths;
+  size_t trustSize;
+  UA_MessageSecurityMode securityMode;
+  const char *securityPolicyUri;
+} SecurityConfig;
+
+/* ========================================================================
+ * File Loading
+ * ======================================================================== */
+
 /**
  * @brief Loads a DER-encoded certificate or key file into a UA_ByteString.
  *
@@ -48,34 +108,9 @@ int loadTrustStore (const char *dirPath, char ***outPaths, size_t *outSize);
  */
 void freeTrustStore (char **paths, size_t size);
 
-/**
- * @brief Creates a UA_Server, optionally configured with security policies.
- *
- * When @p certPath is non-NULL the server is initialized with encryption
- * (certificate, private key, trustlist).  When @p discovery is true the
- * server additionally offers SecurityPolicy#None restricted to discovery
- * services (FindServers, GetEndpoints) so that unencrypted clients can
- * still discover the server.  When @p discovery is false the server is
- * purely secure — no None security policy, no None endpoint.  When
- * @p certPath is NULL the server runs with SecurityPolicy#None only
- * (keyPath, trustPaths and discovery are ignored).  The applicationUri
- * is set in both cases.
- *
- * @param port Server port number.
- * @param applicationUri OPC UA application URI.
- * @param certPath Path to server certificate (.der), or NULL for unsecure.
- * @param keyPath Path to private key (.der), or NULL when certPath is NULL.
- * @param trustPaths Array of trustlist file paths (may be NULL).
- * @param trustSize Number of entries in trustPaths.
- * @param discovery When true and certPath is non-NULL, add a None
- *                  endpoint restricted to discovery services.
- * @param retval Output parameter set to the status code on failure.
- * @return A configured UA_Server, or NULL on error.
- */
-UA_Server *createServer (UA_UInt16 port, const char *applicationUri,
-                         const char *certPath, const char *keyPath,
-                         char **trustPaths, size_t trustSize,
-                         UA_Boolean discovery, UA_StatusCode *retval);
+/* ========================================================================
+ * Parsing Helpers
+ * ======================================================================== */
 
 /**
  * @brief Parses a log-level name into the corresponding UA_LogLevel value.
@@ -91,25 +126,37 @@ int parseLogLevel (const char *name);
 /**
  * @brief Parses the authMode key from a configuration file.
  *
- * When authMode is "anonymous", sets *allowAnonymous to true and leaves
- * *username / *password as NULL.  When authMode is "user", sets
- * *allowAnonymous to false and loads the username/password keys.  When
- * authMode is "cert", sets *allowAnonymous to false and *certAuth to true.
+ * Populates an AuthConfig struct.  When authMode is "anonymous", sets
+ * mode to AUTH_ANONYMOUS.  When "user", sets mode to AUTH_USER and reads
+ * the username/password keys.  When "cert", sets mode to AUTH_CERT.
  * Logs errors internally.
  *
- * @param cfg            Parsed configuration.
- * @param program        Program name (for error messages).
- * @param allowAnonymous Output: true for anonymous, false otherwise.
- *                       May be NULL (ignored — useful for client callers).
- * @param username       Output: username string (owned by cfg), or NULL.
- * @param password       Output: password string (owned by cfg), or NULL.
- * @param certAuth       Output: true when authMode is "cert", false otherwise.
- *                       May be NULL (ignored — useful for server callers).
+ * @param cfg     Parsed configuration.
+ * @param program Program name (for error messages).
+ * @param auth    Output: populated AuthConfig.
+ * @return 0 on success, -1 on error.
+ */
+int parseAuthConfig (const Config *cfg, const char *program, AuthConfig *auth);
+
+/**
+ * @brief Parses security configuration from a config file.
+ *
+ * Reads certificate, privateKey, and trustStore keys.  When all three
+ * are omitted, zeroes @p sec and returns 0 (unsecure).  When any of the
+ * three is present, all three are required.  When @p needsModePolicy is
+ * true, also reads and resolves securityMode and securityPolicy keys.
+ * Calls loadTrustStore() internally; the caller must free
+ * sec->trustPaths with freeTrustStore().
+ *
+ * @param cfg             Parsed configuration.
+ * @param program         Program name (for error messages).
+ * @param needsModePolicy When true, require securityMode and
+ *                        securityPolicy keys (client configs).
+ * @param sec             Output: populated SecurityConfig.
  * @return 0 on success, -1 on error.
  */
-int parseAuthConfig (const Config *cfg, const char *program,
-                     UA_Boolean *allowAnonymous, const char **username,
-                     const char **password, UA_Boolean *certAuth);
+int parseSecurityConfig (const Config *cfg, const char *program,
+                         UA_Boolean needsModePolicy, SecurityConfig *sec);
 
 /**
  * @brief Parses a security mode name into the corresponding enum value.
@@ -133,49 +180,76 @@ UA_MessageSecurityMode parseSecurityMode (const char *name);
  */
 const char *resolveSecurityPolicyUri (const char *shortName);
 
+/* ========================================================================
+ * Factory Functions
+ * ======================================================================== */
+
+/**
+ * @brief Creates a UA_Server, optionally configured with security policies.
+ *
+ * When @p sec is non-NULL the server is initialized with encryption
+ * (certificate, private key, trustlist).  When @p discovery is true the
+ * server additionally offers SecurityPolicy#None restricted to discovery
+ * services (FindServers, GetEndpoints) so that unencrypted clients can
+ * still discover the server.  When @p discovery is false the server is
+ * purely secure — no None security policy, no None endpoint.  When
+ * @p sec is NULL the server runs with SecurityPolicy#None only
+ * (discovery is ignored).  The applicationUri is set in both cases.
+ *
+ * @param port Server port number.
+ * @param applicationUri OPC UA application URI.
+ * @param sec Security configuration, or NULL for unsecure.
+ * @param discovery When true and sec is non-NULL, add a None
+ *                  endpoint restricted to discovery services.
+ * @param retval Output parameter set to the status code on failure.
+ * @return A configured UA_Server, or NULL on error.
+ */
+UA_Server *createServer (UA_UInt16 port, const char *applicationUri,
+                         const SecurityConfig *sec, UA_Boolean discovery,
+                         UA_StatusCode *retval);
+
 /**
  * @brief Initializes a UA_ClientConfig without encryption.
  *
  * Sets up a default client config with SecurityPolicy#None and the given
  * application URI.  Explicitly sets securityMode and securityPolicyUri so
- * that internal endpoint negotiation matches None endpoints.
+ * that internal endpoint negotiation matches None endpoints.  When @p auth
+ * is non-NULL and mode is AUTH_USER, configures username/password
+ * authentication.  AUTH_CERT returns an error (requires encryption).
  *
  * @param cc Pointer to a zero-initialized UA_ClientConfig.
  * @param applicationUri OPC UA application URI.
+ * @param auth Authentication config, or NULL for anonymous.
  * @return UA_STATUSCODE_GOOD on success, error code otherwise.
  */
 UA_StatusCode createUnsecureClientConfig (UA_ClientConfig *cc,
-                                          const char *applicationUri);
+                                          const char *applicationUri,
+                                          const AuthConfig *auth);
 
 /**
- * @brief Initializes a UA_ClientConfig with encryption from file paths.
+ * @brief Initializes a UA_ClientConfig with encryption.
  *
  * The config must be zero-initialized by the caller before calling this
- * function. Loads the certificate, private key, and trustlist, then applies
- * default encryption settings.  When @p certAuth is true, also configures
- * X509 certificate identity-token authentication using the same application
- * certificate (mutually exclusive with username/password authentication).
+ * function.  Loads the certificate, private key, and trustlist, then
+ * applies default encryption settings.  When @p auth is non-NULL:
+ * AUTH_CERT configures X509 certificate identity-token authentication
+ * using the same application certificate; AUTH_USER configures
+ * username/password authentication.  Both are mutually exclusive.
  *
  * @param cc Pointer to a zero-initialized UA_ClientConfig.
  * @param applicationUri OPC UA application URI.
- * @param certPath Path to client certificate (.der).
- * @param keyPath Path to private key (.der).
- * @param trustPaths Array of trustlist file paths (may be NULL if trustSize is
- * 0).
- * @param trustSize Number of entries in trustPaths.
- * @param securityMode Requested message security mode.
- * @param securityPolicyUri Security policy URI string (e.g.
- * "http://opcfoundation.org/UA/SecurityPolicy#Basic256Sha256").
- * @param certAuth When true, use the application certificate as X509 identity
- * token.
+ * @param sec Security configuration (cert, key, trust, mode, policy).
+ * @param auth Authentication config, or NULL for anonymous.
  * @return UA_STATUSCODE_GOOD on success, error code otherwise.
  */
-UA_StatusCode
-createSecureClientConfig (UA_ClientConfig *cc, const char *applicationUri,
-                          const char *certPath, const char *keyPath,
-                          char **trustPaths, size_t trustSize,
-                          UA_MessageSecurityMode securityMode,
-                          const char *securityPolicyUri, UA_Boolean certAuth);
+UA_StatusCode createSecureClientConfig (UA_ClientConfig *cc,
+                                        const char *applicationUri,
+                                        const SecurityConfig *sec,
+                                        const AuthConfig *auth);
+
+/* ========================================================================
+ * Output Formatting
+ * ======================================================================== */
 
 /**
  * @brief Logs a UA_ApplicationDescription (server info from FindServers).