fix(server): enforce published HistoryUpdate operation limits

src/Opc.Ua.Server/Server/StandardServer.cs

@@ -1877,10 +1877,10 @@ public override async ValueTask<HistoryUpdateResponse> HistoryUpdateAsync(
 
             try
             {
-                // check only for BadNothingToDo here
-                // MaxNodesPerHistoryUpdateEvents & MaxNodesPerHistoryUpdateData
-                // must be checked in NodeManager (TODO)
                 ValidateOperationLimits(historyUpdateDetails);
+                ValidateOperationLimits(
+                    historyUpdateDetails.Count,
+                    GetHistoryUpdateOperationLimit(historyUpdateDetails));
 
                 (ArrayOf<HistoryUpdateResult> results, ArrayOf<DiagnosticInfo> diagnosticInfos) =
                     await ServerInternal.NodeManager.HistoryUpdateAsync(
@@ -1915,6 +1915,37 @@ await ServerInternal.NodeManager.HistoryUpdateAsync(
             }
         }
 
+        private PropertyState<uint>? GetHistoryUpdateOperationLimit(
+            ArrayOf<ExtensionObject> historyUpdateDetails)
+        {
+            foreach (ExtensionObject details in historyUpdateDetails)
+            {
+                if (details.IsNull || !details.TryGetValue(out HistoryUpdateDetails? historyUpdateDetail))
+                {
+                    continue;
+                }
+
+                Type detailsType = historyUpdateDetail!.GetType();
+                if (detailsType == typeof(UpdateEventDetails) ||
+                    detailsType == typeof(DeleteEventDetails))
+                {
+                    return OperationLimits.MaxNodesPerHistoryUpdateEvents;
+                }
+
+                if (detailsType == typeof(UpdateDataDetails) ||
+                    detailsType == typeof(UpdateStructureDataDetails) ||
+                    detailsType == typeof(DeleteRawModifiedDetails) ||
+                    detailsType == typeof(DeleteAtTimeDetails))
+                {
+                    return OperationLimits.MaxNodesPerHistoryUpdateData;
+                }
+
+                break;
+            }
+
+            return null;
+        }
+
         /// <inheritdoc/>
         public override async ValueTask<CreateSubscriptionResponse> CreateSubscriptionAsync(
             SecureChannelContext secureChannelContext,

tests/Opc.Ua.History.Tests/HistoricalAccessTests.cs

@@ -869,6 +869,60 @@ await Session.HistoryUpdateAsync(
             }
         }
 
+        [Test]
+        public void HistoryUpdateRejectsTooManyDataOperationsAsync()
+        {
+            NodeId nodeId = ToNodeId(Constants.ScalarStaticDouble);
+            var details = new ExtensionObject[1001];
+
+            for (int i = 0; i < details.Length; i++)
+            {
+                details[i] = new ExtensionObject(new UpdateDataDetails
+                {
+                    NodeId = nodeId,
+                    PerformInsertReplace = PerformUpdateType.Insert,
+                    UpdateValues =
+                    [
+                        new DataValue(
+                            new Variant((double)i),
+                            StatusCodes.Good,
+                            DateTime.UtcNow.AddSeconds(i))
+                    ]
+                });
+            }
+
+            ServiceResultException ex = Assert.ThrowsAsync<ServiceResultException>(
+                async () => await Session.HistoryUpdateAsync(
+                    null,
+                    details.ToArrayOf(),
+                    CancellationToken.None).ConfigureAwait(false));
+
+            Assert.That(ex.StatusCode, Is.EqualTo(StatusCodes.BadTooManyOperations));
+        }
+
+        [Test]
+        public void HistoryUpdateRejectsTooManyEventOperationsAsync()
+        {
+            var details = new ExtensionObject[1001];
+
+            for (int i = 0; i < details.Length; i++)
+            {
+                details[i] = new ExtensionObject(new DeleteEventDetails
+                {
+                    NodeId = ObjectIds.Server,
+                    EventIds = [ByteString.From([(byte)(i & 0xff)])]
+                });
+            }
+
+            ServiceResultException ex = Assert.ThrowsAsync<ServiceResultException>(
+                async () => await Session.HistoryUpdateAsync(
+                    null,
+                    details.ToArrayOf(),
+                    CancellationToken.None).ConfigureAwait(false));
+
+            Assert.That(ex.StatusCode, Is.EqualTo(StatusCodes.BadTooManyOperations));
+        }
+
         [Description("Verify that HistoryRead can read history for multiple nodes in a single request and returns one result per node.")]
         [Test]
         public async Task HistoryReadMultipleNodesAtOnceAsync()