@contrail/flexplm 1.7.4-alpha.8ba0056 → 1.7.4-alpha.90ac7f4

package/lib/publish/base-process-publish-assortment.js

@@ -493,18 +493,15 @@ class BaseProcessPublishAssortment {
             const item = aItem?.item;
             const itemId = item?.id;
             const itemFamilyId = item?.itemFamilyId;
-            // ET-243: meets criteria is separated out for itemId and familyId separately
             if (meetsCriteria) {
                 releasedForDevelopmentItemIds.push(itemId);
-            }
-            if (!itemFamilySet.has(itemFamilyId) && itemId !== itemFamilyId) {
-                const familyItem = item?.itemFamily;
-                if (familyItem) {
-                    if (this.meetsCriteria({ item: familyItem })
-                        && !releasedForDevelopmentItemIds.includes(itemFamilyId)) {
+                if (!itemFamilySet.has(itemFamilyId) && itemId !== itemFamilyId) {
+                    const familyItem = item?.itemFamily;
+                    const familyItemMeetsCriteria = this.meetsCriteria({ item: familyItem });
+                    if (familyItemMeetsCriteria) {
                         releasedForDevelopmentItemIds.push(itemFamilyId);
                     }
-                    itemFamilySet.add(itemFamilyId); // only mark resolved when we had data to judge
+                    itemFamilySet.add(itemFamilyId);
                 }
             }
         }
@@ -515,19 +512,18 @@ class BaseProcessPublishAssortment {
             const itemFamilyId = item?.itemFamilyId;
             if (meetsCriteria) {
                 releasedForDevelopmentItemIds.push(itemId);
-            }
-            if (!itemFamilySet.has(itemFamilyId) && itemId !== itemFamilyId) {
-                const familyItem = item?.itemFamily;
-                if (familyItem) {
-                    const familyItemMeetsCriteria = this.meetsCriteria({ item: familyItem });
-                    if (familyItemMeetsCriteria
-                        && !releasedForDevelopmentItemIds.includes(itemFamilyId)) {
-                        releasedForDevelopmentItemIds.push(itemFamilyId);
+                if (!itemFamilySet.has(itemFamilyId) && itemId !== itemFamilyId) {
+                    const familyItem = item?.itemFamily;
+                    if (familyItem) {
+                        const familyItemMeetsCriteria = this.meetsCriteria({ item: familyItem });
+                        if (familyItemMeetsCriteria) {
+                            releasedForDevelopmentItemIds.push(itemFamilyId);
+                        }
+                        itemFamilySet.add(itemFamilyId);
+                    }
+                    else {
+                        itemFamilySet.add(itemFamilyId);
                     }
-                    itemFamilySet.add(itemFamilyId);
-                }
-                else {
-                    itemFamilySet.add(itemFamilyId);
                 }
             }
         }

package/lib/util/flexplm-connect.js

@@ -63,7 +63,6 @@ class FlexPLMConnect {
             const nonce_key = body.items[0].attributes.nonce_key;
             const nonce = body.items[0].attributes.nonce;
             console.info('nonce_key: ' + nonce_key);
-            console.info('nonce: ' + nonce);
             return {
                 nonce_key,
                 nonce
@@ -89,7 +88,10 @@ class FlexPLMConnect {
             console.info('Request:');
             console.info('vibeEventsURL: ' + vibeEventsURL);
             const logOptions = JSON.parse(JSON.stringify(xferOptions));
-            logOptions['headers']['Authorization'] = logOptions?.headers?.Authorization.substring(0, 9);
+            if (logOptions?.headers?.Authorization)
+                logOptions.headers.Authorization = logOptions?.headers?.Authorization.substring(0, 9);
+            if (csrf?.nonce_key)
+                logOptions.headers[csrf.nonce_key] = csrf.nonce ? `***masked(length:${csrf.nonce.length})***` : '***masked(empty)***';
             console.info('csrfOptions: ' + JSON.stringify(logOptions));
             console.info('Making call to xfer data to FlexPLM');
         }

package/lib/util/flexplm-connect.spec.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const flexplm_connect_1 = require("./flexplm-connect");
+const app_framework_1 = require("@contrail/app-framework");
 const mockJsonData = { items: [{ id: '123', name: 'test' }] };
 const mockResponse = (status, json = mockJsonData) => ({
     status,
@@ -87,3 +88,36 @@ describe('FlexPLMConnect.getRequest', () => {
         await expect(connect.getRequest()).rejects.toThrow('Error getting json data from FlexPLM: Invalid JSON');
     });
 });
+describe('FlexPLMConnect.sendRequest', () => {
+    it('should mask csrf nonce value in logged request options', async () => {
+        const loggerIsInfoOnSpy = jest.spyOn(app_framework_1.Logger, 'isInfoOn').mockReturnValue(true);
+        const consoleInfoSpy = jest.spyOn(console, 'info').mockImplementation();
+        const csrf = { nonce_key: 'CSRF_NONCE', nonce: 'raw-secret-nonce' };
+        const payload = { id: '123' };
+        const connect = new flexplm_connect_1.FlexPLMConnect(createConfig());
+        await connect.sendRequest(csrf, payload);
+        const csrfOptionsLogMessages = consoleInfoSpy.mock.calls
+            .map(([message]) => String(message ?? ''))
+            .filter(message => message.startsWith('csrfOptions: '));
+        const sendRequestOptionsLogMessage = csrfOptionsLogMessages.find(message => message.includes('"CSRF_NONCE":'));
+        expect(sendRequestOptionsLogMessage).toBeDefined();
+        expect(sendRequestOptionsLogMessage ?? '').not.toContain('raw-secret-nonce');
+        expect(sendRequestOptionsLogMessage ?? '').toContain(`"CSRF_NONCE":"***masked(length:${'raw-secret-nonce'.length})***"`);
+        loggerIsInfoOnSpy.mockRestore();
+        consoleInfoSpy.mockRestore();
+    });
+    it('should log masked(empty) when csrf nonce is empty', async () => {
+        const loggerIsInfoOnSpy = jest.spyOn(app_framework_1.Logger, 'isInfoOn').mockReturnValue(true);
+        const consoleInfoSpy = jest.spyOn(console, 'info').mockImplementation();
+        const csrf = { nonce_key: 'CSRF_NONCE', nonce: '' };
+        const connect = new flexplm_connect_1.FlexPLMConnect(createConfig());
+        await connect.sendRequest(csrf, { id: '123' });
+        const csrfOptionsLog = consoleInfoSpy.mock.calls
+            .map(([message]) => String(message ?? ''))
+            .find(message => message.includes('"CSRF_NONCE":'));
+        expect(csrfOptionsLog).toBeDefined();
+        expect(csrfOptionsLog ?? '').toContain('"CSRF_NONCE":"***masked(empty)***"');
+        loggerIsInfoOnSpy.mockRestore();
+        consoleInfoSpy.mockRestore();
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrail/flexplm",
-  "version": "1.7.4-alpha.8ba0056",
+  "version": "1.7.4-alpha.90ac7f4",
   "description": "Library used for integration with flexplm.",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",