@contrail/flexplm 1.7.6 → 1.7.7-alpha.d6a63ad

package/lib/util/flexplm-connect.d.ts

@@ -5,10 +5,19 @@ export declare class FlexPLMConnect {
     private staticHeaders;
     payloadSendAsArray: boolean;
     constructor(_config: FCConfig, endPoint?: any, payloadAsArray?: any);
+    private get sessionOptions();
+    private getSessionKey;
+    private getCachedSession;
+    private storeSession;
+    private clearSession;
+    /** Returns the session cookie value Windchill issued on this response, if any (last one wins). */
+    private extractSessionCookie;
+    private cookieHeader;
     private getRequestOptions;
-    getCSRF(): Promise<{
+    getCSRF(getNewSession?: boolean): Promise<{
         nonce_key: any;
         nonce: any;
+        sessionCookie: string;
     }>;
     sendRequest(csrf: any, payload: any): Promise<Response>;
     protected processRequest(payload: any): Promise<FlexPLMResponseData>;

package/lib/util/flexplm-connect.js

@@ -2,6 +2,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FlexPLMConnect = void 0;
 const app_framework_1 = require("@contrail/app-framework");
+// Module-level on purpose: a new FlexPLMConnect is constructed for every event. Declaring for Session resuing use case.
+const sessionCache = new Map();
+// Added for Session reuse - ET-390 - Ends
 class FlexPLMConnect {
     constructor(_config, endPoint = undefined, payloadAsArray = undefined) {
         this.vibeEventEndpoint = '';
@@ -19,9 +22,75 @@ class FlexPLMConnect {
         }
     }
     /////////////////////////////////////////////////////////////////////////////
+    ///////// ET-390 - Session reuse: start
+    /////////////////////////////////////////////////////////////////////////////
+    get sessionOptions() {
+        const sessReuseBool = this.config?.flexplmConnect?.sessionReuse;
+        return {
+            enabled: sessReuseBool?.enabled === true || String(sessReuseBool?.enabled).toLowerCase() === 'true',
+            ttlMs: (sessReuseBool?.ttlSeconds ?? 900) * 1000,
+            cookieName: sessReuseBool?.cookieName ?? 'JSESSIONID',
+            retryStatuses: (sessReuseBool?.retryStatuses ?? [401, 403]),
+        };
+    }
+    getSessionKey() {
+        return [this.config.apiHost, this.config.urlContext, this.config.userName(), this.config.plmEnviornment].join('|');
+    }
+    getCachedSession() {
+        if (!this.sessionOptions.enabled)
+            return undefined;
+        const key = this.getSessionKey();
+        const cachedSessValue = sessionCache.get(key);
+        if (!cachedSessValue)
+            return undefined;
+        if (cachedSessValue.expiresAt <= Date.now()) {
+            sessionCache.delete(key);
+            return undefined;
+        }
+        return cachedSessValue.cookie;
+    }
+    storeSession(cookie) {
+        // sliding expiry: Windchill's session timeout is also sliding
+        sessionCache.set(this.getSessionKey(), { cookie, expiresAt: Date.now() + this.sessionOptions.ttlMs });
+    }
+    clearSession() {
+        sessionCache.delete(this.getSessionKey());
+    }
+    /** Returns the session cookie value Windchill issued on this response, if any (last one wins). */
+    extractSessionCookie(response) {
+        const respHeader = response?.headers;
+        if (!respHeader)
+            return undefined;
+        let raw = [];
+        if (typeof respHeader.getSetCookie === 'function') {
+            raw = respHeader.getSetCookie();
+        }
+        else if (typeof respHeader.get === 'function' && respHeader.get('set-cookie')) {
+            raw = [respHeader.get('set-cookie')];
+        }
+        const name = this.sessionOptions.cookieName;
+        const regexFilter = new RegExp('(?:^|[,\\s])' + name + '=([^;,\\s]+)', 'g');
+        let jSession;
+        for (const line of raw) {
+            let cookieNameMatcher = regexFilter.exec(line);
+            while (cookieNameMatcher !== null) {
+                jSession = cookieNameMatcher[1];
+                cookieNameMatcher = regexFilter.exec(line);
+            }
+        }
+        return jSession;
+    }
+    cookieHeader(sessionCookie) {
+        return sessionCookie ? `${this.sessionOptions.cookieName}=${sessionCookie}` : undefined;
+    }
+    /////////////////////////////////////////////////////////////////////////////
+    ///////// ET-390 - Session reuse: end
+    /////////////////////////////////////////////////////////////////////////////
+    /////////////////////////////////////////////////////////////////////////////
     ///////// Custom getRequestOptions: start
     /////////////////////////////////////////////////////////////////////////////
-    getRequestOptions(method) {
+    // ET-390 - adding a new parameter sessionCookie to the getRequestOptions function
+    getRequestOptions(method, sessionCookie) {
         const csrfOptions = {
             method,
             headers: {
@@ -33,9 +102,19 @@ class FlexPLMConnect {
         if (this.staticHeaders) {
             Object.assign(csrfOptions.headers, this.staticHeaders);
         }
+        // Added for Session reuse - ET-390 - Starts
+        const cookie = this.cookieHeader(sessionCookie);
+        if (cookie) {
+            csrfOptions.headers['Cookie'] = cookie;
+        }
+        // Added for Session reuse - ET-390 - Ends
         if (app_framework_1.Logger.isInfoOn()) {
             const logOptions = JSON.parse(JSON.stringify(csrfOptions));
             logOptions['headers']['Authorization'] = logOptions?.headers?.Authorization.substring(0, 9);
+            // Added for Session reuse - ET-390 - Starts
+            if (logOptions.headers['Cookie'])
+                logOptions.headers['Cookie'] = '***masked***';
+            // Added for Session reuse - ET-390 - Ends
             console.info('csrfOptions: ' + JSON.stringify(logOptions));
         }
         return csrfOptions;
@@ -43,13 +122,30 @@ class FlexPLMConnect {
     /////////////////////////////////////////////////////////////////////////////
     ///////// Custom getRequestOptions: end
     /////////////////////////////////////////////////////////////////////////////
-    async getCSRF() {
+    // ET-390 - adding a new parameter getNewSession to the getCSRF function
+    // Whenever a getCSRF is called without getNewSession, the default value of false will be used
+    async getCSRF(getNewSession = false) {
         const urlContext = this.config.urlContext;
         const csrfEndpoint = this.config.csrfEndpoint;
         const csrfURL = this.config.apiHost + urlContext + csrfEndpoint;
         console.info('csrfURL: ' + csrfURL);
-        const csrfOptions = this.getRequestOptions('GET');
-        const response = await fetch(csrfURL, csrfOptions);
+        // Added for Session reuse - ET-390 - Starts
+        if (getNewSession)
+            this.clearSession();
+        let sentCookie = this.getCachedSession();
+        // getRequestOptions will be called with additional sentCookie parameter
+        const csrfOptions = this.getRequestOptions('GET', sentCookie);
+        // Added for Session reuse - ET-390 - Ends
+        let response = await fetch(csrfURL, csrfOptions);
+        // Added for Session reuse - ET-390 - Starts
+        // if the response status is 401 or 403, then get a new session id
+        if (sentCookie && this.sessionOptions.retryStatuses.includes(response.status)) {
+            console.warn('Cached FlexPLM session rejected on csrf call (status ' + response.status + '). Retrying with a new session.');
+            this.clearSession();
+            sentCookie = undefined;
+            response = await fetch(csrfURL, this.getRequestOptions('GET'));
+        }
+        // Added for Session reuse - ET-390 - Ends
         if (response.status >= 300) {
             const message = 'Error connecting to FlexPLM:status: ' + response.status;
             console.error(message);
@@ -58,14 +154,25 @@ class FlexPLMConnect {
             e['httpResponseStatus'] = response.status;
             throw e;
         }
+        // Added for Session reuse - ET-390 - Starts
+        // If the cookie we sent was invalid, Windchill answers with a fresh Set-Cookie --> replace the cache.
+        let sessionCookie = sentCookie;
+        if (this.sessionOptions.enabled) {
+            sessionCookie = this.extractSessionCookie(response) ?? sentCookie;
+            if (sessionCookie)
+                this.storeSession(sessionCookie);
+        }
+        // Added for Session reuse - ET-390 - Ends
         try {
             const body = await response.json();
             const nonce_key = body.items[0].attributes.nonce_key;
             const nonce = body.items[0].attributes.nonce;
             console.info('nonce_key: ' + nonce_key);
+            //ET-390 - adding sessionCookie to the return
             return {
                 nonce_key,
-                nonce
+                nonce,
+                sessionCookie
             };
         }
         catch (e) {
@@ -79,7 +186,7 @@ class FlexPLMConnect {
         if (this.payloadSendAsArray && !Array.isArray(payload)) {
             payload = [payload];
         }
-        const xferOptions = this.getRequestOptions('POST');
+        const xferOptions = this.getRequestOptions('POST', csrf?.sessionCookie);
         xferOptions['body'] = JSON.stringify(payload);
         xferOptions.headers[csrf.nonce_key] = csrf.nonce;
         const urlContext = this.config.urlContext;
@@ -90,6 +197,8 @@ class FlexPLMConnect {
             const logOptions = JSON.parse(JSON.stringify(xferOptions));
             if (logOptions?.headers?.Authorization)
                 logOptions.headers.Authorization = logOptions?.headers?.Authorization.substring(0, 9);
+            if (logOptions?.headers?.Cookie)
+                logOptions.headers.Cookie = '***masked***';
             if (csrf?.nonce_key)
                 logOptions.headers[csrf.nonce_key] = csrf.nonce ? `***masked(length:${csrf.nonce.length})***` : '***masked(empty)***';
             console.info('csrfOptions: ' + JSON.stringify(logOptions));
@@ -107,13 +216,21 @@ class FlexPLMConnect {
         if (app_framework_1.Logger.isInfoOn()) {
             console.info('payload: ' + JSON.stringify(payload));
         }
-        const csrf = await this.getCSRF();
+        let csrf = await this.getCSRF();
         if (!csrf) {
             const message = 'Failed to get CSRF nonce';
             console.error(message);
             throw new Error(message);
         }
-        const response = await this.sendRequest(csrf, payload);
+        /// Added for Session reuse - ET-390 - Starts
+        // const response = await this.sendRequest(csrf, payload);
+        let response = await this.sendRequest(csrf, payload);
+        if (csrf.sessionCookie && this.sessionOptions.retryStatuses.includes(response.status)) {
+            console.warn('FlexPLM rejected session/nonce (status ' + response.status + '). Getting a new session and retrying once.');
+            csrf = await this.getCSRF(true);
+            response = await this.sendRequest(csrf, payload);
+        }
+        // Added for Session reuse - ET-390 - Ends
         const status = response.status;
         if (status >= 300) {
             const message = 'Error sending data to FlexPLM:status: ' + response.status;
@@ -166,8 +283,20 @@ class FlexPLMConnect {
         const urlContext = includeUrlContext ? this.config.urlContext : '';
         const path = urlPath || ('/servlet/rest' + this.vibeEventEndpoint);
         const vibeEventsURL = this.config.apiHost + urlContext + path;
-        const csrfOptions = this.getRequestOptions('GET');
-        const response = await fetch(vibeEventsURL, csrfOptions);
+        // Added for Session reuse - ET-390 - Starts
+        const cached = this.getCachedSession();
+        const csrfOptions = this.getRequestOptions('GET', cached);
+        let response = await fetch(vibeEventsURL, csrfOptions);
+        if (cached && this.sessionOptions.retryStatuses.includes(response.status)) {
+            this.clearSession();
+            response = await fetch(vibeEventsURL, this.getRequestOptions('GET'));
+        }
+        if (this.sessionOptions.enabled) {
+            const cachedCookie = this.extractSessionCookie(response) ?? cached;
+            if (cachedCookie)
+                this.storeSession(cachedCookie);
+        }
+        // Added for Session reuse - ET-390 - Ends
         if (response.status >= 300) {
             const message = 'Error connecting to FlexPLM:status: ' + response.status;
             console.error(message);

package/lib/util/flexplm-connect.spec.js

@@ -28,6 +28,22 @@ const createConfig = (overrides) => ({
     useDistinctRestEndPointForImages: false,
     ...overrides,
 });
+// Added for Session reuse - ET-390 - Starts
+const csrfBody = { items: [{ attributes: { nonce_key: 'CSRF_NONCE', nonce: 'n1' } }] };
+// Response with Set-Cookie support. setCookie = list of raw Set-Cookie header lines.
+const resp = (status, setCookie = [], json = csrfBody) => ({
+    status,
+    json: jest.fn().mockResolvedValue(json),
+    text: jest.fn().mockResolvedValue('error text'),
+    headers: { getSetCookie: () => setCookie, get: () => null },
+});
+let userCounter = 0;
+const uniqueUser = () => 'sess-user-' + (++userCounter);
+const sessionConfig = (user, sessionReuse = { enabled: true }) => createConfig({ userName: () => user, flexplmConnect: { sessionReuse } });
+const fetchMock = () => global.fetch;
+const callHeaders = (i) => fetchMock().mock.calls[i][1].headers;
+const callMethod = (i) => fetchMock().mock.calls[i][1].method;
+// Added for Session reuse - ET-390 - Ends
 describe('FlexPLMConnect.getRequest', () => {
     it('should call default URL with urlContext when no params provided', async () => {
         const connect = new flexplm_connect_1.FlexPLMConnect(createConfig());
@@ -121,3 +137,249 @@ describe('FlexPLMConnect.sendRequest', () => {
         consoleInfoSpy.mockRestore();
     });
 });
+// Added for Session reuse - ET-390 - Starts
+describe('FlexPLMConnect session reuse', () => {
+    const payload = { id: '123' };
+    it('captures JSESSIONID from the csrf GET and sends it on the POST', async () => {
+        const u = uniqueUser();
+        fetchMock()
+            .mockResolvedValueOnce(resp(200, ['JSESSIONID=abc.tomcat1; Path=/; HttpOnly']))
+            .mockResolvedValueOnce(resp(200, [], {}));
+        await new flexplm_connect_1.FlexPLMConnect(sessionConfig(u)).sendToFlexPLM(payload);
+        expect(fetchMock()).toHaveBeenCalledTimes(2);
+        expect(callHeaders(0).Cookie).toBeUndefined(); // first ever call: no cached session
+        expect(callHeaders(1).Cookie).toBe('JSESSIONID=abc.tomcat1');
+        expect(callHeaders(1).CSRF_NONCE).toBe('n1');
+    });
+    it('reuses the cached session on the next event (new FlexPLMConnect instance)', async () => {
+        const u = uniqueUser();
+        fetchMock()
+            .mockResolvedValueOnce(resp(200, ['JSESSIONID=abc.tomcat1; Path=/'])) // event 1 GET
+            .mockResolvedValueOnce(resp(200, [], {})) // event 1 POST
+            .mockResolvedValueOnce(resp(200, [])) // event 2 GET (valid session -> no Set-Cookie)
+            .mockResolvedValueOnce(resp(200, [], {})); // event 2 POST
+        await new flexplm_connect_1.FlexPLMConnect(sessionConfig(u)).sendToFlexPLM(payload);
+        await new flexplm_connect_1.FlexPLMConnect(sessionConfig(u)).sendToFlexPLM(payload);
+        expect(callHeaders(2).Cookie).toBe('JSESSIONID=abc.tomcat1'); // GET reuses it
+        expect(callHeaders(3).Cookie).toBe('JSESSIONID=abc.tomcat1'); // POST reuses it
+    });
+    it('replaces the cached session when Windchill answers the GET with a new Set-Cookie', async () => {
+        const u = uniqueUser();
+        fetchMock()
+            .mockResolvedValueOnce(resp(200, ['JSESSIONID=old.tomcat1; Path=/']))
+            .mockResolvedValueOnce(resp(200, [], {}))
+            .mockResolvedValueOnce(resp(200, ['JSESSIONID=new.tomcat1; Path=/'])) // old one was stale -> new issued
+            .mockResolvedValueOnce(resp(200, [], {}))
+            .mockResolvedValueOnce(resp(200, []))
+            .mockResolvedValueOnce(resp(200, [], {}));
+        const connect = () => new flexplm_connect_1.FlexPLMConnect(sessionConfig(u));
+        await connect().sendToFlexPLM(payload);
+        await connect().sendToFlexPLM(payload);
+        await connect().sendToFlexPLM(payload);
+        expect(callHeaders(2).Cookie).toBe('JSESSIONID=old.tomcat1'); // event 2 GET sent the old one
+        expect(callHeaders(3).Cookie).toBe('JSESSIONID=new.tomcat1'); // POST uses the replacement
+        expect(callHeaders(4).Cookie).toBe('JSESSIONID=new.tomcat1'); // event 3 GET sends the replacement
+    });
+    it('retries once with a new session when the POST is rejected with 403', async () => {
+        const u = uniqueUser();
+        fetchMock()
+            .mockResolvedValueOnce(resp(200, ['JSESSIONID=old.tomcat1; Path=/'])) // GET
+            .mockResolvedValueOnce(resp(403, [], {})) // POST rejected
+            .mockResolvedValueOnce(resp(200, ['JSESSIONID=new.tomcat1; Path=/'])) // GET again, fresh session
+            .mockResolvedValueOnce(resp(200, [], { ok: true })); // POST succeeds
+        const result = await new flexplm_connect_1.FlexPLMConnect(sessionConfig(u)).sendToFlexPLM(payload);
+        expect(fetchMock()).toHaveBeenCalledTimes(4);
+        expect(callHeaders(2).Cookie).toBeUndefined(); // retry GET must NOT send the stale cookie
+        expect(callHeaders(3).Cookie).toBe('JSESSIONID=new.tomcat1');
+        expect(result.status).toBe(200);
+        expect(result.data).toEqual({ ok: true });
+    });
+    it('also retries on 401', async () => {
+        const u = uniqueUser();
+        fetchMock()
+            .mockResolvedValueOnce(resp(200, ['JSESSIONID=old.tomcat1']))
+            .mockResolvedValueOnce(resp(401, [], {}))
+            .mockResolvedValueOnce(resp(200, ['JSESSIONID=new.tomcat1']))
+            .mockResolvedValueOnce(resp(200, [], {}));
+        await new flexplm_connect_1.FlexPLMConnect(sessionConfig(u)).sendToFlexPLM(payload);
+        expect(fetchMock()).toHaveBeenCalledTimes(4);
+    });
+    it('does not loop: a second 403 after the retry is surfaced as an error', async () => {
+        const u = uniqueUser();
+        fetchMock()
+            .mockResolvedValueOnce(resp(200, ['JSESSIONID=old.tomcat1']))
+            .mockResolvedValueOnce(resp(403, [], {}))
+            .mockResolvedValueOnce(resp(200, ['JSESSIONID=new.tomcat1']))
+            .mockResolvedValueOnce(resp(403, [], {}));
+        await expect(new flexplm_connect_1.FlexPLMConnect(sessionConfig(u)).sendToFlexPLM(payload))
+            .rejects.toThrow('Error sending data to FlexPLM:status: 403');
+        expect(fetchMock()).toHaveBeenCalledTimes(4);
+    });
+    it('does not retry on non-auth errors such as 500 (event may already be processed)', async () => {
+        const u = uniqueUser();
+        fetchMock()
+            .mockResolvedValueOnce(resp(200, ['JSESSIONID=abc.tomcat1']))
+            .mockResolvedValueOnce(resp(500, [], {}));
+        await expect(new flexplm_connect_1.FlexPLMConnect(sessionConfig(u)).sendToFlexPLM(payload))
+            .rejects.toThrow('Error sending data to FlexPLM:status: 500');
+        expect(fetchMock()).toHaveBeenCalledTimes(2);
+    });
+    it('retries the csrf GET without a cookie when the cached session is rejected there', async () => {
+        const u = uniqueUser();
+        fetchMock()
+            .mockResolvedValueOnce(resp(200, ['JSESSIONID=old.tomcat1'])) // event 1 GET
+            .mockResolvedValueOnce(resp(200, [], {})) // event 1 POST
+            .mockResolvedValueOnce(resp(401, [])) // event 2 GET with cached cookie rejected
+            .mockResolvedValueOnce(resp(200, ['JSESSIONID=new.tomcat1'])) // event 2 GET retry, no cookie
+            .mockResolvedValueOnce(resp(200, [], {})); // event 2 POST
+        await new flexplm_connect_1.FlexPLMConnect(sessionConfig(u)).sendToFlexPLM(payload);
+        await new flexplm_connect_1.FlexPLMConnect(sessionConfig(u)).sendToFlexPLM(payload);
+        expect(callHeaders(2).Cookie).toBe('JSESSIONID=old.tomcat1');
+        expect(callHeaders(3).Cookie).toBeUndefined();
+        expect(callHeaders(4).Cookie).toBe('JSESSIONID=new.tomcat1');
+    });
+    it('expires the cached session after ttlSeconds', async () => {
+        const u = uniqueUser();
+        const realNow = Date.now();
+        const nowSpy = jest.spyOn(Date, 'now').mockReturnValue(realNow);
+        fetchMock()
+            .mockResolvedValueOnce(resp(200, ['JSESSIONID=abc.tomcat1']))
+            .mockResolvedValueOnce(resp(200, [], {}))
+            .mockResolvedValueOnce(resp(200, ['JSESSIONID=def.tomcat1']))
+            .mockResolvedValueOnce(resp(200, [], {}));
+        const cfg = sessionConfig(u, { enabled: true, ttlSeconds: 1 });
+        await new flexplm_connect_1.FlexPLMConnect(cfg).sendToFlexPLM(payload);
+        nowSpy.mockReturnValue(realNow + 2000); // 2s later > 1s ttl
+        await new flexplm_connect_1.FlexPLMConnect(cfg).sendToFlexPLM(payload);
+        expect(callHeaders(2).Cookie).toBeUndefined(); // expired -> GET sends no cookie
+        expect(callHeaders(3).Cookie).toBe('JSESSIONID=def.tomcat1');
+        nowSpy.mockRestore();
+    });
+    it('uses the last JSESSIONID when several Set-Cookie lines are returned', async () => {
+        const u = uniqueUser();
+        fetchMock()
+            .mockResolvedValueOnce(resp(200, ['JSESSIONID=first.tomcat1; Path=/', 'OTHER=x; Path=/', 'JSESSIONID=second.tomcat1; Path=/']))
+            .mockResolvedValueOnce(resp(200, [], {}));
+        await new flexplm_connect_1.FlexPLMConnect(sessionConfig(u)).sendToFlexPLM(payload);
+        expect(callHeaders(1).Cookie).toBe('JSESSIONID=second.tomcat1');
+    });
+    it('falls back to headers.get("set-cookie") when getSetCookie is not available', async () => {
+        const u = uniqueUser();
+        const legacy = {
+            status: 200,
+            json: jest.fn().mockResolvedValue(csrfBody),
+            text: jest.fn(),
+            headers: { get: (k) => (k.toLowerCase() === 'set-cookie' ? 'JSESSIONID=legacy.tomcat1; Path=/' : null) },
+        };
+        fetchMock().mockResolvedValueOnce(legacy).mockResolvedValueOnce(resp(200, [], {}));
+        await new flexplm_connect_1.FlexPLMConnect(sessionConfig(u)).sendToFlexPLM(payload);
+        expect(callHeaders(1).Cookie).toBe('JSESSIONID=legacy.tomcat1');
+    });
+    it('honours a custom cookieName', async () => {
+        const u = uniqueUser();
+        fetchMock()
+            .mockResolvedValueOnce(resp(200, ['MYSESSION=zzz; Path=/', 'JSESSIONID=ignored; Path=/']))
+            .mockResolvedValueOnce(resp(200, [], {}));
+        await new flexplm_connect_1.FlexPLMConnect(sessionConfig(u, { enabled: true, cookieName: 'MYSESSION' })).sendToFlexPLM(payload);
+        expect(callHeaders(1).Cookie).toBe('MYSESSION=zzz');
+    });
+    it('accepts enabled as the string "true"', async () => {
+        const u = uniqueUser();
+        fetchMock()
+            .mockResolvedValueOnce(resp(200, ['JSESSIONID=abc.tomcat1']))
+            .mockResolvedValueOnce(resp(200, [], {}));
+        await new flexplm_connect_1.FlexPLMConnect(sessionConfig(u, { enabled: 'true' })).sendToFlexPLM(payload);
+        expect(callHeaders(1).Cookie).toBe('JSESSIONID=abc.tomcat1');
+    });
+    it('keeps separate sessions per user', async () => {
+        const a = uniqueUser();
+        const b = uniqueUser();
+        fetchMock()
+            .mockResolvedValueOnce(resp(200, ['JSESSIONID=aaa.tomcat1']))
+            .mockResolvedValueOnce(resp(200, [], {}))
+            .mockResolvedValueOnce(resp(200, ['JSESSIONID=bbb.tomcat1']))
+            .mockResolvedValueOnce(resp(200, [], {}));
+        await new flexplm_connect_1.FlexPLMConnect(sessionConfig(a)).sendToFlexPLM(payload);
+        await new flexplm_connect_1.FlexPLMConnect(sessionConfig(b)).sendToFlexPLM(payload);
+        expect(callHeaders(2).Cookie).toBeUndefined(); // user b must not see user a's cookie
+        expect(callHeaders(3).Cookie).toBe('JSESSIONID=bbb.tomcat1');
+    });
+    it('never logs the cookie value', async () => {
+        const isInfoOn = jest.spyOn(app_framework_1.Logger, 'isInfoOn').mockReturnValue(true);
+        const info = jest.spyOn(console, 'info').mockImplementation();
+        const u = uniqueUser();
+        fetchMock()
+            .mockResolvedValueOnce(resp(200, ['JSESSIONID=supersecret.tomcat1']))
+            .mockResolvedValueOnce(resp(200, [], {}))
+            .mockResolvedValueOnce(resp(200, []))
+            .mockResolvedValueOnce(resp(200, [], {}));
+        await new flexplm_connect_1.FlexPLMConnect(sessionConfig(u)).sendToFlexPLM(payload);
+        await new flexplm_connect_1.FlexPLMConnect(sessionConfig(u)).sendToFlexPLM(payload); // 2nd event sends Cookie on GET and POST
+        const logged = info.mock.calls.map(c => String(c[0] ?? '')).join('\n');
+        expect(logged).toContain('"Cookie":"***masked***"');
+        expect(logged).not.toContain('supersecret');
+        isInfoOn.mockRestore();
+        info.mockRestore();
+    });
+});
+describe('FlexPLMConnect session reuse - feature disabled (default)', () => {
+    const payload = { id: '123' };
+    it('sends no Cookie header and makes exactly one GET + one POST', async () => {
+        const u = uniqueUser();
+        fetchMock()
+            .mockResolvedValueOnce(resp(200, ['JSESSIONID=abc.tomcat1'])) // Set-Cookie present but must be ignored
+            .mockResolvedValueOnce(resp(200, [], {}))
+            .mockResolvedValueOnce(resp(200, ['JSESSIONID=def.tomcat1']))
+            .mockResolvedValueOnce(resp(200, [], {}));
+        const cfg = createConfig({ userName: () => u }); // no flexplmConnect at all
+        await new flexplm_connect_1.FlexPLMConnect(cfg).sendToFlexPLM(payload);
+        await new flexplm_connect_1.FlexPLMConnect(cfg).sendToFlexPLM(payload);
+        for (let i = 0; i < 4; i++) {
+            expect(callHeaders(i).Cookie).toBeUndefined();
+        }
+    });
+    it('does not retry on 403 (behaves exactly as before)', async () => {
+        const u = uniqueUser();
+        fetchMock()
+            .mockResolvedValueOnce(resp(200))
+            .mockResolvedValueOnce(resp(403, [], {}));
+        await expect(new flexplm_connect_1.FlexPLMConnect(createConfig({ userName: () => u })).sendToFlexPLM(payload))
+            .rejects.toThrow('Error sending data to FlexPLM:status: 403');
+        expect(fetchMock()).toHaveBeenCalledTimes(2);
+    });
+    it('explicit enabled:false behaves the same as not configured', async () => {
+        const u = uniqueUser();
+        fetchMock()
+            .mockResolvedValueOnce(resp(200, ['JSESSIONID=abc.tomcat1']))
+            .mockResolvedValueOnce(resp(200, [], {}));
+        await new flexplm_connect_1.FlexPLMConnect(sessionConfig(u, { enabled: false })).sendToFlexPLM(payload);
+        expect(callHeaders(1).Cookie).toBeUndefined();
+    });
+});
+describe('FlexPLMConnect.getRequest session reuse (only if you applied step 2g)', () => {
+    it('sends the cached cookie on image/GET requests', async () => {
+        const u = uniqueUser();
+        fetchMock()
+            .mockResolvedValueOnce(resp(200, ['JSESSIONID=abc.tomcat1'])) // csrf GET primes the cache
+            .mockResolvedValueOnce(resp(200, [], {})) // POST
+            .mockResolvedValueOnce(resp(200, [], { items: [] })); // getRequest
+        const connect = new flexplm_connect_1.FlexPLMConnect(sessionConfig(u));
+        await connect.sendToFlexPLM({ id: '1' });
+        await connect.getRequest();
+        expect(callHeaders(2).Cookie).toBe('JSESSIONID=abc.tomcat1');
+    });
+    it('retries once without the cookie when the cached session is rejected on getRequest', async () => {
+        const u = uniqueUser();
+        fetchMock()
+            .mockResolvedValueOnce(resp(200, ['JSESSIONID=abc.tomcat1']))
+            .mockResolvedValueOnce(resp(200, [], {}))
+            .mockResolvedValueOnce(resp(401, [])) // getRequest with cached cookie
+            .mockResolvedValueOnce(resp(200, ['JSESSIONID=new.tomcat1'], { items: [] })); // retry, no cookie
+        const connect = new flexplm_connect_1.FlexPLMConnect(sessionConfig(u));
+        await connect.sendToFlexPLM({ id: '1' });
+        await connect.getRequest();
+        expect(callHeaders(2).Cookie).toBe('JSESSIONID=abc.tomcat1');
+        expect(callHeaders(3).Cookie).toBeUndefined();
+    });
+});
+// Added for Session reuse - ET-390 - Ends

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrail/flexplm",
-  "version": "1.7.6",
+  "version": "1.7.7-alpha.d6a63ad",
   "description": "Library used for integration with flexplm.",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",