@contrail/flexplm 1.7.7-alpha.279b642 → 1.7.7-alpha.3e12cec

package/lib/util/flexplm-connect.js

@@ -3,6 +3,15 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.FlexPLMConnect = void 0;
 const app_framework_1 = require("@contrail/app-framework");
 const flexplm_session_manager_1 = require("./flexplm-session-manager");
+// Cookie values carry the session id: mask them in logs whatever the header-name casing.
+const maskCookieHeaders = (headers) => {
+    if (!headers)
+        return;
+    for (const key of Object.keys(headers)) {
+        if (key.toLowerCase() === 'cookie' && headers[key])
+            headers[key] = '***masked***';
+    }
+};
 class FlexPLMConnect {
     constructor(_config, endPoint = undefined, payloadAsArray = undefined) {
         this.vibeEventEndpoint = '';
@@ -48,17 +57,21 @@ class FlexPLMConnect {
             Object.assign(csrfOptions.headers, this.staticHeaders);
         }
         // Added for Session reuse - ET-390 - Starts
-        const cookie = this.sessions.cookieHeader(sessionCookie);
+        // Merge with a configured static Cookie header (any header-name casing) instead of replacing it.
+        const headers = csrfOptions.headers;
+        const staticCookieKeys = Object.keys(headers).filter(key => key.toLowerCase() === 'cookie');
+        const staticCookie = staticCookieKeys.map(key => headers[key]).join('; ');
+        const cookie = this.sessions.buildCookieHeader(staticCookie, sessionCookie);
+        staticCookieKeys.forEach(key => delete headers[key]);
         if (cookie) {
-            csrfOptions.headers['Cookie'] = cookie;
+            headers['Cookie'] = cookie;
         }
         // Added for Session reuse - ET-390 - Ends
         if (app_framework_1.Logger.isInfoOn()) {
             const logOptions = JSON.parse(JSON.stringify(csrfOptions));
             logOptions['headers']['Authorization'] = logOptions?.headers?.Authorization.substring(0, 9);
             // Added for Session reuse - ET-390 - Starts
-            if (logOptions.headers['Cookie'])
-                logOptions.headers['Cookie'] = '***masked***';
+            maskCookieHeaders(logOptions.headers);
             // Added for Session reuse - ET-390 - Ends
             console.info('csrfOptions: ' + JSON.stringify(logOptions));
         }
@@ -127,7 +140,7 @@ class FlexPLMConnect {
         if (this.sessions.options.enabled) {
             sessionCookie = this.sessions.extractSessionCookie(response) ?? sentCookie;
             if (sessionCookie)
-                this.sessions.storeSession(sessionCookie);
+                this.sessions.storeSession(sessionCookie, sentCookie);
         }
         // Added for Session reuse - ET-390 - Ends
         try {
@@ -163,8 +176,7 @@ class FlexPLMConnect {
             const logOptions = JSON.parse(JSON.stringify(xferOptions));
             if (logOptions?.headers?.Authorization)
                 logOptions.headers.Authorization = logOptions?.headers?.Authorization.substring(0, 9);
-            if (logOptions?.headers?.Cookie)
-                logOptions.headers.Cookie = '***masked***';
+            maskCookieHeaders(logOptions?.headers);
             if (csrf?.nonce_key)
                 logOptions.headers[csrf.nonce_key] = csrf.nonce ? `***masked(length:${csrf.nonce.length})***` : '***masked(empty)***';
             console.info('csrfOptions: ' + JSON.stringify(logOptions));
@@ -264,7 +276,7 @@ class FlexPLMConnect {
                 if (!(sent && this.sessions.options.retryStatuses.includes(res.status))) {
                     const cookie = this.sessions.extractSessionCookie(res) ?? sent;
                     if (cookie)
-                        this.sessions.storeSession(cookie);
+                        this.sessions.storeSession(cookie, sent);
                 }
                 return { response: res, sent };
             };

package/lib/util/flexplm-connect.spec.js

@@ -354,6 +354,60 @@ describe('FlexPLMConnect session reuse', () => {
         isInfoOn.mockRestore();
         info.mockRestore();
     });
+    describe('static Cookie header', () => {
+        const withStatic = (user, staticHeaders, sessionReuse = { enabled: true }) => createConfig({ userName: () => user, flexplmConnect: { sessionReuse, staticHeaders } });
+        it('should keep other static cookies and replace only the managed one once a session is cached', async () => {
+            const u = uniqueUser();
+            fetchMock()
+                .mockResolvedValueOnce(resp(200, ['JSESSIONID=new.tomcat1; Path=/']))
+                .mockResolvedValueOnce(resp(200, [], {}));
+            await new flexplm_connect_1.FlexPLMConnect(withStatic(u, { Cookie: 'lb=abc; JSESSIONID=stale; theme=dark' })).sendToFlexPLM(payload);
+            expect(callHeaders(0).Cookie).toBe('lb=abc; theme=dark'); // cold: stale managed cookie dropped
+            expect(callHeaders(1).Cookie).toBe('lb=abc; theme=dark; JSESSIONID=new.tomcat1');
+        });
+        it('should send a single Cookie header when the static header name is lowercase', async () => {
+            const u = uniqueUser();
+            fetchMock()
+                .mockResolvedValueOnce(resp(200, ['JSESSIONID=abc.tomcat1; Path=/']))
+                .mockResolvedValueOnce(resp(200, [], {}));
+            await new flexplm_connect_1.FlexPLMConnect(withStatic(u, { cookie: 'lb=abc' })).sendToFlexPLM(payload);
+            const postHeaders = callHeaders(1);
+            expect(Object.keys(postHeaders).filter(k => k.toLowerCase() === 'cookie')).toEqual(['Cookie']);
+            expect(postHeaders.Cookie).toBe('lb=abc; JSESSIONID=abc.tomcat1');
+        });
+        it('should send the static Cookie unchanged when session reuse is disabled', async () => {
+            const u = uniqueUser();
+            fetchMock()
+                .mockResolvedValueOnce(resp(200, ['JSESSIONID=abc.tomcat1; Path=/']))
+                .mockResolvedValueOnce(resp(200, [], {}));
+            await new flexplm_connect_1.FlexPLMConnect(withStatic(u, { Cookie: 'lb=abc; JSESSIONID=static' }, { enabled: false })).sendToFlexPLM(payload);
+            expect(callHeaders(0).Cookie).toBe('lb=abc; JSESSIONID=static');
+            expect(callHeaders(1).Cookie).toBe('lb=abc; JSESSIONID=static');
+        });
+        it('should not resend a rejected static JSESSIONID on the fresh retry', async () => {
+            const u = uniqueUser();
+            fetchMock()
+                .mockResolvedValueOnce(resp(200, ['JSESSIONID=old.tomcat1; Path=/']))
+                .mockResolvedValueOnce(resp(403, [], {})) // POST rejected
+                .mockResolvedValueOnce(resp(200, ['JSESSIONID=fresh.tomcat1; Path=/'])) // fresh GET
+                .mockResolvedValueOnce(resp(200, [], {}));
+            await new flexplm_connect_1.FlexPLMConnect(withStatic(u, { Cookie: 'lb=abc; JSESSIONID=static' })).sendToFlexPLM(payload);
+            expect(callHeaders(2).Cookie).toBe('lb=abc'); // fresh GET carries no JSESSIONID
+            expect(callHeaders(3).Cookie).toBe('lb=abc; JSESSIONID=fresh.tomcat1');
+        });
+        it('should mask a lowercase static cookie header in logs', async () => {
+            const isInfoOn = jest.spyOn(app_framework_1.Logger, 'isInfoOn').mockReturnValue(true);
+            const info = jest.spyOn(console, 'info').mockImplementation();
+            fetchMock()
+                .mockResolvedValueOnce(resp(200, ['JSESSIONID=abc.tomcat1']))
+                .mockResolvedValueOnce(resp(200, [], {}));
+            await new flexplm_connect_1.FlexPLMConnect(withStatic(uniqueUser(), { cookie: 'lb=topsecret' }, { enabled: false })).sendToFlexPLM(payload);
+            const logged = info.mock.calls.map(c => String(c[0] ?? '')).join('\n');
+            expect(logged).not.toContain('topsecret');
+            isInfoOn.mockRestore();
+            info.mockRestore();
+        });
+    });
     describe('option normalisation', () => {
         const rejectedOnceThenOk = (u, opts) => {
             fetchMock()
@@ -521,6 +575,41 @@ describe('FlexPLMConnect session reuse', () => {
     describe('concurrent session acquisition', () => {
         const flush = () => new Promise(r => setImmediate(r));
         const isColdGet = (call) => call[1].method === 'GET' && !call[1].headers.Cookie;
+        it('should not let a late response using an older cookie roll back a refreshed session', async () => {
+            const u = uniqueUser();
+            const cfg = () => sessionConfig(u);
+            // seed the cache with 'old'
+            fetchMock()
+                .mockResolvedValueOnce(resp(200, ['JSESSIONID=old']))
+                .mockResolvedValueOnce(resp(200, [], {}));
+            await new flexplm_connect_1.FlexPLMConnect(cfg()).sendToFlexPLM(payload);
+            let lateGetsSeen = 0;
+            let releaseLate;
+            const lateGate = new Promise(r => { releaseLate = r; });
+            fetchMock().mockReset();
+            fetchMock().mockImplementation(async (_url, opts) => {
+                const cookie = opts.headers.Cookie;
+                if (opts.method === 'GET' && cookie === 'JSESSIONID=old') {
+                    if (++lateGetsSeen === 1)
+                        return resp(403, []); // event A: old rejected
+                    await lateGate; // event B: slow 200, no Set-Cookie
+                    return resp(200, []);
+                }
+                if (opts.method === 'GET' && !cookie)
+                    return resp(200, ['JSESSIONID=new']); // A's fresh acquisition
+                if (opts.method === 'GET')
+                    return resp(200, []);
+                return resp(200, [], {});
+            });
+            const a = new flexplm_connect_1.FlexPLMConnect(cfg()).sendToFlexPLM(payload);
+            const b = new flexplm_connect_1.FlexPLMConnect(cfg()).sendToFlexPLM(payload);
+            await a;
+            releaseLate();
+            await b;
+            fetchMock().mockClear();
+            await new flexplm_connect_1.FlexPLMConnect(cfg()).getCSRF();
+            expect(callHeaders(0).Cookie).toBe('JSESSIONID=new'); // B must not have stored 'old' again
+        });
         it('should share one session across concurrent events on a cold cache', async () => {
             const u = uniqueUser();
             let release;

package/lib/util/flexplm-session-manager.d.ts

@@ -21,9 +21,20 @@ export declare class FlexPLMSessionManager {
     runColdAcquisition<T>(acquire: () => Promise<T>): Promise<T>;
     private getSessionKey;
     getCachedSession(): string | undefined;
-    storeSession(cookie: string): void;
+    /**
+     * Compare-and-set: stores `cookie` only if the cache still holds the cookie this request was sent with
+     * (`sentCookie`, undefined for a cold acquisition = nothing cached). A late response must not roll back or
+     * resurrect a session that a concurrent event already replaced or cleared.
+     * @returns true if the cache was updated
+     */
+    storeSession(cookie: string, sentCookie: string | undefined): boolean;
     clearSession(): void;
     /** Returns the session cookie value Windchill issued on this response, if any (last one wins). */
     extractSessionCookie(response: Response): string | undefined;
-    cookieHeader(sessionCookie?: string): string | undefined;
+    /**
+     * Builds the Cookie header value from the configured static Cookie header and the managed session cookie.
+     * With session reuse enabled only the managed cookie is replaced/removed; every other static cookie pair is kept.
+     * With session reuse disabled the static value is returned unchanged.
+     */
+    buildCookieHeader(staticCookie?: string, sessionCookie?: string): string | undefined;
 }

package/lib/util/flexplm-session-manager.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FlexPLMSessionManager = exports.SessionRejectedError = void 0;
+const crypto_1 = require("crypto");
 // Module-level on purpose: a new FlexPLMConnect (and session manager) is constructed for every event.
 const sessionCache = new Map();
 // Upper bound so users/option combinations that are never requested again cannot accumulate cookies forever.
@@ -18,6 +19,7 @@ const pruneSessionCache = () => {
 };
 // In-flight cold session acquisitions per key, so concurrent events share one FlexPLM session instead of each creating their own.
 const inFlightAcquisitions = new Map();
+const SESSION_CACHE_DIGEST_KEY = (0, crypto_1.randomBytes)(32);
 const DEFAULT_SESSION_COOKIE_NAME = 'JSESSIONID';
 const DEFAULT_SESSION_TTL_SECONDS = 900;
 const DEFAULT_RETRY_STATUSES = [401, 403];
@@ -98,8 +100,18 @@ class FlexPLMSessionManager {
     getSessionKey() {
         // Options that change the cached value are part of the key; JSON avoids '|' collisions between fields.
         const { cookieName, ttlMs } = this.options;
+        const staticHeaders = Object.entries(this.config.flexplmConnect?.staticHeaders ?? {})
+            .map(([name, value]) => [name.toLowerCase(), value])
+            .sort(([nameA, valueA], [nameB, valueB]) => {
+            if (nameA !== nameB)
+                return nameA < nameB ? -1 : 1;
+            return valueA < valueB ? -1 : valueA > valueB ? 1 : 0;
+        });
+        const authenticationAndRoutingDigest = (0, crypto_1.createHmac)('sha256', SESSION_CACHE_DIGEST_KEY)
+            .update(JSON.stringify([this.config.userName(), this.config.password(), staticHeaders]))
+            .digest('hex');
         return JSON.stringify([
-            this.config.apiHost, this.config.urlContext, this.config.userName(), this.config.plmEnviornment, cookieName, ttlMs,
+            this.config.apiHost, this.config.urlContext, this.config.plmEnviornment, cookieName, ttlMs, authenticationAndRoutingDigest,
         ]);
     }
     getCachedSession() {
@@ -115,13 +127,22 @@ class FlexPLMSessionManager {
         }
         return cachedSessValue.cookie;
     }
-    storeSession(cookie) {
-        // sliding expiry: Windchill's session timeout is also sliding
+    /**
+     * Compare-and-set: stores `cookie` only if the cache still holds the cookie this request was sent with
+     * (`sentCookie`, undefined for a cold acquisition = nothing cached). A late response must not roll back or
+     * resurrect a session that a concurrent event already replaced or cleared.
+     * @returns true if the cache was updated
+     */
+    storeSession(cookie, sentCookie) {
         const key = this.getSessionKey();
+        if (sessionCache.get(key)?.cookie !== sentCookie)
+            return false;
+        // sliding expiry: Windchill's session timeout is also sliding
         // delete first so a refreshed entry moves to the newest position (oldest-first eviction then acts as LRU)
         sessionCache.delete(key);
         pruneSessionCache();
         sessionCache.set(key, { cookie, expiresAt: Date.now() + this.options.ttlMs });
+        return true;
     }
     clearSession() {
         sessionCache.delete(this.getSessionKey());
@@ -150,8 +171,22 @@ class FlexPLMSessionManager {
         }
         return jSession;
     }
-    cookieHeader(sessionCookie) {
-        return sessionCookie ? `${this.options.cookieName}=${sessionCookie}` : undefined;
+    /**
+     * Builds the Cookie header value from the configured static Cookie header and the managed session cookie.
+     * With session reuse enabled only the managed cookie is replaced/removed; every other static cookie pair is kept.
+     * With session reuse disabled the static value is returned unchanged.
+     */
+    buildCookieHeader(staticCookie, sessionCookie) {
+        if (!this.options.enabled)
+            return staticCookie || undefined;
+        const name = this.options.cookieName;
+        const pairs = (staticCookie ?? '')
+            .split(';')
+            .map(pair => pair.trim())
+            .filter(pair => pair && pair.split('=')[0].trim() !== name);
+        if (sessionCookie)
+            pairs.push(`${name}=${sessionCookie}`);
+        return pairs.length ? pairs.join('; ') : undefined;
     }
 }
 exports.FlexPLMSessionManager = FlexPLMSessionManager;

package/lib/util/flexplm-session-manager.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/util/flexplm-session-manager.spec.js

@@ -0,0 +1,70 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const flexplm_session_manager_1 = require("./flexplm-session-manager");
+let userCounter = 0;
+const newManager = (user = 'mgr-user-' + (++userCounter), staticHeaders) => {
+    const config = {
+        apiHost: 'https://flexplm.example.com',
+        urlContext: '/FlexPLM',
+        vibeEventEndpoint: '/api/events',
+        csrfEndpoint: '/csrf',
+        plmEnviornment: 'test',
+        userName: () => user,
+        password: () => 'pass',
+        itemPreDevelopmentLifecycleStages: [],
+        flexplmConnect: { staticHeaders, sessionReuse: { enabled: true } },
+    };
+    return new flexplm_session_manager_1.FlexPLMSessionManager(config);
+};
+describe('FlexPLMSessionManager.storeSession (compare-and-set)', () => {
+    it('should store a cold acquisition when nothing is cached', () => {
+        const m = newManager();
+        expect(m.storeSession('a', undefined)).toBe(true);
+        expect(m.getCachedSession()).toBe('a');
+    });
+    it('should not let a cold acquisition overwrite an entry that appeared meanwhile', () => {
+        const m = newManager();
+        m.storeSession('a', undefined);
+        expect(m.storeSession('b', undefined)).toBe(false);
+        expect(m.getCachedSession()).toBe('a');
+    });
+    it('should replace or refresh the entry while it still holds the cookie that was sent', () => {
+        const m = newManager();
+        m.storeSession('old', undefined);
+        expect(m.storeSession('new', 'old')).toBe(true);
+        expect(m.getCachedSession()).toBe('new');
+        expect(m.storeSession('new', 'new')).toBe(true); // sliding refresh with the same cookie
+    });
+    it('should ignore a late response that was sent with an older cookie', () => {
+        const m = newManager();
+        m.storeSession('old', undefined);
+        m.storeSession('new', 'old');
+        expect(m.storeSession('old', 'old')).toBe(false);
+        expect(m.getCachedSession()).toBe('new');
+    });
+    it('should not resurrect a session that was cleared meanwhile', () => {
+        const m = newManager();
+        m.storeSession('old', undefined);
+        m.clearSession();
+        expect(m.storeSession('old', 'old')).toBe(false);
+        expect(m.getCachedSession()).toBeUndefined();
+    });
+    it('should isolate cached sessions when static authorization headers differ', () => {
+        const firstManager = newManager('shared-user', { Authorization: 'Basic first', PLM_ENV: 'test' });
+        const secondManager = newManager('shared-user', { Authorization: 'Basic second', PLM_ENV: 'test' });
+        firstManager.storeSession('first-session', undefined);
+        expect(secondManager.getCachedSession()).toBeUndefined();
+    });
+    it('should isolate cached sessions when static routing headers differ', () => {
+        const firstManager = newManager('shared-user', { 'X-Route': 'route-a' });
+        const secondManager = newManager('shared-user', { 'X-Route': 'route-b' });
+        firstManager.storeSession('first-session', undefined);
+        expect(secondManager.getCachedSession()).toBeUndefined();
+    });
+    it('should reuse cached sessions for equivalent static headers regardless of header order or casing', () => {
+        const firstManager = newManager('shared-user', { 'Authorization': 'Basic same', 'X-Route': 'route-a' });
+        const secondManager = newManager('shared-user', { 'x-route': 'route-a', 'authorization': 'Basic same' });
+        firstManager.storeSession('shared-session', undefined);
+        expect(secondManager.getCachedSession()).toBe('shared-session');
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrail/flexplm",
-  "version": "1.7.7-alpha.279b642",
+  "version": "1.7.7-alpha.3e12cec",
   "description": "Library used for integration with flexplm.",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",