@contrail/flexplm 1.7.7-alpha.99f62a7 → 1.7.7-alpha.a0d86c7

package/lib/interfaces/interfaces.d.ts

@@ -1,15 +1,3 @@
-export interface SessionReuseConfig {
-    enabled?: boolean | string;
-    ttlSeconds?: number | string;
-    cookieName?: string;
-    retryStatuses?: number | number[] | string;
-}
-export interface FlexPLMConnectConfig {
-    staticHeaders?: {
-        [key: string]: string;
-    };
-    sessionReuse?: SessionReuseConfig;
-}
 export interface FCConfig {
     apiKey?: string;
     orgSlug?: string;
@@ -17,7 +5,11 @@ export interface FCConfig {
     configFile?: string;
     eventObjectClassParam?: string;
     eventFlexTypePathParam?: string;
-    flexplmConnect?: FlexPLMConnectConfig;
+    flexplmConnect?: any;
+    'flexplmConnect.sessionReuse.enabled'?: boolean | string;
+    'flexplmConnect.sessionReuse.ttlSeconds'?: number | string;
+    'flexplmConnect.sessionReuse.cookieName'?: string;
+    'flexplmConnect.sessionReuse.retryStatuses'?: number | number[] | string;
     taskId?: string;
     apiHost: string;
     userName(): string;

package/lib/util/flexplm-connect.d.ts

@@ -1,13 +1,28 @@
 import { FCConfig, FlexPLMResponseData, PayloadType } from '../interfaces/interfaces';
 export declare class FlexPLMConnect {
     private config;
-    private sessions;
     private vibeEventEndpoint;
     private staticHeaders;
     payloadSendAsArray: boolean;
     constructor(_config: FCConfig, endPoint?: any, payloadAsArray?: any);
+    private get sessionOptions();
+    /**
+     * Waits until no cold session acquisition is running for this key.
+     * Callers must `await` this only when it returns a promise: awaiting even a resolved promise yields,
+     * and the check-then-register in runColdAcquisition has to stay synchronous to be race free.
+     */
+    private waitForInFlightAcquisition;
+    /** Runs a cold acquisition and registers it so concurrent callers wait for it instead of opening their own session. */
+    private runColdAcquisition;
+    private getSessionKey;
     /** Releases the connection of a rejected response before it is replaced by a retry. */
     private discardBody;
+    private getCachedSession;
+    private storeSession;
+    private clearSession;
+    /** Returns the session cookie value Windchill issued on this response, if any (last one wins). */
+    private extractSessionCookie;
+    private cookieHeader;
     private getRequestOptions;
     getCSRF(getNewSession?: boolean, rejectedCookie?: string): any;
     private fetchCSRF;

package/lib/util/flexplm-connect.js

@@ -2,23 +2,62 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FlexPLMConnect = void 0;
 const app_framework_1 = require("@contrail/app-framework");
-const flexplm_session_manager_1 = require("./flexplm-session-manager");
-// Cookie values carry the session id: mask them in logs whatever the header-name casing.
-const maskCookieHeaders = (headers) => {
-    if (!headers)
-        return;
-    for (const key of Object.keys(headers)) {
-        if (key.toLowerCase() === 'cookie' && headers[key])
-            headers[key] = '***masked***';
+// Module-level on purpose: a new FlexPLMConnect is constructed for every event. Declaring for Session reusing use case.
+const sessionCache = new Map();
+// Upper bound so users/option combinations that are never requested again cannot accumulate cookies forever.
+const MAX_CACHED_SESSIONS = 100;
+const pruneSessionCache = () => {
+    const now = Date.now();
+    for (const [key, session] of sessionCache) {
+        if (session.expiresAt <= now)
+            sessionCache.delete(key);
     }
+    // Still full: drop the oldest entries (Map keeps insertion order).
+    while (sessionCache.size >= MAX_CACHED_SESSIONS) {
+        sessionCache.delete(sessionCache.keys().next().value);
+    }
+};
+// In-flight cold session acquisitions per key, so concurrent events share one FlexPLM session instead of each creating their own.
+const inFlightAcquisitions = new Map();
+const DEFAULT_SESSION_COOKIE_NAME = 'JSESSIONID';
+const DEFAULT_SESSION_TTL_SECONDS = 900;
+const DEFAULT_RETRY_STATUSES = [401, 403];
+const COOKIE_NAME_TOKEN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+// Thrown internally when a cached cookie was rejected, so the caller can re-acquire under the lock.
+class SessionRejectedError extends Error {
+}
+const escapeRegExp = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+const parseRetryStatuses = (value) => {
+    let list = [];
+    if (Array.isArray(value))
+        list = value;
+    else if (typeof value === 'string')
+        list = value.split(',');
+    else if (value !== undefined && value !== null)
+        list = [value];
+    const statuses = list
+        .map(status => (typeof status === 'string' ? status.trim() : status))
+        .filter(status => status !== '' && status !== null && status !== undefined)
+        .map(Number)
+        // Only client-error statuses can mean "session rejected". 2xx/5xx would resend events the server already processed.
+        .filter(status => Number.isInteger(status) && status >= 400 && status <= 499);
+    return statuses.length ? statuses : DEFAULT_RETRY_STATUSES;
+};
+const parseTtlSeconds = (value) => {
+    const ttl = Number(value);
+    return Number.isFinite(ttl) && ttl > 0 ? ttl : DEFAULT_SESSION_TTL_SECONDS;
 };
+const parseCookieName = (value) => {
+    const name = typeof value === 'string' ? value.trim() : '';
+    return COOKIE_NAME_TOKEN.test(name) ? name : DEFAULT_SESSION_COOKIE_NAME;
+};
+// Added for Session reuse - ET-390 - Ends
 class FlexPLMConnect {
     constructor(_config, endPoint = undefined, payloadAsArray = undefined) {
         this.vibeEventEndpoint = '';
         this.staticHeaders = undefined;
         this.payloadSendAsArray = true;
         this.config = _config;
-        this.sessions = new flexplm_session_manager_1.FlexPLMSessionManager(_config);
         this.vibeEventEndpoint = (endPoint)
             ? endPoint
             : this.config.vibeEventEndpoint;
@@ -29,7 +68,70 @@ class FlexPLMConnect {
             this.staticHeaders = this.config?.flexplmConnect?.staticHeaders;
         }
     }
-    // ET-390 - Session reuse
+    /////////////////////////////////////////////////////////////////////////////
+    ///////// ET-390 - Session reuse: start
+    /////////////////////////////////////////////////////////////////////////////
+    /*
+    private get sessionOptions() {
+      const sessReuseBool = this.config?.flexplmConnect?.sessionReuse;
+      console.info('sessReuseBool value is --> ' + sessReuseBool);
+      console.info('enabled value is --> ' + sessReuseBool?.enabled);
+      return {
+        enabled: sessReuseBool?.enabled === true || String(sessReuseBool?.enabled).toLowerCase() === 'true',
+        ttlMs: (sessReuseBool?.ttlSeconds ?? 900) * 1000,
+        cookieName: sessReuseBool?.cookieName ?? 'JSESSIONID',
+        retryStatuses: (sessReuseBool?.retryStatuses ?? [401, 403]) as number[],
+      };
+    }
+     */
+    get sessionOptions() {
+        const cfg = this.config ?? {};
+        const sessReuseEntries = (name) => cfg[`flexplmConnect.sessionReuse.${name}`];
+        const enabled = sessReuseEntries('enabled');
+        return {
+            enabled: enabled === true || String(enabled).toLowerCase() === 'true',
+            ttlMs: parseTtlSeconds(sessReuseEntries('ttlSeconds')) * 1000,
+            cookieName: parseCookieName(sessReuseEntries('cookieName')),
+            retryStatuses: parseRetryStatuses(sessReuseEntries('retryStatuses')),
+        };
+    }
+    /**
+     * Waits until no cold session acquisition is running for this key.
+     * Callers must `await` this only when it returns a promise: awaiting even a resolved promise yields,
+     * and the check-then-register in runColdAcquisition has to stay synchronous to be race free.
+     */
+    waitForInFlightAcquisition() {
+        const key = this.getSessionKey();
+        if (!inFlightAcquisitions.has(key))
+            return undefined;
+        return (async () => {
+            let pending = inFlightAcquisitions.get(key);
+            while (pending) {
+                await pending.catch(() => undefined);
+                pending = inFlightAcquisitions.get(key);
+            }
+        })();
+    }
+    /** Runs a cold acquisition and registers it so concurrent callers wait for it instead of opening their own session. */
+    async runColdAcquisition(acquire) {
+        const key = this.getSessionKey();
+        const acquisition = acquire();
+        inFlightAcquisitions.set(key, acquisition);
+        try {
+            return await acquisition;
+        }
+        finally {
+            if (inFlightAcquisitions.get(key) === acquisition)
+                inFlightAcquisitions.delete(key);
+        }
+    }
+    getSessionKey() {
+        // Options that change the cached value are part of the key; JSON avoids '|' collisions between fields.
+        const { cookieName, ttlMs } = this.sessionOptions;
+        return JSON.stringify([
+            this.config.apiHost, this.config.urlContext, this.config.userName(), this.config.plmEnviornment, cookieName, ttlMs,
+        ]);
+    }
     /** Releases the connection of a rejected response before it is replaced by a retry. */
     async discardBody(response) {
         try {
@@ -40,6 +142,60 @@ class FlexPLMConnect {
             // best effort: nothing to do if the body is already consumed or locked
         }
     }
+    getCachedSession() {
+        if (!this.sessionOptions.enabled)
+            return undefined;
+        const key = this.getSessionKey();
+        const cachedSessValue = sessionCache.get(key);
+        if (!cachedSessValue)
+            return undefined;
+        if (cachedSessValue.expiresAt <= Date.now()) {
+            sessionCache.delete(key);
+            return undefined;
+        }
+        return cachedSessValue.cookie;
+    }
+    storeSession(cookie) {
+        // sliding expiry: Windchill's session timeout is also sliding
+        const key = this.getSessionKey();
+        // delete first so a refreshed entry moves to the newest position (oldest-first eviction then acts as LRU)
+        sessionCache.delete(key);
+        pruneSessionCache();
+        sessionCache.set(key, { cookie, expiresAt: Date.now() + this.sessionOptions.ttlMs });
+    }
+    clearSession() {
+        sessionCache.delete(this.getSessionKey());
+    }
+    /** Returns the session cookie value Windchill issued on this response, if any (last one wins). */
+    extractSessionCookie(response) {
+        const respHeader = response?.headers;
+        if (!respHeader)
+            return undefined;
+        let raw = [];
+        if (typeof respHeader.getSetCookie === 'function') {
+            raw = respHeader.getSetCookie();
+        }
+        else if (typeof respHeader.get === 'function' && respHeader.get('set-cookie')) {
+            raw = [respHeader.get('set-cookie')];
+        }
+        const name = this.sessionOptions.cookieName;
+        const regexFilter = new RegExp('(?:^|[,\\s])' + escapeRegExp(name) + '=([^;,\\s]+)', 'g');
+        let jSession;
+        for (const line of raw) {
+            let cookieNameMatcher = regexFilter.exec(line);
+            while (cookieNameMatcher !== null) {
+                jSession = cookieNameMatcher[1];
+                cookieNameMatcher = regexFilter.exec(line);
+            }
+        }
+        return jSession;
+    }
+    cookieHeader(sessionCookie) {
+        return sessionCookie ? `${this.sessionOptions.cookieName}=${sessionCookie}` : undefined;
+    }
+    /////////////////////////////////////////////////////////////////////////////
+    ///////// ET-390 - Session reuse: end
+    /////////////////////////////////////////////////////////////////////////////
     /////////////////////////////////////////////////////////////////////////////
     ///////// Custom getRequestOptions: start
     /////////////////////////////////////////////////////////////////////////////
@@ -57,21 +213,17 @@ class FlexPLMConnect {
             Object.assign(csrfOptions.headers, this.staticHeaders);
         }
         // Added for Session reuse - ET-390 - Starts
-        // Merge with a configured static Cookie header (any header-name casing) instead of replacing it.
-        const headers = csrfOptions.headers;
-        const staticCookieKeys = Object.keys(headers).filter(key => key.toLowerCase() === 'cookie');
-        const staticCookie = staticCookieKeys.map(key => headers[key]).join('; ');
-        const cookie = this.sessions.buildCookieHeader(staticCookie, sessionCookie);
-        staticCookieKeys.forEach(key => delete headers[key]);
+        const cookie = this.cookieHeader(sessionCookie);
         if (cookie) {
-            headers['Cookie'] = cookie;
+            csrfOptions.headers['Cookie'] = cookie;
         }
         // Added for Session reuse - ET-390 - Ends
         if (app_framework_1.Logger.isInfoOn()) {
             const logOptions = JSON.parse(JSON.stringify(csrfOptions));
             logOptions['headers']['Authorization'] = logOptions?.headers?.Authorization.substring(0, 9);
             // Added for Session reuse - ET-390 - Starts
-            maskCookieHeaders(logOptions.headers);
+            if (logOptions.headers['Cookie'])
+                logOptions.headers['Cookie'] = '***masked***';
             // Added for Session reuse - ET-390 - Ends
             console.info('csrfOptions: ' + JSON.stringify(logOptions));
         }
@@ -85,30 +237,30 @@ class FlexPLMConnect {
     // rejectedCookie: the cookie that was rejected by the caller, so a refresh already done by a concurrent event is not thrown away
     async getCSRF(getNewSession = false, rejectedCookie) {
         // Added for Session reuse - ET-390 - Starts
-        if (!this.sessions.options.enabled)
+        if (!this.sessionOptions.enabled)
             return this.fetchCSRF(undefined);
-        for (let wait = this.sessions.waitForInFlightAcquisition(); wait; wait = this.sessions.waitForInFlightAcquisition())
+        for (let wait = this.waitForInFlightAcquisition(); wait; wait = this.waitForInFlightAcquisition())
             await wait;
         if (getNewSession) {
-            const current = this.sessions.getCachedSession();
+            const current = this.getCachedSession();
             if (rejectedCookie === undefined || !current || current === rejectedCookie)
-                this.sessions.clearSession();
+                this.clearSession();
         }
-        const cached = this.sessions.getCachedSession();
+        const cached = this.getCachedSession();
         if (cached) {
             try {
                 return await this.fetchCSRF(cached);
             }
             catch (e) {
-                if (!(e instanceof flexplm_session_manager_1.SessionRejectedError))
+                if (!(e instanceof SessionRejectedError))
                     throw e;
                 // if the cached cookie is rejected (401/403), drop it and acquire a new session (serialized)
-                if (this.sessions.getCachedSession() === cached)
-                    this.sessions.clearSession();
+                if (this.getCachedSession() === cached)
+                    this.clearSession();
                 return this.getCSRF();
             }
         }
-        return this.sessions.runColdAcquisition(() => this.fetchCSRF(undefined));
+        return this.runColdAcquisition(() => this.fetchCSRF(undefined));
         // Added for Session reuse - ET-390 - Ends
     }
     async fetchCSRF(sentCookie) {
@@ -120,10 +272,10 @@ class FlexPLMConnect {
         const csrfOptions = this.getRequestOptions('GET', sentCookie);
         const response = await fetch(csrfURL, csrfOptions);
         // Added for Session reuse - ET-390 - Starts
-        if (sentCookie && this.sessions.options.retryStatuses.includes(response.status)) {
+        if (sentCookie && this.sessionOptions.retryStatuses.includes(response.status)) {
             console.warn('Cached FlexPLM session rejected on csrf call (status ' + response.status + '). Retrying with a new session.');
             await this.discardBody(response);
-            throw new flexplm_session_manager_1.SessionRejectedError();
+            throw new SessionRejectedError();
         }
         // Added for Session reuse - ET-390 - Ends
         if (response.status >= 300) {
@@ -137,10 +289,10 @@ class FlexPLMConnect {
         // Added for Session reuse - ET-390 - Starts
         // If the cookie we sent was invalid, Windchill answers with a fresh Set-Cookie --> replace the cache.
         let sessionCookie = sentCookie;
-        if (this.sessions.options.enabled) {
-            sessionCookie = this.sessions.extractSessionCookie(response) ?? sentCookie;
+        if (this.sessionOptions.enabled) {
+            sessionCookie = this.extractSessionCookie(response) ?? sentCookie;
             if (sessionCookie)
-                this.sessions.storeSession(sessionCookie, sentCookie);
+                this.storeSession(sessionCookie);
         }
         // Added for Session reuse - ET-390 - Ends
         try {
@@ -176,7 +328,8 @@ class FlexPLMConnect {
             const logOptions = JSON.parse(JSON.stringify(xferOptions));
             if (logOptions?.headers?.Authorization)
                 logOptions.headers.Authorization = logOptions?.headers?.Authorization.substring(0, 9);
-            maskCookieHeaders(logOptions?.headers);
+            if (logOptions?.headers?.Cookie)
+                logOptions.headers.Cookie = '***masked***';
             if (csrf?.nonce_key)
                 logOptions.headers[csrf.nonce_key] = csrf.nonce ? `***masked(length:${csrf.nonce.length})***` : '***masked(empty)***';
             console.info('csrfOptions: ' + JSON.stringify(logOptions));
@@ -203,7 +356,7 @@ class FlexPLMConnect {
         /// Added for Session reuse - ET-390 - Starts
         // const response = await this.sendRequest(csrf, payload);
         let response = await this.sendRequest(csrf, payload);
-        if (csrf.sessionCookie && this.sessions.options.retryStatuses.includes(response.status)) {
+        if (csrf.sessionCookie && this.sessionOptions.retryStatuses.includes(response.status)) {
             console.warn('FlexPLM rejected session/nonce (status ' + response.status + '). Getting a new session and retrying once.');
             await this.discardBody(response);
             csrf = await this.getCSRF(true, csrf.sessionCookie);
@@ -264,30 +417,30 @@ class FlexPLMConnect {
         const vibeEventsURL = this.config.apiHost + urlContext + path;
         // Added for Session reuse - ET-390 - Starts
         const attempt = async () => {
-            if (!this.sessions.options.enabled) {
+            if (!this.sessionOptions.enabled) {
                 return { response: await fetch(vibeEventsURL, this.getRequestOptions('GET')), sent: undefined };
             }
-            for (let wait = this.sessions.waitForInFlightAcquisition(); wait; wait = this.sessions.waitForInFlightAcquisition())
+            for (let wait = this.waitForInFlightAcquisition(); wait; wait = this.waitForInFlightAcquisition())
                 await wait;
-            const sent = this.sessions.getCachedSession();
+            const sent = this.getCachedSession();
             const call = async () => {
                 const res = await fetch(vibeEventsURL, this.getRequestOptions('GET', sent));
                 // A rejected cookie must not be stored again; only keep a cookie that was accepted or newly issued.
-                if (!(sent && this.sessions.options.retryStatuses.includes(res.status))) {
-                    const cookie = this.sessions.extractSessionCookie(res) ?? sent;
+                if (!(sent && this.sessionOptions.retryStatuses.includes(res.status))) {
+                    const cookie = this.extractSessionCookie(res) ?? sent;
                     if (cookie)
-                        this.sessions.storeSession(cookie, sent);
+                        this.storeSession(cookie);
                 }
                 return { response: res, sent };
             };
-            return sent ? call() : this.sessions.runColdAcquisition(call);
+            return sent ? call() : this.runColdAcquisition(call);
         };
         const first = await attempt();
         let response = first.response;
-        if (first.sent && this.sessions.options.retryStatuses.includes(response.status)) {
+        if (first.sent && this.sessionOptions.retryStatuses.includes(response.status)) {
             await this.discardBody(response);
-            if (this.sessions.getCachedSession() === first.sent)
-                this.sessions.clearSession();
+            if (this.getCachedSession() === first.sent)
+                this.clearSession();
             response = (await attempt()).response;
         }
         // Added for Session reuse - ET-390 - Ends

package/lib/util/flexplm-connect.spec.js

@@ -39,8 +39,12 @@ const resp = (status, setCookie = [], json = csrfBody) => ({
 });
 let userCounter = 0;
 const uniqueUser = () => 'sess-user-' + (++userCounter);
-// Session options are nested: { flexplmConnect: { sessionReuse: { enabled, ... } } }
-const sessionConfig = (user, sessionReuse = { enabled: true }) => createConfig({ userName: () => user, flexplmConnect: { sessionReuse } });
+// The connector config is flat: keys look like 'flexplmConnect.sessionReuse.enabled'
+const sessionConfig = (user, sessionReuse = { enabled: true }) => {
+    const flat = {};
+    Object.entries(sessionReuse).forEach(([k, v]) => { flat[`flexplmConnect.sessionReuse.${k}`] = v; });
+    return createConfig({ userName: () => user, ...flat });
+};
 const fetchMock = () => global.fetch;
 const callHeaders = (i) => fetchMock().mock.calls[i][1].headers;
 const callMethod = (i) => fetchMock().mock.calls[i][1].method;
@@ -354,60 +358,6 @@ describe('FlexPLMConnect session reuse', () => {
         isInfoOn.mockRestore();
         info.mockRestore();
     });
-    describe('static Cookie header', () => {
-        const withStatic = (user, staticHeaders, sessionReuse = { enabled: true }) => createConfig({ userName: () => user, flexplmConnect: { sessionReuse, staticHeaders } });
-        it('should keep other static cookies and replace only the managed one once a session is cached', async () => {
-            const u = uniqueUser();
-            fetchMock()
-                .mockResolvedValueOnce(resp(200, ['JSESSIONID=new.tomcat1; Path=/']))
-                .mockResolvedValueOnce(resp(200, [], {}));
-            await new flexplm_connect_1.FlexPLMConnect(withStatic(u, { Cookie: 'lb=abc; JSESSIONID=stale; theme=dark' })).sendToFlexPLM(payload);
-            expect(callHeaders(0).Cookie).toBe('lb=abc; theme=dark'); // cold: stale managed cookie dropped
-            expect(callHeaders(1).Cookie).toBe('lb=abc; theme=dark; JSESSIONID=new.tomcat1');
-        });
-        it('should send a single Cookie header when the static header name is lowercase', async () => {
-            const u = uniqueUser();
-            fetchMock()
-                .mockResolvedValueOnce(resp(200, ['JSESSIONID=abc.tomcat1; Path=/']))
-                .mockResolvedValueOnce(resp(200, [], {}));
-            await new flexplm_connect_1.FlexPLMConnect(withStatic(u, { cookie: 'lb=abc' })).sendToFlexPLM(payload);
-            const postHeaders = callHeaders(1);
-            expect(Object.keys(postHeaders).filter(k => k.toLowerCase() === 'cookie')).toEqual(['Cookie']);
-            expect(postHeaders.Cookie).toBe('lb=abc; JSESSIONID=abc.tomcat1');
-        });
-        it('should send the static Cookie unchanged when session reuse is disabled', async () => {
-            const u = uniqueUser();
-            fetchMock()
-                .mockResolvedValueOnce(resp(200, ['JSESSIONID=abc.tomcat1; Path=/']))
-                .mockResolvedValueOnce(resp(200, [], {}));
-            await new flexplm_connect_1.FlexPLMConnect(withStatic(u, { Cookie: 'lb=abc; JSESSIONID=static' }, { enabled: false })).sendToFlexPLM(payload);
-            expect(callHeaders(0).Cookie).toBe('lb=abc; JSESSIONID=static');
-            expect(callHeaders(1).Cookie).toBe('lb=abc; JSESSIONID=static');
-        });
-        it('should not resend a rejected static JSESSIONID on the fresh retry', async () => {
-            const u = uniqueUser();
-            fetchMock()
-                .mockResolvedValueOnce(resp(200, ['JSESSIONID=old.tomcat1; Path=/']))
-                .mockResolvedValueOnce(resp(403, [], {})) // POST rejected
-                .mockResolvedValueOnce(resp(200, ['JSESSIONID=fresh.tomcat1; Path=/'])) // fresh GET
-                .mockResolvedValueOnce(resp(200, [], {}));
-            await new flexplm_connect_1.FlexPLMConnect(withStatic(u, { Cookie: 'lb=abc; JSESSIONID=static' })).sendToFlexPLM(payload);
-            expect(callHeaders(2).Cookie).toBe('lb=abc'); // fresh GET carries no JSESSIONID
-            expect(callHeaders(3).Cookie).toBe('lb=abc; JSESSIONID=fresh.tomcat1');
-        });
-        it('should mask a lowercase static cookie header in logs', async () => {
-            const isInfoOn = jest.spyOn(app_framework_1.Logger, 'isInfoOn').mockReturnValue(true);
-            const info = jest.spyOn(console, 'info').mockImplementation();
-            fetchMock()
-                .mockResolvedValueOnce(resp(200, ['JSESSIONID=abc.tomcat1']))
-                .mockResolvedValueOnce(resp(200, [], {}));
-            await new flexplm_connect_1.FlexPLMConnect(withStatic(uniqueUser(), { cookie: 'lb=topsecret' }, { enabled: false })).sendToFlexPLM(payload);
-            const logged = info.mock.calls.map(c => String(c[0] ?? '')).join('\n');
-            expect(logged).not.toContain('topsecret');
-            isInfoOn.mockRestore();
-            info.mockRestore();
-        });
-    });
     describe('option normalisation', () => {
         const rejectedOnceThenOk = (u, opts) => {
             fetchMock()
@@ -575,41 +525,6 @@ describe('FlexPLMConnect session reuse', () => {
     describe('concurrent session acquisition', () => {
         const flush = () => new Promise(r => setImmediate(r));
         const isColdGet = (call) => call[1].method === 'GET' && !call[1].headers.Cookie;
-        it('should not let a late response using an older cookie roll back a refreshed session', async () => {
-            const u = uniqueUser();
-            const cfg = () => sessionConfig(u);
-            // seed the cache with 'old'
-            fetchMock()
-                .mockResolvedValueOnce(resp(200, ['JSESSIONID=old']))
-                .mockResolvedValueOnce(resp(200, [], {}));
-            await new flexplm_connect_1.FlexPLMConnect(cfg()).sendToFlexPLM(payload);
-            let lateGetsSeen = 0;
-            let releaseLate;
-            const lateGate = new Promise(r => { releaseLate = r; });
-            fetchMock().mockReset();
-            fetchMock().mockImplementation(async (_url, opts) => {
-                const cookie = opts.headers.Cookie;
-                if (opts.method === 'GET' && cookie === 'JSESSIONID=old') {
-                    if (++lateGetsSeen === 1)
-                        return resp(403, []); // event A: old rejected
-                    await lateGate; // event B: slow 200, no Set-Cookie
-                    return resp(200, []);
-                }
-                if (opts.method === 'GET' && !cookie)
-                    return resp(200, ['JSESSIONID=new']); // A's fresh acquisition
-                if (opts.method === 'GET')
-                    return resp(200, []);
-                return resp(200, [], {});
-            });
-            const a = new flexplm_connect_1.FlexPLMConnect(cfg()).sendToFlexPLM(payload);
-            const b = new flexplm_connect_1.FlexPLMConnect(cfg()).sendToFlexPLM(payload);
-            await a;
-            releaseLate();
-            await b;
-            fetchMock().mockClear();
-            await new flexplm_connect_1.FlexPLMConnect(cfg()).getCSRF();
-            expect(callHeaders(0).Cookie).toBe('JSESSIONID=new'); // B must not have stored 'old' again
-        });
         it('should share one session across concurrent events on a cold cache', async () => {
             const u = uniqueUser();
             let release;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrail/flexplm",
-  "version": "1.7.7-alpha.99f62a7",
+  "version": "1.7.7-alpha.a0d86c7",
   "description": "Library used for integration with flexplm.",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",

package/lib/util/flexplm-session-manager.d.ts

@@ -1,40 +0,0 @@
-import { FCConfig } from '../interfaces/interfaces';
-export declare class SessionRejectedError extends Error {
-}
-/** Owns the FlexPLM session cookie cache: options, keying, expiry, in-flight acquisition sharing and Set-Cookie parsing. */
-export declare class FlexPLMSessionManager {
-    private config;
-    constructor(config: FCConfig);
-    get options(): {
-        enabled: boolean;
-        ttlMs: number;
-        cookieName: string;
-        retryStatuses: number[];
-    };
-    /**
-     * Waits until no cold session acquisition is running for this key.
-     * Callers must `await` this only when it returns a promise: awaiting even a resolved promise yields,
-     * and the check-then-register in runColdAcquisition has to stay synchronous to be race free.
-     */
-    waitForInFlightAcquisition(): Promise<void> | undefined;
-    /** Runs a cold acquisition and registers it so concurrent callers wait for it instead of opening their own session. */
-    runColdAcquisition<T>(acquire: () => Promise<T>): Promise<T>;
-    private getSessionKey;
-    getCachedSession(): string | undefined;
-    /**
-     * Compare-and-set: stores `cookie` only if the cache still holds the cookie this request was sent with
-     * (`sentCookie`, undefined for a cold acquisition = nothing cached). A late response must not roll back or
-     * resurrect a session that a concurrent event already replaced or cleared.
-     * @returns true if the cache was updated
-     */
-    storeSession(cookie: string, sentCookie: string | undefined): boolean;
-    clearSession(): void;
-    /** Returns the session cookie value Windchill issued on this response, if any (last one wins). */
-    extractSessionCookie(response: Response): string | undefined;
-    /**
-     * Builds the Cookie header value from the configured static Cookie header and the managed session cookie.
-     * With session reuse enabled only the managed cookie is replaced/removed; every other static cookie pair is kept.
-     * With session reuse disabled the static value is returned unchanged.
-     */
-    buildCookieHeader(staticCookie?: string, sessionCookie?: string): string | undefined;
-}

package/lib/util/flexplm-session-manager.js

@@ -1,192 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.FlexPLMSessionManager = exports.SessionRejectedError = void 0;
-const crypto_1 = require("crypto");
-// Module-level on purpose: a new FlexPLMConnect (and session manager) is constructed for every event.
-const sessionCache = new Map();
-// Upper bound so users/option combinations that are never requested again cannot accumulate cookies forever.
-const MAX_CACHED_SESSIONS = 100;
-const pruneSessionCache = () => {
-    const now = Date.now();
-    for (const [key, session] of sessionCache) {
-        if (session.expiresAt <= now)
-            sessionCache.delete(key);
-    }
-    // Still full: drop the oldest entries (Map keeps insertion order).
-    while (sessionCache.size >= MAX_CACHED_SESSIONS) {
-        sessionCache.delete(sessionCache.keys().next().value);
-    }
-};
-// In-flight cold session acquisitions per key, so concurrent events share one FlexPLM session instead of each creating their own.
-const inFlightAcquisitions = new Map();
-const SESSION_CACHE_DIGEST_KEY = (0, crypto_1.randomBytes)(32);
-const DEFAULT_SESSION_COOKIE_NAME = 'JSESSIONID';
-const DEFAULT_SESSION_TTL_SECONDS = 900;
-const DEFAULT_RETRY_STATUSES = [401, 403];
-const COOKIE_NAME_TOKEN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
-// Thrown internally when a cached cookie was rejected, so the caller can re-acquire under the lock.
-class SessionRejectedError extends Error {
-}
-exports.SessionRejectedError = SessionRejectedError;
-const escapeRegExp = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-const parseRetryStatuses = (value) => {
-    let list = [];
-    if (Array.isArray(value))
-        list = value;
-    else if (typeof value === 'string')
-        list = value.split(',');
-    else if (value !== undefined && value !== null)
-        list = [value];
-    const statuses = list
-        .map(status => (typeof status === 'string' ? status.trim() : status))
-        .filter(status => status !== '' && status !== null && status !== undefined)
-        .map(Number)
-        // Only client-error statuses can mean "session rejected". 2xx/5xx would resend events the server already processed.
-        .filter(status => Number.isInteger(status) && status >= 400 && status <= 499);
-    return statuses.length ? statuses : DEFAULT_RETRY_STATUSES;
-};
-const parseTtlSeconds = (value) => {
-    const ttl = Number(value);
-    return Number.isFinite(ttl) && ttl > 0 ? ttl : DEFAULT_SESSION_TTL_SECONDS;
-};
-const parseCookieName = (value) => {
-    const name = typeof value === 'string' ? value.trim() : '';
-    return COOKIE_NAME_TOKEN.test(name) ? name : DEFAULT_SESSION_COOKIE_NAME;
-};
-/** Owns the FlexPLM session cookie cache: options, keying, expiry, in-flight acquisition sharing and Set-Cookie parsing. */
-class FlexPLMSessionManager {
-    constructor(config) {
-        this.config = config;
-    }
-    get options() {
-        const sessionReuseConfig = this.config?.flexplmConnect?.sessionReuse ?? {};
-        return {
-            enabled: sessionReuseConfig.enabled === true || String(sessionReuseConfig.enabled).toLowerCase() === 'true',
-            ttlMs: parseTtlSeconds(sessionReuseConfig.ttlSeconds) * 1000,
-            cookieName: parseCookieName(sessionReuseConfig.cookieName),
-            retryStatuses: parseRetryStatuses(sessionReuseConfig.retryStatuses),
-        };
-    }
-    /**
-     * Waits until no cold session acquisition is running for this key.
-     * Callers must `await` this only when it returns a promise: awaiting even a resolved promise yields,
-     * and the check-then-register in runColdAcquisition has to stay synchronous to be race free.
-     */
-    waitForInFlightAcquisition() {
-        const key = this.getSessionKey();
-        if (!inFlightAcquisitions.has(key))
-            return undefined;
-        return (async () => {
-            let pending = inFlightAcquisitions.get(key);
-            while (pending) {
-                await pending.catch(() => undefined);
-                pending = inFlightAcquisitions.get(key);
-            }
-        })();
-    }
-    /** Runs a cold acquisition and registers it so concurrent callers wait for it instead of opening their own session. */
-    async runColdAcquisition(acquire) {
-        const key = this.getSessionKey();
-        const acquisition = acquire();
-        inFlightAcquisitions.set(key, acquisition);
-        try {
-            return await acquisition;
-        }
-        finally {
-            if (inFlightAcquisitions.get(key) === acquisition)
-                inFlightAcquisitions.delete(key);
-        }
-    }
-    getSessionKey() {
-        // Options that change the cached value are part of the key; JSON avoids '|' collisions between fields.
-        const { cookieName, ttlMs } = this.options;
-        const staticHeaders = Object.entries(this.config.flexplmConnect?.staticHeaders ?? {})
-            .map(([name, value]) => [name.toLowerCase(), value])
-            .sort(([nameA, valueA], [nameB, valueB]) => {
-            if (nameA !== nameB)
-                return nameA < nameB ? -1 : 1;
-            return valueA < valueB ? -1 : valueA > valueB ? 1 : 0;
-        });
-        const authenticationAndRoutingDigest = (0, crypto_1.createHmac)('sha256', SESSION_CACHE_DIGEST_KEY)
-            .update(JSON.stringify([this.config.userName(), staticHeaders]))
-            .digest('hex');
-        return JSON.stringify([
-            this.config.apiHost, this.config.urlContext, this.config.plmEnviornment, cookieName, ttlMs, authenticationAndRoutingDigest,
-        ]);
-    }
-    getCachedSession() {
-        if (!this.options.enabled)
-            return undefined;
-        const key = this.getSessionKey();
-        const cachedSessValue = sessionCache.get(key);
-        if (!cachedSessValue)
-            return undefined;
-        if (cachedSessValue.expiresAt <= Date.now()) {
-            sessionCache.delete(key);
-            return undefined;
-        }
-        return cachedSessValue.cookie;
-    }
-    /**
-     * Compare-and-set: stores `cookie` only if the cache still holds the cookie this request was sent with
-     * (`sentCookie`, undefined for a cold acquisition = nothing cached). A late response must not roll back or
-     * resurrect a session that a concurrent event already replaced or cleared.
-     * @returns true if the cache was updated
-     */
-    storeSession(cookie, sentCookie) {
-        const key = this.getSessionKey();
-        if (sessionCache.get(key)?.cookie !== sentCookie)
-            return false;
-        // sliding expiry: Windchill's session timeout is also sliding
-        // delete first so a refreshed entry moves to the newest position (oldest-first eviction then acts as LRU)
-        sessionCache.delete(key);
-        pruneSessionCache();
-        sessionCache.set(key, { cookie, expiresAt: Date.now() + this.options.ttlMs });
-        return true;
-    }
-    clearSession() {
-        sessionCache.delete(this.getSessionKey());
-    }
-    /** Returns the session cookie value Windchill issued on this response, if any (last one wins). */
-    extractSessionCookie(response) {
-        const respHeader = response?.headers;
-        if (!respHeader)
-            return undefined;
-        let raw = [];
-        if (typeof respHeader.getSetCookie === 'function') {
-            raw = respHeader.getSetCookie();
-        }
-        else if (typeof respHeader.get === 'function' && respHeader.get('set-cookie')) {
-            raw = [respHeader.get('set-cookie')];
-        }
-        const name = this.options.cookieName;
-        const regexFilter = new RegExp('(?:^|[,\\s])' + escapeRegExp(name) + '=([^;,\\s]+)', 'g');
-        let jSession;
-        for (const line of raw) {
-            let cookieNameMatcher = regexFilter.exec(line);
-            while (cookieNameMatcher !== null) {
-                jSession = cookieNameMatcher[1];
-                cookieNameMatcher = regexFilter.exec(line);
-            }
-        }
-        return jSession;
-    }
-    /**
-     * Builds the Cookie header value from the configured static Cookie header and the managed session cookie.
-     * With session reuse enabled only the managed cookie is replaced/removed; every other static cookie pair is kept.
-     * With session reuse disabled the static value is returned unchanged.
-     */
-    buildCookieHeader(staticCookie, sessionCookie) {
-        if (!this.options.enabled)
-            return staticCookie || undefined;
-        const name = this.options.cookieName;
-        const pairs = (staticCookie ?? '')
-            .split(';')
-            .map(pair => pair.trim())
-            .filter(pair => pair && pair.split('=')[0].trim() !== name);
-        if (sessionCookie)
-            pairs.push(`${name}=${sessionCookie}`);
-        return pairs.length ? pairs.join('; ') : undefined;
-    }
-}
-exports.FlexPLMSessionManager = FlexPLMSessionManager;

package/lib/util/flexplm-session-manager.spec.d.ts

@@ -1 +0,0 @@
-export {};

package/lib/util/flexplm-session-manager.spec.js

@@ -1,70 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const flexplm_session_manager_1 = require("./flexplm-session-manager");
-let userCounter = 0;
-const newManager = (user = 'mgr-user-' + (++userCounter), staticHeaders) => {
-    const config = {
-        apiHost: 'https://flexplm.example.com',
-        urlContext: '/FlexPLM',
-        vibeEventEndpoint: '/api/events',
-        csrfEndpoint: '/csrf',
-        plmEnviornment: 'test',
-        userName: () => user,
-        password: () => 'pass',
-        itemPreDevelopmentLifecycleStages: [],
-        flexplmConnect: { staticHeaders, sessionReuse: { enabled: true } },
-    };
-    return new flexplm_session_manager_1.FlexPLMSessionManager(config);
-};
-describe('FlexPLMSessionManager.storeSession (compare-and-set)', () => {
-    it('should store a cold acquisition when nothing is cached', () => {
-        const m = newManager();
-        expect(m.storeSession('a', undefined)).toBe(true);
-        expect(m.getCachedSession()).toBe('a');
-    });
-    it('should not let a cold acquisition overwrite an entry that appeared meanwhile', () => {
-        const m = newManager();
-        m.storeSession('a', undefined);
-        expect(m.storeSession('b', undefined)).toBe(false);
-        expect(m.getCachedSession()).toBe('a');
-    });
-    it('should replace or refresh the entry while it still holds the cookie that was sent', () => {
-        const m = newManager();
-        m.storeSession('old', undefined);
-        expect(m.storeSession('new', 'old')).toBe(true);
-        expect(m.getCachedSession()).toBe('new');
-        expect(m.storeSession('new', 'new')).toBe(true); // sliding refresh with the same cookie
-    });
-    it('should ignore a late response that was sent with an older cookie', () => {
-        const m = newManager();
-        m.storeSession('old', undefined);
-        m.storeSession('new', 'old');
-        expect(m.storeSession('old', 'old')).toBe(false);
-        expect(m.getCachedSession()).toBe('new');
-    });
-    it('should not resurrect a session that was cleared meanwhile', () => {
-        const m = newManager();
-        m.storeSession('old', undefined);
-        m.clearSession();
-        expect(m.storeSession('old', 'old')).toBe(false);
-        expect(m.getCachedSession()).toBeUndefined();
-    });
-    it('should isolate cached sessions when static authorization headers differ', () => {
-        const firstManager = newManager('shared-user', { Authorization: 'Basic first', PLM_ENV: 'test' });
-        const secondManager = newManager('shared-user', { Authorization: 'Basic second', PLM_ENV: 'test' });
-        firstManager.storeSession('first-session', undefined);
-        expect(secondManager.getCachedSession()).toBeUndefined();
-    });
-    it('should isolate cached sessions when static routing headers differ', () => {
-        const firstManager = newManager('shared-user', { 'X-Route': 'route-a' });
-        const secondManager = newManager('shared-user', { 'X-Route': 'route-b' });
-        firstManager.storeSession('first-session', undefined);
-        expect(secondManager.getCachedSession()).toBeUndefined();
-    });
-    it('should reuse cached sessions for equivalent static headers regardless of header order or casing', () => {
-        const firstManager = newManager('shared-user', { 'Authorization': 'Basic same', 'X-Route': 'route-a' });
-        const secondManager = newManager('shared-user', { 'x-route': 'route-a', 'authorization': 'Basic same' });
-        firstManager.storeSession('shared-session', undefined);
-        expect(secondManager.getCachedSession()).toBe('shared-session');
-    });
-});