npm - @contrail/flexplm - Versions diffs - 1.7.7-alpha.d153eea → 1.7.7-alpha.e0ee6a0 - Mend

@contrail/flexplm 1.7.7-alpha.d153eea → 1.7.7-alpha.e0ee6a0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (9) hide show

package/lib/interfaces/interfaces.d.ts +13 -5
package/lib/util/flexplm-connect.d.ts +1 -16
package/lib/util/flexplm-connect.js +44 -197
package/lib/util/flexplm-connect.spec.js +91 -6
package/lib/util/flexplm-session-manager.d.ts +40 -0
package/lib/util/flexplm-session-manager.js +180 -0
package/lib/util/flexplm-session-manager.spec.d.ts +1 -0
package/lib/util/flexplm-session-manager.spec.js +53 -0
package/package.json +1 -1

package/lib/interfaces/interfaces.d.ts CHANGED Viewed

@@ -1,3 +1,15 @@
+export interface SessionReuseConfig {
+    enabled?: boolean | string;
+    ttlSeconds?: number | string;
+    cookieName?: string;
+    retryStatuses?: number | number[] | string;
+}
+export interface FlexPLMConnectConfig {
+    staticHeaders?: {
+        [key: string]: string;
+    };
+    sessionReuse?: SessionReuseConfig;
+}
 export interface FCConfig {
     apiKey?: string;
     orgSlug?: string;
@@ -5,11 +17,7 @@ export interface FCConfig {
     configFile?: string;
     eventObjectClassParam?: string;
     eventFlexTypePathParam?: string;
-    flexplmConnect?: any;
-    'flexplmConnect.sessionReuse.enabled'?: boolean | string;
-    'flexplmConnect.sessionReuse.ttlSeconds'?: number | string;
-    'flexplmConnect.sessionReuse.cookieName'?: string;
-    'flexplmConnect.sessionReuse.retryStatuses'?: number | number[] | string;
+    flexplmConnect?: FlexPLMConnectConfig;
     taskId?: string;
     apiHost: string;
     userName(): string;

package/lib/util/flexplm-connect.d.ts CHANGED Viewed

@@ -1,28 +1,13 @@
 import { FCConfig, FlexPLMResponseData, PayloadType } from '../interfaces/interfaces';
 export declare class FlexPLMConnect {
     private config;
+    private sessions;
     private vibeEventEndpoint;
     private staticHeaders;
     payloadSendAsArray: boolean;
     constructor(_config: FCConfig, endPoint?: any, payloadAsArray?: any);
-    private get sessionOptions();
-    /**
-     * Waits until no cold session acquisition is running for this key.
-     * Callers must `await` this only when it returns a promise: awaiting even a resolved promise yields,
-     * and the check-then-register in runColdAcquisition has to stay synchronous to be race free.
-     */
-    private waitForInFlightAcquisition;
-    /** Runs a cold acquisition and registers it so concurrent callers wait for it instead of opening their own session. */
-    private runColdAcquisition;
-    private getSessionKey;
     /** Releases the connection of a rejected response before it is replaced by a retry. */
     private discardBody;
-    private getCachedSession;
-    private storeSession;
-    private clearSession;
-    /** Returns the session cookie value Windchill issued on this response, if any (last one wins). */
-    private extractSessionCookie;
-    private cookieHeader;
     private getRequestOptions;
     getCSRF(getNewSession?: boolean, rejectedCookie?: string): any;
     private fetchCSRF;

package/lib/util/flexplm-connect.js CHANGED Viewed

@@ -2,62 +2,23 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FlexPLMConnect = void 0;
 const app_framework_1 = require("@contrail/app-framework");
-// Module-level on purpose: a new FlexPLMConnect is constructed for every event. Declaring for Session reusing use case.
-const sessionCache = new Map();
-// Upper bound so users/option combinations that are never requested again cannot accumulate cookies forever.
-const MAX_CACHED_SESSIONS = 100;
-const pruneSessionCache = () => {
-    const now = Date.now();
-    for (const [key, session] of sessionCache) {
-        if (session.expiresAt <= now)
-            sessionCache.delete(key);
+const flexplm_session_manager_1 = require("./flexplm-session-manager");
+// Cookie values carry the session id: mask them in logs whatever the header-name casing.
+const maskCookieHeaders = (headers) => {
+    if (!headers)
+        return;
+    for (const key of Object.keys(headers)) {
+        if (key.toLowerCase() === 'cookie' && headers[key])
+            headers[key] = '***masked***';
     }
-    // Still full: drop the oldest entries (Map keeps insertion order).
-    while (sessionCache.size >= MAX_CACHED_SESSIONS) {
-        sessionCache.delete(sessionCache.keys().next().value);
-    }
-};
-// In-flight cold session acquisitions per key, so concurrent events share one FlexPLM session instead of each creating their own.
-const inFlightAcquisitions = new Map();
-const DEFAULT_SESSION_COOKIE_NAME = 'JSESSIONID';
-const DEFAULT_SESSION_TTL_SECONDS = 900;
-const DEFAULT_RETRY_STATUSES = [401, 403];
-const COOKIE_NAME_TOKEN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
-// Thrown internally when a cached cookie was rejected, so the caller can re-acquire under the lock.
-class SessionRejectedError extends Error {
-}
-const escapeRegExp = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-const parseRetryStatuses = (value) => {
-    let list = [];
-    if (Array.isArray(value))
-        list = value;
-    else if (typeof value === 'string')
-        list = value.split(',');
-    else if (value !== undefined && value !== null)
-        list = [value];
-    const statuses = list
-        .map(status => (typeof status === 'string' ? status.trim() : status))
-        .filter(status => status !== '' && status !== null && status !== undefined)
-        .map(Number)
-        // Only client-error statuses can mean "session rejected". 2xx/5xx would resend events the server already processed.
-        .filter(status => Number.isInteger(status) && status >= 400 && status <= 499);
-    return statuses.length ? statuses : DEFAULT_RETRY_STATUSES;
-};
-const parseTtlSeconds = (value) => {
-    const ttl = Number(value);
-    return Number.isFinite(ttl) && ttl > 0 ? ttl : DEFAULT_SESSION_TTL_SECONDS;
 };
-const parseCookieName = (value) => {
-    const name = typeof value === 'string' ? value.trim() : '';
-    return COOKIE_NAME_TOKEN.test(name) ? name : DEFAULT_SESSION_COOKIE_NAME;
-};
-// Added for Session reuse - ET-390 - Ends
 class FlexPLMConnect {
     constructor(_config, endPoint = undefined, payloadAsArray = undefined) {
         this.vibeEventEndpoint = '';
         this.staticHeaders = undefined;
         this.payloadSendAsArray = true;
         this.config = _config;
+        this.sessions = new flexplm_session_manager_1.FlexPLMSessionManager(_config);
         this.vibeEventEndpoint = (endPoint)
             ? endPoint
             : this.config.vibeEventEndpoint;
@@ -68,70 +29,7 @@ class FlexPLMConnect {
             this.staticHeaders = this.config?.flexplmConnect?.staticHeaders;
         }
     }
-    /////////////////////////////////////////////////////////////////////////////
-    ///////// ET-390 - Session reuse: start
-    /////////////////////////////////////////////////////////////////////////////
-    /*
-    private get sessionOptions() {
-      const sessReuseBool = this.config?.flexplmConnect?.sessionReuse;
-      console.info('sessReuseBool value is --> ' + sessReuseBool);
-      console.info('enabled value is --> ' + sessReuseBool?.enabled);
-      return {
-        enabled: sessReuseBool?.enabled === true || String(sessReuseBool?.enabled).toLowerCase() === 'true',
-        ttlMs: (sessReuseBool?.ttlSeconds ?? 900) * 1000,
-        cookieName: sessReuseBool?.cookieName ?? 'JSESSIONID',
-        retryStatuses: (sessReuseBool?.retryStatuses ?? [401, 403]) as number[],
-      };
-    }
-     */
-    get sessionOptions() {
-        const cfg = this.config ?? {};
-        const sessReuseEntries = (name) => cfg[`flexplmConnect.sessionReuse.${name}`];
-        const enabled = sessReuseEntries('enabled');
-        return {
-            enabled: enabled === true || String(enabled).toLowerCase() === 'true',
-            ttlMs: parseTtlSeconds(sessReuseEntries('ttlSeconds')) * 1000,
-            cookieName: parseCookieName(sessReuseEntries('cookieName')),
-            retryStatuses: parseRetryStatuses(sessReuseEntries('retryStatuses')),
-        };
-    }
-    /**
-     * Waits until no cold session acquisition is running for this key.
-     * Callers must `await` this only when it returns a promise: awaiting even a resolved promise yields,
-     * and the check-then-register in runColdAcquisition has to stay synchronous to be race free.
-     */
-    waitForInFlightAcquisition() {
-        const key = this.getSessionKey();
-        if (!inFlightAcquisitions.has(key))
-            return undefined;
-        return (async () => {
-            let pending = inFlightAcquisitions.get(key);
-            while (pending) {
-                await pending.catch(() => undefined);
-                pending = inFlightAcquisitions.get(key);
-            }
-        })();
-    }
-    /** Runs a cold acquisition and registers it so concurrent callers wait for it instead of opening their own session. */
-    async runColdAcquisition(acquire) {
-        const key = this.getSessionKey();
-        const acquisition = acquire();
-        inFlightAcquisitions.set(key, acquisition);
-        try {
-            return await acquisition;
-        }
-        finally {
-            if (inFlightAcquisitions.get(key) === acquisition)
-                inFlightAcquisitions.delete(key);
-        }
-    }
-    getSessionKey() {
-        // Options that change the cached value are part of the key; JSON avoids '|' collisions between fields.
-        const { cookieName, ttlMs } = this.sessionOptions;
-        return JSON.stringify([
-            this.config.apiHost, this.config.urlContext, this.config.userName(), this.config.plmEnviornment, cookieName, ttlMs,
-        ]);
-    }
+    // ET-390 - Session reuse
     /** Releases the connection of a rejected response before it is replaced by a retry. */
     async discardBody(response) {
         try {
@@ -142,60 +40,6 @@ class FlexPLMConnect {
             // best effort: nothing to do if the body is already consumed or locked
         }
     }
-    getCachedSession() {
-        if (!this.sessionOptions.enabled)
-            return undefined;
-        const key = this.getSessionKey();
-        const cachedSessValue = sessionCache.get(key);
-        if (!cachedSessValue)
-            return undefined;
-        if (cachedSessValue.expiresAt <= Date.now()) {
-            sessionCache.delete(key);
-            return undefined;
-        }
-        return cachedSessValue.cookie;
-    }
-    storeSession(cookie) {
-        // sliding expiry: Windchill's session timeout is also sliding
-        const key = this.getSessionKey();
-        // delete first so a refreshed entry moves to the newest position (oldest-first eviction then acts as LRU)
-        sessionCache.delete(key);
-        pruneSessionCache();
-        sessionCache.set(key, { cookie, expiresAt: Date.now() + this.sessionOptions.ttlMs });
-    }
-    clearSession() {
-        sessionCache.delete(this.getSessionKey());
-    }
-    /** Returns the session cookie value Windchill issued on this response, if any (last one wins). */
-    extractSessionCookie(response) {
-        const respHeader = response?.headers;
-        if (!respHeader)
-            return undefined;
-        let raw = [];
-        if (typeof respHeader.getSetCookie === 'function') {
-            raw = respHeader.getSetCookie();
-        }
-        else if (typeof respHeader.get === 'function' && respHeader.get('set-cookie')) {
-            raw = [respHeader.get('set-cookie')];
-        }
-        const name = this.sessionOptions.cookieName;
-        const regexFilter = new RegExp('(?:^|[,\\s])' + escapeRegExp(name) + '=([^;,\\s]+)', 'g');
-        let jSession;
-        for (const line of raw) {
-            let cookieNameMatcher = regexFilter.exec(line);
-            while (cookieNameMatcher !== null) {
-                jSession = cookieNameMatcher[1];
-                cookieNameMatcher = regexFilter.exec(line);
-            }
-        }
-        return jSession;
-    }
-    cookieHeader(sessionCookie) {
-        return sessionCookie ? `${this.sessionOptions.cookieName}=${sessionCookie}` : undefined;
-    }
-    /////////////////////////////////////////////////////////////////////////////
-    ///////// ET-390 - Session reuse: end
-    /////////////////////////////////////////////////////////////////////////////
     /////////////////////////////////////////////////////////////////////////////
     ///////// Custom getRequestOptions: start
     /////////////////////////////////////////////////////////////////////////////
@@ -213,17 +57,21 @@ class FlexPLMConnect {
             Object.assign(csrfOptions.headers, this.staticHeaders);
         }
         // Added for Session reuse - ET-390 - Starts
-        const cookie = this.cookieHeader(sessionCookie);
+        // Merge with a configured static Cookie header (any header-name casing) instead of replacing it.
+        const headers = csrfOptions.headers;
+        const staticCookieKeys = Object.keys(headers).filter(key => key.toLowerCase() === 'cookie');
+        const staticCookie = staticCookieKeys.map(key => headers[key]).join('; ');
+        const cookie = this.sessions.buildCookieHeader(staticCookie, sessionCookie);
+        staticCookieKeys.forEach(key => delete headers[key]);
         if (cookie) {
-            csrfOptions.headers['Cookie'] = cookie;
+            headers['Cookie'] = cookie;
         }
         // Added for Session reuse - ET-390 - Ends
         if (app_framework_1.Logger.isInfoOn()) {
             const logOptions = JSON.parse(JSON.stringify(csrfOptions));
             logOptions['headers']['Authorization'] = logOptions?.headers?.Authorization.substring(0, 9);
             // Added for Session reuse - ET-390 - Starts
-            if (logOptions.headers['Cookie'])
-                logOptions.headers['Cookie'] = '***masked***';
+            maskCookieHeaders(logOptions.headers);
             // Added for Session reuse - ET-390 - Ends
             console.info('csrfOptions: ' + JSON.stringify(logOptions));
         }
@@ -237,30 +85,30 @@ class FlexPLMConnect {
     // rejectedCookie: the cookie that was rejected by the caller, so a refresh already done by a concurrent event is not thrown away
     async getCSRF(getNewSession = false, rejectedCookie) {
         // Added for Session reuse - ET-390 - Starts
-        if (!this.sessionOptions.enabled)
+        if (!this.sessions.options.enabled)
             return this.fetchCSRF(undefined);
-        for (let wait = this.waitForInFlightAcquisition(); wait; wait = this.waitForInFlightAcquisition())
+        for (let wait = this.sessions.waitForInFlightAcquisition(); wait; wait = this.sessions.waitForInFlightAcquisition())
             await wait;
         if (getNewSession) {
-            const current = this.getCachedSession();
+            const current = this.sessions.getCachedSession();
             if (rejectedCookie === undefined || !current || current === rejectedCookie)
-                this.clearSession();
+                this.sessions.clearSession();
         }
-        const cached = this.getCachedSession();
+        const cached = this.sessions.getCachedSession();
         if (cached) {
             try {
                 return await this.fetchCSRF(cached);
             }
             catch (e) {
-                if (!(e instanceof SessionRejectedError))
+                if (!(e instanceof flexplm_session_manager_1.SessionRejectedError))
                     throw e;
                 // if the cached cookie is rejected (401/403), drop it and acquire a new session (serialized)
-                if (this.getCachedSession() === cached)
-                    this.clearSession();
+                if (this.sessions.getCachedSession() === cached)
+                    this.sessions.clearSession();
                 return this.getCSRF();
             }
         }
-        return this.runColdAcquisition(() => this.fetchCSRF(undefined));
+        return this.sessions.runColdAcquisition(() => this.fetchCSRF(undefined));
         // Added for Session reuse - ET-390 - Ends
     }
     async fetchCSRF(sentCookie) {
@@ -272,10 +120,10 @@ class FlexPLMConnect {
         const csrfOptions = this.getRequestOptions('GET', sentCookie);
         const response = await fetch(csrfURL, csrfOptions);
         // Added for Session reuse - ET-390 - Starts
-        if (sentCookie && this.sessionOptions.retryStatuses.includes(response.status)) {
+        if (sentCookie && this.sessions.options.retryStatuses.includes(response.status)) {
             console.warn('Cached FlexPLM session rejected on csrf call (status ' + response.status + '). Retrying with a new session.');
             await this.discardBody(response);
-            throw new SessionRejectedError();
+            throw new flexplm_session_manager_1.SessionRejectedError();
         }
         // Added for Session reuse - ET-390 - Ends
         if (response.status >= 300) {
@@ -289,10 +137,10 @@ class FlexPLMConnect {
         // Added for Session reuse - ET-390 - Starts
         // If the cookie we sent was invalid, Windchill answers with a fresh Set-Cookie --> replace the cache.
         let sessionCookie = sentCookie;
-        if (this.sessionOptions.enabled) {
-            sessionCookie = this.extractSessionCookie(response) ?? sentCookie;
+        if (this.sessions.options.enabled) {
+            sessionCookie = this.sessions.extractSessionCookie(response) ?? sentCookie;
             if (sessionCookie)
-                this.storeSession(sessionCookie);
+                this.sessions.storeSession(sessionCookie, sentCookie);
         }
         // Added for Session reuse - ET-390 - Ends
         try {
@@ -328,8 +176,7 @@ class FlexPLMConnect {
             const logOptions = JSON.parse(JSON.stringify(xferOptions));
             if (logOptions?.headers?.Authorization)
                 logOptions.headers.Authorization = logOptions?.headers?.Authorization.substring(0, 9);
-            if (logOptions?.headers?.Cookie)
-                logOptions.headers.Cookie = '***masked***';
+            maskCookieHeaders(logOptions?.headers);
             if (csrf?.nonce_key)
                 logOptions.headers[csrf.nonce_key] = csrf.nonce ? `***masked(length:${csrf.nonce.length})***` : '***masked(empty)***';
             console.info('csrfOptions: ' + JSON.stringify(logOptions));
@@ -356,7 +203,7 @@ class FlexPLMConnect {
         /// Added for Session reuse - ET-390 - Starts
         // const response = await this.sendRequest(csrf, payload);
         let response = await this.sendRequest(csrf, payload);
-        if (csrf.sessionCookie && this.sessionOptions.retryStatuses.includes(response.status)) {
+        if (csrf.sessionCookie && this.sessions.options.retryStatuses.includes(response.status)) {
             console.warn('FlexPLM rejected session/nonce (status ' + response.status + '). Getting a new session and retrying once.');
             await this.discardBody(response);
             csrf = await this.getCSRF(true, csrf.sessionCookie);
@@ -417,30 +264,30 @@ class FlexPLMConnect {
         const vibeEventsURL = this.config.apiHost + urlContext + path;
         // Added for Session reuse - ET-390 - Starts
         const attempt = async () => {
-            if (!this.sessionOptions.enabled) {
+            if (!this.sessions.options.enabled) {
                 return { response: await fetch(vibeEventsURL, this.getRequestOptions('GET')), sent: undefined };
             }
-            for (let wait = this.waitForInFlightAcquisition(); wait; wait = this.waitForInFlightAcquisition())
+            for (let wait = this.sessions.waitForInFlightAcquisition(); wait; wait = this.sessions.waitForInFlightAcquisition())
                 await wait;
-            const sent = this.getCachedSession();
+            const sent = this.sessions.getCachedSession();
             const call = async () => {
                 const res = await fetch(vibeEventsURL, this.getRequestOptions('GET', sent));
                 // A rejected cookie must not be stored again; only keep a cookie that was accepted or newly issued.
-                if (!(sent && this.sessionOptions.retryStatuses.includes(res.status))) {
-                    const cookie = this.extractSessionCookie(res) ?? sent;
+                if (!(sent && this.sessions.options.retryStatuses.includes(res.status))) {
+                    const cookie = this.sessions.extractSessionCookie(res) ?? sent;
                     if (cookie)
-                        this.storeSession(cookie);
+                        this.sessions.storeSession(cookie, sent);
                 }
                 return { response: res, sent };
             };
-            return sent ? call() : this.runColdAcquisition(call);
+            return sent ? call() : this.sessions.runColdAcquisition(call);
         };
         const first = await attempt();
         let response = first.response;
-        if (first.sent && this.sessionOptions.retryStatuses.includes(response.status)) {
+        if (first.sent && this.sessions.options.retryStatuses.includes(response.status)) {
             await this.discardBody(response);
-            if (this.getCachedSession() === first.sent)
-                this.clearSession();
+            if (this.sessions.getCachedSession() === first.sent)
+                this.sessions.clearSession();
             response = (await attempt()).response;
         }
         // Added for Session reuse - ET-390 - Ends

package/lib/util/flexplm-connect.spec.js CHANGED Viewed

@@ -39,12 +39,8 @@ const resp = (status, setCookie = [], json = csrfBody) => ({
 });
 let userCounter = 0;
 const uniqueUser = () => 'sess-user-' + (++userCounter);
-// The connector config is flat: keys look like 'flexplmConnect.sessionReuse.enabled'
-const sessionConfig = (user, sessionReuse = { enabled: true }) => {
-    const flat = {};
-    Object.entries(sessionReuse).forEach(([k, v]) => { flat[`flexplmConnect.sessionReuse.${k}`] = v; });
-    return createConfig({ userName: () => user, ...flat });
-};
+// Session options are nested: { flexplmConnect: { sessionReuse: { enabled, ... } } }
+const sessionConfig = (user, sessionReuse = { enabled: true }) => createConfig({ userName: () => user, flexplmConnect: { sessionReuse } });
 const fetchMock = () => global.fetch;
 const callHeaders = (i) => fetchMock().mock.calls[i][1].headers;
 const callMethod = (i) => fetchMock().mock.calls[i][1].method;
@@ -358,6 +354,60 @@ describe('FlexPLMConnect session reuse', () => {
         isInfoOn.mockRestore();
         info.mockRestore();
     });
+    describe('static Cookie header', () => {
+        const withStatic = (user, staticHeaders, sessionReuse = { enabled: true }) => createConfig({ userName: () => user, flexplmConnect: { sessionReuse, staticHeaders } });
+        it('should keep other static cookies and replace only the managed one once a session is cached', async () => {
+            const u = uniqueUser();
+            fetchMock()
+                .mockResolvedValueOnce(resp(200, ['JSESSIONID=new.tomcat1; Path=/']))
+                .mockResolvedValueOnce(resp(200, [], {}));
+            await new flexplm_connect_1.FlexPLMConnect(withStatic(u, { Cookie: 'lb=abc; JSESSIONID=stale; theme=dark' })).sendToFlexPLM(payload);
+            expect(callHeaders(0).Cookie).toBe('lb=abc; theme=dark'); // cold: stale managed cookie dropped
+            expect(callHeaders(1).Cookie).toBe('lb=abc; theme=dark; JSESSIONID=new.tomcat1');
+        });
+        it('should send a single Cookie header when the static header name is lowercase', async () => {
+            const u = uniqueUser();
+            fetchMock()
+                .mockResolvedValueOnce(resp(200, ['JSESSIONID=abc.tomcat1; Path=/']))
+                .mockResolvedValueOnce(resp(200, [], {}));
+            await new flexplm_connect_1.FlexPLMConnect(withStatic(u, { cookie: 'lb=abc' })).sendToFlexPLM(payload);
+            const postHeaders = callHeaders(1);
+            expect(Object.keys(postHeaders).filter(k => k.toLowerCase() === 'cookie')).toEqual(['Cookie']);
+            expect(postHeaders.Cookie).toBe('lb=abc; JSESSIONID=abc.tomcat1');
+        });
+        it('should send the static Cookie unchanged when session reuse is disabled', async () => {
+            const u = uniqueUser();
+            fetchMock()
+                .mockResolvedValueOnce(resp(200, ['JSESSIONID=abc.tomcat1; Path=/']))
+                .mockResolvedValueOnce(resp(200, [], {}));
+            await new flexplm_connect_1.FlexPLMConnect(withStatic(u, { Cookie: 'lb=abc; JSESSIONID=static' }, { enabled: false })).sendToFlexPLM(payload);
+            expect(callHeaders(0).Cookie).toBe('lb=abc; JSESSIONID=static');
+            expect(callHeaders(1).Cookie).toBe('lb=abc; JSESSIONID=static');
+        });
+        it('should not resend a rejected static JSESSIONID on the fresh retry', async () => {
+            const u = uniqueUser();
+            fetchMock()
+                .mockResolvedValueOnce(resp(200, ['JSESSIONID=old.tomcat1; Path=/']))
+                .mockResolvedValueOnce(resp(403, [], {})) // POST rejected
+                .mockResolvedValueOnce(resp(200, ['JSESSIONID=fresh.tomcat1; Path=/'])) // fresh GET
+                .mockResolvedValueOnce(resp(200, [], {}));
+            await new flexplm_connect_1.FlexPLMConnect(withStatic(u, { Cookie: 'lb=abc; JSESSIONID=static' })).sendToFlexPLM(payload);
+            expect(callHeaders(2).Cookie).toBe('lb=abc'); // fresh GET carries no JSESSIONID
+            expect(callHeaders(3).Cookie).toBe('lb=abc; JSESSIONID=fresh.tomcat1');
+        });
+        it('should mask a lowercase static cookie header in logs', async () => {
+            const isInfoOn = jest.spyOn(app_framework_1.Logger, 'isInfoOn').mockReturnValue(true);
+            const info = jest.spyOn(console, 'info').mockImplementation();
+            fetchMock()
+                .mockResolvedValueOnce(resp(200, ['JSESSIONID=abc.tomcat1']))
+                .mockResolvedValueOnce(resp(200, [], {}));
+            await new flexplm_connect_1.FlexPLMConnect(withStatic(uniqueUser(), { cookie: 'lb=topsecret' }, { enabled: false })).sendToFlexPLM(payload);
+            const logged = info.mock.calls.map(c => String(c[0] ?? '')).join('\n');
+            expect(logged).not.toContain('topsecret');
+            isInfoOn.mockRestore();
+            info.mockRestore();
+        });
+    });
     describe('option normalisation', () => {
         const rejectedOnceThenOk = (u, opts) => {
             fetchMock()
@@ -525,6 +575,41 @@ describe('FlexPLMConnect session reuse', () => {
     describe('concurrent session acquisition', () => {
         const flush = () => new Promise(r => setImmediate(r));
         const isColdGet = (call) => call[1].method === 'GET' && !call[1].headers.Cookie;
+        it('should not let a late response using an older cookie roll back a refreshed session', async () => {
+            const u = uniqueUser();
+            const cfg = () => sessionConfig(u);
+            // seed the cache with 'old'
+            fetchMock()
+                .mockResolvedValueOnce(resp(200, ['JSESSIONID=old']))
+                .mockResolvedValueOnce(resp(200, [], {}));
+            await new flexplm_connect_1.FlexPLMConnect(cfg()).sendToFlexPLM(payload);
+            let lateGetsSeen = 0;
+            let releaseLate;
+            const lateGate = new Promise(r => { releaseLate = r; });
+            fetchMock().mockReset();
+            fetchMock().mockImplementation(async (_url, opts) => {
+                const cookie = opts.headers.Cookie;
+                if (opts.method === 'GET' && cookie === 'JSESSIONID=old') {
+                    if (++lateGetsSeen === 1)
+                        return resp(403, []); // event A: old rejected
+                    await lateGate; // event B: slow 200, no Set-Cookie
+                    return resp(200, []);
+                }
+                if (opts.method === 'GET' && !cookie)
+                    return resp(200, ['JSESSIONID=new']); // A's fresh acquisition
+                if (opts.method === 'GET')
+                    return resp(200, []);
+                return resp(200, [], {});
+            });
+            const a = new flexplm_connect_1.FlexPLMConnect(cfg()).sendToFlexPLM(payload);
+            const b = new flexplm_connect_1.FlexPLMConnect(cfg()).sendToFlexPLM(payload);
+            await a;
+            releaseLate();
+            await b;
+            fetchMock().mockClear();
+            await new flexplm_connect_1.FlexPLMConnect(cfg()).getCSRF();
+            expect(callHeaders(0).Cookie).toBe('JSESSIONID=new'); // B must not have stored 'old' again
+        });
         it('should share one session across concurrent events on a cold cache', async () => {
             const u = uniqueUser();
             let release;

package/lib/util/flexplm-session-manager.d.ts ADDED Viewed

@@ -0,0 +1,40 @@
+import { FCConfig } from '../interfaces/interfaces';
+export declare class SessionRejectedError extends Error {
+}
+/** Owns the FlexPLM session cookie cache: options, keying, expiry, in-flight acquisition sharing and Set-Cookie parsing. */
+export declare class FlexPLMSessionManager {
+    private config;
+    constructor(config: FCConfig);
+    get options(): {
+        enabled: boolean;
+        ttlMs: number;
+        cookieName: string;
+        retryStatuses: number[];
+    };
+    /**
+     * Waits until no cold session acquisition is running for this key.
+     * Callers must `await` this only when it returns a promise: awaiting even a resolved promise yields,
+     * and the check-then-register in runColdAcquisition has to stay synchronous to be race free.
+     */
+    waitForInFlightAcquisition(): Promise<void> | undefined;
+    /** Runs a cold acquisition and registers it so concurrent callers wait for it instead of opening their own session. */
+    runColdAcquisition<T>(acquire: () => Promise<T>): Promise<T>;
+    private getSessionKey;
+    getCachedSession(): string | undefined;
+    /**
+     * Compare-and-set: stores `cookie` only if the cache still holds the cookie this request was sent with
+     * (`sentCookie`, undefined for a cold acquisition = nothing cached). A late response must not roll back or
+     * resurrect a session that a concurrent event already replaced or cleared.
+     * @returns true if the cache was updated
+     */
+    storeSession(cookie: string, sentCookie: string | undefined): boolean;
+    clearSession(): void;
+    /** Returns the session cookie value Windchill issued on this response, if any (last one wins). */
+    extractSessionCookie(response: Response): string | undefined;
+    /**
+     * Builds the Cookie header value from the configured static Cookie header and the managed session cookie.
+     * With session reuse enabled only the managed cookie is replaced/removed; every other static cookie pair is kept.
+     * With session reuse disabled the static value is returned unchanged.
+     */
+    buildCookieHeader(staticCookie?: string, sessionCookie?: string): string | undefined;
+}

package/lib/util/flexplm-session-manager.js ADDED Viewed

@@ -0,0 +1,180 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FlexPLMSessionManager = exports.SessionRejectedError = void 0;
+// Module-level on purpose: a new FlexPLMConnect (and session manager) is constructed for every event.
+const sessionCache = new Map();
+// Upper bound so users/option combinations that are never requested again cannot accumulate cookies forever.
+const MAX_CACHED_SESSIONS = 100;
+const pruneSessionCache = () => {
+    const now = Date.now();
+    for (const [key, session] of sessionCache) {
+        if (session.expiresAt <= now)
+            sessionCache.delete(key);
+    }
+    // Still full: drop the oldest entries (Map keeps insertion order).
+    while (sessionCache.size >= MAX_CACHED_SESSIONS) {
+        sessionCache.delete(sessionCache.keys().next().value);
+    }
+};
+// In-flight cold session acquisitions per key, so concurrent events share one FlexPLM session instead of each creating their own.
+const inFlightAcquisitions = new Map();
+const DEFAULT_SESSION_COOKIE_NAME = 'JSESSIONID';
+const DEFAULT_SESSION_TTL_SECONDS = 900;
+const DEFAULT_RETRY_STATUSES = [401, 403];
+const COOKIE_NAME_TOKEN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+// Thrown internally when a cached cookie was rejected, so the caller can re-acquire under the lock.
+class SessionRejectedError extends Error {
+}
+exports.SessionRejectedError = SessionRejectedError;
+const escapeRegExp = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+const parseRetryStatuses = (value) => {
+    let list = [];
+    if (Array.isArray(value))
+        list = value;
+    else if (typeof value === 'string')
+        list = value.split(',');
+    else if (value !== undefined && value !== null)
+        list = [value];
+    const statuses = list
+        .map(status => (typeof status === 'string' ? status.trim() : status))
+        .filter(status => status !== '' && status !== null && status !== undefined)
+        .map(Number)
+        // Only client-error statuses can mean "session rejected". 2xx/5xx would resend events the server already processed.
+        .filter(status => Number.isInteger(status) && status >= 400 && status <= 499);
+    return statuses.length ? statuses : DEFAULT_RETRY_STATUSES;
+};
+const parseTtlSeconds = (value) => {
+    const ttl = Number(value);
+    return Number.isFinite(ttl) && ttl > 0 ? ttl : DEFAULT_SESSION_TTL_SECONDS;
+};
+const parseCookieName = (value) => {
+    const name = typeof value === 'string' ? value.trim() : '';
+    return COOKIE_NAME_TOKEN.test(name) ? name : DEFAULT_SESSION_COOKIE_NAME;
+};
+/** Owns the FlexPLM session cookie cache: options, keying, expiry, in-flight acquisition sharing and Set-Cookie parsing. */
+class FlexPLMSessionManager {
+    constructor(config) {
+        this.config = config;
+    }
+    get options() {
+        const sessionReuseConfig = this.config?.flexplmConnect?.sessionReuse ?? {};
+        return {
+            enabled: sessionReuseConfig.enabled === true || String(sessionReuseConfig.enabled).toLowerCase() === 'true',
+            ttlMs: parseTtlSeconds(sessionReuseConfig.ttlSeconds) * 1000,
+            cookieName: parseCookieName(sessionReuseConfig.cookieName),
+            retryStatuses: parseRetryStatuses(sessionReuseConfig.retryStatuses),
+        };
+    }
+    /**
+     * Waits until no cold session acquisition is running for this key.
+     * Callers must `await` this only when it returns a promise: awaiting even a resolved promise yields,
+     * and the check-then-register in runColdAcquisition has to stay synchronous to be race free.
+     */
+    waitForInFlightAcquisition() {
+        const key = this.getSessionKey();
+        if (!inFlightAcquisitions.has(key))
+            return undefined;
+        return (async () => {
+            let pending = inFlightAcquisitions.get(key);
+            while (pending) {
+                await pending.catch(() => undefined);
+                pending = inFlightAcquisitions.get(key);
+            }
+        })();
+    }
+    /** Runs a cold acquisition and registers it so concurrent callers wait for it instead of opening their own session. */
+    async runColdAcquisition(acquire) {
+        const key = this.getSessionKey();
+        const acquisition = acquire();
+        inFlightAcquisitions.set(key, acquisition);
+        try {
+            return await acquisition;
+        }
+        finally {
+            if (inFlightAcquisitions.get(key) === acquisition)
+                inFlightAcquisitions.delete(key);
+        }
+    }
+    getSessionKey() {
+        // Options that change the cached value are part of the key; JSON avoids '|' collisions between fields.
+        const { cookieName, ttlMs } = this.options;
+        return JSON.stringify([
+            this.config.apiHost, this.config.urlContext, this.config.userName(), this.config.plmEnviornment, cookieName, ttlMs,
+        ]);
+    }
+    getCachedSession() {
+        if (!this.options.enabled)
+            return undefined;
+        const key = this.getSessionKey();
+        const cachedSessValue = sessionCache.get(key);
+        if (!cachedSessValue)
+            return undefined;
+        if (cachedSessValue.expiresAt <= Date.now()) {
+            sessionCache.delete(key);
+            return undefined;
+        }
+        return cachedSessValue.cookie;
+    }
+    /**
+     * Compare-and-set: stores `cookie` only if the cache still holds the cookie this request was sent with
+     * (`sentCookie`, undefined for a cold acquisition = nothing cached). A late response must not roll back or
+     * resurrect a session that a concurrent event already replaced or cleared.
+     * @returns true if the cache was updated
+     */
+    storeSession(cookie, sentCookie) {
+        const key = this.getSessionKey();
+        if (sessionCache.get(key)?.cookie !== sentCookie)
+            return false;
+        // sliding expiry: Windchill's session timeout is also sliding
+        // delete first so a refreshed entry moves to the newest position (oldest-first eviction then acts as LRU)
+        sessionCache.delete(key);
+        pruneSessionCache();
+        sessionCache.set(key, { cookie, expiresAt: Date.now() + this.options.ttlMs });
+        return true;
+    }
+    clearSession() {
+        sessionCache.delete(this.getSessionKey());
+    }
+    /** Returns the session cookie value Windchill issued on this response, if any (last one wins). */
+    extractSessionCookie(response) {
+        const respHeader = response?.headers;
+        if (!respHeader)
+            return undefined;
+        let raw = [];
+        if (typeof respHeader.getSetCookie === 'function') {
+            raw = respHeader.getSetCookie();
+        }
+        else if (typeof respHeader.get === 'function' && respHeader.get('set-cookie')) {
+            raw = [respHeader.get('set-cookie')];
+        }
+        const name = this.options.cookieName;
+        const regexFilter = new RegExp('(?:^|[,\\s])' + escapeRegExp(name) + '=([^;,\\s]+)', 'g');
+        let jSession;
+        for (const line of raw) {
+            let cookieNameMatcher = regexFilter.exec(line);
+            while (cookieNameMatcher !== null) {
+                jSession = cookieNameMatcher[1];
+                cookieNameMatcher = regexFilter.exec(line);
+            }
+        }
+        return jSession;
+    }
+    /**
+     * Builds the Cookie header value from the configured static Cookie header and the managed session cookie.
+     * With session reuse enabled only the managed cookie is replaced/removed; every other static cookie pair is kept.
+     * With session reuse disabled the static value is returned unchanged.
+     */
+    buildCookieHeader(staticCookie, sessionCookie) {
+        if (!this.options.enabled)
+            return staticCookie || undefined;
+        const name = this.options.cookieName;
+        const pairs = (staticCookie ?? '')
+            .split(';')
+            .map(pair => pair.trim())
+            .filter(pair => pair && pair.split('=')[0].trim() !== name);
+        if (sessionCookie)
+            pairs.push(`${name}=${sessionCookie}`);
+        return pairs.length ? pairs.join('; ') : undefined;
+    }
+}
+exports.FlexPLMSessionManager = FlexPLMSessionManager;

package/lib/util/flexplm-session-manager.spec.d.ts ADDED Viewed

	@@ -0,0 +1 @@
1	+ export {};

package/lib/util/flexplm-session-manager.spec.js ADDED Viewed

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const flexplm_session_manager_1 = require("./flexplm-session-manager");
+let userCounter = 0;
+const newManager = () => {
+    const user = 'mgr-user-' + (++userCounter);
+    const config = {
+        apiHost: 'https://flexplm.example.com',
+        urlContext: '/FlexPLM',
+        vibeEventEndpoint: '/api/events',
+        csrfEndpoint: '/csrf',
+        plmEnviornment: 'test',
+        userName: () => user,
+        password: () => 'pass',
+        itemPreDevelopmentLifecycleStages: [],
+        flexplmConnect: { sessionReuse: { enabled: true } },
+    };
+    return new flexplm_session_manager_1.FlexPLMSessionManager(config);
+};
+describe('FlexPLMSessionManager.storeSession (compare-and-set)', () => {
+    it('should store a cold acquisition when nothing is cached', () => {
+        const m = newManager();
+        expect(m.storeSession('a', undefined)).toBe(true);
+        expect(m.getCachedSession()).toBe('a');
+    });
+    it('should not let a cold acquisition overwrite an entry that appeared meanwhile', () => {
+        const m = newManager();
+        m.storeSession('a', undefined);
+        expect(m.storeSession('b', undefined)).toBe(false);
+        expect(m.getCachedSession()).toBe('a');
+    });
+    it('should replace or refresh the entry while it still holds the cookie that was sent', () => {
+        const m = newManager();
+        m.storeSession('old', undefined);
+        expect(m.storeSession('new', 'old')).toBe(true);
+        expect(m.getCachedSession()).toBe('new');
+        expect(m.storeSession('new', 'new')).toBe(true); // sliding refresh with the same cookie
+    });
+    it('should ignore a late response that was sent with an older cookie', () => {
+        const m = newManager();
+        m.storeSession('old', undefined);
+        m.storeSession('new', 'old');
+        expect(m.storeSession('old', 'old')).toBe(false);
+        expect(m.getCachedSession()).toBe('new');
+    });
+    it('should not resurrect a session that was cleared meanwhile', () => {
+        const m = newManager();
+        m.storeSession('old', undefined);
+        m.clearSession();
+        expect(m.storeSession('old', 'old')).toBe(false);
+        expect(m.getCachedSession()).toBeUndefined();
+    });
+});

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@contrail/flexplm",
-  "version": "1.7.7-alpha.d153eea",
+  "version": "1.7.7-alpha.e0ee6a0",
   "description": "Library used for integration with flexplm.",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",