@contrail/flexplm 1.8.1 → 2.0.0-alpha.df05bb5

package/lib/util/flexplm-connect.js

@@ -2,6 +2,25 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FlexPLMConnect = void 0;
 const app_framework_1 = require("@contrail/app-framework");
+const telemetry_1 = require("@contrail/telemetry");
+const telemetry_attributes_1 = require("./telemetry-attributes");
+const telemetry_utils_1 = require("./telemetry-utils");
+// Telemetry: only the path is recorded, never the host or the query string (it can carry file paths).
+const toUrlPath = (path) => (path || '').split('?')[0];
+const MAX_LOGGED_RESPONSE_BODY = 2048;
+/** Reads the response body for an error log; never throws (the body may already be consumed). */
+const readBodyForLog = async (response) => {
+    try {
+        const text = await response.text();
+        return text.length > MAX_LOGGED_RESPONSE_BODY ? text.substring(0, MAX_LOGGED_RESPONSE_BODY) + '...(truncated)' : text;
+    }
+    catch (e) {
+        return '(response body unavailable)';
+    }
+};
+const logFlexPLMError = async (message, response, urlPath) => {
+    telemetry_1.logger.error({ flexplm: { status: response.status, url_path: urlPath, response_body: await readBodyForLog(response) } }, message);
+};
 // Module-level on purpose: a new FlexPLMConnect is constructed for every event. Declaring for Session reusing use case.
 const sessionCache = new Map();
 // Upper bound so users/option combinations that are never requested again cannot accumulate cookies forever.
@@ -98,6 +117,14 @@ class FlexPLMConnect {
             }
         })();
     }
+    /** Marks the active span when this request is about to wait for another request's cold acquisition.
+     * Synchronous on purpose: it must not add an await to the wait loops (see waitForInFlightAcquisition).
+     */
+    recordWaitForInFlightAcquisition() {
+        if (inFlightAcquisitions.has(this.getSessionKey())) {
+            (0, telemetry_utils_1.setActiveSpanAttributes)({ [telemetry_attributes_1.ATTR_FLEXPLM_SESSION_WAITED]: true });
+        }
+    }
     /** Runs a cold acquisition and registers it so concurrent callers wait for it instead of opening their own session. */
     async runColdAcquisition(acquire) {
         const key = this.getSessionKey();
@@ -223,8 +250,11 @@ class FlexPLMConnect {
     // rejectedCookie: the cookie that was rejected by the caller, so a refresh already done by a concurrent event is not thrown away
     async getCSRF(getNewSession = false, rejectedCookie) {
         // Added for Session reuse - ET-390 - Starts
-        if (!this.sessionOptions.enabled)
+        if (!this.sessionOptions.enabled) {
+            (0, telemetry_utils_1.setActiveSpanAttributes)({ [telemetry_attributes_1.ATTR_FLEXPLM_SESSION_SOURCE]: 'disabled' });
             return this.fetchCSRF(undefined);
+        }
+        this.recordWaitForInFlightAcquisition();
         for (let wait = this.waitForInFlightAcquisition(); wait; wait = this.waitForInFlightAcquisition())
             await wait;
         if (getNewSession) {
@@ -233,6 +263,8 @@ class FlexPLMConnect {
                 this.clearSession();
         }
         const cached = this.getCachedSession();
+        // Set on the caller's span; a retry below overwrites it with the session that was finally used.
+        (0, telemetry_utils_1.setActiveSpanAttributes)({ [telemetry_attributes_1.ATTR_FLEXPLM_SESSION_SOURCE]: cached ? 'cached' : 'new' });
         if (cached) {
             try {
                 return await this.fetchCSRF(cached);
@@ -254,50 +286,62 @@ class FlexPLMConnect {
         const csrfEndpoint = this.config.csrfEndpoint;
         const csrfURL = this.config.apiHost + urlContext + csrfEndpoint;
         console.info('csrfURL: ' + csrfURL);
-        // getRequestOptions will be called with additional sentCookie parameter
-        const csrfOptions = this.getRequestOptions('GET', sentCookie);
-        const response = await fetch(csrfURL, csrfOptions);
-        // Added for Session reuse - ET-390 - Starts
-        if (sentCookie && this.sessionOptions.retryStatuses.includes(response.status)) {
-            console.warn('Cached FlexPLM session rejected on csrf call (status ' + response.status + '). Retrying with a new session.');
-            await this.discardBody(response);
+        const urlPath = toUrlPath(urlContext + csrfEndpoint);
+        const result = await (0, telemetry_1.traceSection)('fetch_flexplm_csrf', {
+            [telemetry_attributes_1.ATTR_FLEXPLM_REQUEST_KIND]: 'csrf',
+            [telemetry_attributes_1.ATTR_HTTP_REQUEST_METHOD]: 'GET',
+            [telemetry_attributes_1.ATTR_URL_PATH]: urlPath,
+        }, async (span) => {
+            // getRequestOptions will be called with additional sentCookie parameter
+            const csrfOptions = this.getRequestOptions('GET', sentCookie);
+            const response = await fetch(csrfURL, csrfOptions);
+            span.setAttribute(telemetry_attributes_1.ATTR_HTTP_RESPONSE_STATUS_CODE, response.status);
+            // Added for Session reuse - ET-390 - Starts
+            if (sentCookie && this.sessionOptions.retryStatuses.includes(response.status)) {
+                console.warn('Cached FlexPLM session rejected on csrf call (status ' + response.status + '). Retrying with a new session.');
+                // Expected and retried by getCSRF, so it is an event and the span stays OK.
+                span.addEvent('flexplm_session_rejected');
+                await this.discardBody(response);
+                return { sessionRejected: true };
+            }
+            // Added for Session reuse - ET-390 - Ends
+            if (response.status >= 300) {
+                const message = 'Error connecting to FlexPLM:status: ' + response.status;
+                await logFlexPLMError(message, response, urlPath);
+                const e = new Error(message);
+                e['httpResponseStatus'] = response.status;
+                throw e;
+            }
+            // Added for Session reuse - ET-390 - Starts
+            // If the cookie we sent was invalid, Windchill answers with a fresh Set-Cookie --> replace the cache.
+            let sessionCookie = sentCookie;
+            if (this.sessionOptions.enabled) {
+                sessionCookie = this.extractSessionCookie(response) ?? sentCookie;
+                if (sessionCookie)
+                    this.storeSession(sessionCookie);
+            }
+            // Added for Session reuse - ET-390 - Ends
+            try {
+                const body = await response.json();
+                const nonce_key = body.items[0].attributes.nonce_key;
+                const nonce = body.items[0].attributes.nonce;
+                // ET-390 - adding sessionCookie to the return
+                return {
+                    nonce_key,
+                    nonce,
+                    sessionCookie,
+                };
+            }
+            catch (e) {
+                const message = 'Error connecting to FlexPLM: ' + e.message;
+                await logFlexPLMError(message, response, urlPath);
+                throw new Error(message);
+            }
+        });
+        // Thrown outside the span so the expected rejection is not recorded as a span error.
+        if ('sessionRejected' in result)
             throw new SessionRejectedError();
-        }
-        // Added for Session reuse - ET-390 - Ends
-        if (response.status >= 300) {
-            const message = 'Error connecting to FlexPLM:status: ' + response.status;
-            console.error(message);
-            console.error(await response.text());
-            const e = new Error(message);
-            e['httpResponseStatus'] = response.status;
-            throw e;
-        }
-        // Added for Session reuse - ET-390 - Starts
-        // If the cookie we sent was invalid, Windchill answers with a fresh Set-Cookie --> replace the cache.
-        let sessionCookie = sentCookie;
-        if (this.sessionOptions.enabled) {
-            sessionCookie = this.extractSessionCookie(response) ?? sentCookie;
-            if (sessionCookie)
-                this.storeSession(sessionCookie);
-        }
-        // Added for Session reuse - ET-390 - Ends
-        try {
-            const body = await response.json();
-            const nonce_key = body.items[0].attributes.nonce_key;
-            const nonce = body.items[0].attributes.nonce;
-            // ET-390 - adding sessionCookie to the return
-            return {
-                nonce_key,
-                nonce,
-                sessionCookie,
-            };
-        }
-        catch (e) {
-            const message = 'Error connecting to FlexPLM: ' + e.message;
-            console.error(message);
-            console.error(await response.text());
-            throw new Error(message);
-        }
+        return result;
     }
     async sendRequest(csrf, payload) {
         if (this.payloadSendAsArray && !Array.isArray(payload)) {
@@ -325,63 +369,73 @@ class FlexPLMConnect {
         return eventResponse;
     }
     async processRequest(payload) {
-        if (!payload) {
-            const message = 'No payload to send to FlexPLM';
-            console.error(message);
-            throw new Error(message);
-        }
-        if (app_framework_1.Logger.isInfoOn()) {
-            console.info('payload: ' + JSON.stringify(payload));
-        }
-        let csrf = await this.getCSRF();
-        if (!csrf) {
-            const message = 'Failed to get CSRF nonce';
-            console.error(message);
-            throw new Error(message);
-        }
-        /// Added for Session reuse - ET-390 - Starts
-        // const response = await this.sendRequest(csrf, payload);
-        let response = await this.sendRequest(csrf, payload);
-        if (csrf.sessionCookie && this.sessionOptions.retryStatuses.includes(response.status)) {
-            console.warn('FlexPLM rejected session/nonce (status ' + response.status + '). Getting a new session and retrying once.');
-            await this.discardBody(response);
-            csrf = await this.getCSRF(true, csrf.sessionCookie);
-            response = await this.sendRequest(csrf, payload);
-        }
-        // Added for Session reuse - ET-390 - Ends
-        const status = response.status;
-        if (status >= 300) {
-            const message = 'Error sending data to FlexPLM:status: ' + response.status;
-            console.error(message);
-            console.error(await response.text());
-            const e = new Error(message);
-            e['httpResponseStatus'] = status;
-            throw e;
-        }
-        try {
-            const res = {
-                status,
-            };
-            if (![204, 205].includes(status)) {
-                try {
-                    const data = await response.json();
-                    res.data = data;
-                }
-                catch (e) {
-                    console.error('Error getting response body. Setting {} body: ' + e);
-                    res.data = {};
+        const urlPath = toUrlPath(this.config.urlContext + '/servlet/rest' + this.vibeEventEndpoint);
+        return (0, telemetry_1.traceSection)('send_to_flexplm', {
+            [telemetry_attributes_1.ATTR_FLEXPLM_REQUEST_KIND]: 'send',
+            [telemetry_attributes_1.ATTR_HTTP_REQUEST_METHOD]: 'POST',
+            [telemetry_attributes_1.ATTR_URL_PATH]: urlPath,
+            [telemetry_attributes_1.ATTR_FLEXPLM_PAYLOAD_COUNT]: Array.isArray(payload) ? payload.length : (payload ? 1 : 0),
+            [telemetry_attributes_1.ATTR_FLEXPLM_REQUEST_RETRIED]: false,
+        }, async (span) => {
+            if (!payload) {
+                const message = 'No payload to send to FlexPLM';
+                console.error(message);
+                throw new Error(message);
+            }
+            if (app_framework_1.Logger.isInfoOn()) {
+                console.info('payload: ' + JSON.stringify(payload));
+            }
+            let csrf = await this.getCSRF();
+            if (!csrf) {
+                const message = 'Failed to get CSRF nonce';
+                console.error(message);
+                throw new Error(message);
+            }
+            /// Added for Session reuse - ET-390 - Starts
+            // const response = await this.sendRequest(csrf, payload);
+            let response = await this.sendRequest(csrf, payload);
+            if (csrf.sessionCookie && this.sessionOptions.retryStatuses.includes(response.status)) {
+                console.warn('FlexPLM rejected session/nonce (status ' + response.status + '). Getting a new session and retrying once.');
+                span.setAttribute(telemetry_attributes_1.ATTR_FLEXPLM_REQUEST_RETRIED, true);
+                await this.discardBody(response);
+                csrf = await this.getCSRF(true, csrf.sessionCookie);
+                response = await this.sendRequest(csrf, payload);
+            }
+            // Added for Session reuse - ET-390 - Ends
+            const status = response.status;
+            span.setAttribute(telemetry_attributes_1.ATTR_HTTP_RESPONSE_STATUS_CODE, status);
+            if (status >= 300) {
+                // traceSection records the thrown error and sets the span status to ERROR.
+                const message = 'Error sending data to FlexPLM:status: ' + response.status;
+                await logFlexPLMError(message, response, urlPath);
+                const e = new Error(message);
+                e['httpResponseStatus'] = status;
+                throw e;
+            }
+            try {
+                const res = {
+                    status,
+                };
+                if (![204, 205].includes(status)) {
+                    try {
+                        const data = await response.json();
+                        res.data = data;
+                    }
+                    catch (e) {
+                        console.error('Error getting response body. Setting {} body: ' + e);
+                        res.data = {};
+                    }
                 }
+                console.log('eventResponse.status: ' + status);
+                // console.log('eventBody: ', JSON.stringify(data));
+                return res;
             }
-            console.log('eventResponse.status: ' + status);
-            // console.log('eventBody: ', JSON.stringify(data));
-            return res;
-        }
-        catch (e) {
-            const message = 'Error getting json data from FlexPLM: ' + e.message;
-            console.error(message);
-            console.error(await response.text());
-            throw new Error(message);
-        }
+            catch (e) {
+                const message = 'Error getting json data from FlexPLM: ' + e.message;
+                await logFlexPLMError(message, response, urlPath);
+                throw new Error(message);
+            }
+        });
     }
     async sendToFlexPLM(payload) {
         return await this.processRequest(payload);
@@ -401,54 +455,65 @@ class FlexPLMConnect {
         const urlContext = includeUrlContext ? this.config.urlContext : '';
         const path = urlPath || ('/servlet/rest' + this.vibeEventEndpoint);
         const vibeEventsURL = this.config.apiHost + urlContext + path;
-        // Added for Session reuse - ET-390 - Starts
-        const attempt = async () => {
-            if (!this.sessionOptions.enabled) {
-                return { response: await fetch(vibeEventsURL, this.getRequestOptions('GET')), sent: undefined };
-            }
-            for (let wait = this.waitForInFlightAcquisition(); wait; wait = this.waitForInFlightAcquisition())
-                await wait;
-            const sent = this.getCachedSession();
-            const call = async () => {
-                const res = await fetch(vibeEventsURL, this.getRequestOptions('GET', sent));
-                // A rejected cookie must not be stored again; only keep a cookie that was accepted or newly issued.
-                if (!(sent && this.sessionOptions.retryStatuses.includes(res.status))) {
-                    const cookie = this.extractSessionCookie(res) ?? sent;
-                    if (cookie)
-                        this.storeSession(cookie);
+        const spanUrlPath = toUrlPath(urlContext + path);
+        return (0, telemetry_1.traceSection)('get_from_flexplm', {
+            [telemetry_attributes_1.ATTR_FLEXPLM_REQUEST_KIND]: 'get',
+            [telemetry_attributes_1.ATTR_HTTP_REQUEST_METHOD]: 'GET',
+            [telemetry_attributes_1.ATTR_URL_PATH]: spanUrlPath,
+            [telemetry_attributes_1.ATTR_FLEXPLM_REQUEST_RETRIED]: false,
+        }, async (span) => {
+            // Added for Session reuse - ET-390 - Starts
+            const attempt = async () => {
+                if (!this.sessionOptions.enabled) {
+                    span.setAttribute(telemetry_attributes_1.ATTR_FLEXPLM_SESSION_SOURCE, 'disabled');
+                    return { response: await fetch(vibeEventsURL, this.getRequestOptions('GET')), sent: undefined };
                 }
-                return { response: res, sent };
+                this.recordWaitForInFlightAcquisition();
+                for (let wait = this.waitForInFlightAcquisition(); wait; wait = this.waitForInFlightAcquisition())
+                    await wait;
+                const sent = this.getCachedSession();
+                span.setAttribute(telemetry_attributes_1.ATTR_FLEXPLM_SESSION_SOURCE, sent ? 'cached' : 'new');
+                const call = async () => {
+                    const res = await fetch(vibeEventsURL, this.getRequestOptions('GET', sent));
+                    // A rejected cookie must not be stored again; only keep a cookie that was accepted or newly issued.
+                    if (!(sent && this.sessionOptions.retryStatuses.includes(res.status))) {
+                        const cookie = this.extractSessionCookie(res) ?? sent;
+                        if (cookie)
+                            this.storeSession(cookie);
+                    }
+                    return { response: res, sent };
+                };
+                return sent ? call() : this.runColdAcquisition(call);
             };
-            return sent ? call() : this.runColdAcquisition(call);
-        };
-        const first = await attempt();
-        let response = first.response;
-        if (first.sent && this.sessionOptions.retryStatuses.includes(response.status)) {
-            await this.discardBody(response);
-            if (this.getCachedSession() === first.sent)
-                this.clearSession();
-            response = (await attempt()).response;
-        }
-        // Added for Session reuse - ET-390 - Ends
-        if (response.status >= 300) {
-            const message = 'Error connecting to FlexPLM:status: ' + response.status;
-            console.error(message);
-            console.error(await response.text());
-            throw new Error(message);
-        }
-        if (returnFullResponse) {
-            return response;
-        }
-        try {
-            const data = await response.json();
-            return data;
-        }
-        catch (e) {
-            const message = 'Error getting json data from FlexPLM: ' + e.message;
-            console.error(message);
-            console.error(await response.text());
-            throw new Error(message);
-        }
+            const first = await attempt();
+            let response = first.response;
+            if (first.sent && this.sessionOptions.retryStatuses.includes(response.status)) {
+                span.setAttribute(telemetry_attributes_1.ATTR_FLEXPLM_REQUEST_RETRIED, true);
+                await this.discardBody(response);
+                if (this.getCachedSession() === first.sent)
+                    this.clearSession();
+                response = (await attempt()).response;
+            }
+            // Added for Session reuse - ET-390 - Ends
+            span.setAttribute(telemetry_attributes_1.ATTR_HTTP_RESPONSE_STATUS_CODE, response.status);
+            if (response.status >= 300) {
+                const message = 'Error connecting to FlexPLM:status: ' + response.status;
+                await logFlexPLMError(message, response, spanUrlPath);
+                throw new Error(message);
+            }
+            if (returnFullResponse) {
+                return response;
+            }
+            try {
+                const data = await response.json();
+                return data;
+            }
+            catch (e) {
+                const message = 'Error getting json data from FlexPLM: ' + e.message;
+                await logFlexPLMError(message, response, spanUrlPath);
+                throw new Error(message);
+            }
+        });
     }
 }
 exports.FlexPLMConnect = FlexPLMConnect;

package/lib/util/flexplm-connect.telemetry.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/util/flexplm-connect.telemetry.spec.js

@@ -0,0 +1,212 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const api_1 = require("@opentelemetry/api");
+const telemetry_1 = require("@contrail/telemetry");
+const flexplm_connect_1 = require("./flexplm-connect");
+const telemetry_test_utils_1 = require("../__tests__/telemetry-test-utils");
+const telemetry_attributes_1 = require("./telemetry-attributes");
+// Same mocks as flexplm-connect.spec.ts
+const csrfBody = { items: [{ attributes: { nonce_key: 'CSRF_NONCE', nonce: 'secret-nonce-value' } }] };
+const resp = (status, setCookie = [], json = csrfBody) => ({
+    status,
+    json: jest.fn().mockResolvedValue(json),
+    text: jest.fn().mockResolvedValue('error text'),
+    headers: { getSetCookie: () => setCookie, get: () => null },
+});
+const createConfig = (overrides) => ({
+    apiHost: 'https://flexplm.example.com',
+    urlContext: '/FlexPLM',
+    vibeEventEndpoint: '/api/events',
+    csrfEndpoint: '/csrf',
+    plmEnviornment: 'test',
+    userName: () => 'user',
+    password: () => 'super-secret-password',
+    itemPreDevelopmentLifecycleStages: [],
+    payloadDefaultAsArray: true,
+    useDistinctRestEndPointForImages: false,
+    ...overrides,
+});
+// The session cache is module level, so each test uses its own user to start cold.
+let userCounter = 0;
+const sessionConfig = () => {
+    const user = 'telemetry-user-' + (++userCounter);
+    return createConfig({ userName: () => user, flexplmConnect: { sessionReuse: { enabled: true } } });
+};
+const fetchMock = () => global.fetch;
+const payload = { eventType: 'PERSIST', objectClass: 'LCSProduct', data: {} };
+const allRecordedValues = (spans) => spans.flatMap(span => [
+    ...Object.values(span.attributes).map(String),
+    ...span.events.flatMap(event => [event.name, ...Object.values(event.attributes || {}).map(String)]),
+]);
+describe('FlexPLMConnect telemetry', () => {
+    let exporter;
+    const globalFetch = global.fetch;
+    beforeAll(() => {
+        exporter = (0, telemetry_test_utils_1.registerInMemoryTracing)();
+    });
+    beforeEach(() => {
+        exporter.reset();
+        global.fetch = jest.fn();
+    });
+    afterEach(() => {
+        jest.restoreAllMocks();
+    });
+    afterAll(() => {
+        global.fetch = globalFetch;
+    });
+    it('should record a send_to_flexplm span with http.response.status_code 200', async () => {
+        fetchMock()
+            .mockResolvedValueOnce(resp(200))
+            .mockResolvedValueOnce(resp(200, [], { ok: true }));
+        await new flexplm_connect_1.FlexPLMConnect(createConfig()).sendToFlexPLM(payload);
+        const send = (0, telemetry_test_utils_1.findSpan)(exporter, 'send_to_flexplm');
+        expect(send.attributes).toEqual(expect.objectContaining({
+            [telemetry_attributes_1.ATTR_FLEXPLM_REQUEST_KIND]: 'send',
+            [telemetry_attributes_1.ATTR_HTTP_REQUEST_METHOD]: 'POST',
+            [telemetry_attributes_1.ATTR_URL_PATH]: '/FlexPLM/servlet/rest/api/events',
+            [telemetry_attributes_1.ATTR_FLEXPLM_PAYLOAD_COUNT]: 1,
+            [telemetry_attributes_1.ATTR_FLEXPLM_REQUEST_RETRIED]: false,
+            [telemetry_attributes_1.ATTR_HTTP_RESPONSE_STATUS_CODE]: 200,
+        }));
+        expect(send.status.code).not.toBe(api_1.SpanStatusCode.ERROR);
+        const csrf = (0, telemetry_test_utils_1.findSpan)(exporter, 'fetch_flexplm_csrf');
+        expect(csrf.attributes).toEqual(expect.objectContaining({
+            [telemetry_attributes_1.ATTR_FLEXPLM_REQUEST_KIND]: 'csrf',
+            [telemetry_attributes_1.ATTR_HTTP_REQUEST_METHOD]: 'GET',
+            [telemetry_attributes_1.ATTR_URL_PATH]: '/FlexPLM/csrf',
+            [telemetry_attributes_1.ATTR_HTTP_RESPONSE_STATUS_CODE]: 200,
+        }));
+        expect((0, telemetry_test_utils_1.isChildOf)(csrf, send)).toBe(true);
+    });
+    it('should set retried true when the cached session is rejected', async () => {
+        fetchMock()
+            .mockResolvedValueOnce(resp(200, ['JSESSIONID=first; Path=/']))
+            .mockResolvedValueOnce(resp(403))
+            .mockResolvedValueOnce(resp(200, ['JSESSIONID=second; Path=/']))
+            .mockResolvedValueOnce(resp(200, [], { ok: true }));
+        await new flexplm_connect_1.FlexPLMConnect(sessionConfig()).sendToFlexPLM(payload);
+        const send = (0, telemetry_test_utils_1.findSpan)(exporter, 'send_to_flexplm');
+        expect(send.attributes[telemetry_attributes_1.ATTR_FLEXPLM_REQUEST_RETRIED]).toBe(true);
+        expect(send.attributes[telemetry_attributes_1.ATTR_HTTP_RESPONSE_STATUS_CODE]).toBe(200);
+        expect(send.status.code).not.toBe(api_1.SpanStatusCode.ERROR);
+    });
+    it('should record a rejected cached session on the csrf call as an event, not an error', async () => {
+        const config = sessionConfig();
+        // Warm the cache with a cookie.
+        fetchMock()
+            .mockResolvedValueOnce(resp(200, ['JSESSIONID=cached; Path=/']))
+            .mockResolvedValueOnce(resp(200, [], { ok: true }));
+        await new flexplm_connect_1.FlexPLMConnect(config).sendToFlexPLM(payload);
+        exporter.reset();
+        fetchMock()
+            .mockResolvedValueOnce(resp(401))
+            .mockResolvedValueOnce(resp(200, ['JSESSIONID=fresh; Path=/']))
+            .mockResolvedValueOnce(resp(200, [], { ok: true }));
+        await new flexplm_connect_1.FlexPLMConnect(config).sendToFlexPLM(payload);
+        const [rejected, fresh] = (0, telemetry_test_utils_1.findSpans)(exporter, 'fetch_flexplm_csrf');
+        expect(rejected.events.map(event => event.name)).toEqual(['flexplm_session_rejected']);
+        expect(rejected.status.code).not.toBe(api_1.SpanStatusCode.ERROR);
+        expect(rejected.attributes[telemetry_attributes_1.ATTR_HTTP_RESPONSE_STATUS_CODE]).toBe(401);
+        expect(fresh.events).toEqual([]);
+        expect(fresh.attributes[telemetry_attributes_1.ATTR_HTTP_RESPONSE_STATUS_CODE]).toBe(200);
+        expect((0, telemetry_test_utils_1.findSpan)(exporter, 'send_to_flexplm').status.code).not.toBe(api_1.SpanStatusCode.ERROR);
+    });
+    it('should set the span status to ERROR when FlexPLM returns 500', async () => {
+        const errorLog = jest.spyOn(telemetry_1.logger, 'error').mockImplementation(() => undefined);
+        fetchMock()
+            .mockResolvedValueOnce(resp(200))
+            .mockResolvedValueOnce(resp(500));
+        await expect(new flexplm_connect_1.FlexPLMConnect(createConfig()).sendToFlexPLM(payload))
+            .rejects.toThrow('Error sending data to FlexPLM:status: 500');
+        const send = (0, telemetry_test_utils_1.findSpan)(exporter, 'send_to_flexplm');
+        expect(send.status.code).toBe(api_1.SpanStatusCode.ERROR);
+        expect(send.attributes[telemetry_attributes_1.ATTR_HTTP_RESPONSE_STATUS_CODE]).toBe(500);
+        expect(send.events.map(event => event.name)).toContain('exception');
+        expect(errorLog).toHaveBeenCalledWith({ flexplm: { status: 500, url_path: '/FlexPLM/servlet/rest/api/events', response_body: 'error text' } }, 'Error sending data to FlexPLM:status: 500');
+    });
+    it('should truncate the logged response body', async () => {
+        const errorLog = jest.spyOn(telemetry_1.logger, 'error').mockImplementation(() => undefined);
+        const failed = resp(500);
+        failed.text.mockResolvedValue('x'.repeat(5000));
+        fetchMock()
+            .mockResolvedValueOnce(resp(200))
+            .mockResolvedValueOnce(failed);
+        await expect(new flexplm_connect_1.FlexPLMConnect(createConfig()).sendToFlexPLM(payload)).rejects.toThrow();
+        const logged = errorLog.mock.calls[0][0].flexplm.response_body;
+        expect(logged.length).toBeLessThan(2100);
+        expect(logged.endsWith('...(truncated)')).toBe(true);
+    });
+    it('should record only the path of a getRequest, without the host or query string', async () => {
+        fetchMock().mockResolvedValueOnce(resp(200, [], { ok: true }));
+        await new flexplm_connect_1.FlexPLMConnect(createConfig()).getRequest({ urlPath: '/servlet/rest/rfa/vibeiq/image?path=%2Fsecret%2Ffile.png' });
+        const get = (0, telemetry_test_utils_1.findSpan)(exporter, 'get_from_flexplm');
+        expect(get.attributes).toEqual(expect.objectContaining({
+            [telemetry_attributes_1.ATTR_FLEXPLM_REQUEST_KIND]: 'get',
+            [telemetry_attributes_1.ATTR_URL_PATH]: '/FlexPLM/servlet/rest/rfa/vibeiq/image',
+            [telemetry_attributes_1.ATTR_HTTP_RESPONSE_STATUS_CODE]: 200,
+            [telemetry_attributes_1.ATTR_FLEXPLM_REQUEST_RETRIED]: false,
+        }));
+    });
+    it('should record the session source: disabled, then new, then cached', async () => {
+        fetchMock().mockResolvedValueOnce(resp(200)).mockResolvedValueOnce(resp(200, [], { ok: true }));
+        await new flexplm_connect_1.FlexPLMConnect(createConfig()).sendToFlexPLM(payload);
+        expect((0, telemetry_test_utils_1.findSpan)(exporter, 'send_to_flexplm').attributes[telemetry_attributes_1.ATTR_FLEXPLM_SESSION_SOURCE]).toBe('disabled');
+        const config = sessionConfig();
+        for (let i = 0; i < 2; i++) {
+            fetchMock().mockResolvedValueOnce(resp(200, ['JSESSIONID=reused; Path=/'])).mockResolvedValueOnce(resp(200, [], { ok: true }));
+        }
+        exporter.reset();
+        await new flexplm_connect_1.FlexPLMConnect(config).sendToFlexPLM(payload);
+        await new flexplm_connect_1.FlexPLMConnect(config).sendToFlexPLM(payload);
+        const [first, second] = (0, telemetry_test_utils_1.findSpans)(exporter, 'send_to_flexplm');
+        expect(first.attributes[telemetry_attributes_1.ATTR_FLEXPLM_SESSION_SOURCE]).toBe('new');
+        expect(second.attributes[telemetry_attributes_1.ATTR_FLEXPLM_SESSION_SOURCE]).toBe('cached');
+        expect(first.attributes[telemetry_attributes_1.ATTR_FLEXPLM_SESSION_WAITED]).toBeUndefined();
+    });
+    it('should record session.source new after a rejected cached session is replaced', async () => {
+        const config = sessionConfig();
+        fetchMock().mockResolvedValueOnce(resp(200, ['JSESSIONID=cached; Path=/'])).mockResolvedValueOnce(resp(200, [], { ok: true }));
+        await new flexplm_connect_1.FlexPLMConnect(config).sendToFlexPLM(payload);
+        exporter.reset();
+        fetchMock()
+            .mockResolvedValueOnce(resp(401))
+            .mockResolvedValueOnce(resp(200, ['JSESSIONID=fresh; Path=/']))
+            .mockResolvedValueOnce(resp(200, [], { ok: true }));
+        await new flexplm_connect_1.FlexPLMConnect(config).sendToFlexPLM(payload);
+        expect((0, telemetry_test_utils_1.findSpan)(exporter, 'send_to_flexplm').attributes[telemetry_attributes_1.ATTR_FLEXPLM_SESSION_SOURCE]).toBe('new');
+    });
+    it('should record session.waited when a request waits for another request\'s session acquisition', async () => {
+        const config = sessionConfig();
+        let release;
+        const gate = new Promise(r => { release = r; });
+        fetchMock().mockImplementation(async (_url, opts) => {
+            if (opts.method === 'GET' && !opts.headers.Cookie) {
+                await gate;
+                return resp(200, ['JSESSIONID=shared; Path=/']);
+            }
+            return opts.method === 'GET' ? resp(200) : resp(200, [], { ok: true });
+        });
+        const all = Promise.all([1, 2].map(() => new flexplm_connect_1.FlexPLMConnect(config).sendToFlexPLM(payload)));
+        await new Promise(r => setImmediate(r));
+        release();
+        await all;
+        const spans = (0, telemetry_test_utils_1.findSpans)(exporter, 'send_to_flexplm');
+        expect(spans.map(span => span.attributes[telemetry_attributes_1.ATTR_FLEXPLM_SESSION_WAITED]).sort()).toEqual([true, undefined]);
+        expect(spans.map(span => span.attributes[telemetry_attributes_1.ATTR_FLEXPLM_SESSION_SOURCE]).sort()).toEqual(['cached', 'new']);
+    });
+    it('should not record Authorization, Cookie or nonce values on any span', async () => {
+        fetchMock()
+            .mockResolvedValueOnce(resp(200, ['JSESSIONID=cookie-value-1; Path=/']))
+            .mockResolvedValueOnce(resp(403))
+            .mockResolvedValueOnce(resp(200, ['JSESSIONID=cookie-value-2; Path=/']))
+            .mockResolvedValueOnce(resp(200, [], { ok: true }));
+        await new flexplm_connect_1.FlexPLMConnect(sessionConfig()).sendToFlexPLM(payload);
+        const spans = exporter.getFinishedSpans();
+        expect(spans.length).toBeGreaterThan(0);
+        const recorded = allRecordedValues(spans).join('\n');
+        const authorization = Buffer.from('telemetry-user-' + userCounter + ':super-secret-password').toString('base64');
+        for (const secret of ['super-secret-password', authorization, 'cookie-value-1', 'cookie-value-2', 'secret-nonce-value', 'CSRF_NONCE', 'flexplm.example.com']) {
+            expect(recorded).not.toContain(secret);
+        }
+    });
+});

package/lib/util/logger-config.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.setLoggerConfig = void 0;
+exports.setLoggerConfig = setLoggerConfig;
 const app_framework_1 = require("@contrail/app-framework");
 async function setLoggerConfig(appConfig) {
     let logLevel = app_framework_1.LogLevel.INFO;
@@ -24,4 +24,3 @@ async function setLoggerConfig(appConfig) {
     }
     app_framework_1.Logger.setConfig({ logLevel: logLevel });
 }
-exports.setLoggerConfig = setLoggerConfig;