meadow 2.0.45 → 2.0.46

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "meadow",
-  "version": "2.0.45",
+  "version": "2.0.46",
   "description": "A data access library.",
   "main": "source/Meadow.js",
   "scripts": {
@@ -87,7 +87,7 @@
   "devDependencies": {
     "alasql": "^4.17.0",
     "dgraph-js-http": "^21.3.0",
-    "fable": "^3.1.77",
+    "fable": "^3.1.78",
     "gulp-util": "^3.0.8",
     "meadow-connection-dgraph": "^1.0.3",
     "meadow-connection-mongodb": "^1.0.3",

package/source/providers/Meadow-Provider-MeadowEndpoints.js

@@ -97,7 +97,28 @@ var MeadowProvider = function()
 				timeout: tmpRequestTimeout
 			});
 
-			tmpRequestOptions.headers.cookie = tmpCookies.join(';');
+			// Per-request session override: when an operation carries a caller
+			// session (a forwarded identity — e.g. a databeacon proxying a
+			// user's request, or a cron run impersonating a RunAs user), present
+			// THAT session upstream instead of the connection's bound machine
+			// session, so the remote enforces row-level auth as the real caller.
+			// The override rides the per-operation query (concurrency-safe — it
+			// never touches the connection's shared cookie state). Absent or a
+			// default placeholder session falls back to the bound cookies.
+			let tmpSessionOverride = (pQuery && pQuery.query && pQuery.query.parameters)
+				? pQuery.query.parameters.MeadowEndpointsSessionOverride : null;
+			if (tmpSessionOverride && typeof(tmpSessionOverride.SessionID) === 'string'
+				&& tmpSessionOverride.SessionID.length > 0 && tmpSessionOverride.SessionID !== '0x0000')
+			{
+				let tmpCookieName = (tmpEndpointSettings.Authentication && tmpEndpointSettings.Authentication.CookieName)
+					? tmpEndpointSettings.Authentication.CookieName
+					: (tmpEndpointSettings.SessionCookieName || 'UserSession');
+				tmpRequestOptions.headers.cookie = `${tmpCookieName}=${tmpSessionOverride.SessionID}`;
+			}
+			else
+			{
+				tmpRequestOptions.headers.cookie = tmpCookies.join(';');
+			}
 
 
 			if (pQuery.logLevel > 0 ||

package/test/Meadow-Provider-MeadowEndpoints-Session_tests.js

@@ -122,6 +122,52 @@ suite('MeadowEndpoints provider instance-driven configuration', function ()
 	});
 });
 
+function readAnimalsWithSession(pDAL, pSessionOverride)
+{
+	return new Promise((fResolve) =>
+	{
+		let tmpQuery = pDAL.query.clone().setCap(1);
+		tmpQuery.query.parameters.MeadowEndpointsSessionOverride = pSessionOverride;
+		pDAL.doReads(tmpQuery, (pError, pQuery, pRecords) => fResolve({ Error: pError, Records: pRecords }));
+	});
+}
+
+suite('MeadowEndpoints provider per-request session override', function ()
+{
+	suiteSetup(async function () { await startStubAPI(); });
+	suiteTeardown(function () { if (_Server) { _Server.close(); } });
+	setup(function () { _LastRequest = null; });
+
+	test('a forwarded caller session is presented upstream INSTEAD of the bound machine session', async function ()
+	{
+		const tmpInstance = { settings: serverSettings(), headers: {}, cookies: [ 'UserSession=machine-bound' ] };
+		await readAnimalsWithSession(buildDAL(tmpInstance), { SessionID: 'caller-session-xyz' });
+		Expect(_LastRequest.Cookie).to.equal('UserSession=caller-session-xyz', 'the per-request caller session wins; the bound machine session is not sent');
+	});
+
+	test('the upstream cookie name follows the connection Authentication.CookieName', async function ()
+	{
+		const tmpSettings = Object.assign(serverSettings(), { Authentication: { CookieName: 'SessionID' } });
+		const tmpInstance = { settings: tmpSettings, headers: {}, cookies: [ 'SessionID=machine-bound' ] };
+		await readAnimalsWithSession(buildDAL(tmpInstance), { SessionID: 'caller-abc' });
+		Expect(_LastRequest.Cookie).to.equal('SessionID=caller-abc');
+	});
+
+	test('a default placeholder session (0x0000) falls back to the bound connection session', async function ()
+	{
+		const tmpInstance = { settings: serverSettings(), headers: {}, cookies: [ 'UserSession=machine-bound' ] };
+		await readAnimalsWithSession(buildDAL(tmpInstance), { SessionID: '0x0000' });
+		Expect(_LastRequest.Cookie).to.equal('UserSession=machine-bound', 'an anonymous/placeholder session is not a real identity — use the machine session');
+	});
+
+	test('no override present → bound connection session (backward compatible)', async function ()
+	{
+		const tmpInstance = { settings: serverSettings(), headers: {}, cookies: [ 'UserSession=machine-bound' ] };
+		await readAnimals(buildDAL(tmpInstance));
+		Expect(_LastRequest.Cookie).to.equal('UserSession=machine-bound');
+	});
+});
+
 suite('MeadowEndpoints provider request timeout', function ()
 {
 	suiteSetup(async function () { await startStubAPI(); });