kittimzhe commented on issue #18699:
URL:
https://github.com/apache/dolphinscheduler/issues/18699#issuecomment-6159613274
Confirmed — the condition is inverted exactly as you suspected, on both
3.4.3 and dev. In `SessionServiceImpl#createSessionIfAbsent`
(dolphinscheduler-api/.../SessionServiceImpl.java:74-80):
```java
session = sessionList.get(0);
if (isSessionExpire(session)) { // true == the session IS expired
session.setLastLoginTime(new Date());
sessionDao.updateById(session); // ...yet it is refreshed and
reused
return session;
} else {
sessionDao.deleteById(session.getId()); // an unexpired session is
deleted
}
```
and `isSessionExpire` (:99-102) is `elapsed >= sessionTimeout` — so true
means expired. Net effect, as you describe: a second successful login **deletes
the user's live session** and mints a new one, while a **timed-out session gets
refreshed and reused** — the exact opposite of the method's contract ("create
session *if absent*": a valid session should be reused, an expired one
replaced).
Claiming this — the fix is the branch inversion (reuse when
`!isSessionExpire`, delete-and-recreate when expired), plus a test pinning both
directions. I'll check the git history for when the inversion landed to answer
your regression-vs-intentional question in the PR.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
