kittimzhe opened a new pull request, #18703: URL: https://github.com/apache/dolphinscheduler/pull/18703
## Was this PR generated or assisted by AI? YES — issue triage, root-cause analysis, fix and tests were developed with AI assistance (mechanism verified against the code and pinned by red→green tests below). ## Purpose of the pull request Fixes #18699. `SessionServiceImpl#createSessionIfAbsent` reused an **expired** session (refreshing its last-login time) and **deleted a still-valid** one — the exact opposite of the method's contract. A second successful login invalidated the user's live session, while a timed-out session ID was kept alive. ## Brief change log - Invert the branch in `createSessionIfAbsent`: reuse the existing session when `!isSessionExpire(session)`, delete-and-recreate when it has expired. **Regression origin** (answering the question in the issue): commit 12f813816 (#15219, "Expire session when update user password") rewrote the old `createSession` into `createSessionIfAbsent` and flipped the polarity along the way — the pre-refactor code reused the session when `now - lastLoginTime <= SESSION_TIME_OUT` (i.e. *not* expired). So this is a regression introduced in #15219, not an intentional login policy. ## Verify this pull request This change added tests and can be verified as follows: - `SessionServiceTest#testCreateSessionIfAbsentReusesUnexpiredSession` — an unexpired session is returned as-is (`updateById` called; no `deleteById`/`insert`). Fails on the pre-fix code (expected the old session id but got a freshly generated UUID). - `SessionServiceTest#testCreateSessionIfAbsentReplacesExpiredSession` — a session 40 days past its last login is deleted and a new one inserted. Fails on the pre-fix code (the expired id was returned). - Full `SessionServiceTest`: 6/6 green with the fix (JDK 8, `mvn test -pl dolphinscheduler-api -Dtest=SessionServiceTest`). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
