[jwrosewell]

Problem

With session tracking on, usage sharing compares a request with those already shared using the values it would share and the session cookie (pipeline/fiftyone.pipeline.engines.fiftyone/shareUsage.js lines 263 to 276 at 0e89a400). Those values come from the Evidence and from the web request supplied as server.http-request (lines 289 to 313), as the specification asks. The only test of session tracking, in shareUsage.test.js, gives the session cookie as Evidence, so nothing showed that a cookie found only in the web request is read too.

What the specification says

From pipeline-specification/pipeline-elements/usage-sharing-element.md lines 90 to 99 at b6fae7fe, the text specifications#155 merged:

The element accepts no Evidence, so it does not accept the session cookie either. When the track session option is on, the element MUST read the cookie named by the session cookie name option from the same two places as the values it shares, being the Evidence in the Flow Data and the web request supplied as server.http-request (see Accepted Evidence), so that the session tracking can compare it. A cookie found in both places is read once, with the value from the Evidence. The session cookie MUST NOT be shared unless its name starts with 51D_, as no other cookie is.

What changed

Tests only, so no package is released for this.

Tests

The new pipeline/fiftyone.pipeline.engines.fiftyone/tests/shareUsageSessionFromRequest.test.js builds a Pipeline with usage sharing tracking sessions by the cookie sessionid, and processes three requests whose user agent is in the Evidence and whose session cookie is only in server.http-request, two in one session and one in another. The package size is larger than the number of requests, so nothing is sent and the queue shows what was shared. It checks that two records are queued, the repeat in the first session being left out and the same request in the new session shared, and that no record holds the cookie's value.

Run 43678509790 on fe491af, this head, with only a throwaway workflow added that runs the usage sharing package's tests. All 99 pass on Ubuntu and on Windows, lint passes on the package, and npm run tsc writes the committed types again with no difference but pipeline/fiftyone.pipeline.did/types/owid-js/v1.d.ts, which #127 decides.

The test passes on rc's code, so to show it fails when the web request is not read, run 43678515060 ran it on a throwaway branch where getFoundEvidence ignores server.http-request. On Ubuntu and on Windows 3 of 99 fail, being this test, where only 1 record was queued, and two existing tests of values found only in the web request.

Full build

Run 43679480793 on tmp/pr-matrix-145, started by tools/pr-matrix.py without macOS. All 7 Setting 'PullRequestSha' lines give this head, fe491af, and Configure printed "Left out 2 macOS entries". Each of the six Build and Test jobs, Ubuntu, Ubuntu ARM and Windows on Node.js 22 and 24, passed 1,604 unit tests with 2 skipped and 119 integration tests with 4 skipped.

macOS was left out of this draft's full build under the 9 November decision. The rc head is built with macOS before it merges into main.

What remains

Nothing for this requirement.