creating_release_version_3.6.5

Merge pull request #290 from NationalSecurityAgency/int_client_session
Fix integration client session and CSRF handling for login
2026-11-08 01:06:44 -10:00 · 2026-10-02 11:43:21 +00:00 · 2026-09-29 09:04:35 -04:00 · 2026-09-29 11:12:02 +00:00 · 2026-09-23 15:19:21 -04:00 · 2026-09-23 15:45:29 +00:00
27 changed files with 137 additions and 84 deletions
@@ -7,8 +7,11 @@ env:
  JAVA_VERSION: 25

 on:
-  schedule:
-    - cron: '0 8 * * *'
+  push:
+    paths-ignore:
+      - 'README.md'
+      - .github/workflows/skills-service-backward-compat.yml
+      - .github/workflows/client-libs-backward-compat.yml
  workflow_dispatch:

 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
@@ -12,11 +12,6 @@ on:
      - 'README.md'
      - .github/workflows/skills-service-backward-compat.yml
      - .github/workflows/client-libs-backward-compat.yml
-  pull_request:
-    paths-ignore:
-      - 'README.md'
-      - .github/workflows/skills-service-backward-compat.yml
-      - .github/workflows/client-libs-backward-compat.yml
  workflow_dispatch:

 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
@@ -12,11 +12,6 @@ on:
      - 'README.md'
      - .github/workflows/skills-service-backward-compat.yml
      - .github/workflows/client-libs-backward-compat.yml
-  pull_request:
-    paths-ignore:
-      - 'README.md'
-      - .github/workflows/skills-service-backward-compat.yml
-      - .github/workflows/client-libs-backward-compat.yml
  workflow_dispatch:

 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
@@ -10,11 +10,6 @@ on:
      - 'README.md'
      - .github/workflows/skills-service-backward-compat.yml
      - .github/workflows/client-libs-backward-compat.yml
-  pull_request:
-    paths-ignore:
-      - 'README.md'
-      - .github/workflows/skills-service-backward-compat.yml
-      - .github/workflows/client-libs-backward-compat.yml
  workflow_dispatch:

 jobs:
@@ -13,8 +13,6 @@ on:
  pull_request:
    paths-ignore:
      - 'README.md'
-  schedule:
-    - cron: '0 6 * * *'
  workflow_dispatch:

 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
@@ -85,7 +83,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        skillsJsVersion: [ '3.1.1', '3.2.0', '3.3.0', '3.3.1', '3.4.0', '3.4.1', '3.5.0']
+        skillsJsVersion: [ '3.5.0', '3.6.0', '3.6.1', '3.6.2', '3.6.3']

    services:
      postgres:
@@ -16,3 +16,5 @@
 /skills-client-ng/dist/
 /skills-client-ng/projects/skilltree/skills-client-ng/src/version.js
 /skills-client-integration/skills-int-e2e-test/cypress/downloads/*
+
+AGENTS.md
@@ -7,13 +7,13 @@
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
-        <version>3.5.16</version>
+        <version>4.1.1</version>
        <relativePath/> <!-- lookup parent from repository -->
    </parent>
    <groupId>skills</groupId>
    <artifactId>skills-client-integration</artifactId>
    <packaging>pom</packaging>
-    <version>3.6.3-SNAPSHOT</version>
+    <version>3.6.5-SNAPSHOT</version>

    <licenses>
        <license>
@@ -31,10 +31,6 @@
    <properties>
        <!--suppress UnresolvedMavenProperty -->
        <nexusServer>${nexus.url}</nexusServer>
-        <frontend-maven-plugin.version>1.10.3</frontend-maven-plugin.version>
-
-        <!--  TODO: Temporary override spring boot versions, remove once spring boot upgrades these versions -->
-        <commons-lang3.version>3.19.0</commons-lang3.version>
    </properties>

 </project>
@@ -1,6 +1,6 @@
 {
    "name": "skills-int-client-js",
-    "version": "3.6.3",
+    "version": "3.6.5",
    "license": "Apache-2.0",
    "description": "SkillTree Client Lib Integration Tests - Native JS",
    "main": "index.js",
@@ -16,13 +16,13 @@
    },
    "author": "SkillTree Team",
    "dependencies": {
-        "@skilltree/skills-client-js": "3.6.3",
-        "axios": "1.17.0",
+        "@skilltree/skills-client-js": "3.6.5",
+        "axios": "1.20.0",
        "bootstrap": "5.3.8",
        "jquery": "4.0.0"
    },
    "devDependencies": {
-        "fs-extra": "11.3.5",
+        "fs-extra": "11.4.0",
        "license-check-and-add": "4.0.5",
        "license-checker": "25.0.1",
        "live-server": "1.2.2"
@@ -7,7 +7,7 @@
    <parent>
        <groupId>skills</groupId>
        <artifactId>skills-client-integration</artifactId>
-        <version>3.6.3-SNAPSHOT</version>
+        <version>3.6.5-SNAPSHOT</version>
    </parent>
    <artifactId>skills-int-client-js</artifactId>

@@ -20,6 +20,8 @@ const homePage = '/native/index.html'

 context("Global Events Tests", () => {

+    const level1CompleteRegex = /"completed"\s*:\s*\[(?=[\s\S]*?\{[^{}]*?(?:"type"\s*:\s*"Overall"[^{}]*?"level"\s*:\s*1|"level"\s*:\s*1[^{}]*?"type"\s*:\s*"Overall")[^{}]*?\})[\s\S]*?\]/;
+
    it("global event show correct results", () => {
        cy.createDefaultProject();

@@ -34,7 +36,7 @@ context("Global Events Tests", () => {
        cy.get('pre[data-cy=globalEventResult]').contains('"skillId": "IronMan"')
        cy.get('pre[data-cy=globalEventResult]').contains('"pointsEarned": 50')
        cy.get('pre[data-cy=globalEventResult]').contains('"skillApplied": true')
-        cy.get('pre[data-cy=globalEventResult]').contains(/completed": [[][^]*"type": "Overall",[^]\s*"level": 1/)
+        cy.get('pre[data-cy=globalEventResult]').contains(level1CompleteRegex)
    });
    it("global event show correct results (skills reported directly to backend endpoint)", () => {
        cy.createDefaultProject();
@@ -46,7 +48,7 @@ context("Global Events Tests", () => {
        cy.get('pre[data-cy=globalEventResult]').contains('"skillId": "IronMan"')
        cy.get('pre[data-cy=globalEventResult]').contains('"pointsEarned": 50')
        cy.get('pre[data-cy=globalEventResult]').contains('"skillApplied": true')
-        cy.get('pre[data-cy=globalEventResult]').contains(/completed": [[][^]*"type": "Overall",[^]\s*"level": 1/)
+        cy.get('pre[data-cy=globalEventResult]').contains(level1CompleteRegex)
    });

    it('global event does not update when skill reported for a different project', () => {
@@ -18,6 +18,8 @@ const homePage = '/native/index.html'

 context("Token timeout JS Tests", () => {

+  const level1CompleteRegex = /"completed"\s*:\s*\[(?=[\s\S]*?\{[^{}]*?(?:"type"\s*:\s*"Overall"[^{}]*?"level"\s*:\s*1|"level"\s*:\s*1[^{}]*?"type"\s*:\s*"Overall")[^{}]*?\})[\s\S]*?\]/;
+
  if (Cypress.env('timeout') === true || Cypress.env('timeout') === 'true') {
    it("report skill with expired token, retry checker will resend with new token", () => {
      cy.createDefaultProject();
@@ -28,14 +30,17 @@ context("Token timeout JS Tests", () => {
      cy.wait(71000)  // wait 71 seconds to ensure the token has expired
      cy.get('[data-cy="exampleDirectiveClickEventButton"]').click();

-      cy.get('pre[data-cy=globalEventResult]').should('be.empty');
+      // should be empty string or empty JSON object
+      cy.get('pre[data-cy=globalEventResult]')
+        .invoke('text')
+        .should('match', /^\s*$|^\s*\{\s*\}\s*$/);

      cy.wait("@getToken", { timeout: 60000 }); // wait ~ another 50 seconds to all for the RetryChecker to resubmit

      cy.get('pre[data-cy=globalEventResult]').contains('"skillId": "IronMan"')
      cy.get('pre[data-cy=globalEventResult]').contains('"pointsEarned": 50')
      cy.get('pre[data-cy=globalEventResult]').contains('"skillApplied": true')
-      cy.get('pre[data-cy=globalEventResult]').contains(/completed": [[][^]*"type": "Overall",[^]\s*"level": 1/)
+      cy.get('pre[data-cy=globalEventResult]').contains(level1CompleteRegex)
    });

    it('skill display - navigate after token expires', () => {
@@ -52,8 +52,8 @@
    "license-check-and-add": "4.0.5",
    "license-checker": "25.0.1",
    "pdf-parse": "1.1.1",
-    "semver": "7.7.2",
-    "wait-on": "8.0.3",
+    "semver": "7.8.5",
+    "wait-on": "9.1.0",
    "wait-port": "1.1.0"
  }
 }
@@ -5,7 +5,7 @@
    <parent>
        <groupId>skills</groupId>
        <artifactId>skills-client-integration</artifactId>
-        <version>3.6.3-SNAPSHOT</version>
+        <version>3.6.5-SNAPSHOT</version>
    </parent>
    <artifactId>skills-int-e2e-test</artifactId>
    <description>End to End tests for Skills client libs using skills-int-service app</description>
@@ -14,7 +14,6 @@
 spring.datasource.username = postgres
 spring.datasource.url = jdbc:postgresql://localhost:5432/skills
 spring.datasource.password = skillsPassword
-spring.autoconfigure.exclude=org.springframework.boot.autoconfigure.web.servlet.error.ErrorMvcAutoConfiguration

 skills.config.ui.userCommunityUserTagKey=dragons
 skills.config.ui.userCommunityUserTagValue=DivineDragon
@@ -5,7 +5,7 @@
 	<parent>
 		<groupId>skills</groupId>
 		<artifactId>skills-client-integration</artifactId>
-		<version>3.6.3-SNAPSHOT</version>
+		<version>3.6.5-SNAPSHOT</version>
 	</parent>
 	<artifactId>skills-int-service</artifactId>
 	<description>SkillTree Client Lib Integration Tests</description>
@@ -23,6 +23,10 @@
 			<groupId>org.apache.httpcomponents.client5</groupId>
 			<artifactId>httpclient5</artifactId>
 		</dependency>
+		<dependency>
+			<groupId>org.springframework.boot</groupId>
+			<artifactId>spring-boot-starter-restclient</artifactId>
+		</dependency>
 	</dependencies>

 	<build>
@@ -15,10 +15,8 @@
 */
 package skills.example;

-import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.ObjectMapper;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.web.client.RestTemplateBuilder;
+import org.springframework.boot.restclient.RestTemplateBuilder;
 import org.springframework.http.*;
 import org.springframework.http.client.support.BasicAuthenticationInterceptor;
 import org.springframework.util.LinkedMultiValueMap;
@@ -27,6 +25,8 @@ import org.springframework.util.StringUtils;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.client.RestTemplate;
 import skills.example.SkillsExampleApplication.SkillsConfig;
+import tools.jackson.databind.JsonNode;
+import tools.jackson.databind.ObjectMapper;

 import java.util.ArrayList;
 import java.util.Arrays;
@@ -128,6 +128,9 @@ public class Controller {

    private void authIfNecessary() {
        if (!skillsConfig.getAuthMode().equalsIgnoreCase("pki")) {
+            // Seed the session and XSRF-TOKEN before /performLogin, which requires CSRF validation.
+            // SecurityRestTemplateCustomizer retains the cookies and sends X-XSRF-TOKEN on later requests.
+            restTemplate.getForEntity(skillsConfig.getServiceUrl() + "/app/userInfo", String.class);
            HttpHeaders headers = new HttpHeaders();
            headers.setContentType(MediaType.APPLICATION_FORM_URLENCODED);
            MultiValueMap<String, String> params = new LinkedMultiValueMap<>();
@@ -16,6 +16,8 @@
 package skills.example;

 import org.apache.hc.client5.http.classic.HttpClient;
+import org.apache.hc.client5.http.cookie.BasicCookieStore;
+import org.apache.hc.client5.http.cookie.Cookie;
 import org.apache.hc.client5.http.impl.classic.HttpClients;
 import org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManager;
 import org.apache.hc.client5.http.socket.ConnectionSocketFactory;
@@ -23,11 +25,9 @@ import org.apache.hc.client5.http.socket.PlainConnectionSocketFactory;
 import org.apache.hc.client5.http.ssl.NoopHostnameVerifier;
 import org.apache.hc.client5.http.ssl.SSLConnectionSocketFactory;
 import org.apache.hc.core5.http.config.RegistryBuilder;
-import org.apache.hc.core5.ssl.SSLContextBuilder;
 import org.apache.hc.core5.ssl.SSLContexts;
-import org.apache.hc.core5.ssl.TrustStrategy;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.web.client.RestTemplateCustomizer;
+import org.springframework.boot.restclient.RestTemplateCustomizer;
 import org.springframework.http.client.HttpComponentsClientHttpRequestFactory;
 import org.springframework.stereotype.Component;
 import org.springframework.web.client.RestTemplate;
@@ -47,12 +47,22 @@ public class SecurityRestTemplateCustomizer implements RestTemplateCustomizer {
        // not by default keeps track of session.  This method is called by the
        // RestTemplateBuilder used in the skills.example.Controller constructor
        HttpComponentsClientHttpRequestFactory clientHttpRequestFactory = new HttpComponentsClientHttpRequestFactory();
-        HttpClient client = getHttpClient();
+        BasicCookieStore cookieStore = new BasicCookieStore();
+        HttpClient client = getHttpClient(cookieStore);
        clientHttpRequestFactory.setHttpClient(client);
        restTemplate.setRequestFactory(clientHttpRequestFactory);
+        restTemplate.getInterceptors().add((request, body, execution) -> {
+            for (Cookie cookie : cookieStore.getCookies()) {
+                if ("XSRF-TOKEN".equals(cookie.getName())) {
+                    request.getHeaders().set("X-XSRF-TOKEN", cookie.getValue());
+                    break;
+                }
+            }
+            return execution.execute(request, body);
+        });
    }

-    private HttpClient getHttpClient() {
+    private HttpClient getHttpClient(BasicCookieStore cookieStore) {
        try {
            SSLContext sslContext = SSLContexts.createSystemDefault();
            HostnameVerifier allowAllHosts = new NoopHostnameVerifier();
@@ -69,6 +79,7 @@ public class SecurityRestTemplateCustomizer implements RestTemplateCustomizer {

            return HttpClients.custom()
                    .useSystemProperties()
+                    .setDefaultCookieStore(cookieStore)
                    .setConnectionManager(poolingHttpClientConnectionManager)
                    .build();
        } catch (Exception e) {
@@ -18,15 +18,18 @@ package skills.example.filters;
 import jakarta.servlet.*;
 import jakarta.servlet.http.HttpServletRequest;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.autoconfigure.security.SecurityProperties;
 import org.springframework.core.annotation.Order;
 import org.springframework.stereotype.Component;

 import java.io.IOException;

@Component
-@Order(SecurityProperties.DEFAULT_FILTER_ORDER-1)
+@Order(VueEntryPointFilter.BEFORE_SECURITY_FILTER_ORDER)
 public class VueEntryPointFilter implements Filter {
+
+    // -100 (Default Security Order) - 1
+    public static final int BEFORE_SECURITY_FILTER_ORDER = -101;
+
    @Autowired
    private VueEntryPointFilterUtils vueEntryPointFilterUtils;

@@ -1,6 +1,6 @@
 {
    "name": "@skilltree/skills-client-js",
-    "version": "3.6.3",
+    "version": "3.6.5",
    "license": "Apache-2.0",
    "description": "SkillTree Client Lib - Native JS Lib",
    "main": "dist/skills-client-js.umd.min.js",
@@ -21,7 +21,7 @@
        "buildSkipTests": "npm run lint && npm run clean && npm run build:umd && npm run build:esm",
        "build:umd": "rollup --config --format umd --file dist/skills-client-js.umd.min.js --name SkillsClient --bundleConfigAsCjs",
        "build:esm": "rollup --config --format esm --file dist/skills-client-js.esm.min.js --bundleConfigAsCjs",
-        "deploy-to-examples": "npm run build && cp ./dist/skills-display-js.umd.min.js ../skills-examples/skills-example-client-js/app/assets/js/@skilltree/skills-client-js/dist",
+        "deploy-to-examples": "npm run clean && npm run build:umd && npm run build:esm && rm ../skills-client-integration/skills-int-service/src/main/resources/public/native/assets/js/@skilltree/skills-client-js/dist/* && cp ./dist/* ../skills-client-integration/skills-int-service/src/main/resources/public/native/assets/js/@skilltree/skills-client-js/dist/",
        "test": "NODE_ENV=test jest --coverage",
        "test-watch": "npx jest --passWithNoTests --coverage --watch",
        "prepublishOnly": "npm run build",
@@ -30,33 +30,33 @@
    "author": "SkillTree Team",
    "devDependencies": {
        "@babel/cli": "7.28.6",
-        "@babel/core": "7.29.0",
+        "@babel/core": "7.29.6",
        "@babel/plugin-transform-runtime": "7.29.0",
        "@babel/polyfill": "7.12.1",
        "@babel/preset-env": "7.29.5",
        "@babel/runtime": "7.29.2",
        "@eslint/js": "10.0.1",
-        "@rollup/plugin-babel": "7.0.0",
-        "@rollup/plugin-commonjs": "29.0.2",
+        "@rollup/plugin-babel": "7.1.0",
+        "@rollup/plugin-commonjs": "29.0.3",
        "@rollup/plugin-json": "6.1.0",
        "@rollup/plugin-node-resolve": "16.0.3",
        "@rollup/plugin-replace": "6.0.3",
        "@rollup/plugin-terser": "1.0.0",
        "axios-mock-adapter": "2.1.0",
-        "babel-jest": "30.4.1",
-        "eslint": "10.3.0",
-        "globals": "17.6.0",
-        "jest": "30.4.2",
-        "jest-environment-jsdom": "30.4.1",
+        "babel-jest": "30.5.1",
+        "eslint": "10.10.0",
+        "globals": "17.12.0",
+        "jest": "30.5.1",
+        "jest-environment-jsdom": "30.5.1",
        "license-check-and-add": "4.0.5",
        "license-checker": "25.0.1",
        "regenerator-runtime": "0.14.1",
-        "rollup": "4.60.3",
+        "rollup": "4.63.3",
        "xhr-mock": "2.5.1"
    },
    "dependencies": {
        "@stomp/stompjs": "7.3.0",
-        "axios": "1.17.0",
+        "axios": "1.20.0",
        "js-logger": "1.6.1",
        "postmate": "1.5.2",
        "sockjs-client": "1.6.1"
@@ -58,7 +58,7 @@ export default {
    return new Promise((resolve, reject) => {
      const xhr = new XMLHttpRequest();
      xhr.open('POST', `${conf.getServiceUrl()}/api/projects/${conf.getProjectId()}/skillsClientVersion`);
-      xhr.withCredentials = true;
+      xhr.withCredentials = conf.isPKIMode();
      if (!conf.isPKIMode()) {
        xhr.setRequestHeader('Authorization', `Bearer ${conf.getAuthToken()}`);
      }
@@ -111,7 +111,6 @@ export default {
        xhr.open('GET', authenticator);
      } else {
        xhr.open('GET', `${serviceUrl}/api/projects/${projectId}/token`);
-        xhr.withCredentials = true;
      }

      xhr.onreadystatechange = () => {
@@ -119,7 +118,7 @@ export default {
          if (xhr.status !== 200) {
            if (isOAuthMode && oauthRedirect && xhr.status === 401) {
              // if we get 401 and we are using OAuth, then redirect to the OAuth Provider
-              const oauthAuthenticator = `${authenticator}?skillsRedirectUri=${window.location}`;
+              const oauthAuthenticator = `${authenticator}?skillsRedirectUri=${encodeURIComponent(window.location.href)}`;
              log.info(`SkillsClient::SkillService::unable to get oAuth token, navigating to [${oauthAuthenticator}]`);
              this.assignWindowLocation(oauthAuthenticator);
              resolve();
@@ -28,7 +28,7 @@ const markedForDestruction = [];
 export default class SkillsDisplayJS {
  constructor({ options, theme, version, handleRouteChanged, userId } = {}) {
    log.debug(`SkillsClient::SkillsDisplayJS::Constructing with options [${options}], theme [${theme}], version [${version}], userId [${userId}]`);
-    this._options = { ...{ }, ...options };
+    this._options = { parentPath: window.location.pathname, ...options };
    this._theme = theme;
    this._version = version;
    this._handleRouteChanged = handleRouteChanged;
@@ -55,7 +55,7 @@ export default class SkillsLevelJS {
          this._projectId = SkillsConfiguration.getProjectId();
          log.debug(`SkillsClient::SkillsLevelJS::getting projectId from SkillsConfiguration: [${this._projectId}]`);
        }
-        const requestConfig = { withCredentials: true };
+        const requestConfig = { withCredentials: SkillsConfiguration.isPKIMode() };
        if (!SkillsConfiguration.isPKIMode()) {
          const authToken = SkillsConfiguration.getAuthToken();
          requestConfig.headers = { Authorization: `Bearer ${authToken}` };
@@ -138,7 +138,7 @@ const reportInternal = (resolve, reject, userSkillId, timestamp, isRetry, retryA
  const xhr = new XMLHttpRequest();

  xhr.open('POST', `${SkillsConfiguration.getServiceUrl()}/api/projects/${SkillsConfiguration.getProjectId()}/skills/${userSkillId}`);
-  xhr.withCredentials = true;
+  xhr.withCredentials = SkillsConfiguration.isPKIMode();
  if (!SkillsConfiguration.isPKIMode()) {
    xhr.setRequestHeader('Authorization', `Bearer ${SkillsConfiguration.getAuthToken()}`);
  }
@@ -45,7 +45,23 @@ describe('OAuth auto redirect tests', () => {
    await SkillsService.getAuthenticationToken(authEndpoint, mockServiceUrl, mockProjectId, true);

    expect(SkillsService.assignWindowLocation).toHaveBeenCalledTimes(1)
-    expect(SkillsService.assignWindowLocation).toHaveBeenCalledWith(`${authEndpoint}?skillsRedirectUri=http://localhost/`)
+    expect(SkillsService.assignWindowLocation).toHaveBeenCalledWith(`${authEndpoint}?skillsRedirectUri=${encodeURIComponent('http://localhost/')}`)
+  });
+
+  it('oauth redirect encodes the current location so it cannot add query parameters', async () => {
+    const oauthTokenEndpoint = `${mockServiceUrl}/api/projects/${mockProjectId}/token`;
+    mock.get(oauthTokenEndpoint, (req, res) => res.status(401));
+
+    window.history.pushState({}, '', '/page?a=1&skillsRedirectUri=http://evil.example.com/');
+    const injected = window.location.href;
+
+    await SkillsService.getAuthenticationToken(authEndpoint, mockServiceUrl, mockProjectId, true);
+
+    const [redirectedTo] = SkillsService.assignWindowLocation.mock.calls[0];
+    expect(redirectedTo).toBe(`${authEndpoint}?skillsRedirectUri=${encodeURIComponent(injected)}`);
+    // the injected separators must not survive as separators
+    expect(redirectedTo.split('?')).toHaveLength(2);
+    expect(redirectedTo).not.toContain('&skillsRedirectUri=');
  });

  it('oauth does not auto redirect when oauthRedirect=false', async () => {
@@ -482,6 +482,7 @@ describe('SkillsDisplayJS', () => {
          isSummaryOnly: false,
          projectId: mockProjectId,
          serviceUrl: mockServiceUrl,
+          parentPath: '/',
        };
        mockVersion = `${Math.random()}`;

@@ -497,6 +498,7 @@ describe('SkillsDisplayJS', () => {
          authenticator: 'pki',
          serviceUrl: mockServiceUrl,
          projectId: mockProjectId,
+          parentPath: '/'
        };

        const client = new SkillsDisplayJS({
@@ -538,6 +540,7 @@ describe('SkillsDisplayJS', () => {
          authenticator: mockAuthenticator,
          serviceUrl: mockServiceUrl,
          projectId: mockProjectId,
+          parentPath: '/'
        };
        const client = new SkillsDisplayJS({
          options,
@@ -578,6 +581,7 @@ describe('SkillsDisplayJS', () => {
          serviceUrl: mockServiceUrl,
          projectId: mockProjectId,
          internalBackButton: false,
+          parentPath: '/'
        };
        const client = new SkillsDisplayJS({
          options,
@@ -618,6 +622,7 @@ describe('SkillsDisplayJS', () => {
          serviceUrl: mockServiceUrl,
          projectId: mockProjectId,
          internalBackButton: true,
+          parentPath: '/'
        };
        const client = new SkillsDisplayJS({
          options,
@@ -657,6 +662,7 @@ describe('SkillsDisplayJS', () => {
          authenticator: mockAuthenticator,
          serviceUrl: mockServiceUrl,
          projectId: mockProjectId,
+          parentPath: '/'
        };
        const client = new SkillsDisplayJS({
          options,
@@ -695,7 +701,7 @@ describe('SkillsDisplayJS', () => {
  describe('construction', () => {
    describe('options', () => {
      it('accepts options in the constructor', () => {
-        const mockOptions = { authenticator: 'option' };
+        const mockOptions = { authenticator: 'option', parentPath: 'non-default/' };
        const client = new SkillsDisplayJS({
          options: mockOptions,
        });
@@ -704,14 +710,14 @@ describe('SkillsDisplayJS', () => {

      it('supports null or undefined being passed', () => {
        let client = new SkillsDisplayJS({ options: null });
-        expect(client.options).toEqual({});
+        expect(client.options).toEqual({ parentPath: '/' });
        client = new SkillsDisplayJS({ options: undefined });
-        expect(client.options).toEqual({});
+        expect(client.options).toEqual({ parentPath: '/'} );
      });

-      it('supports empty constructor', () => {
+      it('supports empty constructor, defaults parentPath to window.location.pathname', () => {
        const client = new SkillsDisplayJS();
-        expect(client.options).toEqual({});
+        expect(client.options).toEqual({ parentPath: '/'} );
      });

      it('accepts valid options', () => {
@@ -18,21 +18,33 @@ import mock from 'xhr-mock';
 import SkillsConfiguration from '../../src/config/SkillsConfiguration';
 import { SkillsReporter } from '../../src/reporter/SkillsReporter.js';

+// These tests exercise HTTP authentication, not the background websocket connection.
+jest.mock('@stomp/stompjs');
+
 describe('authPkiTests()', () => {
  const mockServiceUrl = 'http://some.com';
  const mockProjectId = 'proj1';

-  SkillsConfiguration.configure({
-    serviceUrl: mockServiceUrl,
-    projectId: mockProjectId,
-    authenticator: 'pki',
+  // replace the real XHR object with the mock XHR object before each test
+  beforeEach(async () => {
+    mock.setup();
+    SkillsConfiguration.logout();
+    mock.get(/.*\/public\/status/, (req, res) => res.status(200).body('{"status":"OK","clientLib":{"loggingEnabled":"false","loggingLevel":"DEBUG"}}'));
+    mock.post(/.*\/api\/projects\/proj1\/skillsClientVersion/, (req, res) => res.status(200).body('{"success":true,"explanation":null}'));
+    await SkillsConfiguration.configure({
+      serviceUrl: mockServiceUrl,
+      projectId: mockProjectId,
+      authenticator: 'pki',
+    });
  });

-  // replace the real XHR object with the mock XHR object before each test
-  beforeEach(() => mock.setup());
-
  // put the real XHR object back and clear the mocks after each test
-  afterEach(() => mock.teardown());
+  afterEach(() => {
+    SkillsReporter.cancelRetryChecker();
+    window.localStorage.removeItem('skillTreeRetryQueue');
+    SkillsConfiguration.logout();
+    mock.teardown();
+  });

  it('successful call in pki mode', async () => {
    expect.assertions(2);
@@ -55,6 +55,8 @@ describe('userSkillsService', () => {
  });

  afterEach(() => {
+    SkillsReporter.cancelRetryChecker();
+    jest.restoreAllMocks();
    window.XMLHttpRequest = realXMLHttpRequest;
  });

@@ -79,9 +81,16 @@ describe('userSkillsService', () => {
      expect(MockXMLHttpRequest.setRequestHeader).toHaveBeenCalledWith('Authorization', `Bearer ${SkillsConfiguration.getAuthToken()}`);
    });

-    it('enables withCredentials', () => {
+    it('disables withCredentials in token mode', () => {
      SkillsReporter.reportSkill(mockUserSkillId);
-      expect(MockXMLHttpRequest.withCredentials).toBeTruthy();
+      expect(MockXMLHttpRequest.withCredentials).toBe(false);
+    });
+
+    it('enables withCredentials without an Authorization header in PKI mode', () => {
+      SkillsConfiguration.setAuthToken('pki');
+      SkillsReporter.reportSkill(mockUserSkillId);
+      expect(MockXMLHttpRequest.withCredentials).toBe(true);
+      expect(MockXMLHttpRequest.setRequestHeader).not.toHaveBeenCalledWith('Authorization', expect.anything());
    });

    it('sends out the ajax request', () => {
Author	SHA1	Message	Date
Dima May	5a98e7fd2c	creating_release_version_3.6.5	2026-10-02 11:43:21 +00:00
Ryan Mayo	897d1b9b1c	Merge pull request #290 from NationalSecurityAgency/int_client_session Fix integration client session and CSRF handling for login	2026-09-29 09:04:35 -04:00
Dima May	3a5bcc1f04	Fix integration client session and CSRF handling for login	2026-09-29 11:12:02 +00:00
Ryan Mayo	030a8bd24a	Merge pull request #289 from NationalSecurityAgency/xhr_withCredentials Xhr with credentials	2026-09-23 15:19:21 -04:00
Dima May	532f33a8a7	fixed tests	2026-09-23 15:45:29 +00:00
Dima May	b070e4058e	only set xhr.withCredentials to true in PKI mode	2026-09-23 14:39:08 +00:00
Dima May	6b1ba358d8	Merge pull request #288 from NationalSecurityAgency/remove_scheuduled_ci_actions updated skills-client CI actions to no longer run on a schedule	2026-09-15 11:46:54 -04:00
rmmayo	e845fb7788	updated skills-client CI actions to no longer run on a schedule	2026-09-15 15:28:24 +00:00
rmmayo	599e838086	updated skills-client-js to add the current window.location.pathname as the default `parentPath` option	2026-09-15 15:11:02 +00:00
rmmayo	ad5ab89439	creating_release_version_3.6.4	2026-09-14 19:38:41 +00:00
rmmayo	3c408f555f	updated the dependencies	2026-09-14 19:11:24 +00:00
rmmayo	ea523e9381	updated the versions for testing	2026-09-14 13:59:38 +00:00
rmmayo	cea08a3dd5	set parentPath to window.location.pathname so that it is available to the skills-display iframe	2026-09-09 21:56:16 +00:00
rmmayo	731853a8a6	globalEventResult can be empty string or empty JSON object (after spring-boot 4 upgrade)	2026-08-26 16:46:03 +00:00
rmmayo	78c338fd36	updated spring-boot	2026-08-26 16:45:12 +00:00
rmmayo	80052f77ac	remove unnecessary spring.autoconfigure.exclude props from tests since it's the default in the main application.yml	2026-08-26 16:45:00 +00:00
rmmayo	b4e7718741	Updated the regex to match the `completed` array when it contains an object with: - `"type": "Overall"` - `"level": 1` regardless of property order.	2026-08-26 14:59:35 +00:00
rmmayo	42c40ce92f	Updated the regex to match the `completed` array when it contains an object with: - `"type": "Overall"` - `"level": 1` regardless of property order.	2026-08-26 12:03:02 +00:00
Ryan Mayo	18ad1af38e	Merge pull request #287 from NationalSecurityAgency/spring_4_upgrade upgraded to spring boot 4.1.0	2026-08-12 16:11:07 -04:00
Dima May	58f6265836	upgraded to spring boot 4.1.0	2026-08-12 19:35:43 +00:00
Ryan Mayo	e3f299376c	Merge pull request #285 from arpitjain099/fix/encode-oauth-redirect-uri Encode the redirect target before interpolating it into the authenticator URL	2026-07-31 10:09:11 -04:00
Arpit Jain	2b66377a30	Encode the redirect target before interpolating it into the authenticator URL getAuthenticationToken built the OAuth redirect by interpolating window.location straight into the query string, so any reserved character already present in the current URL was carried through as structure rather than data. A page reached with an ampersand in its query string could therefore append parameters to the authenticator URL, including a second skillsRedirectUri. Use encodeURIComponent(window.location.href) so the value is passed as a single opaque parameter. Closes #284. Signed-off-by: Arpit Jain <[email protected]>	2026-07-31 00:06:02 +09:00
Dima May	b88c19d0c7	Merge pull request #283 from NationalSecurityAgency/dependabot/npm_and_yarn/skills-client-integration/skills-int-client-js/axios-1.18.0 Bump axios from 1.17.0 to 1.18.0 in /skills-client-integration/skills-int-client-js	2026-07-21 07:21:08 -04:00
dependabot[bot]	558cecacdd	Bump axios in /skills-client-integration/skills-int-client-js Bumps [axios](https://github.com/axios/axios) from 1.17.0 to 1.18.0. - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](https://github.com/axios/axios/compare/v1.17.0...v1.18.0) --- updated-dependencies: - dependency-name: axios dependency-version: 1.18.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]>	2026-07-21 10:55:51 +00:00
Dima May	dbcc95f951	Merge pull request #282 from NationalSecurityAgency/dependabot/npm_and_yarn/skills-client-js/axios-1.18.0 Bump axios from 1.17.0 to 1.18.0 in /skills-client-js	2026-07-21 06:54:48 -04:00
dependabot[bot]	50ac5c413f	Bump axios from 1.17.0 to 1.18.0 in /skills-client-js Bumps [axios](https://github.com/axios/axios) from 1.17.0 to 1.18.0. - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](https://github.com/axios/axios/compare/v1.17.0...v1.18.0) --- updated-dependencies: - dependency-name: axios dependency-version: 1.18.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]>	2026-07-20 20:13:33 +00:00
Don Walizer	cf0961c435	Merge pull request #280 from NationalSecurityAgency/upgrades_gh-actions_node_java upgrade gh actions, node and java	2026-07-06 09:38:03 -04:00
Dima May	56cb884fdb	Merge pull request #279 from NationalSecurityAgency/dependabot/npm_and_yarn/skills-client-js/babel/core-7.29.6 Bump @babel/core from 7.29.0 to 7.29.6 in /skills-client-js	2026-07-06 08:02:34 -04:00
dependabot[bot]	a301650700	Bump @babel/core from 7.29.0 to 7.29.6 in /skills-client-js Bumps [@babel/core](https://github.com/babel/babel/tree/HEAD/packages/babel-core) from 7.29.0 to 7.29.6. - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.29.6/packages/babel-core) --- updated-dependencies: - dependency-name: "@babel/core" dependency-version: 7.29.6 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <[email protected]>	2026-06-25 14:51:08 +00:00