upgrade spring-boot to 4.1.2

Tests fix

.github/workflows/build-and-test-expired-token.yml

@@ -7,8 +7,11 @@ env:
   JAVA_VERSION: 25
 
 on:
-  schedule:
-    - cron: '0 8 * * *'
+  push:
+    paths-ignore:
+      - 'README.md'
+      - .github/workflows/skills-service-backward-compat.yml
+      - .github/workflows/client-libs-backward-compat.yml
   workflow_dispatch:
 
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel

.github/workflows/build-and-test-oauth.yml

@@ -12,11 +12,6 @@ on:
       - 'README.md'
       - .github/workflows/skills-service-backward-compat.yml
       - .github/workflows/client-libs-backward-compat.yml
-  pull_request:
-    paths-ignore:
-      - 'README.md'
-      - .github/workflows/skills-service-backward-compat.yml
-      - .github/workflows/client-libs-backward-compat.yml
   workflow_dispatch:
 
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel

.github/workflows/build-and-test.yml

@@ -12,11 +12,6 @@ on:
       - 'README.md'
       - .github/workflows/skills-service-backward-compat.yml
       - .github/workflows/client-libs-backward-compat.yml
-  pull_request:
-    paths-ignore:
-      - 'README.md'
-      - .github/workflows/skills-service-backward-compat.yml
-      - .github/workflows/client-libs-backward-compat.yml
   workflow_dispatch:
 
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel

.github/workflows/client-libs-backwards-compat.yml

@@ -10,11 +10,6 @@ on:
       - 'README.md'
       - .github/workflows/skills-service-backward-compat.yml
       - .github/workflows/client-libs-backward-compat.yml
-  pull_request:
-    paths-ignore:
-      - 'README.md'
-      - .github/workflows/skills-service-backward-compat.yml
-      - .github/workflows/client-libs-backward-compat.yml
   workflow_dispatch:
 
 jobs:

.github/workflows/skills-service-backward-compat.yml

@@ -13,8 +13,6 @@ on:
   pull_request:
     paths-ignore:
       - 'README.md'
-  schedule:
-    - cron: '0 6 * * *'
   workflow_dispatch:
 
 # A workflow run is made up of one or more jobs that can run sequentially or in parallel
@@ -85,7 +83,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        skillsJsVersion: [ '3.1.1', '3.2.0', '3.3.0', '3.3.1', '3.4.0', '3.4.1', '3.5.0']
+        skillsJsVersion: [ '3.5.0', '3.6.0', '3.6.1', '3.6.2', '3.6.3']
 
     services:
       postgres:

.gitignore

@@ -16,3 +16,5 @@
 /skills-client-ng/dist/
 /skills-client-ng/projects/skilltree/skills-client-ng/src/version.js
 /skills-client-integration/skills-int-e2e-test/cypress/downloads/*
+
+AGENTS.md

skills-client-integration/pom.xml

@@ -7,13 +7,13 @@
     <parent>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-parent</artifactId>
-        <version>3.5.16</version>
+        <version>4.1.2</version>
         <relativePath/> <!-- lookup parent from repository -->
     </parent>
     <groupId>skills</groupId>
     <artifactId>skills-client-integration</artifactId>
     <packaging>pom</packaging>
-    <version>3.6.3-SNAPSHOT</version>
+    <version>3.6.5-SNAPSHOT</version>
 
     <licenses>
         <license>
@@ -31,10 +31,6 @@
     <properties>
         <!--suppress UnresolvedMavenProperty -->
         <nexusServer>${nexus.url}</nexusServer>
-        <frontend-maven-plugin.version>1.10.3</frontend-maven-plugin.version>
-
-        <!--  TODO: Temporary override spring boot versions, remove once spring boot upgrades these versions -->
-        <commons-lang3.version>3.19.0</commons-lang3.version>
     </properties>
 
 </project>

skills-client-integration/skills-int-client-js/package.json

@@ -1,6 +1,6 @@
 {
     "name": "skills-int-client-js",
-    "version": "3.6.3",
+    "version": "3.6.5",
     "license": "Apache-2.0",
     "description": "SkillTree Client Lib Integration Tests - Native JS",
     "main": "index.js",
@@ -16,13 +16,13 @@
     },
     "author": "SkillTree Team",
     "dependencies": {
-        "@skilltree/skills-client-js": "3.6.3",
-        "axios": "1.17.0",
+        "@skilltree/skills-client-js": "3.6.5",
+        "axios": "1.20.0",
         "bootstrap": "5.3.8",
         "jquery": "4.0.0"
     },
     "devDependencies": {
-        "fs-extra": "11.3.5",
+        "fs-extra": "11.4.0",
         "license-check-and-add": "4.0.5",
         "license-checker": "25.0.1",
         "live-server": "1.2.2"

skills-client-integration/skills-int-client-js/pom.xml

@@ -7,7 +7,7 @@
     <parent>
         <groupId>skills</groupId>
         <artifactId>skills-client-integration</artifactId>
-        <version>3.6.3-SNAPSHOT</version>
+        <version>3.6.5-SNAPSHOT</version>
     </parent>
     <artifactId>skills-int-client-js</artifactId>
 

skills-client-integration/skills-int-e2e-test/cypress/e2e/global-event_specs.js

@@ -20,6 +20,8 @@ const homePage = '/native/index.html'
 
 context("Global Events Tests", () => {
 
+    const level1CompleteRegex = /"completed"\s*:\s*\[(?=[\s\S]*?\{[^{}]*?(?:"type"\s*:\s*"Overall"[^{}]*?"level"\s*:\s*1|"level"\s*:\s*1[^{}]*?"type"\s*:\s*"Overall")[^{}]*?\})[\s\S]*?\]/;
+
     it("global event show correct results", () => {
         cy.createDefaultProject();
 
@@ -34,7 +36,7 @@ context("Global Events Tests", () => {
         cy.get('pre[data-cy=globalEventResult]').contains('"skillId": "IronMan"')
         cy.get('pre[data-cy=globalEventResult]').contains('"pointsEarned": 50')
         cy.get('pre[data-cy=globalEventResult]').contains('"skillApplied": true')
-        cy.get('pre[data-cy=globalEventResult]').contains(/completed": [[][^]*"type": "Overall",[^]\s*"level": 1/)
+        cy.get('pre[data-cy=globalEventResult]').contains(level1CompleteRegex)
     });
     it("global event show correct results (skills reported directly to backend endpoint)", () => {
         cy.createDefaultProject();
@@ -46,7 +48,7 @@ context("Global Events Tests", () => {
         cy.get('pre[data-cy=globalEventResult]').contains('"skillId": "IronMan"')
         cy.get('pre[data-cy=globalEventResult]').contains('"pointsEarned": 50')
         cy.get('pre[data-cy=globalEventResult]').contains('"skillApplied": true')
-        cy.get('pre[data-cy=globalEventResult]').contains(/completed": [[][^]*"type": "Overall",[^]\s*"level": 1/)
+        cy.get('pre[data-cy=globalEventResult]').contains(level1CompleteRegex)
     });
 
     it('global event does not update when skill reported for a different project', () => {

skills-client-integration/skills-int-e2e-test/cypress/e2e/timeout.specs.js

@@ -18,6 +18,8 @@ const homePage = '/native/index.html'
 
 context("Token timeout JS Tests", () => {
 
+  const level1CompleteRegex = /"completed"\s*:\s*\[(?=[\s\S]*?\{[^{}]*?(?:"type"\s*:\s*"Overall"[^{}]*?"level"\s*:\s*1|"level"\s*:\s*1[^{}]*?"type"\s*:\s*"Overall")[^{}]*?\})[\s\S]*?\]/;
+
   if (Cypress.env('timeout') === true || Cypress.env('timeout') === 'true') {
     it("report skill with expired token, retry checker will resend with new token", () => {
       cy.createDefaultProject();
@@ -28,14 +30,17 @@ context("Token timeout JS Tests", () => {
       cy.wait(71000)  // wait 71 seconds to ensure the token has expired
       cy.get('[data-cy="exampleDirectiveClickEventButton"]').click();
 
-      cy.get('pre[data-cy=globalEventResult]').should('be.empty');
+      // should be empty string or empty JSON object
+      cy.get('pre[data-cy=globalEventResult]')
+        .invoke('text')
+        .should('match', /^\s*$|^\s*\{\s*\}\s*$/);
 
       cy.wait("@getToken", { timeout: 60000 }); // wait ~ another 50 seconds to all for the RetryChecker to resubmit
 
       cy.get('pre[data-cy=globalEventResult]').contains('"skillId": "IronMan"')
       cy.get('pre[data-cy=globalEventResult]').contains('"pointsEarned": 50')
       cy.get('pre[data-cy=globalEventResult]').contains('"skillApplied": true')
-      cy.get('pre[data-cy=globalEventResult]').contains(/completed": [[][^]*"type": "Overall",[^]\s*"level": 1/)
+      cy.get('pre[data-cy=globalEventResult]').contains(level1CompleteRegex)
     });
 
     it('skill display - navigate after token expires', () => {

skills-client-integration/skills-int-e2e-test/cypress/support/commands.js

@@ -45,6 +45,44 @@ const baseUrl = Cypress.config().baseUrl;
 const skillsDisplayHomePage = '/native/clientDisplay.html'
 
 
+// cy.request does not add Axios's X-XSRF-TOKEN header automatically. Keep the
+// cookie and header in sync for requests to the Skills Service, including
+// registration and login requests made before the browser visits the dashboard.
+Cypress.Commands.overwrite('request', (originalFn, ...args) => {
+  const options = typeof args[0] === 'object'
+      ? { ...args[0] }
+      : typeof args[1] === 'string'
+          ? { method: args[0], url: args[1], body: args[2] }
+          : { url: args[0], body: args[1] };
+  const method = (options.method || 'GET').toUpperCase();
+  const url = new URL(options.url, Cypress.config('baseUrl'));
+  const backend = new URL(Cypress.config('baseUrl'));
+  const isSkillsService = url.origin === backend.origin ||
+      (url.hostname === backend.hostname && url.port === '8080');
+
+  if (!isSkillsService || ['GET', 'HEAD', 'OPTIONS', 'TRACE'].includes(method)) {
+    return originalFn(...args);
+  }
+
+  return cy.getCookie('XSRF-TOKEN').then((cookie) => {
+    if (cookie) {
+      return originalFn({
+        ...options,
+        headers: { ...options.headers, 'X-XSRF-TOKEN': cookie.value },
+      });
+    }
+
+    // The first request can be registration, logout, or login. A GET loads
+    // the token without requiring an authenticated session.
+    return cy.request({ url: `${url.origin}/app/userInfo` })
+        .then(() => cy.getCookie('XSRF-TOKEN').should('exist'))
+        .then((xsrfCookie) => originalFn({
+          ...options,
+          headers: { ...options.headers, 'X-XSRF-TOKEN': xsrfCookie.value },
+        }));
+  });
+});
+
 Cypress.Commands.add('onlyOn', (enabled) => {
   if (enabled !== true) {
     cy.state('runnable').ctx.skip()
@@ -59,15 +97,20 @@ Cypress.Commands.add("backendRegister", (user, pass, grantRoot) => {
   return cy.request(`${backend}/app/users/validExistingDashboardUserId/${user}`)
     .then((response) => {
       if (response.body !== true) {
-        cy.log(`Creating user [${user}]`)
-        cy.request('PUT', `${backend}/createAccount`, {
+
+        const userBody = {
           firstName: 'Firstname',
           lastName: 'LastName',
           email: user,
           password: pass,
-        });
+        }
+
         if (grantRoot) {
-          cy.request('POST', `${backend}/grantFirstRoot`);
+          cy.log(`Creating root user [${user}]`)
+          cy.request('PUT', `${backend}/createRootAccount`, userBody)
+        } else {
+          cy.log(`Creating user [${user}]`)
+          cy.request('PUT', `${backend}/createAccount`, userBody);
         }
         cy.backendLogout()
       } else {
@@ -230,18 +273,23 @@ Cypress.Commands.add('skillsLog', (message) => {
   });
 });
 
-Cypress.Commands.add('loginBySingleSignOn', (projId = 'proj1') => {
+Cypress.Commands.add('loginBySingleSignOn', () => {
   Cypress.log({
     name: 'loginBySingleSignOn',
   })
 
-  // first try to get a skills token,
-  cy.request({
-    url: `http://localhost:8080/api/projects/${projId}/token`,
+  // Check the session without saving a protected request for Spring to replay
+  // after OAuth login, before the test has created any projects.
+  return cy.request({
+    url: `${backend}/app/userInfo`,
     failOnStatusCode: false,
-  }).then((tokenResp) => {
-    if (tokenResp.status === 401) {
-      cy.skillsLog('Skills token request failed, authenticating with OAuth provider...');
+    followRedirect: false,
+  }).then((sessionResp) => {
+    const requiresLogin = sessionResp.status === 401 ||
+      (sessionResp.status === 200 && !sessionResp.body?.userId) ||
+      ([301, 302, 303, 307, 308].includes(sessionResp.status) && Boolean(sessionResp.headers.location));
+    if (requiresLogin) {
+      cy.skillsLog('Skills session requires authentication, authenticating with OAuth provider...');
       cy.request({
         url: 'http://localhost:8080/oauth2/authorization/hydra', 
         qs: { skillsRedirectUri: baseUrl, },
@@ -253,10 +301,14 @@ Cypress.Commands.add('loginBySingleSignOn', (projId = 'proj1') => {
         const $html = Cypress.$(resp.body)
         const authenticityToken = $html.find('input[name=_csrf]').val()
         const challenge = $html.find('input[name=challenge]').val()
+        expect(authenticityToken, 'OAuth login CSRF token').to.be.a('string').and.not.be.empty;
+        expect(challenge, 'OAuth login challenge').to.be.a('string').and.not.be.empty;
         const options = {
           method: 'POST',
           url: 'http://localhost:3000/login',
           form: true, // we are submitting a regular form body
+          followRedirect: false,
+          failOnStatusCode: false,
           body: {
             _csrf: authenticityToken,
             challenge,
@@ -268,38 +320,53 @@ Cypress.Commands.add('loginBySingleSignOn', (projId = 'proj1') => {
         };
 
         cy.request(options).then((resp2) => {
-          expect(resp2.status).to.eq(200)
+          expect(
+            resp2.status,
+            `OAuth login: ${JSON.stringify({
+              location: resp2.headers.location,
+              body: resp2.body,
+            })}`,
+          ).to.eq(302);
 
-          if (resp2.redirects[resp2.redirects.length-1].includes('/consent?consent_challenge')) {
-            cy.skillsLog('Granting consent with OAuth provider...');
-            const $html = Cypress.$(resp2.body)
-            const authenticityToken = $html.find('input[name=_csrf]').val()
-            const challenge = $html.find('input[name=challenge]').val()
-            // const consentUrl = resp2.redirects.filter(r => r.includes('/consent?consent_challenge'))[0].split(' ')[1]
-            const options = {
-              method: 'POST',
-              url: 'http://localhost:3000/consent',
-              form: true, // we are submitting a regular form body
-              qs: { consent_challenge: challenge },
-              body: {
-                _csrf: authenticityToken,
-                challenge,
-                grant_scope: 'openid',
-                // grant_scope: 'offline',
-                submit: 'Allow access',
-                remember: '1',
-              },
-              failOnStatusCode: false,
-            };
+          expect(resp2.headers.location, 'OAuth login redirect').to.be.a('string').and.not.be.empty;
+          const redirectUrl = new URL(resp2.headers.location, options.url).href;
+          return cy.request(redirectUrl).then((resp2) => {
+            expect(resp2.status).to.eq(200)
 
-            cy.request(options).then((resp3) => {
-              expect(resp3.status).to.eq(200)
-            })
-          }
+            if ((resp2.redirects || []).some(redirect => redirect.includes('/consent?consent_challenge')) &&
+              Cypress.$(resp2.body).find('input[name=challenge]').length > 0) {
+              cy.skillsLog('Granting consent with OAuth provider...');
+              const $html = Cypress.$(resp2.body)
+              const authenticityToken = $html.find('input[name=_csrf]').val()
+              const challenge = $html.find('input[name=challenge]').val()
+              const options = {
+                method: 'POST',
+                url: 'http://localhost:3000/consent',
+                form: true, // we are submitting a regular form body
+                qs: { consent_challenge: challenge },
+                body: {
+                  _csrf: authenticityToken,
+                  challenge,
+                  grant_scope: 'openid',
+                  submit: 'Allow access',
+                  remember: '1',
+                },
+                failOnStatusCode: false,
+              };
+
+              cy.request(options).then((resp3) => {
+                expect(resp3.status).to.eq(200)
+              })
+            }
+          })
         })
       })
     } else {
-      cy.skillsLog('Received Skills token, already authenticated with OAuth provider.');
+      expect(sessionResp.status, 'Skills session response status').to.eq(200)
+      cy.skillsLog('Skills session already authenticated with OAuth provider.');
     }
-  })
-});
+  }).then(() => cy.request(`${backend}/app/userInfo`).then((resp) => {
+    expect(resp.status, 'Authenticated Skills session status').to.eq(200)
+    expect(resp.body.userId, 'Authenticated Skills user').to.be.a('string').and.not.be.empty;
+  }))
+});

skills-client-integration/skills-int-e2e-test/package.json

@@ -52,8 +52,8 @@
     "license-check-and-add": "4.0.5",
     "license-checker": "25.0.1",
     "pdf-parse": "1.1.1",
-    "semver": "7.7.2",
-    "wait-on": "8.0.3",
+    "semver": "7.8.5",
+    "wait-on": "9.1.0",
     "wait-port": "1.1.0"
   }
 }

skills-client-integration/skills-int-e2e-test/pom.xml

@@ -5,7 +5,7 @@
     <parent>
         <groupId>skills</groupId>
         <artifactId>skills-client-integration</artifactId>
-        <version>3.6.3-SNAPSHOT</version>
+        <version>3.6.5-SNAPSHOT</version>
     </parent>
     <artifactId>skills-int-e2e-test</artifactId>
     <description>End to End tests for Skills client libs using skills-int-service app</description>

skills-client-integration/skills-int-e2e-test/serverConfigs/backend_application.properties

@@ -14,7 +14,6 @@
 spring.datasource.username = postgres
 spring.datasource.url = jdbc:postgresql://localhost:5432/skills
 spring.datasource.password = skillsPassword
-spring.autoconfigure.exclude=org.springframework.boot.autoconfigure.web.servlet.error.ErrorMvcAutoConfiguration
 
 skills.config.ui.userCommunityUserTagKey=dragons
 skills.config.ui.userCommunityUserTagValue=DivineDragon
@@ -38,3 +37,5 @@ logging.level.skills=DEBUG
 
 skills.config.client.loggingEnabled=true
 skills.config.client.loggingLevel=TRACE
+
+skills.config.client.loggingMaxRequestsPerMinute=5000

skills-client-integration/skills-int-e2e-test/serverConfigs/backend_oauth_application.properties

@@ -26,4 +26,6 @@ skills.config.ui.userCommunityParagraphValidationMessage=May not contain divined
 skills.config.ui.userCommunityRestrictedDescriptor=Divine Dragon
 skills.config.ui.userCommunityBeforeLabel=For
 skills.config.ui.userCommunityAfterLabel=Nation
-skills.config.ui.defaultCommunityDescriptor=All Dragons
+skills.config.ui.defaultCommunityDescriptor=All Dragons
+
+skills.config.client.loggingMaxRequestsPerMinute=5000

skills-client-integration/skills-int-service/pom.xml

@@ -5,7 +5,7 @@
 	<parent>
 		<groupId>skills</groupId>
 		<artifactId>skills-client-integration</artifactId>
-		<version>3.6.3-SNAPSHOT</version>
+		<version>3.6.5-SNAPSHOT</version>
 	</parent>
 	<artifactId>skills-int-service</artifactId>
 	<description>SkillTree Client Lib Integration Tests</description>
@@ -23,6 +23,10 @@
 			<groupId>org.apache.httpcomponents.client5</groupId>
 			<artifactId>httpclient5</artifactId>
 		</dependency>
+		<dependency>
+			<groupId>org.springframework.boot</groupId>
+			<artifactId>spring-boot-starter-restclient</artifactId>
+		</dependency>
 	</dependencies>
 
 	<build>

skills-client-integration/skills-int-service/src/main/java/skills/example/Controller.java

@@ -15,10 +15,8 @@
  */
 package skills.example;
 
-import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.ObjectMapper;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.web.client.RestTemplateBuilder;
+import org.springframework.boot.restclient.RestTemplateBuilder;
 import org.springframework.http.*;
 import org.springframework.http.client.support.BasicAuthenticationInterceptor;
 import org.springframework.util.LinkedMultiValueMap;
@@ -27,6 +25,8 @@ import org.springframework.util.StringUtils;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.client.RestTemplate;
 import skills.example.SkillsExampleApplication.SkillsConfig;
+import tools.jackson.databind.JsonNode;
+import tools.jackson.databind.ObjectMapper;
 
 import java.util.ArrayList;
 import java.util.Arrays;
@@ -128,6 +128,9 @@ public class Controller {
 
     private void authIfNecessary() {
         if (!skillsConfig.getAuthMode().equalsIgnoreCase("pki")) {
+            // Seed the session and XSRF-TOKEN before /performLogin, which requires CSRF validation.
+            // SecurityRestTemplateCustomizer retains the cookies and sends X-XSRF-TOKEN on later requests.
+            restTemplate.getForEntity(skillsConfig.getServiceUrl() + "/app/userInfo", String.class);
             HttpHeaders headers = new HttpHeaders();
             headers.setContentType(MediaType.APPLICATION_FORM_URLENCODED);
             MultiValueMap<String, String> params = new LinkedMultiValueMap<>();

skills-client-integration/skills-int-service/src/main/java/skills/example/SecurityRestTemplateCustomizer.java

@@ -16,6 +16,8 @@
 package skills.example;
 
 import org.apache.hc.client5.http.classic.HttpClient;
+import org.apache.hc.client5.http.cookie.BasicCookieStore;
+import org.apache.hc.client5.http.cookie.Cookie;
 import org.apache.hc.client5.http.impl.classic.HttpClients;
 import org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManager;
 import org.apache.hc.client5.http.socket.ConnectionSocketFactory;
@@ -23,11 +25,9 @@ import org.apache.hc.client5.http.socket.PlainConnectionSocketFactory;
 import org.apache.hc.client5.http.ssl.NoopHostnameVerifier;
 import org.apache.hc.client5.http.ssl.SSLConnectionSocketFactory;
 import org.apache.hc.core5.http.config.RegistryBuilder;
-import org.apache.hc.core5.ssl.SSLContextBuilder;
 import org.apache.hc.core5.ssl.SSLContexts;
-import org.apache.hc.core5.ssl.TrustStrategy;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.web.client.RestTemplateCustomizer;
+import org.springframework.boot.restclient.RestTemplateCustomizer;
 import org.springframework.http.client.HttpComponentsClientHttpRequestFactory;
 import org.springframework.stereotype.Component;
 import org.springframework.web.client.RestTemplate;
@@ -47,12 +47,22 @@ public class SecurityRestTemplateCustomizer implements RestTemplateCustomizer {
         // not by default keeps track of session.  This method is called by the
         // RestTemplateBuilder used in the skills.example.Controller constructor
         HttpComponentsClientHttpRequestFactory clientHttpRequestFactory = new HttpComponentsClientHttpRequestFactory();
-        HttpClient client = getHttpClient();
+        BasicCookieStore cookieStore = new BasicCookieStore();
+        HttpClient client = getHttpClient(cookieStore);
         clientHttpRequestFactory.setHttpClient(client);
         restTemplate.setRequestFactory(clientHttpRequestFactory);
+        restTemplate.getInterceptors().add((request, body, execution) -> {
+            for (Cookie cookie : cookieStore.getCookies()) {
+                if ("XSRF-TOKEN".equals(cookie.getName())) {
+                    request.getHeaders().set("X-XSRF-TOKEN", cookie.getValue());
+                    break;
+                }
+            }
+            return execution.execute(request, body);
+        });
     }
 
-    private HttpClient getHttpClient() {
+    private HttpClient getHttpClient(BasicCookieStore cookieStore) {
         try {
             SSLContext sslContext = SSLContexts.createSystemDefault();
             HostnameVerifier allowAllHosts = new NoopHostnameVerifier();
@@ -69,6 +79,7 @@ public class SecurityRestTemplateCustomizer implements RestTemplateCustomizer {
 
             return HttpClients.custom()
                     .useSystemProperties()
+                    .setDefaultCookieStore(cookieStore)
                     .setConnectionManager(poolingHttpClientConnectionManager)
                     .build();
         } catch (Exception e) {

skills-client-integration/skills-int-service/src/main/java/skills/example/filters/VueEntryPointFilter.java

@@ -18,15 +18,18 @@ package skills.example.filters;
 import jakarta.servlet.*;
 import jakarta.servlet.http.HttpServletRequest;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.autoconfigure.security.SecurityProperties;
 import org.springframework.core.annotation.Order;
 import org.springframework.stereotype.Component;
 
 import java.io.IOException;
 
 @Component
-@Order(SecurityProperties.DEFAULT_FILTER_ORDER-1)
+@Order(VueEntryPointFilter.BEFORE_SECURITY_FILTER_ORDER)
 public class VueEntryPointFilter implements Filter {
+
+    // -100 (Default Security Order) - 1
+    public static final int BEFORE_SECURITY_FILTER_ORDER = -101;
+
     @Autowired
     private VueEntryPointFilterUtils vueEntryPointFilterUtils;
 

skills-client-js/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@skilltree/skills-client-js",
-    "version": "3.6.3",
+    "version": "3.6.5",
     "license": "Apache-2.0",
     "description": "SkillTree Client Lib - Native JS Lib",
     "main": "dist/skills-client-js.umd.min.js",
@@ -21,7 +21,7 @@
         "buildSkipTests": "npm run lint && npm run clean && npm run build:umd && npm run build:esm",
         "build:umd": "rollup --config --format umd --file dist/skills-client-js.umd.min.js --name SkillsClient --bundleConfigAsCjs",
         "build:esm": "rollup --config --format esm --file dist/skills-client-js.esm.min.js --bundleConfigAsCjs",
-        "deploy-to-examples": "npm run build && cp ./dist/skills-display-js.umd.min.js ../skills-examples/skills-example-client-js/app/assets/js/@skilltree/skills-client-js/dist",
+        "deploy-to-examples": "npm run clean && npm run build:umd && npm run build:esm && rm ../skills-client-integration/skills-int-service/src/main/resources/public/native/assets/js/@skilltree/skills-client-js/dist/* && cp ./dist/* ../skills-client-integration/skills-int-service/src/main/resources/public/native/assets/js/@skilltree/skills-client-js/dist/",
         "test": "NODE_ENV=test jest --coverage",
         "test-watch": "npx jest --passWithNoTests --coverage --watch",
         "prepublishOnly": "npm run build",
@@ -30,33 +30,33 @@
     "author": "SkillTree Team",
     "devDependencies": {
         "@babel/cli": "7.28.6",
-        "@babel/core": "7.29.0",
+        "@babel/core": "7.29.6",
         "@babel/plugin-transform-runtime": "7.29.0",
         "@babel/polyfill": "7.12.1",
         "@babel/preset-env": "7.29.5",
         "@babel/runtime": "7.29.2",
         "@eslint/js": "10.0.1",
-        "@rollup/plugin-babel": "7.0.0",
-        "@rollup/plugin-commonjs": "29.0.2",
+        "@rollup/plugin-babel": "7.1.0",
+        "@rollup/plugin-commonjs": "29.0.3",
         "@rollup/plugin-json": "6.1.0",
         "@rollup/plugin-node-resolve": "16.0.3",
         "@rollup/plugin-replace": "6.0.3",
         "@rollup/plugin-terser": "1.0.0",
         "axios-mock-adapter": "2.1.0",
-        "babel-jest": "30.4.1",
-        "eslint": "10.3.0",
-        "globals": "17.6.0",
-        "jest": "30.4.2",
-        "jest-environment-jsdom": "30.4.1",
+        "babel-jest": "30.5.1",
+        "eslint": "10.10.0",
+        "globals": "17.12.0",
+        "jest": "30.5.1",
+        "jest-environment-jsdom": "30.5.1",
         "license-check-and-add": "4.0.5",
         "license-checker": "25.0.1",
         "regenerator-runtime": "0.14.1",
-        "rollup": "4.60.3",
+        "rollup": "4.63.3",
         "xhr-mock": "2.5.1"
     },
     "dependencies": {
         "@stomp/stompjs": "7.3.0",
-        "axios": "1.17.0",
+        "axios": "1.20.0",
         "js-logger": "1.6.1",
         "postmate": "1.5.2",
         "sockjs-client": "1.6.1"

skills-client-js/src/SkillsService.js

@@ -58,7 +58,7 @@ export default {
     return new Promise((resolve, reject) => {
       const xhr = new XMLHttpRequest();
       xhr.open('POST', `${conf.getServiceUrl()}/api/projects/${conf.getProjectId()}/skillsClientVersion`);
-      xhr.withCredentials = true;
+      xhr.withCredentials = conf.isPKIMode();
       if (!conf.isPKIMode()) {
         xhr.setRequestHeader('Authorization', `Bearer ${conf.getAuthToken()}`);
       }
@@ -111,7 +111,6 @@ export default {
         xhr.open('GET', authenticator);
       } else {
         xhr.open('GET', `${serviceUrl}/api/projects/${projectId}/token`);
-        xhr.withCredentials = true;
       }
 
       xhr.onreadystatechange = () => {
@@ -119,7 +118,7 @@ export default {
           if (xhr.status !== 200) {
             if (isOAuthMode && oauthRedirect && xhr.status === 401) {
               // if we get 401 and we are using OAuth, then redirect to the OAuth Provider
-              const oauthAuthenticator = `${authenticator}?skillsRedirectUri=${window.location}`;
+              const oauthAuthenticator = `${authenticator}?skillsRedirectUri=${encodeURIComponent(window.location.href)}`;
               log.info(`SkillsClient::SkillService::unable to get oAuth token, navigating to [${oauthAuthenticator}]`);
               this.assignWindowLocation(oauthAuthenticator);
               resolve();

skills-client-js/src/display/SkillsDisplayJS.js

@@ -28,7 +28,7 @@ const markedForDestruction = [];
 export default class SkillsDisplayJS {
   constructor({ options, theme, version, handleRouteChanged, userId } = {}) {
     log.debug(`SkillsClient::SkillsDisplayJS::Constructing with options [${options}], theme [${theme}], version [${version}], userId [${userId}]`);
-    this._options = { ...{ }, ...options };
+    this._options = { parentPath: window.location.pathname, ...options };
     this._theme = theme;
     this._version = version;
     this._handleRouteChanged = handleRouteChanged;

skills-client-js/src/display/SkillsLevelJS.js

@@ -55,7 +55,7 @@ export default class SkillsLevelJS {
           this._projectId = SkillsConfiguration.getProjectId();
           log.debug(`SkillsClient::SkillsLevelJS::getting projectId from SkillsConfiguration: [${this._projectId}]`);
         }
-        const requestConfig = { withCredentials: true };
+        const requestConfig = { withCredentials: SkillsConfiguration.isPKIMode() };
         if (!SkillsConfiguration.isPKIMode()) {
           const authToken = SkillsConfiguration.getAuthToken();
           requestConfig.headers = { Authorization: `Bearer ${authToken}` };

skills-client-js/src/reporter/SkillsReporter.js

@@ -138,7 +138,7 @@ const reportInternal = (resolve, reject, userSkillId, timestamp, isRetry, retryA
   const xhr = new XMLHttpRequest();
 
   xhr.open('POST', `${SkillsConfiguration.getServiceUrl()}/api/projects/${SkillsConfiguration.getProjectId()}/skills/${userSkillId}`);
-  xhr.withCredentials = true;
+  xhr.withCredentials = SkillsConfiguration.isPKIMode();
   if (!SkillsConfiguration.isPKIMode()) {
     xhr.setRequestHeader('Authorization', `Bearer ${SkillsConfiguration.getAuthToken()}`);
   }

skills-client-js/test/SkillsService.test.js

@@ -45,7 +45,23 @@ describe('OAuth auto redirect tests', () => {
     await SkillsService.getAuthenticationToken(authEndpoint, mockServiceUrl, mockProjectId, true);
 
     expect(SkillsService.assignWindowLocation).toHaveBeenCalledTimes(1)
-    expect(SkillsService.assignWindowLocation).toHaveBeenCalledWith(`${authEndpoint}?skillsRedirectUri=http://localhost/`)
+    expect(SkillsService.assignWindowLocation).toHaveBeenCalledWith(`${authEndpoint}?skillsRedirectUri=${encodeURIComponent('http://localhost/')}`)
+  });
+
+  it('oauth redirect encodes the current location so it cannot add query parameters', async () => {
+    const oauthTokenEndpoint = `${mockServiceUrl}/api/projects/${mockProjectId}/token`;
+    mock.get(oauthTokenEndpoint, (req, res) => res.status(401));
+
+    window.history.pushState({}, '', '/page?a=1&skillsRedirectUri=http://evil.example.com/');
+    const injected = window.location.href;
+
+    await SkillsService.getAuthenticationToken(authEndpoint, mockServiceUrl, mockProjectId, true);
+
+    const [redirectedTo] = SkillsService.assignWindowLocation.mock.calls[0];
+    expect(redirectedTo).toBe(`${authEndpoint}?skillsRedirectUri=${encodeURIComponent(injected)}`);
+    // the injected separators must not survive as separators
+    expect(redirectedTo.split('?')).toHaveLength(2);
+    expect(redirectedTo).not.toContain('&skillsRedirectUri=');
   });
 
   it('oauth does not auto redirect when oauthRedirect=false', async () => {

skills-client-js/test/display/SkillsDisplayJS.test.js

@@ -482,6 +482,7 @@ describe('SkillsDisplayJS', () => {
           isSummaryOnly: false,
           projectId: mockProjectId,
           serviceUrl: mockServiceUrl,
+          parentPath: '/',
         };
         mockVersion = `${Math.random()}`;
 
@@ -497,6 +498,7 @@ describe('SkillsDisplayJS', () => {
           authenticator: 'pki',
           serviceUrl: mockServiceUrl,
           projectId: mockProjectId,
+          parentPath: '/'
         };
 
         const client = new SkillsDisplayJS({
@@ -538,6 +540,7 @@ describe('SkillsDisplayJS', () => {
           authenticator: mockAuthenticator,
           serviceUrl: mockServiceUrl,
           projectId: mockProjectId,
+          parentPath: '/'
         };
         const client = new SkillsDisplayJS({
           options,
@@ -578,6 +581,7 @@ describe('SkillsDisplayJS', () => {
           serviceUrl: mockServiceUrl,
           projectId: mockProjectId,
           internalBackButton: false,
+          parentPath: '/'
         };
         const client = new SkillsDisplayJS({
           options,
@@ -618,6 +622,7 @@ describe('SkillsDisplayJS', () => {
           serviceUrl: mockServiceUrl,
           projectId: mockProjectId,
           internalBackButton: true,
+          parentPath: '/'
         };
         const client = new SkillsDisplayJS({
           options,
@@ -657,6 +662,7 @@ describe('SkillsDisplayJS', () => {
           authenticator: mockAuthenticator,
           serviceUrl: mockServiceUrl,
           projectId: mockProjectId,
+          parentPath: '/'
         };
         const client = new SkillsDisplayJS({
           options,
@@ -695,7 +701,7 @@ describe('SkillsDisplayJS', () => {
   describe('construction', () => {
     describe('options', () => {
       it('accepts options in the constructor', () => {
-        const mockOptions = { authenticator: 'option' };
+        const mockOptions = { authenticator: 'option', parentPath: 'non-default/' };
         const client = new SkillsDisplayJS({
           options: mockOptions,
         });
@@ -704,14 +710,14 @@ describe('SkillsDisplayJS', () => {
 
       it('supports null or undefined being passed', () => {
         let client = new SkillsDisplayJS({ options: null });
-        expect(client.options).toEqual({});
+        expect(client.options).toEqual({ parentPath: '/' });
         client = new SkillsDisplayJS({ options: undefined });
-        expect(client.options).toEqual({});
+        expect(client.options).toEqual({ parentPath: '/'} );
       });
 
-      it('supports empty constructor', () => {
+      it('supports empty constructor, defaults parentPath to window.location.pathname', () => {
         const client = new SkillsDisplayJS();
-        expect(client.options).toEqual({});
+        expect(client.options).toEqual({ parentPath: '/'} );
       });
 
       it('accepts valid options', () => {

skills-client-js/test/reporter/SkillsReportAuthPKI.test.js

@@ -18,21 +18,33 @@ import mock from 'xhr-mock';
 import SkillsConfiguration from '../../src/config/SkillsConfiguration';
 import { SkillsReporter } from '../../src/reporter/SkillsReporter.js';
 
+// These tests exercise HTTP authentication, not the background websocket connection.
+jest.mock('@stomp/stompjs');
+
 describe('authPkiTests()', () => {
   const mockServiceUrl = 'http://some.com';
   const mockProjectId = 'proj1';
 
-  SkillsConfiguration.configure({
-    serviceUrl: mockServiceUrl,
-    projectId: mockProjectId,
-    authenticator: 'pki',
+  // replace the real XHR object with the mock XHR object before each test
+  beforeEach(async () => {
+    mock.setup();
+    SkillsConfiguration.logout();
+    mock.get(/.*\/public\/status/, (req, res) => res.status(200).body('{"status":"OK","clientLib":{"loggingEnabled":"false","loggingLevel":"DEBUG"}}'));
+    mock.post(/.*\/api\/projects\/proj1\/skillsClientVersion/, (req, res) => res.status(200).body('{"success":true,"explanation":null}'));
+    await SkillsConfiguration.configure({
+      serviceUrl: mockServiceUrl,
+      projectId: mockProjectId,
+      authenticator: 'pki',
+    });
   });
 
-  // replace the real XHR object with the mock XHR object before each test
-  beforeEach(() => mock.setup());
-
   // put the real XHR object back and clear the mocks after each test
-  afterEach(() => mock.teardown());
+  afterEach(() => {
+    SkillsReporter.cancelRetryChecker();
+    window.localStorage.removeItem('skillTreeRetryQueue');
+    SkillsConfiguration.logout();
+    mock.teardown();
+  });
 
   it('successful call in pki mode', async () => {
     expect.assertions(2);

skills-client-js/test/reporter/SkillsReporter.test.js

@@ -55,6 +55,8 @@ describe('userSkillsService', () => {
   });
 
   afterEach(() => {
+    SkillsReporter.cancelRetryChecker();
+    jest.restoreAllMocks();
     window.XMLHttpRequest = realXMLHttpRequest;
   });
 
@@ -79,9 +81,16 @@ describe('userSkillsService', () => {
       expect(MockXMLHttpRequest.setRequestHeader).toHaveBeenCalledWith('Authorization', `Bearer ${SkillsConfiguration.getAuthToken()}`);
     });
 
-    it('enables withCredentials', () => {
+    it('disables withCredentials in token mode', () => {
       SkillsReporter.reportSkill(mockUserSkillId);
-      expect(MockXMLHttpRequest.withCredentials).toBeTruthy();
+      expect(MockXMLHttpRequest.withCredentials).toBe(false);
+    });
+
+    it('enables withCredentials without an Authorization header in PKI mode', () => {
+      SkillsConfiguration.setAuthToken('pki');
+      SkillsReporter.reportSkill(mockUserSkillId);
+      expect(MockXMLHttpRequest.withCredentials).toBe(true);
+      expect(MockXMLHttpRequest.setRequestHeader).not.toHaveBeenCalledWith('Authorization', expect.anything());
     });
 
     it('sends out the ajax request', () => {