fix: Harden SessionManager + KeycloakSessionHandler against cross-DB JWT reuse, race conditions and stale role/session caches

[EdwinBetanc0urt]

fix: Harden SessionManager + KeycloakSessionHandler against cross-DB JWT reuse, race conditions and stale role/session caches

Brings into the library a bundle of hardening fixes that have been living as local overlays in adempiere-grpc-server, adempiere-report-engine-service and sabana for the past weeks. With this merge those consumers can drop their patched copies and inherit the same behaviour from the JAR.

The bundle closes four classes of problems reported under issue #2389 and its follow-ups.

SessionManager

JWT can no longer be reused across databases (opt-in)

• HMAC signing key derivation: when ECA52_JWT_BIND_TO_DATABASE=Y is set in AD_SysConfig (default N), the signing key becomes HmacSHA256(configuredSecret, dbName) instead of the configured secret directly. Two installations sharing ECA52_JWT_SECRET_KEY no longer produce the same effective key.
• New opaque tenant_id claim (SHA-256(dbName) in hex) emitted alongside the existing claims, also gated on the flag. getSessionFromToken rejects tokens whose tenant_id does not match the current installation before any DB access.
• The flag is opt-in / default OFF so deployments with several services on different release cadences can adopt the new code without breaking JWT interop. Operators flip the flag in AD_SysConfig once every connected service is on the new build; existing JWTs in circulation get rejected after the flip, users re-log once.

Multi-tenant integrations can plug their own DB-name resolver

• New public setDatabaseNameResolver(Supplier<String>). Single-tenant services keep the default (CConnection.get().getDbName()); multi-tenant services that route per request (e.g. Sabana) register a per-thread resolver that returns the current tenant's catalog. Avoids the JVM-wide singleton drifting under concurrent requests for different tenants.

Cross-validation of JWT claims against the AD_Session row

• After loading the AD_Session from DB, getSessionFromToken checks:
  • JWT.AD_User_ID == session.getCreatedBy(),
  • JWT.AD_Client_ID == session.getAD_Client_ID(),
  • session.isProcessed() == false.
• Mismatch or processed session → @Invalid@ @AD_Session_ID@. Blocks JWT replay after server-side logout and AD_Session_ID collisions across installations.
• These checks are always on — no flag needed; they read claims that have always been in the JWT, so they interoperate with both old and new tokens.

New helper: createTokenFromSession(MSession, boolean)

• Lets callers build the MSession externally (e.g. change-role / change-organization flows that need the instance before issuing the token) and mint the JWT for it without re-creating the session. createSessionAndGetToken now delegates to it — DRY.

KeycloakSessionHandler

Refuse rows whose WebSession doesn't belong to the Keycloak flow

• loadExistingSessionContext rejects an AD_Session whose WebSession does not start with "keycloak:". Protects against AD_Session_ID collisions with rows created by other flows.

Force-reload of MRole when resolving a Keycloak session

• After setting #AD_Role_ID / #AD_Client_ID / #AD_Org_ID on the context, evict the cached MRole and reload with reload=true. Rebuilds access SQL with the current tenant context — protects against stale role instances cached under a previous #AD_Client_ID.

Per-sid lock prevents duplicate AD_Session rows under concurrency

• New ConcurrentMap<String, Object> sidLocks. The slow path (DB-fallback + create) runs inside synchronized (sidLocks.computeIfAbsent(sid, …)) with double-checked cache and DB lookup inside the lock. The winner creates; every loser observes the winner's session. The fast path (cache hit) stays outside the lock.

Downstream coordination

Each consumer (adempiere-grpc-server, adempiere-report-engine-service, sabana) currently ships a byte-identical copy of these two files in src/patches/.../authentication/ (or equivalent). Once this PR releases:

1. Cut a new adempiere-base version and publish.
2. Open follow-up PRs in each consumer that:
   • Bump the dependency.
   • Delete the local patched copies of SessionManager.java and KeycloakSessionHandler.java.
3. Sabana's BaseInit.loadInitValues already calls SessionManager.setDatabaseNameResolver(...) — no change needed there once the new lib is on the classpath.

Until step 2 lands in each consumer, the local patches will continue to shadow the JAR; consumers running mixed versions will see no behavioural change but also no benefit from the new lib.

Test

• Boot a single backend connected to one DB, log in, hit endpoints → expected: behaviour unchanged (flag default OFF).
• Set ECA52_JWT_BIND_TO_DATABASE=Y in AD_SysConfig, restart → existing JWTs rejected (signature mismatch), new logins issue tokens with the tenant_id claim, cross-DB JWT replay attempts rejected with @Invalid@ @AD_Session_ID@.
• N parallel requests with the same fresh Keycloak sid (no AD_Session yet) → exactly one row in AD_Session with WebSession='keycloak:<sid>' (was 1–N before).
• After explicit logout, replay the same JWT → rejected.

Additional context

ref https://github.com/solop-develop/adempiere-solop/issues/2389
ref https://github.com/solop-develop/adempiere-solop/issues/1356