← Commit history

v1.9.139: fix APS userinfo cache key collision (JWT prefix) - dashboard identity showed first account for all

John Lauer ·8b745cb759 ·1mo ago ·parent 33b8137
4 files changed +14−8
BRIDGE_VERSION+1−1
@@ -1 +1 @@-1.9.138\ No newline at end of file+1.9.139\ No newline at end of file
adom-bridge-fusion-manifest.json+5−5
@@ -1,13 +1,13 @@ {   "manifest_version": 1,   "name": "fusion360",-  "version": "1.9.138",-  "url": "https://wiki.adom.inc/download/adom/fusion-bridge/1.9.158/adom-bridge-fusion-v1.9.138.zip",-  "sha256": "e10b353dc4387216f5a84309cbbb5b97396e752f6cc317483bb6d7e8672f09dd",-  "size": 474554,+  "version": "1.9.139",+  "url": "https://wiki.adom.inc/download/adom/fusion-bridge/1.9.139/adom-bridge-fusion-v1.9.139.zip",+  "sha256": "c4802f411504b8b3846bd60ff7906006aead2a32b275e879b100508f384f0c5c",+  "size": 474763,   "verbPrefixes": [     "fusion_"   ],   "healthEndpoint": "/status",-  "released_at": "2026-08-19T00:00:00Z"+  "released_at": "2026-08-22T16:00:05Z" }\ No newline at end of file
aps.py+7−1
@@ -768,7 +768,13 @@ def _aps_user_info() -> dict:         at = None     if not at:         return {}-    key = at[:24]+    # Key by a hash of the FULL token, never a prefix: every Autodesk token is a+    # JWT that begins with the identical base64 header ("eyJhbGciOi..."), so at[:24]+    # collides across ALL users and the cache returned the FIRST account's identity+    # for every later one (john shown while jlauer12 was actually signed in — caught+    # live 2026-08-22 during the multi-account auth tests). A full-token hash is unique+    # per token and never stores the secret itself.+    key = hashlib.sha256(at.encode()).hexdigest()     hit = _USERINFO_CACHE.get(key)     if hit:         return hit
bridge.json+1−1
@@ -2,7 +2,7 @@   "manifest_version": 1,   "name": "fusion360",   "displayName": "Autodesk Fusion 360",-  "version": "1.9.138",+  "version": "1.9.139",   "description": "Drive Autodesk Fusion 360 from the cloud: launch Fusion, electronics board layout, design rules, exports (STEP/IGES/STL/3MF/USDZ/OBJ/DXF/DWG/Gerbers/BOM/CPL), fast APS server-indexed cloud search plus browse/recent/file-info/versions, cloud file download/upload and folder creation, and in-app parametric modeling (fusion_run_modeling_script). Never-charge: APS calls are capped to the free tier.",   "homepage": "https://wiki.adom.inc/adom/fusion-bridge",   "author": "Adom Inc.",