🐛 api-server: fixes product header contamination in webserver's client session (#7865)

Author: pcrespov

packages/service-library/src/servicelib/long_running_tasks/task.py

@@ -6,7 +6,7 @@
 from collections import deque
 from contextlib import suppress
 from datetime import datetime
-from typing import Any, Protocol
+from typing import Any, Protocol, TypeAlias
 from uuid import uuid4
 
 from models_library.api_schemas_long_running_tasks.base import (
@@ -53,8 +53,8 @@ def _mark_task_to_remove_if_required(
             tasks_to_remove.append(task_id)
 
 
-TrackedTaskGroupDict = dict[TaskId, TrackedTask]
-TaskContext = dict[str, Any]
+TrackedTaskGroupDict: TypeAlias = dict[TaskId, TrackedTask]
+TaskContext: TypeAlias = dict[str, Any]
 
 
 class TasksManager:

services/api-server/src/simcore_service_api_server/api/dependencies/services.py

@@ -12,6 +12,7 @@
 from ..._service_programs import ProgramService
 from ..._service_solvers import SolverService
 from ..._service_studies import StudyService
+from ...services_http.webserver import AuthSession
 from ...services_rpc.catalog import CatalogService
 from ...services_rpc.wb_api_server import WbApiRpcClient
 from ...utils.client_base import BaseServiceClientApi

services/api-server/src/simcore_service_api_server/api/dependencies/webserver_http.py

@@ -5,13 +5,16 @@
 from cryptography.fernet import Fernet
 from fastapi import Depends, FastAPI, HTTPException, status
 from fastapi.requests import Request
-from servicelib.rest_constants import X_PRODUCT_NAME_HEADER
 
 from ..._constants import MSG_BACKEND_SERVICE_UNAVAILABLE
 from ...core.settings import ApplicationSettings, WebServerSettings
 from ...services_http.webserver import AuthSession
 from .application import get_app, get_settings
-from .authentication import Identity, get_active_user_email, get_current_identity
+from .authentication import (
+    Identity,
+    get_active_user_email,
+    get_current_identity,
+)
 
 
 def _get_settings(
@@ -68,14 +71,14 @@ def get_webserver_session(
     Lifetime of AuthSession wrapper is one request because it needs different session cookies
     Lifetime of embedded client is attached to the app lifetime
     """
-    product_header: dict[str, str] = {X_PRODUCT_NAME_HEADER: f"{identity.product_name}"}
-    session = AuthSession.create(app, session_cookies, product_header)
+    session = AuthSession.create(
+        app,
+        session_cookies=session_cookies,
+        product_name=identity.product_name,
+        user_id=identity.user_id,
+    )
     assert isinstance(session, AuthSession)  # nosec
     return session
 
 
-__all__: tuple[str, ...] = (
-    "AuthSession",
-    "get_session_cookie",
-    "get_webserver_session",
-)
+__all__: tuple[str, ...] = ("AuthSession",)