Bugfix: do not load Session Id in a JWT session (#761, #964)

nebula-logger/core/main/logger-engine/classes/Logger.cls

@@ -89,16 +89,9 @@ global with sharing class Logger {
   private static final String USER_SESSION_ID {
     get {
       if (USER_SESSION_ID == null) {
-        // TODO Spring '24 release - simplify this (and other lazy-loaded values)
-        // by switching to the fancy, new ?? null coalescing operator
-        try {
-          USER_SESSION_ID = System.UserInfo.getSessionId();
-        } catch (Exception ex) {
-          USER_SESSION_ID = '';
-        }
-        // If System.UserInfo.getSessionId() returns null, set to an empty string to
-        // avoid calling System.UserInfo.getSessionId() again
-        USER_SESSION_ID = USER_SESSION_ID ?? '';
+        // If loadSessionId() returns null, set to an empty string to
+        // avoid calling loadSessionId() again
+        USER_SESSION_ID = loadSessionId() ?? '';
       }
       return USER_SESSION_ID;
     }
@@ -3937,6 +3930,22 @@ global with sharing class Logger {
     }
   }
 
+  private static String loadSessionId() {
+    LoggerSObjectProxy.AuthSession authSessionProxy = LoggerEngineDataSelector.getInstance().getCachedAuthSessionProxy();
+
+    if (authSessionProxy != null && authSessionProxy.IsAssociatedWithJwtAccessToken) {
+      // If the user is authenticated via a JWT access token, 
+      // calling `getSessionId()` will throw an uncatchable exception
+      return null;
+    }
+
+    try {
+      return System.UserInfo.getSessionId();
+    } catch (Exception ex) {
+      return null;
+    }
+  }
+
   private static void setAsyncContext(AsyncContext asyncContext) {
     // Only set the async context the first time that a non-null value is provided
     // Previous versions of Nebula Logger would always set it, but that wasn't the

nebula-logger/core/main/logger-engine/classes/LoggerEngineDataSelector.cls

@@ -48,6 +48,7 @@ public without sharing virtual class LoggerEngineDataSelector {
     List<SObject> authSessionRecords = [
       SELECT
         Id,
+        IsAssociatedWithJwtAccessToken,
         LoginType,
         LoginHistoryId,
         LoginHistory.Application,
@@ -61,8 +62,12 @@ public without sharing virtual class LoggerEngineDataSelector {
         SourceIp,
         UsersId
       FROM AuthSession
-      WHERE UsersId IN :userIds AND IsCurrent = TRUE
-      ORDER BY ParentId NULLS FIRST
+      WHERE UsersId IN :userIds 
+      AND (
+        IsCurrent = TRUE
+        OR IsAssociatedWithJwtAccessToken = TRUE
+      )
+      ORDER BY ParentId NULLS LAST, IsCurrent DESC
     ];
 
     List<LoggerSObjectProxy.AuthSession> authSessionProxies = (List<LoggerSObjectProxy.AuthSession>) System.JSON.deserialize(
@@ -75,7 +80,9 @@ public without sharing virtual class LoggerEngineDataSelector {
     }
 
     for (LoggerSObjectProxy.AuthSession authSessionProxy : authSessionProxies) {
-      userIdToAuthSessionProxy.put(authSessionProxy.UsersId, authSessionProxy);
+      if (!userIdToAuthSessionProxy.containsKey(authSessionProxy.UsersId)) {
+        userIdToAuthSessionProxy.put(authSessionProxy.UsersId, authSessionProxy);
+      }
     }
     return userIdToAuthSessionProxy;
   }

nebula-logger/core/main/logger-engine/classes/LoggerSObjectProxy.cls

@@ -27,6 +27,7 @@ public without sharing class LoggerSObjectProxy {
     public String SessionType;
     public String SourceIp;
     public Id UsersId;
+    public Boolean IsAssociatedWithJwtAccessToken;
   }
 
   /**