Add experimental support for long running MATLAB sessions.

Author: krisctl

matlab_proxy/util/mw.py

@@ -1,14 +1,16 @@
-# Copyright 2020-2024 The MathWorks, Inc.
+# Copyright 2020-2026 The MathWorks, Inc.
 
 import asyncio
 import os
 import select
 import xml.etree.ElementTree as ET
 
 import aiohttp
+
 from matlab_proxy.default_configuration import config
-from matlab_proxy.util import mwi
 from matlab_proxy.settings import get_process_startup_timeout
+from matlab_proxy.util import mwi
+from matlab_proxy.util.mwi import environment_variables as mwi_env
 from matlab_proxy.util.mwi.exceptions import (
     EntitlementError,
     MatlabError,
@@ -146,6 +148,14 @@ async def fetch_access_token(mwa_api_endpoint, identity_token, source_id):
     Returns:
         Dict : Containing the Access token.
     """
+    # MWAJ -> Long-running session (90 days), MWAS -> Short-running session (24 hours)
+    # It comes with the security risk of being stolen and used by an attacker for an extended period.
+    # Hence, it is recommended to use MWAJ only when necessary.
+    access_token_type = (
+        "MWAJ" if mwi_env.Experimental.is_long_running_session_enabled() else "MWAS"
+    )
+    logger.debug(f"Requesting access token of type: {access_token_type}")
+
     async with aiohttp.ClientSession(trust_env=True) as client_session:
         async with client_session.post(
             f"{mwa_api_endpoint}/tokens/access",
@@ -157,7 +167,7 @@ async def fetch_access_token(mwa_api_endpoint, identity_token, source_id):
             data=aiohttp.FormData(
                 {
                     "tokenString": identity_token,
-                    "type": "MWAS",
+                    "type": access_token_type,
                     "sourceId": source_id,
                 }
             ),

matlab_proxy/util/mwi/environment_variables.py

@@ -1,4 +1,4 @@
-# Copyright 2020-2025 The MathWorks, Inc.
+# Copyright 2020-2026 The MathWorks, Inc.
 """This file lists and exposes the environment variables which are used by the integration."""
 
 import os
@@ -228,3 +228,15 @@ def use_rich_logger():
     def get_licmode_override():
         """Returns the licmode oveerride if set"""
         return os.environ.get("MWI_LICMODE_OVERRIDE", None)
+
+    @staticmethod
+    def get_env_name_enable_long_running_session():
+        """Returns the environment variable name used to enable long-running session support"""
+        return "MWI_ENABLE_LONG_RUNNING_SESSION"
+
+    @staticmethod
+    def is_long_running_session_enabled():
+        """Returns true if long-running session support is enabled."""
+        return _is_env_set_to_true(
+            Experimental.get_env_name_enable_long_running_session()
+        )

tests/integration/integration_tests_with_license/test_long_running_session.py

@@ -0,0 +1,153 @@
+# Copyright 2026 The MathWorks, Inc.
+
+"""
+Integration test to verify that when MWI_ENABLE_LONG_RUNNING_SESSION is set,
+MATLAB receives an `MWAJ` token type instead of the default `MWAS`.
+"""
+
+import os
+import re
+import time
+from pathlib import Path
+from urllib.parse import parse_qs, urlparse
+
+import pytest
+
+import matlab_proxy.settings as settings
+from matlab_proxy.constants import MWI_AUTH_TOKEN_NAME_FOR_HTTP
+from matlab_proxy.util import system
+from tests.integration.integration_tests_with_license.test_http_end_points import (
+    _check_matlab_status,
+)
+from tests.integration.utils import integration_tests_utils as utils
+from tests.utils.logging_util import create_integ_test_logger
+
+_logger = create_integ_test_logger(__name__)
+
+MAX_TIMEOUT = settings.get_process_startup_timeout()
+
+MATLAB_SCRIPT_TO_VERIFY_TOKEN_TYPE = (
+    Path(__file__).parent / "verify_token_type.m"
+).read_text()
+
+
+class LongRunningSessionMATLABServer:
+    """
+    Context Manager that launches matlab-proxy with MWI_ENABLE_LONG_RUNNING_SESSION
+    enabled and a startup script that verifies the token type.
+    """
+
+    def __init__(self):
+        self.proc = None
+        self.dpipe = None
+        self.mwi_app_port = None
+        self.mwi_base_url = None
+        self.headers = None
+        self.connection_scheme = None
+        self.url = None
+
+    async def __aenter__(self):
+        _logger.info(
+            "Setting up MATLAB Server with MWI_ENABLE_LONG_RUNNING_SESSION enabled"
+        )
+
+        self.dpipe = os.pipe2(os.O_NONBLOCK) if system.is_linux() else os.pipe()
+        self.mwi_app_port = utils.get_random_free_port()
+        self.mwi_base_url = "/matlab-test"
+
+        input_env = {
+            "MWI_APP_PORT": self.mwi_app_port,
+            "MWI_BASE_URL": self.mwi_base_url,
+            "MWI_ENABLE_LONG_RUNNING_SESSION": "True",
+            "MWI_MATLAB_STARTUP_SCRIPT": MATLAB_SCRIPT_TO_VERIFY_TOKEN_TYPE,
+        }
+
+        self.proc = await utils.start_matlab_proxy_app(
+            out=self.dpipe[1], input_env=input_env
+        )
+
+        utils.wait_server_info_ready(self.mwi_app_port)
+        parsed_url = urlparse(utils.get_connection_string(self.mwi_app_port))
+
+        self.headers = {
+            MWI_AUTH_TOKEN_NAME_FOR_HTTP: (
+                parse_qs(parsed_url.query)[MWI_AUTH_TOKEN_NAME_FOR_HTTP][0]
+                if MWI_AUTH_TOKEN_NAME_FOR_HTTP in parse_qs(parsed_url.query)
+                else ""
+            )
+        }
+        self.connection_scheme = parsed_url.scheme
+        self.url = parsed_url.scheme + "://" + parsed_url.netloc + parsed_url.path
+        return self
+
+    async def __aexit__(self, exc_type, exc_value, exc_traceback):
+        import asyncio
+
+        _logger.info("Tearing down MATLAB Server (long-running session test)")
+        try:
+            self.proc.terminate()
+            await asyncio.wait_for(self.proc.wait(), timeout=10)
+        except asyncio.TimeoutError:
+            self.proc.kill()
+            await self.proc.wait()
+
+
+@pytest.fixture
+async def matlab_proxy_long_running_session_fixture():
+    """Pytest fixture that yields a matlab-proxy server with long-running session enabled."""
+    try:
+        async with LongRunningSessionMATLABServer() as server:
+            yield server
+    except ProcessLookupError as e:
+        _logger.debug(f"ProcessLookupError: {e}")
+
+
+async def test_long_running_session_uses_mwaj_token(
+    matlab_proxy_long_running_session_fixture,
+):
+    """Test that when MWI_ENABLE_LONG_RUNNING_SESSION is set, MATLAB is started
+    with an MWAJ token and can verify this via the MathWorks auth API."""
+    fixture = matlab_proxy_long_running_session_fixture
+
+    status = _check_matlab_status(fixture, "up")
+    assert status == "up", f"MATLAB did not start, status: {status}"
+
+    read_descriptor, write_descriptor = fixture.dpipe
+    number_of_bytes = 4000
+
+    if read_descriptor:
+        line = os.read(read_descriptor, number_of_bytes).decode("utf-8")
+        process_logs = line.strip()
+
+        match = re.search(
+            r"The results of executing MWI_MATLAB_STARTUP_SCRIPT are stored at: \s*(.*?startup_code_output\.txt)",
+            process_logs,
+        )
+        assert match, (
+            f"Could not find startup code output file path in logs. "
+            f"Log excerpt: {process_logs[:2000]}"
+        )
+
+        output_file_path = match.group(1)
+        _logger.info(f"Startup code output file: {output_file_path}")
+
+        # The startup script makes a network call to the auth service,
+        # so poll for the output file to appear.
+        start_time = time.time()
+        while not os.path.exists(output_file_path):
+            if time.time() - start_time > MAX_TIMEOUT:
+                pytest.fail(
+                    f"Startup code output file not found at {output_file_path} "
+                    f"after {MAX_TIMEOUT}s"
+                )
+            time.sleep(1)
+
+        with open(output_file_path, "r") as f:
+            content = f.read()
+
+        assert (
+            "Token Type: MWAJ" in content
+        ), f"Expected token type MWAJ but got: {content}"
+
+    os.close(read_descriptor)
+    os.close(write_descriptor)

tests/integration/integration_tests_with_license/verify_token_type.m

@@ -0,0 +1,41 @@
+% Copyright 2026 The MathWorks, Inc.
+%
+% verify_token_type - Verify the type of access token used to start MATLAB.
+%
+% This script queries the MathWorks authentication service to determine the
+% token type (e.g., MWAS or MWAJ) associated with the current MATLAB session.
+%
+% When MWI_ENABLE_LONG_RUNNING_SESSION is set, the token type should be MWAJ.
+% Otherwise, the default token type is MWAS.
+%
+% Output:
+%   Prints "Token Type: <type>" to stdout, where <type> is the
+%   loginIdentifierType returned by the authentication service.
+
+% Retrieve the current session identity token from the environment variable
+token = getenv('MLM_WEB_USER_CRED');
+
+% Query the MathWorks authentication service to inspect the token
+wsEnv = getenv('WS_ENV');
+if isempty(wsEnv) || strcmp(wsEnv, 'production')
+    authUrl = 'https://login.mathworks.com/authenticationws/service/v4/tokens';
+else
+    authUrl = sprintf('https://login-%s.mathworks.com/authenticationws/service/v4/tokens', wsEnv);
+end
+
+payload = struct('tokenString', token, 'tokenPolicyName', 'L1');
+jsonBody = jsonencode(payload);
+
+options = weboptions( ...
+    'MediaType', 'application/json', ...
+    'HeaderFields', { ...
+        'accept', 'application/json'; ...
+        'x_mw_ws_callerid', 'desktop-jupyter' ...
+    }, ...
+    'RequestMethod', 'post', ...
+    'Timeout', 30 ...
+);
+
+response = webwrite(authUrl, jsonBody, options);
+
+fprintf('Token Type: %s', response.loginIdentifierType);

tests/unit/util/test_mw.py

@@ -1,6 +1,7 @@
-# Copyright 2020-2025 The MathWorks, Inc.
+# Copyright 2020-2026 The MathWorks, Inc.
 
 import datetime
+import os
 import random
 import re
 import secrets
@@ -9,6 +10,7 @@
 from http import HTTPStatus
 
 import pytest
+
 from matlab_proxy import settings
 from matlab_proxy.util import mw, system
 from matlab_proxy.util.mwi import exceptions
@@ -171,6 +173,57 @@ async def test_fetch_access_token(mwa_api_data, fetch_access_token_valid_json, m
     assert json_data["accessTokenString"] == res["token"]
 
 
+async def test_fetch_access_token_uses_mwas_by_default(
+    mwa_api_data, fetch_access_token_valid_json, mocker
+):
+    """Test that fetch_access_token requests MWAS token type by default."""
+    json_data = fetch_access_token_valid_json
+    payload = dict(accessTokenString=json_data["accessTokenString"])
+    mock_resp = MockResponse(payload=payload, ok=True)
+
+    mocked = mocker.patch("aiohttp.ClientSession.post", return_value=mock_resp)
+    mocker.patch.dict(os.environ, {}, clear=False)
+    os.environ.pop("MWI_ENABLE_LONG_RUNNING_SESSION", None)
+
+    await mw.fetch_access_token(
+        mwa_api_data.mwa_api_endpoint,
+        mwa_api_data.identity_token,
+        mwa_api_data.source_id,
+    )
+
+    _, _, kwargs = mocked.mock_calls[0]
+    form_data = kwargs["data"]
+    type_field = form_data._fields[1]
+    assert type_field[0]["name"] == "type"
+    assert type_field[2] == "MWAS"
+
+
+async def test_fetch_access_token_uses_mwaj_when_long_running_session_enabled(
+    mwa_api_data, fetch_access_token_valid_json, mocker
+):
+    """Test that fetch_access_token requests MWAJ token type when long-running session is enabled."""
+    json_data = fetch_access_token_valid_json
+    payload = dict(accessTokenString=json_data["accessTokenString"])
+    mock_resp = MockResponse(payload=payload, ok=True)
+
+    mocked = mocker.patch("aiohttp.ClientSession.post", return_value=mock_resp)
+    mocker.patch.dict(
+        os.environ, {"MWI_ENABLE_LONG_RUNNING_SESSION": "True"}, clear=False
+    )
+
+    await mw.fetch_access_token(
+        mwa_api_data.mwa_api_endpoint,
+        mwa_api_data.identity_token,
+        mwa_api_data.source_id,
+    )
+
+    _, _, kwargs = mocked.mock_calls[0]
+    form_data = kwargs["data"]
+    type_field = form_data._fields[1]
+    assert type_field[0]["name"] == "type"
+    assert type_field[2] == "MWAJ"
+
+
 async def test_fetch_access_token_licensing_error(mwa_api_data, mocker):
     """Test to check mw.fetch_access_token() method raises a mwi_exceptions.OnlineLicensingError.