using is_session_fini, the commit before this one is working ...

attachments/kong/plugins/open-appsec-waf-kong-plugin/handler.lua

@@ -13,10 +13,10 @@ function NanoHandler.init_worker()
 end
 
 function NanoHandler.access(conf)
-    kong.log.err("1-ACCESS PHASE START ========================================")
+    kong.log.debug("1-ACCESS PHASE START ========================================")
     
     if not kong.router.get_route() then
-        kong.log.err("ACCESS SKIPPED: no route matched")
+        kong.log.debug("ACCESS SKIPPED: no route matched")
         return
     end
     
@@ -26,18 +26,18 @@ function NanoHandler.access(conf)
         request_path:match("^/_health") or
         request_path:match("^/metrics")
     ) then
-        kong.log.err("ACCESS SKIPPED: internal endpoint: ", request_path)
+        kong.log.debug("ACCESS SKIPPED: internal endpoint: ", request_path)
         return
     end
     
     if ngx.var.internal then
-        kong.log.err("ACCESS SKIPPED: internal subrequest")
+        kong.log.debug("ACCESS SKIPPED: internal subrequest")
         return
     end
     
     local request_uri = ngx.var.request_uri
     if not request_uri or request_uri == "" then
-        kong.log.err("ACCESS SKIPPED: TLS handshake or no URI")
+        kong.log.debug("ACCESS SKIPPED: TLS handshake or no URI")
         return
     end
     
@@ -184,7 +184,7 @@ function NanoHandler.access(conf)
 end
 
 function NanoHandler.header_filter(conf)
-    kong.log.err("2-HEADER_FILTER PHASE START")
+    kong.log.debug("2-HEADER_FILTER PHASE START")
     local ctx = kong.ctx.plugin
     
     if ctx.blocked or ctx.inspection_complete then
@@ -192,7 +192,7 @@ function NanoHandler.header_filter(conf)
     end
 
     if not ctx.session_id or not ctx.session_data then
-        kong.log.err("No session data in header_filter")
+        kong.log.debug("No session data in header_filter")
         return
     end
 
@@ -232,12 +232,12 @@ function NanoHandler.body_filter(conf)
     
     -- Log first chunk only
     if not ctx.body_filter_start_time then
-        kong.log.err("3-BODY_FILTER PHASE START")
+        kong.log.debug("3-BODY_FILTER PHASE START")
     end
     
-    -- Fast path: skip if already blocked or inspection complete
-    if ctx.blocked or ctx.inspection_complete then
-        ngx.arg[1] = nil  -- Discard chunk
+    -- Fast path: skip if already blocked
+    if ctx.blocked then
+        ngx.arg[1] = nil  -- Discard chunk if blocked
         collectgarbage("step", 100)
         return
     end
@@ -248,6 +248,12 @@ function NanoHandler.body_filter(conf)
         return
     end
     
+    -- Check if session is already finalized (like Envoy/nginx do)
+    if nano.is_session_finalized(ctx.session_data) then
+        kong.log.debug("Skipping already inspected session")
+        return  -- Let remaining data pass through
+    end
+
     -- Initialize timeout tracking on first chunk
     if not ctx.body_filter_start_time then
         ctx.body_filter_start_time = ngx.now() * 1000
@@ -294,6 +300,10 @@ function NanoHandler.body_filter(conf)
                 ctx.session_id = nil
                 ctx.session_data = nil
                 return result
+            elseif verdict == nano.AttachmentVerdict.ACCEPT then
+                -- Final ACCEPT verdict received - session is now finalized at C level
+                kong.log.debug("ACCEPT verdict received - session finalized")
+                ctx.inspection_complete = true
             end
         else
             kong.log.err("nano.send_body failed: ", tostring(result), " - cleaning up session")
@@ -309,6 +319,8 @@ function NanoHandler.body_filter(conf)
 
     -- Process EOF
     if eof then
+        -- Only send end_inspection if session not already finalized
+        if not nano.is_session_finalized(ctx.session_data) then
             local ok, result = pcall(function()
                 return {nano.end_inspection(ctx.session_id, ctx.session_data, nano.HttpChunkType.HTTP_RESPONSE_END)}
             end)
@@ -326,30 +338,26 @@ function NanoHandler.body_filter(conf)
                     ctx.session_id = nil
                     ctx.session_data = nil
                     return result
-            else
-                ngx.arg[1] = nil  -- Discard chunk
-                ctx.inspection_complete = true
-                nano.fini_session(ctx.session_data)
-                nano.cleanup_all()
-                collectgarbage("collect")
-                ctx.session_id = nil
-                ctx.session_data = nil
                 end
             else
                 kong.log.err("nano.end_inspection failed: ", tostring(result), " - cleaning up session")
+            end
+        end
+        
+        -- Clean up session at EOF
+        if not ctx.inspection_complete then
             ctx.inspection_complete = true
             nano.fini_session(ctx.session_data)
             nano.cleanup_all()
             collectgarbage("collect")
             ctx.session_id = nil
             ctx.session_data = nil
-            return
         end
     end
 end
 
 function NanoHandler.log(conf)
-    kong.log.err("4-LOG PHASE START")
+    kong.log.debug("4-LOG PHASE START")
     local ctx = kong.ctx.plugin
     
     -- Force GC if memory is high