MLE-30260 replace Math.random with crypto.randomBytes for SessionID

[RitaChen609]

Summary

SessionState previously generated session IDs using Math.floor(Math.random() * Number.MAX_SAFE_INTEGER). Math.random() in V8 is based on xorshift128+, a non-cryptographic PRNG whose state can be reconstructed after observing ~64 outputs, making session IDs potentially predictable (CWE-338, CVSS 4.8 Medium).

The fix replaces it with crypto.randomBytes(8).toString('hex'), which produces a 16-character hex string using the OS CSPRNG — matching the format MarkLogic itself uses for server-generated SessionID cookies (e.g., Set-Cookie: SessionID=53f1ed9b18ed7196). The return type of sessionId() changes from number to string; both existing call sites (string concatenation in endpoint-proxy.js and a template literal in sessionsTest.js) are unaffected.

New Unit tests (no server required)

npx mocha test-basic/session-state-test.js

SessionState
✔ sessionId() returns a non-empty string
✔ sessionId() returns a 16-character hex string (8 random bytes)
✔ sessionId() returns the same value on repeated calls to the same instance
✔ two instances created in rapid succession produce different session IDs

4 passing (5ms)

Existing Integration tests (requires live MarkLogic server with proxy test data loaded)

npx gulp setupProxyTests # loads ML modules + generates proxy stubs
npx mocha test-basic-proxy/lib/positive/sessionsTest.js

session service
✔ field
✔ transaction (38ms)
✔ concurrent (758ms)
negative
✔ null
✔ transaction without session (1032ms)
✔ field without session

6 passing (2s)

[Copilot]

Pull request overview

This PR strengthens SessionState session ID generation by replacing a predictable Math.random()-derived value with a cryptographically secure identifier derived from crypto.randomBytes(), aligning the format with MarkLogic’s server-generated SessionID cookie shape.

Changes:

• Replace SessionState session ID generation with crypto.randomBytes(8).toString('hex') and update JSDoc return type to string.
• Add unit tests validating session ID format, stability per instance, and basic uniqueness across instances.
• Document the security fix in the changelog and ignore generated artifacts/proxy stubs via .gitignore.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated no comments.

File	Description
lib/session-state.js	Switches session ID generation to CSPRNG-backed 16-char hex string and updates return type documentation.
test-basic/session-state-test.js	Adds unit coverage for session ID type/format/stability and basic uniqueness.
CHANGELOG.md	Records the security-related behavior change and notes the return type change.
.gitignore	Ignores generated documents and generated proxy stub outputs while keeping hand-written *Test.js files tracked.