Gateway: harden custom session-store discovery (#44176)

Merged via squash.

Prepared head SHA: 52ebbf5188b47386f2a78ac4715993bc082e911b
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com>
Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com>
Reviewed-by: @gumadeiras

src/sessions/session-id-resolution.ts

@@ -0,0 +1,37 @@
+import type { SessionEntry } from "../config/sessions.js";
+import { toAgentRequestSessionKey } from "../routing/session-key.js";
+
+export function resolvePreferredSessionKeyForSessionIdMatches(
+  matches: Array<[string, SessionEntry]>,
+  sessionId: string,
+): string | undefined {
+  if (matches.length === 0) {
+    return undefined;
+  }
+  if (matches.length === 1) {
+    return matches[0][0];
+  }
+
+  const loweredSessionId = sessionId.trim().toLowerCase();
+  const structuralMatches = matches.filter(([storeKey]) => {
+    const requestKey = toAgentRequestSessionKey(storeKey)?.toLowerCase();
+    return (
+      storeKey.toLowerCase().endsWith(`:${loweredSessionId}`) ||
+      requestKey === loweredSessionId ||
+      requestKey?.endsWith(`:${loweredSessionId}`) === true
+    );
+  });
+  if (structuralMatches.length === 1) {
+    return structuralMatches[0][0];
+  }
+
+  const sortedMatches = [...matches].toSorted(
+    (a, b) => (b[1]?.updatedAt ?? 0) - (a[1]?.updatedAt ?? 0),
+  );
+  const [freshest, secondFreshest] = sortedMatches;
+  if ((freshest?.[1]?.updatedAt ?? 0) > (secondFreshest?.[1]?.updatedAt ?? 0)) {
+    return freshest?.[0];
+  }
+
+  return undefined;
+}