OneRM Backend

Problem¶

Every IIKO fetcher opens a brand-new API session and closes it again around a single request:

• IikoOlapV2RequestsFetchingService.fetchOlapData — fetchToken(...) at line 35, releaseToken(token) at line 56
• DepartmentsFetchingService.fetchDepartments — same shape
• IikoServerEmployeesFetchingService.fetchEmployees — same shape

So one logical OLAP data point costs three HTTP round-trips (/api/auth → /api/v2/reports/olap → /api/logout) plus two DB writes for the token row.

This is the real source of the "IIKO is single-threaded" symptom. IIKO licenses a limited number of concurrent API sessions; we spend that budget on our own login/logout churn, and the auth endpoint serialises.

A token cache already exists and is simply not used on this path: IikoAuthService.restoreToken() → IikoAuthTokensService.findActiveAndExpireOthers(), with a 3-minute expiry stamped in IikoAuthTokensFetchingService.fetchToken. The OLAP fetcher bypasses IikoAuthService and calls IikoAuthTokensFetchingService directly.

Proposed change¶

Introduce a single session holder (e.g. IikoSessionService) that all fetchers go through:

• hands out the current token, fetching a new one only when there is none or the stored expiration has passed (refresh a little early, e.g. 30s of slack);
• refreshes and retries once when IIKO answers with an expired/invalid-token error;
• releases the session once, at the end of the command run (JVM shutdown hook), not per request.

Then change IikoOlapV2RequestsFetchingService, DepartmentsFetchingService and IikoServerEmployeesFetchingService to use it, and drop their per-call fetchToken/releaseToken pairs.

Keep the login/hashedPassword override parameters working — they should get their own cached session keyed by login.

Acceptance¶

• A run of iiko-stats-data-sync produces one /api/auth call per token lifetime, not one per OLAP request.
• /api/logout is called once at the end of the run.
• No behavioural change to the returned data.