Module server_session 

Shared session-backend plumbing for the interactive auth plugins.

One config surface (session.storage: cookie|redis + session.store: <name>, with the flat session_storage/session_store UI fallbacks) and one establish/load/destroy seam, so the five session plugins differ only in payload shape and flow, not in storage mechanics. Cookie mode is byte-identical to the pre-existing behavior; redis mode puts the SAME sealed bytes server-side and hands the browser a bare 128-bit id.

Enums

SessionBackend

Functions

destroy

Revokes the session and returns the delete-cookie header value. A store delete failure is an Err — server-side revocation is the entire point of redis mode, so a logout that silently leaves the session live must fail loudly (503) instead.

establish

Seals payload and returns the session Set-Cookie value. Cookie mode: the sealed blob IS the cookie. Redis mode: the sealed blob goes under a fresh random id; the cookie carries the bare id.

load

Opens a session cookie value. Ok(None) = treat as unauthenticated (absent/expired/tampered/junk id); Err = store outage (503, never 401).

meta_now

Builds the meta envelope from the context’s __route/__policy vars.

nested_or_flat 🔒

now_unix 🔒

parse_backend

Parses session.storage / session.store and resolves the named store at construction time — a bad reference fails policy compilation.

update

Rewrites an existing session’s payload (token refresh). Redis mode: put under the SAME id (cookie unchanged → returns None). Cookie mode: the caller must send a fresh cookie (returns Some(set_cookie)).