Module sessions 

Server-side sessions for the interactive auth plugins.

In session.storage: redis mode a plugin’s session cookie shrinks to a bare random 128-bit id; the payload — the same bytes the plugin seals into the cookie today — is stored sealed-at-rest under that id with a small unencrypted SessionMeta envelope for the operator surface (list/revoke). The store never sees plaintext tokens.

Backends implement SessionStore; RedisSessionStore (the redis submodule, redis-store feature) is the real one, [FakeSessionStore] serves unit tests. Failure semantics are the spec’s: a StoreError surfaces as a 503 on the plugin’s error port — never 401, never fail-open.

Modules

redis

Redis/Valkey-backed SessionStore (redis-store feature).

Structs

SessionFilter

Listing filter; cursor is backend-opaque (Redis SCAN cursor).

SessionId

A 128-bit random session id, hex-encoded (32 chars). The only thing the browser holds in redis mode, and deliberately unguessable.

SessionMeta

Unencrypted envelope for the operator surface. id is left empty on put (the key already carries it) and filled in by list.

SessionPage

One page of session metadata.

StoreError

Session-store backend failure. Always maps to 503 on the plugin’s error port; callers must never treat it as “unauthenticated”.

Traits

SessionStore

A backend holding sealed session payloads plus their meta envelopes.