Module session 

Session Store

Server-side JWT session registry (HIPAA-4, §164.312(d) Person Authentication). Where AuditMetadata audits writes and AccessLogger audits reads, this trait makes JWTs revocable: a stolen token stays valid only until the corresponding jti is removed from the store.

Failure semantics

is_valid MUST fail closed when the underlying sink is unreachable: revocation is a security control, and we cannot prove a token is not revoked when the store is down. Middleware that consults this trait returns 503, never 200.

Note this is the opposite of the AccessLogger policy where read audit failures fail open — different concerns, different defaults.

Structs

SessionRecord

Persistent record of an issued JWT session.

Enums

SessionStoreError

Errors emitted by SessionStore implementations.

Traits

SessionStore

Server-side registry of issued JWTs.