Struct SessionAuthority 

pub struct SessionAuthority<M, R, U, W> { /* private fields */ }

Origin facade: everything that can create or destroy sessions.

Holds the four origin-tier capabilities — a TokenMinter, a RefreshStore, a UserStore, and a RevocationWriter — plus a SessionPolicy. Generic (not dyn) so the assembled capability set is visible in the type; a consumer wires concrete impls (e.g. PasetoV4SecretMinter + Yubaba-backed stores).

Implementations

impl<M, R, U, W> SessionAuthority<M, R, U, W>

where M: TokenMinter + Send + Sync, R: RefreshStore, U: UserStore, W: RevocationWriter,

pub fn new(minter: M, refresh: R, users: U, revoke: W) -> Self

Assemble an authority with the default policy.

pub fn with_policy(self, policy: SessionPolicy) -> Self

Override the TTL policy.

pub fn policy(&self) -> &SessionPolicy

pub fn users(&self) -> &U

The held UserStore, for device-management reads (list_devices).

pub async fn establish( &self, sub: UserId, device: DeviceId, binding: DeviceBinding, now: i64, ) -> Result<NewSession, Error>

Establish a fresh session: mint a short-TTL access token (with a fresh jti) and start a homed refresh chain for (sub, device).

pub async fn rotate( &self, presented_refresh: &str, binding: DeviceBinding, now: i64, ) -> Result<NewSession, Error>

Rotate presented_refresh → fresh access token + successor refresh token. Replay detection / chain revocation are the rotator’s (see RefreshRotator::rotate). The binding is supplied by the caller because the refresh record doesn’t carry it — guide by omission, the refresh chain is about which session, not how it authenticated.

pub async fn revoke_session(&self, jti: &str) -> Result<(), Error>

Revoke a single access token by its jti — the immediate, edge-visible kill (within the propagation window bounded by the access TTL).

pub async fn revoke_device( &self, user_id: &UserId, device_id: &DeviceId, ) -> Result<(), Error>

Records device-level revocation intent via the UserStore. Blocking new sessions also means revoking that device’s refresh chains via the RefreshStore; killing an in-flight access token is revoke_session. The product owns the device→chain index that drives the first, so this facade exposes the store call and the per-jti kill, not a magic “log out everywhere”.