Crate ferrohealth_session 

The sign-in and the session of a FerroHEALTH operator console.

An operator signs in at the deployment’s OpenID Provider with the authorization code flow and PKCE, through the relying party of ferrohealth-smart (ferrohealth_smart::oidc::RelyingParty), which keeps no state of its own. This crate keeps the state between the redirect and the callback, and the session once the sign-in completes:

• config: the [oidc] and [session] sections every console embeds, read with deny_unknown_fields, each secret through ferrohealth-secret’s <key> / <key>_file rule;
• sessions::Sessions: the store, in process (memory, an opaque id in the cookie) or in one AES-256-GCM sealed cookie (sealed, for a console that runs as several instances with no shared store);
• clock: the clock every lifetime is counted on, the wall clock by default, with clock::ManualClock (feature test-clock) for a console’s tests;
• lifetime: the idle and the absolute lifetime, both counted from times the session carries, the absolute one from the sign-in time, and what is left as FerroUI’s session watch reads it;
• sessions::Sessions::keep_fresh: the refresh of an access token before it expires;
• routes (feature axum): GET /login, GET /auth/callback, POST /logout and GET/POST /session, and the middleware that hands every page what its request holds.

No token, key, password, session id, state, nonce or verifier reaches a log line, a Debug rendering or an error message. No specification governs the session store, its lifetimes or the watch route: our own design, held to the OWASP Session Management Cheat Sheet (idle and absolute timeouts).

Modules

clock

The clock every lifetime is counted on: wall-clock milliseconds, so a sealed cookie opened by another instance reads the same times and a timeout of T lasts at least T.

config

The [oidc] and [session] sections every console embeds in its configuration.

cookies

The cookies a console sets, and the read of one from a request.

lifetime

The idle and the absolute lifetime of a session, and what is left of them.

paths

The four routes every console serves for its sign-in, the same on every console so one provider registration reads alike across the family.

record

What a session holds: what a completed sign-in leaves, and the view of it one request reads.

refresh

The refresh of a session’s access token before it expires (RFC 6749 §6).

return_path

The console page an operator comes back to once a sign-in completes.

routes

The four sign-in routes as an axum router, and the middleware every page sits behind.

sessions

The session store every request of a console shares.