Module session 

The saved Grab web session grabcli reads at runtime.

It mirrors what a logged-in browser already holds: the site’s cookies plus the short-lived hydra device JWT. grabcli never creates these credentials; it imports them from a browser the user is already logged into.

A plain serde struct: where it is stored is up to the embedder’s SessionStore (the CLI keeps it as JSON, mode 0600). The Debug impl redacts every value, and nothing prints a cookie or token value — only names, expiries and derived status.

Structs

Cookie

Session

The on-disk session document. Field names match the browser export helper and the Python reference client so an existing session.json imports as-is.

Constants

LOCATION_COOKIE

The saved delivery address cookie.

PREFERENCE_COOKIES

Site preference cookies that are not credentials: the saved delivery address (location, URL-encoded JSON), the country and the UI language. A fresh login (isolated browser context) doesn’t have them, so they are carried over from the previous session.

Functions

domain_matches

Cookie domain matching (RFC 6265 §5.1.3): .grab.com matches grab.com and any subdomain; a host-only food.grab.com matches only itself.