Module session 

Passwords and browser sessions.

Two kinds of credential live on this server and they are deliberately not the same thing. An agent presents a long random token the server issued, hashed with SHA-256 because there is no dictionary to slow anyone down with (see crate::auth). A person types a password they chose, which is guessable at scale, so it gets Argon2id and a per-password salt.

Sessions are server-side. A signed self-contained token would save a query per request and cost the one thing this server cannot give up: the ability to end someone’s access now, on the afternoon they leave (ADR 0007).

Structs

IssuedSession

A new session token: what the browser gets, and what the database stores.

SessionUser

Who a session token belongs to, if it is still good for anything.

Constants

SESSION_COOKIE

The cookie the browser carries. Named for the product so it is obvious in a developer console which server put it there.

SESSION_LIFETIME_DAYS

How long a session lives without being used.

Functions

authenticate

Resolves a token to its user, refusing expired sessions and inactive people.

hash_password

Hashes a password for storage.

issue

Creates a session for a user.

revoke

Ends one session - what “log out” does.

revoke_all

Ends every session a user has - what “log out everywhere” does, and what deactivating an employee should be followed by.

sweep_expired

Deletes sessions that have expired.

verify_password

Checks a password against a stored hash.