pub struct Session { /* private fields */ }Expand description
Axum extractor providing access to the current session.
Session is inserted into the request extensions by super::middleware::SessionLayer.
Extracting it in a handler does not require the user to be authenticated —
call Session::is_authenticated or Session::user_id to check.
All read methods are synchronous (lock-free from the caller’s perspective).
Write methods that only modify in-memory data (Session::set,
Session::remove_key) are also synchronous. Methods that touch the
database (Session::authenticate, Session::logout, etc.) are async.
§Panics
Panics if SessionLayer is not present in the middleware stack. Apply the
layer with super::layer before using this extractor.
Implementations§
Source§impl Session
impl Session
Sourcepub fn user_id(&self) -> Option<String>
pub fn user_id(&self) -> Option<String>
Return the authenticated user’s ID, or None if no session is active.
Sourcepub fn get<T: DeserializeOwned>(&self, key: &str) -> Result<Option<T>>
pub fn get<T: DeserializeOwned>(&self, key: &str) -> Result<Option<T>>
Deserialise a value stored in the session under key.
Returns Ok(None) when there is no active session or the key is absent.
§Errors
Returns an error if the stored value cannot be deserialised into T.
Sourcepub fn is_authenticated(&self) -> bool
pub fn is_authenticated(&self) -> bool
Return true when a valid, authenticated session exists for this request.
Sourcepub fn current(&self) -> Option<SessionData>
pub fn current(&self) -> Option<SessionData>
Return a clone of the full session data, or None if unauthenticated.
Sourcepub fn set<T: Serialize>(&self, key: &str, value: &T) -> Result<()>
pub fn set<T: Serialize>(&self, key: &str, value: &T) -> Result<()>
Store a serialisable value under key in the session data.
The change is held in memory and flushed to the database by the middleware after the handler returns. No-op when there is no active session.
§Errors
Returns an error if the value cannot be serialised to JSON.
Sourcepub fn remove_key(&self, key: &str)
pub fn remove_key(&self, key: &str)
Remove a key from the session data.
No-op when there is no active session or the key does not exist. The change is flushed to the database by the middleware after the handler returns.
Sourcepub async fn authenticate(&self, user_id: &str) -> Result<()>
pub async fn authenticate(&self, user_id: &str) -> Result<()>
Create a new authenticated session for user_id with empty data.
If a session already exists, it is destroyed first (session fixation
prevention). A new token is generated and set on the cookie. Equivalent
to authenticate_with(user_id, serde_json::json!({})).
§Errors
Returns an error if the existing session cannot be destroyed or the new session cannot be created in the database.
Sourcepub async fn authenticate_with(&self, user_id: &str, data: Value) -> Result<()>
pub async fn authenticate_with(&self, user_id: &str, data: Value) -> Result<()>
Create a new authenticated session for user_id with initial data.
If a session already exists, it is destroyed first (session fixation prevention). A new token is generated and set on the cookie.
§Errors
Returns an error if the existing session cannot be destroyed or the new session cannot be created in the database.
Sourcepub async fn rotate(&self) -> Result<()>
pub async fn rotate(&self) -> Result<()>
Issue a new session token and refresh the session expiry.
Returns 401 Unauthorized if there is no active session. Use this
after privilege escalation to prevent session fixation.
§Errors
Returns 401 Unauthorized when no active session exists, or an
internal error if the database update fails.
Sourcepub async fn logout(&self) -> Result<()>
pub async fn logout(&self) -> Result<()>
Destroy the current session and clear the session cookie.
No-op (succeeds silently) when there is no active session.
§Errors
Returns an error if the database delete fails.
Sourcepub async fn logout_all(&self) -> Result<()>
pub async fn logout_all(&self) -> Result<()>
Destroy all sessions for the current user and clear the session cookie.
Returns 401 Unauthorized if there is no active session.
§Errors
Returns an error if the database delete fails.
Sourcepub async fn logout_other(&self) -> Result<()>
pub async fn logout_other(&self) -> Result<()>
Destroy all sessions for the current user except the current one.
Returns 401 Unauthorized if there is no active session.
§Errors
Returns 401 Unauthorized when no active session exists, or an
internal error if the database delete fails.
Sourcepub async fn list_my_sessions(&self) -> Result<Vec<SessionData>>
pub async fn list_my_sessions(&self) -> Result<Vec<SessionData>>
Return all active sessions for the current user.
Returns 401 Unauthorized if there is no active session.
§Errors
Returns 401 Unauthorized when no active session exists, or an
internal error if the database query fails.
Sourcepub async fn revoke(&self, id: &str) -> Result<()>
pub async fn revoke(&self, id: &str) -> Result<()>
Revoke a specific session belonging to the current user.
Returns 401 Unauthorized if there is no active session and 404 Not Found if id does not belong to the current user (deliberately
indistinguishable to prevent enumeration).
§Errors
Returns 401 Unauthorized when no active session exists, 404 Not Found when the target session does not exist or belongs to another
user, or an internal error if the database operation fails.