Struct SessionManager 

pub struct SessionManager { /* private fields */ }

Request-scoped session manager, available as an axum extractor.

Inject SessionManager as a handler parameter to read or modify the session for the current request. The session middleware must be installed via crate::layer for the extractor to work; if the middleware is missing the extractor returns an internal error.

Each request receives its own SessionManager instance backed by its own per-request state. There is no cross-request sharing; operations on one request’s SessionManager cannot affect another request’s session state.

Changes made through SessionManager (authentication, logout, token rotation, data writes) are applied to the HTTP response cookie automatically by the middleware after the handler returns.

Implementations

impl SessionManager

pub async fn authenticate(&self, user_id: &str) -> Result<(), Error>

Create a new session for user_id.

Any existing session is destroyed before the new one is created to prevent session-fixation attacks. The session cookie is set on the response automatically.

pub async fn authenticate_with( &self, user_id: &str, data: Value, ) -> Result<(), Error>

Create a new session for user_id with custom JSON data attached.

Any existing session is destroyed before the new one is created to prevent session-fixation attacks. The session cookie is set on the response automatically.

pub async fn logout(&self) -> Result<(), Error>

Destroy the current session.

The session cookie is cleared on the response automatically. If there is no active session this is a no-op.

pub async fn logout_all(&self) -> Result<(), Error>

Destroy ALL sessions for the currently authenticated user.

The session cookie is cleared on the response automatically. If there is no active session this is a no-op.

pub async fn logout_other(&self) -> Result<(), Error>

Destroy all sessions for the current user except the current one.

Returns Unauthorized if the request is not authenticated.

pub async fn revoke(&self, id: &SessionId) -> Result<(), Error>

Destroy a specific session by ID.

Only sessions owned by the currently authenticated user can be revoked. Returns Unauthorized if the request is not authenticated, or NotFound if the target session does not exist or belongs to a different user.

pub async fn rotate(&self) -> Result<(), Error>

Regenerate the session token without changing the session ID or data.

The new token is set on the response cookie automatically. Returns Unauthorized if the request is not authenticated.

pub async fn current(&self) -> Option<SessionData>

Return the full session record for the current request, or None if the request is not authenticated.

pub async fn user_id(&self) -> Option<String>

Return the authenticated user ID, or None if the request is not authenticated.

pub async fn is_authenticated(&self) -> bool

Return true if the current request has an active, authenticated session.

pub async fn list_my_sessions(&self) -> Result<Vec<SessionData>, Error>

Return all active (non-expired) sessions for the authenticated user, ordered by most-recently-active first.

Returns Unauthorized if the request is not authenticated.

pub async fn get<T: DeserializeOwned>( &self, key: &str, ) -> Result<Option<T>, Error>

Read a typed value from the session’s JSON data by key.

Returns Ok(None) if the key is absent or if the request is not authenticated. Returns Ok(None) (with a tracing warning) if the stored value cannot be deserialised into T.

pub async fn set<T: Serialize>(&self, key: &str, value: &T) -> Result<(), Error>

Set a key in the session’s JSON data and persist the change immediately.

Returns Unauthorized if the request is not authenticated.

pub async fn remove_key(&self, key: &str) -> Result<(), Error>

Remove a key from the session’s JSON data and persist the change immediately.

Returns Unauthorized if the request is not authenticated.

Trait Implementations

impl<S: Send + Sync> FromRequestParts<S> for SessionManager

type Rejection = Error

If the extractor fails it’ll use this “rejection” type. A rejection is a kind of error that can be converted into a response.

async fn from_request_parts( parts: &mut Parts, _state: &S, ) -> Result<Self, Self::Rejection>

Perform the extraction.