Struct SessionManager 

pub struct SessionManager { /* private fields */ }

Manages 1:1 encrypted sessions.

Implementations

impl SessionManager

pub fn new( user_id: String, storage: Arc<dyn MlsStorage>, provider: MlsProvider, ) -> Self

Creates a new session manager.

pub fn group_manager(&self) -> &GroupManager

Returns a reference to the underlying group manager.

pub fn get_session_id(&self, other_user_id: &str) -> Result<GroupId>

Gets the session ID for a 1:1 conversation with another user.

Fails with crate::MlsError::InvalidGroupId if other_user_id contains storage-hostile characters (the session id is a raw storage key).

pub fn has_session(&self, other_user_id: &str) -> Result<bool>

Checks if a session exists with another user.

pub fn create_session( &self, other_user_id: &str, their_key_package: KeyPackage, credential_with_key: &CredentialWithKey, signer: &impl Signer, ) -> Result<WelcomeMessage>

Creates a new session with another user using their key package.

pub fn join_session(&self, welcome_msg: &WelcomeMessage) -> Result<GroupInfo>

Joins a session using a Welcome message.

Implements a non-destructive “welcome-wins” strategy: if we already created a session for this peer (both-create race), the incoming Welcome is staged first and only replaces our group once staging succeeds (see crate::group::GroupManager::join_group_replacing). A retransmitted Welcome we already adopted, or a first-contact key-package race, fails to stage and leaves the existing converged group intact — so adoption is idempotent and never bricks a working session.

pub fn encrypt_message( &self, other_user_id: &str, plaintext: &[u8], signer: &impl Signer, ) -> Result<EncryptedMessage>

Encrypts a message for the session partner.

pub fn decrypt_message( &self, encrypted: &EncryptedMessage, claimed_sender: &str, ) -> Result<Option<Vec<u8>>>

Decrypts a message from a session.

claimed_sender is the transport-level sender this message will be attributed to; it must match the MLS-authenticated credential.

The envelope’s group_id is bound to claimed_sender before the group is loaded, because every failure OpenMLS raises below happens before it authenticates anything — see MlsError::SessionIdentityMismatch. This is the single chokepoint for the binding: decrypt_from_user is reachable both from the receive path and from the public manual_mls_decrypt_from_user API, so checking it in either caller alone leaves the other as a bypass.

pub fn list_sessions(&self) -> Result<Vec<String>>

Lists the peers this device has a 1:1 session with.

A session id is session:<a>:<b> where exactly one of the two halves is us — ids cannot contain : (GroupId::validate runs the storage-key charset check per segment), so the split is unambiguous. Anything that does not have that exact shape is skipped rather than guessed at: a slot naming two other parties has no “other peer” to report, and returning one half of it anyway would surface a peer this device has no session with.

pub fn delete_session(&self, other_user_id: &str) -> Result<()>

Deletes a session.

pub fn get_session_info(&self, other_user_id: &str) -> Result<Option<GroupInfo>>

Gets information about a session.