Skip to main content

resolve_session

parse_rust_auth::sessions

Function resolve_session 

Source 
pub async fn resolve_session<S: StorageAdapter>(
    storage: &S,
    session_token: &str,
) -> Result<ResolvedSession, ParseError>
Expand description

Resolve a session token to its session.

getAuthForSessionToken’s miss path (Auth.js:157-197). The order of the three failures is upstream’s and is observable, because the first one reached is the error the client sees:

  1. no row, or a row with no user: INVALID_SESSION_TOKEN (209) Invalid session token
  2. expiresAt in the past: 209 Session token is expired.
  3. the user objectId starts with role:: INTERNAL_SERVER_ERROR (1) Invalid object ID.

UPSTREAM-QUIRK: a session with no expiresAt never expires. Upstream computes expiresAt = session.expiresAt ? new Date(session.expiresAt.iso) : undefined and then tests expiresAt < now (Auth.js:188-192). In JavaScript undefined < now is false, so the check passes. That is intended, and it is what keeps a row written under expireInactiveSessions: false, or by an older server, working. Reproduced exactly. See a_session_with_no_expiry_never_expires for the test that makes “fixing” this fail loudly.

The role: guard is upstream’s check on the included user object rather than on the pointer. The two carry the same objectId, including when the referenced _User row does not exist, in which case include leaves the pointer un-hydrated and upstream reads the objectId straight off it.