pub async fn create_session<S: StorageAdapter>(
storage: &S,
config: &SessionConfig,
new: NewSession<'_>,
) -> Result<CreatedSession, ParseError>Expand description
Mint a session and write its row.
The row is upstream’s, key for key and in upstream’s order (RestWrite.js:1107-1135, then the
default fields at :423-431): sessionToken, user, createdWith, expiresAt,
installationId when present, then updatedAt, createdAt, objectId.
No ACL. _Session rows carry none. Upstream refuses a client-supplied one outright,
Cannot set ACL on a Session. (RestWrite.js:1231-1232), and the two paths that add an ACL
automatically do not apply: the CLP-derived default ACL needs a non-default
classLevelPermissions.ACL (RestWrite.js:378-395), and the owner-private ACL is _User
only (RestWrite.js:1674-1686). An absent ACL means the row is public to anything reading the
collection directly, and what makes that safe is that the client-facing read of _Session is
narrowed to the caller’s own user before it reaches storage (RestQuery.js:117-133). Adding
an ACL here would be inventing a column parse-server does not write.