Module sessions 

_Session rows.

Sessions are rows in a real Parse class, not entries in a process’s memory. That is the whole point of this module: a token minted here survives a restart, is visible to every node, and is accepted by a parse-server pointed at the same database.

Everything here runs unauthenticated against storage, deliberately. Upstream resolves a session token with auth: master(config) (Auth.js:168). It has to: until the lookup finishes there is no caller, so there is no ACL to evaluate and no CLP to consult. Creation is the same, new RestWrite(config, Auth.master(config), '_Session', null, sessionData) (RestWrite.js:1133). What keeps that narrow is that no query in this module comes from a client. Each one is built here from a session token, a user objectId or a session objectId.

The read side of _Session that a client reaches, GET /sessions, is a different path and is not this module. Upstream narrows it to the caller’s own user rather than master-gating it (RestQuery.js:117-133), and that belongs with the router.

Out of scope, and absent rather than half-present:

• Session renewal. extendSessionOnUse defaults to false upstream, so sessions expire and are never extended. Matching the default configuration is the whole of it.
• The user cache. getAuthForSessionToken consults a cache before the query (Auth.js:135-155). Every resolution here is a query.
• Legacy non-r: tokens. middlewares.js routes a token without the prefix to a separate resolver that looks the user up by _session_token on _User. Not implemented.
• POST /upgradeToRevocableSession, and client-driven _Session create and update.

Structs

CreatedSession

A freshly minted session.

CreatedWith

The createdWith column.

NewSession

What a caller must supply to mint a session.

ResolvedSession

A session resolved from a token.

SessionConfig

The two options that decide a session’s lifetime.

Enums

SessionAction

What created a session.

Constants

SESSION_TOKEN_PREFIX

Upstream’s revocable-session prefix (RestWrite.js:1111).

Functions

create_session

Mint a session and write its row.

ensure_session_schema

Ensure _SCHEMA carries a _Session entry.

new_session_token

A new session token: r: followed by 32 lowercase hex characters, 34 in total.

resolve_session

Resolve a session token to its session.

revoke

Delete one session by its token. Returns whether a row was removed.

revoke_all_for_user

Delete every session belonging to a user. Returns how many.