Struct SessionExpiryPlugin 

pub struct SessionExpiryPlugin { /* private fields */ }

Session expiry plugin. Tracks session lifetimes and rejects expired sessions.

Implementations

impl SessionExpiryPlugin

pub fn new() -> Self

Create with default settings: 24h max lifetime, 2h idle timeout.

pub fn with_timeouts(max_lifetime: Duration, idle_timeout: Duration) -> Self

Create with custom timeouts.

pub fn track(&self, token: &str, user_id: &str)

Register a session for tracking.

pub fn check(&self, token: &str) -> Result<String, String>

Check if a session is still valid. Updates last_active if valid.

pub fn expire(&self, token: &str) -> bool

Explicitly expire a session.

pub fn cleanup(&self) -> usize

Clean up all expired sessions.

pub fn active_count(&self) -> usize

Get the number of active sessions.

pub fn refresh(&self, token: &str) -> bool

Refresh a session’s expiry (extend the lifetime).

The new expires_at is capped at created_at + max_lifetime, so a session can be kept alive by activity but will still be forced to re-authenticate when its absolute lifetime is up. Previously this method set expires_at = now + max_lifetime unconditionally, which meant a busy user could renew their session indefinitely — defeating the whole point of an “absolute” lifetime cap.

Trait Implementations

impl Plugin for SessionExpiryPlugin

fn name(&self) -> &str

Unique name for this plugin.

fn on_init(&self, _ctx: &PluginContext)

Called once when the plugin is registered.

fn routes(&self) -> Vec<PluginRoute>

Custom API routes this plugin handles.

fn before_insert( &self, _entity: &str, _data: &mut Value, _auth: &AuthContext, ) -> Result<(), PluginError>

Called before an entity insert. Return Err to reject.

fn after_insert( &self, _entity: &str, _id: &str, _data: &Value, _auth: &AuthContext, )

Called after a successful insert.

fn before_update( &self, _entity: &str, _id: &str, _data: &mut Value, _auth: &AuthContext, ) -> Result<(), PluginError>

Called before an entity update. Return Err to reject.

fn after_update( &self, _entity: &str, _id: &str, _data: &Value, _auth: &AuthContext, )

Called after a successful update.

fn before_delete( &self, _entity: &str, _id: &str, _auth: &AuthContext, ) -> Result<(), PluginError>

Called before an entity delete. Return Err to reject.

fn after_delete(&self, _entity: &str, _id: &str, _auth: &AuthContext)

Called after a successful delete.

fn on_request( &self, _method: &str, _path: &str, _auth: &AuthContext, ) -> Result<(), PluginError>

Called on every incoming request (middleware).

fn on_request_with_meta( &self, method: &str, path: &str, auth: &AuthContext, _meta: &RequestMeta<'_>, ) -> Result<(), PluginError>

Richer variant of [on_request] that also receives per-request metadata (peer IP today; more fields may be added later). The default implementation delegates to on_request so existing plugins keep working without changes. Plugins that care about IP — notably rate limiting — override this hook.

fn on_session_create(&self, _user_id: &str, _token: &str)

Called when a new session is created.

fn entities(&self) -> Vec<ManifestEntity>

Additional manifest entities this plugin contributes.