Skip to main content

ISessionStore

webx_core::security

Trait ISessionStore 

Source 
pub trait ISessionStore: Send + Sync {
    // Required methods
    fn revoke<'life0, 'life1, 'async_trait>(
        &'life0 self,
        jti: &'life1 str,
    ) -> Pin<Box<dyn Future<Output = Result<()>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait;
    fn is_revoked<'life0, 'life1, 'async_trait>(
        &'life0 self,
        jti: &'life1 str,
    ) -> Pin<Box<dyn Future<Output = Result<bool>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait;

    // Provided method
    fn revoke_all_for_subject<'life0, 'life1, 'async_trait>(
        &'life0 self,
        subject: &'life1 str,
    ) -> Pin<Box<dyn Future<Output = Result<()>> + Send + 'async_trait>>
       where Self: 'async_trait,
             'life0: 'async_trait,
             'life1: 'async_trait { ... }
}
Expand description

Revocation state for issued tokens.

The authentication middleware calls ISessionStore::is_revoked with the jti of an already verified token; true turns the request into a 401 without waiting for the token to expire. Implementations back this with whatever survives their deployment — process memory, a cache with TTL, or a database table.

Errors are not swallowed: a store failure fails the request (the middleware must not authorize when it cannot prove the token is unrevoked).

Required Methods§

Source

fn revoke<'life0, 'life1, 'async_trait>( &'life0 self, jti: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<()>> + Send + 'async_trait>>
where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Revoke one token by its jti (logout of a single session).

Revoking an already-revoked or unknown jti is not an error: logout is idempotent.

Source

fn is_revoked<'life0, 'life1, 'async_trait>( &'life0 self, jti: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<bool>> + Send + 'async_trait>>
where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Whether the token jti has been revoked.

Provided Methods§

Source

fn revoke_all_for_subject<'life0, 'life1, 'async_trait>( &'life0 self, subject: &'life1 str, ) -> Pin<Box<dyn Future<Output = Result<()>> + Send + 'async_trait>>
where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Revoke every token of subject (“sign out everywhere”).

Optional capability: the default implementation returns 501 Not Implemented (Error::Status) instead of silently succeeding, because a store that cannot enumerate a subject’s sessions would otherwise report a logout that did not happen. 501 lets the caller (and the logs) tell “not supported” from a real server failure. Override it when the backing store keeps a subject-to-session index.

Dyn Compatibility§

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors§