Struct ValkeyStore 

pub struct ValkeyStore { /* private fields */ }

Available on crate feature valkey only.

A SessionStore on Valkey or Redis.

Every write that touches more than one key runs as a Lua script, so it is atomic across any number of processes sharing the server. Requires Valkey 7.2+ or Redis 7.0+ in standalone or primary/replica mode; Cluster is not supported because the scripts derive key names from stored data.

Data layout

All keys start with the key prefix (P, default sg:). Timestamps are microseconds since the Unix epoch as decimal integers.

Key	Type	Contents
P s:{session id}	hash	subject, created, auth, seen, expires, step_up, baseline (JSON), cur (current token), seq (token counter), exp_ms
P t:{token hash hex}	hash	sid, seq (issue order), issued, used, sup (superseded)
P k:{session id}	sorted set	the session’s token hashes, scored by seq
P u:{subject}	set	session ids of a subject
P x	sorted set	session ids scored by expires_at
P i	sorted set	session ids scored by last_seen_at
P e	sorted set	events as JSON, scored by at
P c:{session id}:{kind}	string	time of the last event claim
P cz	sorted set	{session id}:{kind} claims scored by claim time

Session, token and per-session token-set keys expire at the session’s absolute expiry and subject sets at their last session’s expiry, so Valkey cleans up even if delete_expired never runs. Because those TTLs follow the server’s wall clock, sessions whose expires_at is already in the past vanish immediately. Claim keys expire after their window.

Subjects are passed to scripts as data, never as code.

Cheap to clone; clones share the connection.

Implementations

impl ValkeyStore

pub fn new(conn: ConnectionManager) -> Self

A store on an existing connection, with the default key prefix sg:.

pub async fn connect(url: &str) -> Result<Self, RedisError>

Connects to url (redis://, rediss:// or valkey://), with the default key prefix sg:.

Errors

If the URL is invalid or the server is unreachable.

pub fn key_prefix(self, prefix: impl Into<String>) -> Self

Prefixes every key with prefix, so several apps can share one server. Defaults to sg:.

Trait Implementations

impl Clone for ValkeyStore

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ValkeyStore

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl SessionStore for ValkeyStore

async fn insert_session( &self, session: &SessionRecord, token: &TokenHash, ) -> Result<(), StoreError>

Stores a new session with token as its current token (issued_at = created_at, unused, not superseded).

async fn find_by_token( &self, token: &TokenHash, ) -> Result<Option<TokenLookup>, StoreError>

Finds the session holding token, current or superseded.

async fn apply(&self, update: &SessionUpdate) -> Result<bool, StoreError>

Applies update atomically, in this order:

async fn delete_session(&self, session_id: Uuid) -> Result<bool, StoreError>

Deletes a session and its tokens. Returns whether it existed.

async fn delete_subject_sessions( &self, subject: &str, ) -> Result<u64, StoreError>

Deletes every session of subject (canonical JSON). Returns how many.

async fn list_subject_sessions( &self, subject: &str, ) -> Result<Vec<SessionRecord>, StoreError>

Every session of subject (canonical JSON), including expired ones not yet purged.

async fn delete_expired( &self, now: DateTime<Utc>, idle_cutoff: DateTime<Utc>, ) -> Result<u64, StoreError>

Deletes sessions with expires_at <= now or last_seen_at <= idle_cutoff. Returns how many.

async fn record_event(&self, event: &SessionEvent) -> Result<(), StoreError>

Appends a security event. Stores without an event log may discard it.

async fn delete_events_before( &self, cutoff: DateTime<Utc>, ) -> Result<u64, StoreError>

Deletes events with at < cutoff. Returns how many. Also deletes event claims older than cutoff.

async fn claim_event( &self, session_id: Uuid, kind: EventKind, now: DateTime<Utc>, window: TimeDelta, ) -> Result<bool, StoreError>

Claims the right to record an unenforced kind event for a session, for shadow-mode deduplication across processes. Succeeds (true) unless a claim for the same session and kind was made after now - window, and records now as the new claim when it does. Must be atomic across processes.