Expand description
Session-establishment middleware.
SessionMiddleware resolves or mints the per-request session: it skips
untracked paths, short-circuits detected bots into anonymous contexts,
validates an existing JWT session, and refreshes or recreates the session
when the token is stale, issuing a Set-Cookie for newly minted tokens.
Validation runs through attest_session, the same predicate the JWT and
gateway credential paths use: a cookie must name a session the server issued
to that user. An existence-only check would let a signed token borrow
another user’s live session for analytics attribution.
Establishing a session reads and writes the database, so it is bounded and
degrades rather than fails — see the context submodule. A request that
cannot be given a session is served with an untracked, actor-less context
instead of a 500: the alternative is that a database fault takes the public
site down, and a page view is worth more than the analytics row describing
it. Nothing is escalated by the degraded context — it carries no auth token
and no user, so every gate above public still refuses it.
Copyright (c) systemprompt.io — Business Source License 1.1. See https://systemprompt.io for licensing details.