Struct ServerState 

pub struct ServerState {
    pub sessions: Arc<DashMap<String, UserSessions>>,
    pub ws_tx: Sender<String>,
    pub auth: Option<Arc<AuthState>>,
    pub config_toml: Option<String>,
    pub secrets: Option<HashMap<String, String>>,
    pub build_info: Option<BuildInfo>,
    pub workflow_semaphore: Arc<Semaphore>,
    pub max_sessions_per_user: usize,
    pub allow_llm_overlay: bool,
    pub mcp_loaders: Arc<DashMap<String, McpLoaderEntry>>,
    pub thq_dispatch: Arc<DashMap<String, ThqDispatchEntry>>,
    pub agent_dispatch_tokens: Arc<DashMap<String, (String, Instant)>>,
    /* private fields */
}

Shared state accessible by all axum handlers.

Fields

sessions: Arc<DashMap<String, UserSessions>>

Per-user multi-session registry (MSU).

ws_tx: Sender<String>

Broadcast sender for backward compat — delegates to the default user’s channel.

auth: Option<Arc<AuthState>>

Auth state (None = auth disabled, all endpoints open).

config_toml: Option<String>

Shared config TOML (all users share the same agent config).

secrets: Option<HashMap<String, String>>

Shared secrets (injected into every per-user session).

build_info: Option<BuildInfo>

Shared build info (injected into every per-user session).

workflow_semaphore: Arc<Semaphore>

Global concurrency limiter — limits the number of simultaneous workflows across all users. Default: 8 concurrent workflows.

max_sessions_per_user: usize

Maximum number of concurrent sessions per user. Default: 4.

allow_llm_overlay: bool

Whether per-user config overlays may override the [llm] section. Default: false — overlays are limited to [mcp].

mcp_loaders: Arc<DashMap<String, McpLoaderEntry>>

Per-user McpToolLoader cache (16C), keyed by user hash (never the raw key).

thq_dispatch: Arc<DashMap<String, ThqDispatchEntry>>

16F: THQ per-agent dispatch table (agent_name → target), boot-populated.

agent_dispatch_tokens: Arc<DashMap<String, (String, Instant)>>

16F: cached impersonation Bearers per agent user_key (token, expires_at) — expiry-buffered, re-minted on 401.

Implementations

impl ServerState

pub fn new( session: Session, ws_tx: Sender<String>, auth: Option<Arc<AuthState>>, ) -> Self

Create new shared state from a default session, broadcast sender, and optional auth.

pub fn with_config_toml(self, config_toml: String) -> Self

pub fn service_issuer(&self) -> Option<String>

16F: the issuer URL Kanidm accepts SERVICE-ACCOUNT token exchange on.

Kanidm binds exchange to the OAuth2 client’s configured origin: the [oidc] issuer host serves logins/validation fine but REJECTS token exchange with invalid_request, while the idp vhost — the issuer every working [mcp.credentials.*] service-account entry already uses — accepts it (verified live 2026-08-30: same token, 200 vs 400). The exchange therefore takes its issuer from the shared config’s first service-account credential; callers fall back to the auth issuer when absent.

pub fn with_secrets(self, secrets: HashMap<String, String>) -> Self

pub fn with_build_info(self, build_info: BuildInfo) -> Self

pub fn with_max_concurrent_workflows(self, max: usize) -> Self

pub fn with_max_sessions_per_user(self, max: usize) -> Self

Set the max sessions per user.

pub fn with_allow_llm_overlay(self, allow: bool) -> Self

Allow per-user config overlays to override the [llm] section. Default: false (overlays limited to [mcp]).

pub async fn create_session( &self, user_key: &str, session_name: Option<String>, identity: Option<String>, activate: bool, ) -> Result<String, SessionError>

Create a new session for a user. Returns the session_id.

Creates a fresh Session::new(), copies shared config, sets per-user isolation, creates a broadcast channel, spawns a drain task, and inserts into the user’s session DashMap. The new session becomes the “active” one.

pub async fn get_session( &self, user_key: &str, session_id: &str, ) -> Option<(Arc<Mutex<Session>>, Sender<String>)>

Get a specific session by user_key + session_id. Updates last_active on the session entry.

pub async fn get_session_by_any_id( &self, user_key: &str, id: &str, ) -> Option<(String, Arc<Mutex<Session>>, Sender<String>)>

Get a session by EITHER its live MSU registry key OR its checkpoint/session identity (session.session_id).

The web frontend tracks currentSessionId from the ResumeInfo WS message, which carries the auto-derived checkpoint id (session_YYYY_MM_DD_HH_MM_uuid8) — NOT the live MSU registry key ("default" or the key from create_session()). External clients like Torpi/THQ pass the live registry key. This resolver accepts both:

1. Try registry-key lookup first (precise, used by Torpi/THQ).
2. Fall back to scanning the user’s live sessions for one whose session.session_id matches the requested id (used by the embedded web UI after a command or resume).

Returns (live_registry_key, session_arc, ws_tx), or None if not found. The live key is returned so callers that need to set it as active (or otherwise reference the registry) use the real key.

pub async fn list_sessions(&self, user_key: &str) -> Vec<SessionListItem>

List all active sessions for a user, sorted by last_active desc.

pub async fn destroy_session( &self, user_key: &str, session_id: &str, ) -> Result<(), SessionError>

Destroy a session. The session must be Idle.

pub async fn ensure_active_session( &self, user_key: &str, ) -> (String, Arc<Mutex<Session>>, Sender<String>, Arc<MemoryTokenStore>)

Get or create the user’s “active” session for legacy routes.

Behavior:

1. If user has no sessions → create one
2. If active session exists → return it
3. If active session was destroyed → create a new one

Returns: (session_id, session_arc, ws_tx, token_store)

pub async fn ensure_user_session( &self, user_key: &str, ) -> (Arc<Mutex<Session>>, Sender<String>, Arc<MemoryTokenStore>)

DEPRECATED: Use ensure_active_session() instead. Kept for backward compatibility — same 3-tuple return type.

pub async fn set_active_session(&self, user_key: &str, session_id: &str)

Set a session as the user’s active session.

pub fn get_user_home_dir(&self, user_key: &str) -> Option<PathBuf>

Resolve a user’s home_dir without creating an in-memory session.

This is the read-only equivalent of the isolation logic in apply_user_isolation. Used by endpoints that only need to read checkpoint data from disk (history, session list, session detail) and must NOT create ghost sessions as a side effect.

pub fn get_user_config_and_home( &self, user_key: &str, ) -> (Option<String>, Option<PathBuf>)

Resolve config_toml and home_dir without creating an in-memory session.

Returns (config_toml, home_dir). If config is not loaded, config_toml will be None.

pub fn resolve_user_config(&self, user_key: &str) -> Option<String>

Resolve the fully-merged config TOML for a user WITHOUT creating a session.

This is the read-only equivalent of the config resolution in apply_user_isolation: shared config + per-user overlay + ${VAR} substitution. Used by endpoints that need to inspect config (e.g. listing available LLM models) without spawning a ghost session.

Returns None if no shared config is loaded.

pub async fn get_or_build_mcp_loader( &self, user_key: &str, token_store: &Arc<MemoryTokenStore>, ) -> Result<Option<Arc<McpToolLoader>>, String>

Get or build the per-user MCP tool loader (16C).

Cache semantics:

• fingerprint = content hash of the effective [mcp] section (shared + allowlist-filtered overlay + ${VAR} substitution, i.e. exactly what resolve_user_config produces) — stale on ANY change.
• hit + match → Arc clone, zero network I/O.
• miss/stale → single-flight build (one build per user at a time; late arrivals re-check and reuse the winner’s entry).
• Ok(None) = MCP disabled for this user → agent runs MCP-less via abk McpSource::Prebuilt(None) (same semantics as [mcp] enabled = false, no per-task re-evaluation).
• build failure → cached degraded entry with [MCP_BUILD_RETRY_BACKOFF]; the error is returned so THIS user’s dispatch fails loud while other users are unaffected.

pub fn spawn_drain_task(self, workflow_rx: UnboundedReceiver<TuiMessage>)

Spawn the default user’s drain task (backward compatibility). Called during server startup for the initial session.

pub async fn resolve_user_key(&self, headers: &HeaderMap) -> String

Resolve the user key from request headers.

Trait Implementations

impl Clone for ServerState

fn clone(&self) -> ServerState

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.