Session
class SessionAuthority(nowEpochMs: () -> Long = System::currentTimeMillis, sessionTtlMs: Long = DEFAULT_SESSION_TTL_MS, maxAuthenticatedSessions: Int = DEFAULT_MAX_AUTHENTICATED_SESSIONS, random: SecureRandom = SecureRandom())
In-memory authority for the browser session store: creation, TTL/refresh, CSRF tokens, listing, and revocation. One access tier -- every session is equivalent; mutating routes gate on the host's EditingCapabilities flags instead of a session-level role. SessionCodeAuthority is the sole way a session gets minted, via createSession.
Constructors
Link copied to clipboard
constructor(nowEpochMs: () -> Long = System::currentTimeMillis, sessionTtlMs: Long = DEFAULT_SESSION_TTL_MS, maxAuthenticatedSessions: Int = DEFAULT_MAX_AUTHENTICATED_SESSIONS, random: SecureRandom = SecureRandom())
Functions
Link copied to clipboard
Applies host configuration before any session exists. A live authority cannot silently weaken or expand policy while identities exist.
Link copied to clipboard
Link copied to clipboard
Link copied to clipboard
Link copied to clipboard
Rotates both bearer and CSRF credentials while preserving the approved browser identity.
Link copied to clipboard
Link copied to clipboard
Revokes sessionId if it is currently live; returns false for an unknown/already-expired id.
Link copied to clipboard