iet-auth-session-cache

Authoritative session storage over the cache contract; clones share collision coordination.

How to use it

iet-auth-session-cache implements iet_auth::SessionStore over any iet_cache::Cache<Value = SessionRecord>, giving authoritative, expiring session storage. Clones share collision coordination, and scoped keys let revoke_all clear one application's sessions without touching another's. Session mechanisms such as iet-auth-session-opaque are what call into it.

// examples/htmx-starter/servers/web/tests/framework_cached_sessions.rs
use iet_auth::{SessionRecord, SessionStore};
use iet_auth_session_cache::CacheSessions;
use iet_cache_memory::MemoryCache;
use iet_core::Principal;
use std::time::{Duration, SystemTime};

let backend = MemoryCache::new(100)?;
let store = CacheSessions::new(backend.clone(), "account-a".into())?;
let other = CacheSessions::new(backend, "account-b".into())?;

store.insert([3; 32], SessionRecord {
    identity: Principal { subject: "user".into(), profile: None },
    expires_at: SystemTime::now() + Duration::from_secs(60),
}).await?;

store.revoke_all().await?;                     // logout-all for "account-a" only
assert!(store.find(&[3; 32]).await?.is_none());
assert!(other.find(&[3; 32]).await?.is_some());

• The cache is authoritative: a miss or expiry must mean "not authenticated", never a fallback.
• insert rejects collisions and already-expired records atomically within a clone group.
• Distributed stores need a native atomic insert; coordination is local to clones.

How it works

CacheSessions maps the 32-byte digest to a scoped cache key and forwards each SessionStore method to the backing Cache; insert first checks for a collision and refuses already-expired records, while revoke_all clears only the namespace prefix.

flowchart LR
  S["CacheSessions"] --> I["insert"]
  S --> F["find"]
  S --> R["revoke"]
  S --> RA["revoke_all"]
  I --> K["scoped digest key"]
  I --> G["Cache get collision check"]
  I --> P["Cache put with ttl"]
  F --> Q["Cache get"]
  R --> V["Cache invalidate"]
  RA --> X["Cache invalidate_prefix"]

What it implements

• Implements iet_auth::SessionStore from iet-auth.

What's inside

Modules

• src/lib.rs

Public API

(root)

• struct CacheSessions
• pub fn new(cache: C, namespace: String) -> AppResult<Self> — Use a dedicated authoritative backend, not a second facade over shared keys. Coordination is local to clones. Distributed stores need native atomic insert.

Impl map

• Clone for CacheSessions<C>
• SessionStore for CacheSessions<C>

Depends on

• iet-telemetry
• iet-auth
• iet-cache
• iet-core

External crates: tokio

Used by

• No other framework crate depends on it directly.

In this repository

• examples/htmx-starter

Source: crates/features/iet-auth-session-cache