iet-auth-session-timescale

Persists opaque sessions with an application-selected profile policy.

How to use it

Owns fw_auth_sessions and implements iet_auth::SessionStore (insert / find / revoke). It defaults to the NoProfiles policy; attach a profile policy with with_profiles(...) so a disabled persona invalidates session lookups.

// examples/skills-only-app-task-tracker/servers/web/src/providers.rs
let profiles = iet_auth_profiles_timescale::ProfileStore::new(database.clone());
let store = iet_auth_session_timescale::SessionStore::new(database).with_profiles(profiles);
let sessions = Arc::new(Sessions::new(store, SessionConfig { ttl_seconds: 3600 })?);

// Registration: examples/skills-only-app-task-tracker/servers/web/src/database.rs
let mut registry = EntityRegistry::default();
iet_auth_identity_timescale::register(&mut registry)?;
iet_auth_session_timescale::register(&mut registry)?;

• There is no profile foreign key: the policy is enforced in Rust, not by the schema.
• insert rejects duplicate digests atomically and expired records are treated as absent.

How it works

SessionStore implements iet_auth::SessionStore: insert and find first check the attached ProfileStore policy, then repository writes or reads fw_auth_sessions joined to fw_auth_identities; revoke deletes the digest row.

flowchart LR
  Insert["SessionStore insert"] --> Policy["profile_enabled"]
  Policy --> Store["ProfileStore"]
  Insert --> RepoI["repository insert"]
  Find["SessionStore find"] --> Policy
  Find --> RepoF["repository find"]
  Revoke["SessionStore revoke"] --> RepoR["repository revoke"]
  RepoI --> Sess["fw_auth_sessions"]
  RepoI --> Id["fw_auth_identities"]
  RepoF --> Sess
  RepoF --> Id
  RepoR --> Sess

What it implements

• Implements iet_auth::SessionStore from iet-auth.
• Implements iet_auth::ProfileStore (policy) from iet-auth.

Database schema

The details below come from #[derive(Persistent)] entity metadata:

fw_auth_sessions

Entity Session (hard delete).

Foreign key auth_session_subject: (subject) → fw_auth_identities (id)

Index auth_session_expiry: (expires_at_ms)

Check: octet_length(digest) = 32 AND expires_at_ms > 0

Entities register into an EntityRegistry; EntityRegistry::initial emits a reviewed migration pair, and Migrations applies reviewed files. See iet-db-timescale and iet-db.

What's inside

Modules

• src/entity.rs
• src/lib.rs
• src/repository.rs
• src/stores.rs

Public API

(root)

• pub fn register(registry: &mut EntityRegistry) -> AppResult<()> — Register only sessions; register the shared identity table separately.

entity

• struct Session

stores

• struct SessionStore
• pub fn new(database: TimescaleDatabase) -> Self
• pub fn with_profiles<Q: ProfileStore>(self, profiles: Q) -> SessionStore<Q>

Impl map

• iet_auth::SessionStore for SessionStore<P>

Depends on

• iet-telemetry
• iet-core
• iet-auth
• iet-db-timescale
• iet-db-macros

External crates: sqlx, uuid

Used by

• No other framework crate depends on it directly.

In this repository

• examples/htmx-starter
• examples/skills-only-app
• examples/skills-only-app-task-tracker

Source: crates/integrations/iet-auth-session-timescale