sessionmint

type Deps ¶

type Deps struct {
	// Issuer signs the access JWT. Required.
	Issuer TokenIssuer
	// RoleRepo resolves the user's current role names. Required.
	RoleRepo ports.RoleRepository
}

Deps injects the collaborators MintAccess needs.

type Request ¶

type Request struct {
	UserID                string
	SessionID             string
	PasswordResetRequired bool
	// TenantID scopes the role lookup to the correct tenant.
	// Required for GetByUserID (RoleRepository.GetByUserID takes tenant param).
	TenantID tenant.TenantID
}

Request is the per-call input for a MintAccess.

type Result ¶

type Result struct {
	AccessToken string
	Roles       []string
	ExpiresAt   time.Time
	JTI         string
}

Result is the MintAccess output.

ExpiresAt is sampled from Deps.Clk (or clock.Real()) at MintAccess entry; the JWT's own exp claim is stamped independently inside the issuer a moment later. Treat Result.ExpiresAt as the business-layer expiry (used for Session persistence) — the authoritative wire value is the JWT exp claim.

JTI is the per-token unique identifier embedded in the JWT `jti` claim (RFC 9068 §2.2.4). It is generated fresh inside MintAccess so each access token — including post-rotation tokens minted by Refresh — carries its own jti, satisfying ADR-credential D1's per-token uniqueness invariant.

func MintAccess(ctx context.Context, clk clock.Clock, deps Deps, req Request) (Result, error)

type TokenIssuer ¶

type TokenIssuer interface {
	Issue(intent kauth.TokenIntent, subject string, opts auth.IssueOptions) (string, error)
}

TokenIssuer is the minimal surface MintAccess needs from a JWT issuer. Exposing the interface keeps sessionmint unit-testable with a stub issuer. Production code passes in *auth.JWTIssuer directly (it satisfies this interface by method set).