Documentation
¶
Overview ¶
Package sessionvalidate implements the session-validate slice: verifies access tokens and returns Claims. Implements runtime/kauth.IntentTokenVerifier.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func SliceMetadata ¶
SliceMetadata returns the package-scope *metadata.SliceMeta projected from slice.yaml. Composition roots consume this via cell.MustNewBaseSliceFromMeta(<slicePkg>.SliceMetadata()) — the typed funnel that replaces the legacy `cell.NewBaseSlice(id, cellID, level)` literal pattern.
Types ¶
type Option ¶
type Option func(*Service)
Option configures an optional dependency on a Service.
func WithTxManager ¶
func WithTxManager(tx persistence.CellTxManager) Option
WithTxManager sets the CellTxManager used to scope user-repo reads under the session's tenant RLS context. nil is silently ignored; the final nil check is performed by validateRequired.
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
Service validates JWT access tokens and checks session revocation status.
func NewService ¶
func NewService( verifier kauth.IntentTokenVerifier, sessionStore session.Store, userRepo ports.UserRepository, logger *slog.Logger, opts ...Option, ) (*Service, error)
NewService creates a session-validate Service. Returns an error when any required dependency is nil (including typed-nil interfaces).
sessionStore may be nil: when nil, session revocation and epoch checks are skipped (demo / integration-test mode). If non-nil, it is used to verify session liveness before accepting a token.
func (*Service) VerifyIntent ¶
func (s *Service) VerifyIntent(ctx context.Context, tokenStr string, expected kauth.TokenIntent) (kauth.Claims, error)
VerifyIntent validates an access token. This service is intentionally scoped to access tokens (session-revocation checks presume a business endpoint), so any expected intent other than TokenIntentAccess is rejected as ErrAuthInvalidTokenIntent. Callers needing refresh-token validation must use the underlying JWTVerifier directly (see sessionrefresh).
Source Files