Session

@webda/core

---

Class: Session

Defined in: packages/core/src/session/session.ts:77

Session

Extended by

• UnknownSession

Constructors

Constructor

new Session(): Session

Returns

Session

Properties

amr?

optional amr?: string[]

Defined in: packages/core/src/session/session.ts:109

Authentication methods used

---

application?

optional application?: ApplicationIdentity

Defined in: packages/core/src/session/session.ts:156

Application (workload) identity when authenticated by OIDC: mutually exclusive with userId

An application session has no current user, so ownership checks never mistake an application for a user

---

authAt?

optional authAt?: number

Defined in: packages/core/src/session/session.ts:138

When the session was authenticated (ms timestamp, stamped by the Authentication service): a session older than the last password change of its user is loaded as anonymous

---

changed

protected changed: boolean = false

Defined in: packages/core/src/session/session.ts:82

Whether changed is enabled

---

clientId?

optional clientId?: string

Defined in: packages/core/src/session/session.ts:149

OAuth client the bearer token was issued to

---

identUsed

identUsed: string

Defined in: packages/core/src/session/session.ts:94

Ident used

---

mfa?

optional mfa?: MfaState

Defined in: packages/core/src/session/session.ts:118

MFA state of the session

---

mfaAt?

optional mfaAt?: number

Defined in: packages/core/src/session/session.ts:123

When the second factor was last verified (ms timestamp): a proof time, never advanced by a token refresh. Undefined unless mfa === "verified"; sessions verified before it existed have none and are never fresh

---

mfaVerifications?

optional mfaVerifications?: Record<string, MfaVerification>

Defined in: packages/core/src/session/session.ts:127

MFA verifications

---

provider?

optional provider?: string

Defined in: packages/core/src/session/session.ts:104

Authentication provider used

---

refreshFamily?

optional refreshFamily?: string

Defined in: packages/core/src/session/session.ts:132

Refresh token family identifier

---

roles

roles: string[]

Defined in: packages/core/src/session/session.ts:99

User current roles

---

scopes?

optional scopes?: string[]

Defined in: packages/core/src/session/session.ts:144

Operation globs the bearer token is restricted to (OAuth scope); undefined means unrestricted. Never set on cookie sessions.

---

stateless?

optional stateless?: boolean

Defined in: packages/core/src/session/session.ts:162

Session is stateless (not persisted in cookies)

---

transientAmr?

optional transientAmr?: string[]

Defined in: packages/core/src/session/session.ts:113

Authentication methods verified only for this request

---

userId?

optional userId?: string

Defined in: packages/core/src/session/session.ts:90

User id

---

uuid

uuid: string

Defined in: packages/core/src/session/session.ts:86

Session uuid

Methods

addTransientAmr()

addTransientAmr(method): void

Defined in: packages/core/src/session/session.ts:276

Add a method proved only for the current request.

Parameters

method

string

authentication method

Returns

void

---

getPersistentAmr()

getPersistentAmr(): string[]

Defined in: packages/core/src/session/session.ts:286

Get authentication methods safe to persist in a cookie or token

Returns

string[]

authentication methods safe to persist in a cookie or token

---

getProxy()

getProxy(): this

Defined in: packages/core/src/session/session.ts:294

Get the proxy to be able to track modification

Returns

this

this for chaining

---

isApplication()

isApplication(): boolean

Defined in: packages/core/src/session/session.ts:203

If session is authenticated as an application

Returns

boolean

true if the condition is met

---

isDirty()

isDirty(): boolean

Defined in: packages/core/src/session/session.ts:268

Session is dirty and requires save

Returns

boolean

true if the condition is met

---

isLogged()

isLogged(): boolean

Defined in: packages/core/src/session/session.ts:231

If session is authenticated

Returns

boolean

true if the condition is met

---

isPending()

isPending(): boolean

Defined in: packages/core/src/session/session.ts:239

If session is pending MFA verification

Returns

boolean

true if the condition is met

---

login()

login(userId, identUsed, options?): void

Defined in: packages/core/src/session/session.ts:170

Login

Parameters

userId

string

the user identifier

identUsed

string

the identity used

options?

LoginOptions = {}

login options including provider, amr, and mfa state

Returns

void

---

loginApplication()

loginApplication(application, options?): void

Defined in: packages/core/src/session/session.ts:191

Login an application (workload identity): the session becomes stateless and has no user

Parameters

application

ApplicationIdentity

the application identity

options?

authentication methods, ["oidc"] by default

amr?

string[]

authentication methods used

Returns

void

---

logout()

logout(): void

Defined in: packages/core/src/session/session.ts:210

Logout

Returns

void

---

markMfaVerified()

markMfaVerified(amr, now?): void

Defined in: packages/core/src/session/session.ts:249

Record a second factor verified now on an already identified session (login completion or step-up): keeps the user, ident, provider, authAt and refresh family

Parameters

amr

string[]

second factor method(s) verified, added to the session methods

now?

number = ...

verification time (ms)

Returns

void

---

mfaAge()

mfaAge(now?): number

Defined in: packages/core/src/session/session.ts:260

Return ms since the second factor was verified, Infinity when it never was

Parameters

now?

number = ...

reference time (ms)

Returns

number

ms since the second factor was verified, Infinity when it never was