Session

@webda/core

---

Class: Session

Defined in: packages/core/src/session/session.ts:56

Session

Extended by

• UnknownSession

Constructors

Constructor

new Session(): Session

Returns

Session

Properties

amr?

optional amr?: string[]

Defined in: packages/core/src/session/session.ts:85

Authentication methods used

---

application?

optional application?: ApplicationIdentity

Defined in: packages/core/src/session/session.ts:129

Application (workload) identity when authenticated by OIDC: mutually exclusive with userId

An application session has no current user, so ownership checks never mistake an application for a user

---

authAt?

optional authAt?: number

Defined in: packages/core/src/session/session.ts:111

When the session was authenticated (ms timestamp, stamped by the Authentication service): a session older than the last password change of its user is loaded as anonymous

---

changed

protected changed: boolean = false

Defined in: packages/core/src/session/session.ts:58

---

clientId?

optional clientId?: string

Defined in: packages/core/src/session/session.ts:122

OAuth client the bearer token was issued to

---

identUsed

identUsed: string

Defined in: packages/core/src/session/session.ts:70

Ident used

---

mfa?

optional mfa?: MfaState

Defined in: packages/core/src/session/session.ts:94

MFA state of the session

---

mfaAt?

optional mfaAt?: number

Defined in: packages/core/src/session/session.ts:99

When the second factor was last verified (ms timestamp): a proof time, never advanced by a token refresh. Undefined unless mfa === "verified"; sessions verified before it existed have none and are never fresh

---

mfaVerifications?

optional mfaVerifications?: Record<string, MfaVerification>

Defined in: packages/core/src/session/session.ts:100

---

provider?

optional provider?: string

Defined in: packages/core/src/session/session.ts:80

Authentication provider used

---

refreshFamily?

optional refreshFamily?: string

Defined in: packages/core/src/session/session.ts:105

Refresh token family identifier

---

roles

roles: string[]

Defined in: packages/core/src/session/session.ts:75

User current roles

---

scopes?

optional scopes?: string[]

Defined in: packages/core/src/session/session.ts:117

Operation globs the bearer token is restricted to (OAuth scope); undefined means unrestricted. Never set on cookie sessions.

---

stateless?

optional stateless?: boolean

Defined in: packages/core/src/session/session.ts:135

Session is stateless (not persisted in cookies)

---

transientAmr?

optional transientAmr?: string[]

Defined in: packages/core/src/session/session.ts:89

Authentication methods verified only for this request

---

userId?

optional userId?: string

Defined in: packages/core/src/session/session.ts:66

User id

---

uuid

uuid: string

Defined in: packages/core/src/session/session.ts:62

Session uuid

Methods

addTransientAmr()

addTransientAmr(method): void

Defined in: packages/core/src/session/session.ts:248

Add a method proved only for the current request.

Parameters

method

string

authentication method

Returns

void

---

getPersistentAmr()

getPersistentAmr(): string[]

Defined in: packages/core/src/session/session.ts:255

Returns

string[]

authentication methods safe to persist in a cookie or token

---

getProxy()

getProxy(): this

Defined in: packages/core/src/session/session.ts:263

Get the proxy to be able to track modification

Returns

this

this for chaining

---

isApplication()

isApplication(): boolean

Defined in: packages/core/src/session/session.ts:176

If session is authenticated as an application

Returns

boolean

true if the condition is met

---

isDirty()

isDirty(): boolean

Defined in: packages/core/src/session/session.ts:240

Session is dirty and requires save

Returns

boolean

true if the condition is met

---

isLogged()

isLogged(): boolean

Defined in: packages/core/src/session/session.ts:204

If session is authenticated

Returns

boolean

true if the condition is met

---

isPending()

isPending(): boolean

Defined in: packages/core/src/session/session.ts:212

If session is pending MFA verification

Returns

boolean

true if the condition is met

---

login()

login(userId, identUsed, options?): void

Defined in: packages/core/src/session/session.ts:143

Login

Parameters

userId

string

the user identifier

identUsed

string

the identity used

options?

LoginOptions = {}

login options including provider, amr, and mfa state

Returns

void

---

loginApplication()

loginApplication(application, options?): void

Defined in: packages/core/src/session/session.ts:164

Login an application (workload identity): the session becomes stateless and has no user

Parameters

application

ApplicationIdentity

the application identity

options?

authentication methods, ["oidc"] by default

amr?

string[]

authentication methods used

Returns

void

---

logout()

logout(): void

Defined in: packages/core/src/session/session.ts:183

Logout

Returns

void

---

markMfaVerified()

markMfaVerified(amr, now?): void

Defined in: packages/core/src/session/session.ts:222

Record a second factor verified now on an already identified session (login completion or step-up): keeps the user, ident, provider, authAt and refresh family

Parameters

amr

string[]

second factor method(s) verified, added to the session methods

now?

number = ...

verification time (ms)

Returns

void

---

mfaAge()

mfaAge(now?): number

Defined in: packages/core/src/session/session.ts:232

Parameters

now?

number = ...

reference time (ms)

Returns

number

ms since the second factor was verified, Infinity when it never was