The revocable half of being signed in: what an account is issued once it has proved who it is.
generate_session_token/1 returns URL-safe text, and the row holds only its sha256, so a
database dump is not a set of live sessions. Ithibati.Web.Gate is what calls all three
functions; an application reaches them through it rather than directly.
A session is the only credential this table holds. An API token for an extension or a native client is a different thing — scopes, rotation, a page to revoke one on — and building it is the application's, or another library's.
Summary
Functions
Revokes a session token: a logout. Revoking one that was never minted is not an error.
Mints a session token for the account and returns it as URL-safe text.
The account behind this session token, or nil.
Functions
Revokes a session token: a logout. Revoking one that was never minted is not an error.
Mints a session token for the account and returns it as URL-safe text.
What comes back is the only copy. The database gets its digest.
The account behind this session token, or nil.
nil covers every way there is not to have a valid session: an unknown token, a revoked one,
one older than the configured validity, and nil itself. A missing session key gives you
nil, and making each call site write token && … around that only moves the omission
somewhere less visible.