Issues, looks up and revokes server-side sessions.
generate_session_token/1 returns a plaintext token while storage keeps its SHA-256 digest.
get_user_by_session_token/1 returns the account only while that session remains valid.
delete_session_token/1 revokes one token.
Ithibati.Web.Gate connects these calls to a browser session and LiveView sockets. Direct calls
here do not update cookies or broadcast socket disconnections. API tokens with scopes or
rotation are separate application concerns.
Summary
Functions
Revokes one token and returns :ok, including for nil or an unknown token.
Stores a new session and returns its plaintext, URL-safe token.
Returns the account for a valid session token, or nil.
Functions
Revokes one token and returns :ok, including for nil or an unknown token.
Stores a new session and returns its plaintext, URL-safe token.
The account must belong to the configured schema and exist in the database. The row stores
only a digest, so retain the returned token for the client. Invalid session validity raises
ArgumentError; an invalid insert raises Ecto.InvalidChangesetError.
This call does not revoke other sessions or update a browser cookie.
Returns the account for a valid session token, or nil.
Unknown, revoked and expired tokens all return nil. A nil input also returns nil without
reading configuration or querying the database.
Validity is measured from session creation using config :ithibati, session_validity: and
defaults to {60, :day}. Lookup does not extend a session. Invalid validity settings raise
ArgumentError when looking up a string token.