resolveSession method

Future<AuthSession?> resolveSession(EngineContext ctx)

Resolves and validates the current authentication session for ctx.

Returns null when no valid session is present or when a persisted server-side session no longer exists. The configured session strategy, callbacks, account policies, and session refresh rules are applied.

Implementation

Future<AuthSession?> resolveSession(EngineContext ctx) async {
  final storedSession = await _resolveStoredSession(ctx);
  if (options.sessionStrategy == AuthSessionStrategy.session &&
      ctx.hasSession &&
      storedSession == null) {
    return null;
  }
  final resolved =
      await resolveAuthSessionForStrategyWithCallbacks<EngineContext>(
        strategy: options.sessionStrategy,
        callbacks: callbacks,
        context: ctx,
        jwtOptions: options.jwtOptions,
        sessionUpdateAge: options.sessionUpdateAge,
        readSessionPrincipal: () => sessionAuth.current(ctx),
        applySessionMaxAge: () => _applySessionMaxAge(ctx),
        readSessionIssuedAt: () =>
            ctx.getSession<String>(authSessionIssuedAtKey),
        writeSessionIssuedAt: (issuedAtUtc) =>
            _setSessionIssuedAt(ctx, issuedAtUtc),
        touchSession: ctx.session.touch,
        resolveSessionExpiry: () => _sessionExpiry(ctx),
        readJwtToken: () => _resolveJwtToken(ctx),
        validateJwtClaims: _validateJwtClaims,
        writeJwtAttribute: ctx.set,
        httpClient: httpClient,
      );
  final refreshCookie = resolved.refreshCookie;
  if (refreshCookie != null) {
    ctx.response.cookies.add(refreshCookie);
  }
  if (storedSession != null &&
      resolved.session != null &&
      storedSession.userId != resolved.session!.user.id) {
    return null;
  }
  final session = resolved.session;
  if (session != null) {
    await _enforceAuthenticationPolicy(
      ctx,
      session.user,
      AuthAuthenticationPolicyPhase.resolveSession,
    );
  }
  return session;
}