Register the session in the registry after authentication and store the kill receiver. No-op if the user has `user_id == 0` (trust mode fallback). `token_expiry_ms` is `Some(exp_epoch_ms)` for OIDC/JWT sessions so the idle-sweep loop can enforce token lifetime independently of the TCP session.
(
&mut self,
identity: &crate::control::security::identity::AuthenticatedIdentity,
token_expiry_ms: Option<u64>,
)
| 157 | /// `token_expiry_ms` is `Some(exp_epoch_ms)` for OIDC/JWT sessions so the |
| 158 | /// idle-sweep loop can enforce token lifetime independently of the TCP session. |
| 159 | fn register_session( |
| 160 | &mut self, |
| 161 | identity: &crate::control::security::identity::AuthenticatedIdentity, |
| 162 | token_expiry_ms: Option<u64>, |
| 163 | ) { |
| 164 | use crate::control::security::sessions::SessionParams; |
| 165 | |
| 166 | if self.kill_rx.is_some() { |
| 167 | // Already registered (trust auto-auth path called twice). |
| 168 | return; |
| 169 | } |
| 170 | |
| 171 | let auth_method = match identity.auth_method { |
| 172 | crate::control::security::identity::AuthMethod::ScramSha256 => "scram_sha256", |
| 173 | crate::control::security::identity::AuthMethod::CleartextPassword => "password", |
| 174 | crate::control::security::identity::AuthMethod::ApiKey => "api_key", |
| 175 | crate::control::security::identity::AuthMethod::Certificate => "certificate", |
| 176 | crate::control::security::identity::AuthMethod::Trust => "trust", |
| 177 | crate::control::security::identity::AuthMethod::OidcBearer => "oidc_bearer", |
| 178 | }; |
| 179 | |
| 180 | let credential_version = self.state.credentials.current_version(identity.user_id); |
| 181 | self.identity_version = credential_version; |
| 182 | |
| 183 | let params = SessionParams { |
| 184 | user_id: identity.user_id, |
| 185 | username: identity.username.clone(), |
| 186 | db_user: identity.username.clone(), |
| 187 | peer_addr: self.peer_addr.to_string(), |
| 188 | protocol: "native".to_string(), |
| 189 | auth_method: auth_method.to_string(), |
| 190 | tenant_id: identity.tenant_id.as_u64(), |
| 191 | credential_version, |
| 192 | current_database: None, |
| 193 | token_expiry_ms, |
| 194 | }; |
| 195 | |
| 196 | match self |
| 197 | .state |
| 198 | .session_registry |
| 199 | .register(&self.session_id, ¶ms) |
| 200 | { |
| 201 | Ok(kill_rx) => { |
| 202 | self.kill_rx = Some(kill_rx); |
| 203 | } |
| 204 | Err(e) => { |
| 205 | // Cap exceeded; kill_rx stays None and the error will surface as |
| 206 | // a SessionCapExceeded on the next request that calls check_kill. |
| 207 | tracing::warn!(session_id = %self.session_id, cap = e.cap, |
| 208 | "session cap exceeded — session registered without kill channel"); |
| 209 | } |
| 210 | } |
| 211 | } |
| 212 | |
| 213 | /// Check whether the kill signal has fired (hard revoke). |
| 214 | /// |
no test coverage detected