statecraft.
Catalog/rahi

022-session-and-principal

Sessions and the principal: the signed envelope, renewal as a round-trip, the IdP subject as the only id

Lifecycle approvedImplementation completeVerification unknownQualification unknown

The app keeps the shell and gives up the authority. Login is the authorization-code flow with PKCE through the proxy; the session cookie is a signed envelope holding rauthy's refresh token and the pinned subject, httpOnly and same-origin, that grants nothing on presentation; the access assertion is short-lived and minted from the IdP's claims; renewal forwards the refresh token to rauthy and re-reads roles and email_verified from userinfo every time, so a role removed at the IdP takes effect within one access lifetime and a refused grant ends the session. No local account row is ever written. Carries enrahitu://004.

Read the full pinned specification ↗

Relationships

Claimed units

  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-idp/src/login.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-idp/src/session.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-idp/src/envelope.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-idp/src/refresh.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-idp/src/principal.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-idp/src/extractor.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-idp/tests/session.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-idp/tests/principal.rs"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-idp/tests/oidc/"
}
  • establishes
    {
  "kind": "file",
  "path": "crates/rahi-idp/testdata/oidc/"
}
  • extends
    {
  "nature": "additive",
  "spec": "021-idp-proxy-and-discovery",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-idp/src/lib.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "021-idp-proxy-and-discovery",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-idp/Cargo.toml"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "021-idp-proxy-and-discovery",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-idp/src/discovery.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "015-kernel-manifest-and-adjudication",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-kernel/src/lib.rs"
  }
}
  • extends
    {
  "nature": "additive",
  "spec": "010-workspace-and-core-types",
  "unit": {
    "anchor": "workspace.dependencies",
    "file": "Cargo.toml",
    "kind": "section"
  }
}
  • constrains
    {
  "flavor": "invariant-freeze",
  "note": "sub is the only principal id; constitution VII",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-idp/src/principal.rs"
  }
}

Source headings

  1. 022: Sessions and the principal
  2. 1. Purpose
  3. 2. Territory
  4. 3. Behavior
  5. 4. Functional requirements
  6. 5. Acceptance criteria
  7. 6. Out of scope
  8. 7. Resolved decisions
  9. 8. Status
  10. Verification

Frozen anchors

No frozen anchors declared.