Class PreAuthSessionStore

Namespace

SEBT.Portal.Api.Services

Assembly

SEBT.Portal.Api.dll

manages the lifecycle of server-side pre-auth OIDC sessions. Implementations store sessions in a cache (L1 memory + optional L2 Redis) with an automatic TTL so abandoned flows expire without explicit cleanup.

public sealed class PreAuthSessionStore : IPreAuthSessionStore

Inheritance

object

PreAuthSessionStore

Implements

IPreAuthSessionStore

Constructors

PreAuthSessionStore(IDistributedCache, IDistributedLockProvider, ILogger<PreAuthSessionStore>)

manages the lifecycle of server-side pre-auth OIDC sessions. Implementations store sessions in a cache (L1 memory + optional L2 Redis) with an automatic TTL so abandoned flows expire without explicit cleanup.

public PreAuthSessionStore(IDistributedCache cache, IDistributedLockProvider lockProvider, ILogger<PreAuthSessionStore> logger)

Parameters

cache IDistributedCache

lockProvider IDistributedLockProvider

logger ILogger<PreAuthSessionStore>

Methods

CreateAsync(string, string, string, string, bool, string?, CancellationToken)

Creates a new pre-auth session and returns its ID (for the cookie).

public Task<PreAuthSession> CreateAsync(string stateCode, string state, string codeVerifier, string redirectUri, bool isStepUp, string? returnUrl = null, CancellationToken cancellationToken = default)

Parameters

stateCode string

state string

codeVerifier string

redirectUri string

isStepUp bool

returnUrl string

cancellationToken CancellationToken

Returns

Task<PreAuthSession>

GetAsync(string, CancellationToken)

Retrieves a session by ID. Returns null if expired or not found.

public Task<PreAuthSession?> GetAsync(string sessionId, CancellationToken cancellationToken = default)

Parameters

sessionId string

cancellationToken CancellationToken

Returns

Task<PreAuthSession>

RemoveAsync(string, CancellationToken)

Removes a session (used after login completion or on error cleanup).

public Task RemoveAsync(string sessionId, CancellationToken cancellationToken = default)

Parameters

sessionId string

cancellationToken CancellationToken

Returns

Task

TryAdvanceToCallbackCompletedAsync(string, string, CancellationToken)

Advances the session to CallbackCompleted and stores the callback token hash. Fails if the session is not in Created phase.

public Task<bool> TryAdvanceToCallbackCompletedAsync(string sessionId, string callbackTokenHash, CancellationToken cancellationToken = default)

Parameters

sessionId string

callbackTokenHash string

cancellationToken CancellationToken

Returns

Task<bool>

Remarks

Implementations use a distributed lock to serialize concurrent transitions across all container instances (Redis-backed in production, SQL fallback otherwise).

TryAdvanceToLoginCompletedAsync(string, string, CancellationToken)

Advances the session to LoginCompleted. Fails if the session is not in CallbackCompleted phase or the callback token hash doesn't match. Uses the same distributed lock as TryAdvanceToCallbackCompletedAsync(string, string, CancellationToken).

public Task<bool> TryAdvanceToLoginCompletedAsync(string sessionId, string callbackTokenHash, CancellationToken cancellationToken = default)

Parameters

sessionId string

callbackTokenHash string

cancellationToken CancellationToken

Returns

Task<bool>