Class PreAuthSession

Namespace

SEBT.Portal.Core.Models.Auth

Assembly

SEBT.Portal.Core.dll

server-side pre-auth session created at GET /api/auth/oidc/{stateCode}/config. Binds the OIDC PKCE flow to the browser that initiated it via the oidc_session cookie. State transitions: Created → CallbackCompleted → LoginCompleted. Any attempt to advance from a state other than the immediately preceding one fails.

Immutable: state transitions produce a new instance via with expressions so concurrent reads on a shared cache reference cannot observe partial mutations.

public sealed record PreAuthSession

Inheritance

object

PreAuthSession

Properties

CallbackTokenHash

SHA-256 hash of the callback token issued at the Callback step. Stored so CompleteLogin can verify the presented token matches without storing the token itself.

public string? CallbackTokenHash { get; init; }

Property Value

string

CodeVerifier

PKCE code_verifier — never exposed to the browser.

public required string CodeVerifier { get; init; }

Property Value

string

CreatedAt

When the session was created (UTC).

public DateTimeOffset CreatedAt { get; init; }

Property Value

DateTimeOffset

Id

Cryptographically random session ID (also the cookie value).

public required string Id { get; init; }

Property Value

string

IsStepUp

True when this is a step-up (IAL1+) flow.

public bool IsStepUp { get; init; }

Property Value

bool

Phase

Current lifecycle phase.

public PreAuthSessionPhase Phase { get; init; }

Property Value

PreAuthSessionPhase

RedirectUri

redirect_uri that was sent in the authorization request.

public required string RedirectUri { get; init; }

Property Value

string

ReturnUrl

For step-up flows, the relative path to return to after verification completes (e.g. /profile/address). Null for normal login flows.

public string? ReturnUrl { get; init; }

Property Value

string

State

CSRF / OIDC state parameter sent to the IdP.

public required string State { get; init; }

Property Value

string

StateCode

Tenant identifier (e.g. "co").

public required string StateCode { get; init; }

Property Value

string