Interface IPreAuthSessionStore

Namespace

SEBT.Portal.Core.Services

Assembly

SEBT.Portal.Core.dll

manages the lifecycle of server-side pre-auth OIDC sessions. Implementations store sessions in a cache (L1 memory + optional L2 Redis) with an automatic TTL so abandoned flows expire without explicit cleanup.

public interface IPreAuthSessionStore

Methods

CreateAsync(string, string, string, string, bool, string?, CancellationToken)

Creates a new pre-auth session and returns its ID (for the cookie).

Task<PreAuthSession> CreateAsync(string stateCode, string state, string codeVerifier, string redirectUri, bool isStepUp, string? returnUrl = null, CancellationToken cancellationToken = default)

Parameters

stateCode string

state string

codeVerifier string

redirectUri string

isStepUp bool

returnUrl string

cancellationToken CancellationToken

Returns

Task<PreAuthSession>

GetAsync(string, CancellationToken)

Retrieves a session by ID. Returns null if expired or not found.

Task<PreAuthSession?> GetAsync(string sessionId, CancellationToken cancellationToken = default)

Parameters

sessionId string

cancellationToken CancellationToken

Returns

Task<PreAuthSession>

HashCallbackToken(string)

Computes the SHA-256 hash of a callback token for storage/comparison.

public static string HashCallbackToken(string callbackToken)

Parameters

callbackToken string

Returns

string

RemoveAsync(string, CancellationToken)

Removes a session (used after login completion or on error cleanup).

Task RemoveAsync(string sessionId, CancellationToken cancellationToken = default)

Parameters

sessionId string

cancellationToken CancellationToken

Returns

Task

TryAdvanceToCallbackCompletedAsync(string, string, CancellationToken)

Advances the session to CallbackCompleted and stores the callback token hash. Fails if the session is not in Created phase.

Task<bool> TryAdvanceToCallbackCompletedAsync(string sessionId, string callbackTokenHash, CancellationToken cancellationToken = default)

Parameters

sessionId string

callbackTokenHash string

cancellationToken CancellationToken

Returns

Task<bool>

Remarks

Implementations use a distributed lock to serialize concurrent transitions across all container instances (Redis-backed in production, SQL fallback otherwise).

TryAdvanceToLoginCompletedAsync(string, string, CancellationToken)

Advances the session to LoginCompleted. Fails if the session is not in CallbackCompleted phase or the callback token hash doesn't match. Uses the same distributed lock as TryAdvanceToCallbackCompletedAsync(string, string, CancellationToken).

Task<bool> TryAdvanceToLoginCompletedAsync(string sessionId, string callbackTokenHash, CancellationToken cancellationToken = default)

Parameters

sessionId string

callbackTokenHash string

cancellationToken CancellationToken

Returns

Task<bool>