Class SessionLifetimePolicy

Namespace

SEBT.Portal.UseCases.Auth.SessionLifetime

Assembly

SEBT.Portal.UseCases.dll

Evaluates whether a portal session has exceeded its absolute lifetime cap, anchored to the JWT auth_time claim (RFC 7519 / OIDC Core).

public class SessionLifetimePolicy

Inheritance

object

SessionLifetimePolicy

Remarks

Pure business rule; no I/O. The bearer middleware calls this on every authenticated request, so a session that lacks auth_time or has aged past the cap is rejected before any controller runs — not just at /api/auth/refresh.

Constructors

SessionLifetimePolicy(IOptions<JwtSettings>, TimeProvider)

Evaluates whether a portal session has exceeded its absolute lifetime cap, anchored to the JWT auth_time claim (RFC 7519 / OIDC Core).

public SessionLifetimePolicy(IOptions<JwtSettings> jwtSettings, TimeProvider timeProvider)

Parameters

jwtSettings IOptions<JwtSettings>

timeProvider TimeProvider

Remarks

Pure business rule; no I/O. The bearer middleware calls this on every authenticated request, so a session that lacks auth_time or has aged past the cap is rejected before any controller runs — not just at /api/auth/refresh.

Fields

AuthTimeClaimName

Standard OIDC claim name. With MapInboundClaims = false the bearer middleware leaves it as a literal claim type on the principal.

public const string AuthTimeClaimName = "auth_time"

Field Value

string

Methods

Evaluate(ClaimsPrincipal)

public SessionLifetimePolicy.Outcome Evaluate(ClaimsPrincipal principal)

Parameters

principal ClaimsPrincipal

Returns

SessionLifetimePolicy.Outcome