Session Service
Relevant source files
The following files were used as context for generating this wiki page:
The Session Service is a focused component within the FLEXT Auth ecosystem responsible for managing the lifecycle and persistence of user authentication sessions. It acts as an orchestration layer that integrates with flext-core services to provide railway-oriented session operations, including creation, retrieval, and automated cleanup of expired records. Sources: src/flext_auth/services/session_service.py:11-13, tests/README.md:68-75
This service ensures that user sessions comply with enterprise security standards, such as session limits per user and configurable expiration windows. It works in conjunction with the Identity Service to link sessions to specific user identities and the JWT Service for token-based session validation. Sources: examples/comprehensive_demo_03.py:34-45, src/flext_auth/history.json:1040-1045
Architecture and Components
The Session Service is built upon a layered architecture that leverages managers for low-level data manipulation and services for public API exposure.
Component Hierarchy
The diagram shows the relationship between the public service interface and the underlying management utilities. Sources: src/flext_auth/services/session_service.py:16-30
Key Classes
| Class | Responsibility | Source |
|---|---|---|
FlextAuthSessionService | Public entry point for session operations and cleanup orchestration. | session_service.py:16 |
FlextAuthSessionManager | Handles direct CRUD operations on session entities and active session filtering. | session_service.py:32 |
ServiceManagers | A container class that provides the Session Service with its required management dependencies. | session_service.py:23-28 |
Session Lifecycle Management
The service provides specific methods to manage the beginning, monitoring, and end of a user's authenticated state.
Operational Flow
The sequence shows how the service delegates lifecycle tasks to the specialized manager. Sources: src/flext_auth/services/session_service.py:36-40, examples/comprehensive_demo_03.py:42-45
Core Operations
- Active Session Retrieval: Allows developers to fetch all current valid sessions for a specific
identity_id. Sources: examples/README.md:16, examples/comprehensive_demo_03.py:42 - Session Termination: Provides the ability to end a specific session by its unique ID, facilitating manual logout or security revocations. Sources: examples/comprehensive_demo_03.py:44-46
- Expired Session Cleanup: A maintenance operation that removes sessions exceeding their TTL (Time To Live). This returns a
p.Result[int]indicating the number of cleaned sessions. Sources: src/flext_auth/services/session_service.py:36-40
Configuration and Constraints
Session behavior is governed by FlextAuthSettings, which defines the security boundaries for session persistence.
| Constant | Description | Default Value |
|---|---|---|
DEFAULT_SESSION_EXPIRY_MINUTES | The duration after which a session is considered invalid. | 1440 (24 hours) |
DEFAULT_MAX_SESSIONS_PER_USER | Maximum number of concurrent sessions allowed per identity. | 5 |
SESSION_EXPIRY_MAX_MINUTES | The upper limit for custom session durations. | 43200 (30 days) |
Sources: src/flext_auth/history.json:960-965, src/flext_auth/history.json:1040-1045
Implementation Example
The following snippet demonstrates how the Session Service is used within a comprehensive authentication workflow to monitor and terminate sessions.
# Create auth instance
auth = FlextAuth()
# Retrieve active sessions for a user
identity_id = user.unique_id
active_sessions = auth.session_service.session_manager.get_active_sessions(identity_id)
# Terminate a specific session
if session_id:
auth.session_service.session_manager.end_session_by_id(session_id)
# Perform system-wide maintenance
cleanup_result = auth.session_service.cleanup_expired_sessions()
Sources: examples/comprehensive_demo_03.py:41-47, src/flext_auth/services/session_service.py:36-40
Conclusion
The Session Service provides a robust framework for managing user persistence in the FLEXT Auth system. By separating high-level orchestration from the FlextAuthSessionManager, the service maintains clean boundaries while ensuring that enterprise security constraints—like session limits and expiration—are strictly enforced through a railway-oriented API. Sources: src/flext_auth/services/session_service.py:11-14, tests/README.md:34-40