datapages-sessions

Sessions

Read datapages first for the build loop, hard rules and naming conventions.

Declare the session data and alias once in the app package. Do not declare them when the app has no authentication.

type SessionData struct{ Name string }

type Session = datapages.Session[SessionData]

Use struct{} when the session has no application data. Every handler must use the same data type. Use the shared alias in every handler.

Read

Pages, actions, event handlers and stream hooks may take session Session. It is read-only and provides UserID(), IsGuest(), Token(), IssuedAt(), ExpiresAt() and Data(). Datapages treats an expired session as unauthenticated and deletes its cookie. A stream opened with the session ends when the session closes or reaches ExpiresAt(), and its page reloads after 1s.

Add session Session to every action that must reject a closed or expired session. Without this parameter, Datapages does not read the session store. It checks the CSRF token against the session cookie if the request has one, and accepts a request without a cookie: guests can call the action. Take session Session and check IsGuest() when only signed-in users may call it.

Open and close

Return values, from a GET or an action:

// POSTSignIn is /sign-in
func (*App) POSTSignIn(
	r *http.Request,
	signals datapages.Signals[struct {
		Name string `json:"name"`
	}],
) (
	newSession datapages.NewSession[SessionData],
	redirect datapages.Redirect,
	err error,
) {
	name := signals.Values.Name
	if err := datapages.ValidateUserID(name); err != nil {
		return datapages.NewSession[SessionData]{},
			datapages.Redirect{}, datapages.ErrBadRequest
	}
	return datapages.NewSession[SessionData]{
		UserID: name,
		Data:   SessionData{Name: name},
	}, datapages.Redirect{URL: href.PageIndex()}, nil
}

NewSession contains UserID, Data and an optional ExpiresAt. Datapages creates the token and sets the issue time. A zero UserID creates no session. To sign out, return closeSession datapages.CloseSession set to true.