Session

dagster_authkit.auth.session

Session Management Supports Stateless (Signed Cookies) and Stateful (Redis) backends.

SessionBackend

Bases: ABC

Abstract base class for session storage backends.

Implementations: - RedisBackend: Stateful, multi-pod safe, stores sessions in Redis. - CookieBackend: Stateless signed cookies with optional DB-backed session versioning for cross-pod revocation.

create abstractmethod

create(user_data)

Persist a new session.

Parameters:

Name	Type	Description	Default
user_data	Dict[str, Any]	Dict with username, role, email, full_name.	required

Returns:

Type	Description
str	Opaque session token string to be set as a cookie.

validate abstractmethod

validate(token)

Validate a session token.

Parameters:

Name	Type	Description	Default
token	str	Opaque session token (from cookie).	required

Returns:

Type	Description
Optional[Dict[str, Any]]	Original user_data dict if valid, None otherwise.

revoke abstractmethod

revoke(token)

Revoke a single session token.

Parameters:

Name	Type	Description	Default
token	str	Session token to invalidate.	required

Returns:

Type	Description
bool	True if the token existed and was revoked.

revoke_all abstractmethod

revoke_all(username)

Revoke ALL active sessions for a user.

Parameters:

Name	Type	Description	Default
username	str	User whose sessions should be terminated.	required

Returns:

Type	Description
int	Number of sessions revoked.

RedisBackend

Bases: SessionBackend

Redis-based session storage (stateful, multi-pod safe).

Uses SETEX for token storage and Redis SET for per-user token indexing, enabling efficient revoke_all.

Parameters:

Name	Type	Description	Default
redis_url	str	Redis connection URL (redis:// or rediss://).	required
max_age	int	Session TTL in seconds.	required

__init__

__init__(redis_url, max_age)

Initialise Redis connection.

CookieBackend

Bases: SessionBackend

Stateless signed-cookie sessions with optional DB-backed versioning.

Version resolution is lazy: the first create() or validate() call attempts to resolve a version getter from the SQL backend. If successful, revoke_all becomes multi-pod safe via the database.

Individual revoke() is always process-local (best-effort without Redis).

Parameters:

Name	Type	Description	Default
secret_key	str	HMAC signing secret for cookie serialization.	required
max_age	int	Session TTL in seconds.	required

revoke

revoke(token)

Revoke a single token (process-local only).

Without Redis, individual logout only affects the current pod. The token remains valid on other pods until it expires naturally. For cross-pod individual logout, use RedisBackend.

revoke_all

revoke_all(username)

Invalidate all sessions for a user.

When DB-backed: raises NotImplementedError. The caller must use PeeweeAuthBackend._bump_session_version() which bumps the DB column directly. Session propagation delay is up to VERSION_CACHE_TTL (10s).

When in-memory (single-pod): bumps the local counter immediately.

SessionManager

Facade that auto-selects the session backend based on configuration.

• If DAGSTER_AUTH_REDIS_URL is set: uses RedisBackend.
• Otherwise: uses CookieBackend (stateless signed cookies with optional DB-backed session versioning for SQL backends).

Usage::

token = sessions.create(user.to_dict())
user_data = sessions.validate(token)
sessions.revoke(token)

__init__

__init__()

Initialise and auto-select the session backend.