NAME

Yote::YapiServer::Session - Session management with object capability tracking

DESCRIPTION

Manages user sessions and tracks which objects have been exposed to the client. This provides security by ensuring clients can only access objects explicitly granted to their session.

OBJECT CAPABILITY MODEL

When the server returns an object to the client, it calls expose_object() to record that the client has been given access. Subsequent requests that reference that object are validated against the exposed_objs list.

This prevents clients from accessing arbitrary objects by guessing IDs.

METHODS

generate_token()

Class method. Generates a cryptographically random session token with signature.

expose_object($obj)

Records that an object has been exposed to this session. Returns the object ID.

can_access($obj_or_id)

Returns true if the object/ID has been exposed to this session.

is_expired()

Returns true if the session has expired.

touch()

Updates last_access timestamp.