Session registry with durable, linearizable security authority.
ALL mutable state lives in ONE atom: sessions, revoked principals, fork KBs, fork metadata, and a monotonic generation counter.
Authority changes (revocation, restoration, provisioning, lease retirement) are commit-before-ack: the durable store is written BEFORE in-memory state becomes less restrictive.
The generation counter increments on every revocation, restoration, or lease retirement. Dispatchers acquire a permit (generation snapshot) at admission; the mutation boundary checks the permit is still current.
Three lifetimes: connection ≠ session ≠ fork
Session registry with durable, linearizable security authority. ALL mutable state lives in ONE atom: sessions, revoked principals, fork KBs, fork metadata, and a monotonic generation counter. Authority changes (revocation, restoration, provisioning, lease retirement) are commit-before-ack: the durable store is written BEFORE in-memory state becomes less restrictive. The generation counter increments on every revocation, restoration, or lease retirement. Dispatchers acquire a permit (generation snapshot) at admission; the mutation boundary checks the permit is still current. Three lifetimes: connection ≠ session ≠ fork
(acquire-permit)Snapshot the current generation for fencing. Returns the generation value.
Snapshot the current generation for fencing. Returns the generation value.
(authority-healthy?)Returns true if the authority store is configured and healthy.
Returns true if the authority store is configured and healthy.
The authority lock. Held during authority-changing operations (revocation, restoration, provisioning, lease retirement). C3: verbs also hold this during fence-check + mutation to prevent revocation from slipping in between.
The authority lock. Held during authority-changing operations (revocation, restoration, provisioning, lease retirement). C3: verbs also hold this during fence-check + mutation to prevent revocation from slipping in between.
(store-healthy? this)Returns true if the store can accept writes.
Returns true if the store can accept writes.
(store-read this)Read persisted {:revoked #{}, :fork-meta {}} or nil.
Read persisted {:revoked #{}, :fork-meta {}} or nil.
(store-write! this state)Durably write state. Throws on any failure.
Durably write state. Throws on any failure.
(check-session-lease session-id)Check if a session's fork lease is valid. Returns session or nil. Missing fork metadata → fail closed (B6).
Check if a session's fork lease is valid. Returns session or nil. Missing fork metadata → fail closed (B6).
(create-session! principal-id fork-id)Bind a new session. Atomic check of revocation + fork existence + lease.
Bind a new session. Atomic check of revocation + fork existence + lease.
(current-generation)Return the current authority generation.
Return the current authority generation.
(file-authority-store dir-path)Create a FileAuthorityStore at the given directory path.
Create a FileAuthorityStore at the given directory path.
(get-session session-id)Look up a live session by ID.
Look up a live session by ID.
(load-persisted-state!)Load persisted authority from the store. MUST be called before provisioning.
Load persisted authority from the store. MUST be called before provisioning.
(permit-valid? permit-generation)Check if a permit is still valid (generation hasn't changed).
Check if a permit is still valid (generation hasn't changed).
(principal-revoked? principal-id)Check if a principal has been revoked.
Check if a principal has been revoked.
(provision-fork! base-kb fork-id {:keys [lifecycle forks-dir lease-ttl-ms]})Provision a named fork. Rejects expired persisted forks (B5). Preserves existing lease deadlines on restart (B4).
Provision a named fork. Rejects expired persisted forks (B5). Preserves existing lease deadlines on restart (B4).
(recording-authority-store)(recording-authority-store store-atom fail-stage-atom)Create a recording authority store for tests.
Create a recording authority store for tests.
(reset-registry!)Clear all state. For testing.
Clear all state. For testing.
(restore-principal! principal-id)Remove a principal from the revoked set.
Remove a principal from the revoked set.
(revoke-principal! principal-id)Revoke all sessions for a principal. Commit-before-ack: persist FIRST, then update memory. Increments generation for fencing.
Linearization: both revocation and verb writes acquire authority-lock. Whoever gets it first wins. If the write acquired it first, it runs to completion with a success receipt that reflects what it actually committed. Revocation then increments the generation after the lock is released, fencing the NEXT request.
Revoke all sessions for a principal. Commit-before-ack: persist FIRST, then update memory. Increments generation for fencing. Linearization: both revocation and verb writes acquire authority-lock. Whoever gets it first wins. If the write acquired it first, it runs to completion with a success receipt that reflects what it actually committed. Revocation then increments the generation after the lock is released, fencing the NEXT request.
(revoke-session! session-id)Revoke a single session (does not affect the fork). Takes authority-lock and advances generation so that any permit acquired before this call becomes invalid — closing the DELETE/write race (P1#3).
Revoke a single session (does not affect the fork). Takes authority-lock and advances generation so that any permit acquired before this call becomes invalid — closing the DELETE/write race (P1#3).
(set-authority-store! store)Set the durable authority store. Call at startup.
Set the durable authority store. Call at startup.
(sweep-expired-leases!)(sweep-expired-leases! now)Atomically: find expired forks, kill bound sessions, remove forks/meta. Commit-before-ack. Increments generation under authority-lock.
Atomically: find expired forks, kill bound sessions, remove forks/meta. Commit-before-ack. Increments generation under authority-lock.
(testable-file-authority-store dir-path)(testable-file-authority-store dir-path cutpoints-atom)B2: real filesystem authority store with injectable cutpoint hooks. cutpoints-atom is a map of stage keywords to (fn [stage] ...) that may throw. Stages: :before-write :after-write :before-sync :after-sync :before-replace :after-replace :before-dir-sync :after-dir-sync
B2: real filesystem authority store with injectable cutpoint hooks.
cutpoints-atom is a map of stage keywords to (fn [stage] ...) that may throw.
Stages: :before-write :after-write :before-sync :after-sync
:before-replace :after-replace :before-dir-sync :after-dir-synccljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |