() => (ctx: RequestContext, user: User, authenticationStrategyName: string, sessionToken?: string, apiType?: ApiType) => Promise<AuthenticatedSession>Creates a new AuthenticatedSession. To be used after successful authentication.
The apiType argument records the API the session belongs to. The AuthGuard refuses a session
on the Admin API unless it records the Admin API, so this argument is a security control: pass
it whenever the request context is not the API the caller authenticated against, for example a
REST controller which completes an SSO callback for the Shop API.
When it is omitted, the API is taken from ctx.apiType if the context carries a request, which
covers every resolver and every REST route. A context with no request states nothing about the
caller: RequestContext.empty() hardcodes apiType: 'admin', RequestContextService.create()
takes whatever the caller passed, and RequestContext.deserialize() drops the request, so a job
queue worker has none either. A session created from such a context records shop, the
lower-privilege API, so that omitting the argument fails closed rather than granting Admin API
access.
() => Promise<CachedSession>Create an AnonymousSession and caches it using the configured SessionCacheStrategy, and returns the cached session object.
(sessionToken: string) => Promise<CachedSession | undefined>Returns the cached session object matching the given session token.
(session: AuthenticatedSession | AnonymousSession) => CachedSessionSerializes a Session instance into a simplified plain object suitable for caching.
(ctx: RequestContext, serializedSession: T, order: Order) => Promise<CachedSession | T>Sets the activeOrder on the given cached session object and updates the cache.
Accepts the session of a deserialized RequestContext too, which has no token. The returned session is re-read from the database, so it does have one, unless the session row no longer exists, in which case the input is returned as is.
(ctx: RequestContext, serializedSession: T) => Promise<CachedSession | T>Clears the activeOrder on the given cached session object and updates the cache.
Accepts the session of a deserialized RequestContext too, see setActiveOrder.
(serializedSession: CachedSession, channel: Channel) => Promise<CachedSession>Sets the activeChannel on the given cached session object and updates the cache.
(ctx: RequestContext, user: User) => Promise<void>Deletes all existing sessions for the given user.
(ctx: RequestContext, apiKey: ApiKey) => Promise<void>Deletes session related to API-Key
(ctx: RequestContext, activeOrderId: ID) => Promise<void>Deletes all existing sessions with the given activeOrder.
(batchSize: number) => Triggers the clean sessions job.
(ctx: RequestContext, batchSize: number) => Cleans expired sessions from the database & the session cache.
Architecture reviews, custom plugin work, migrations, ongoing support. Get a hand from the team that builds Vendure.
Talk to the team