feat(core): implement experimental stateful session strategy"

packages/core/src/@types/entities.ts

@@ -87,7 +87,7 @@ export interface SessionEntity {
     authenticatedWith: string
     status: SessionStatus
     mfaState: MFAState
-    sessionToken: string
+    tokenHash: string
     expiresAt: Date
     metadata: Record<string, unknown> | null
     lastActivityAt: Date

packages/core/src/@types/index.ts

@@ -13,6 +13,8 @@ export type * from "@/@types/session.ts"
 export type * from "@/@types/utility.ts"
 export type * from "@/@types/api.ts"
 export type * from "@/identity/index.ts"
+export type * from "@/@types/entities.ts"
+export type * from "@/@types/adapter.ts"
 
 export type { Awaitable } from "@aura-stack/router/types"
 export type { TypedJWTPayload } from "@aura-stack/jose"

packages/core/src/@types/session.ts

@@ -211,6 +211,8 @@ export interface GetStatelessSessionReturn<DefaultUser extends User = User> {
     headers: Headers
 }
 
+export type GetStatefulSessionReturn<DefaultUser extends User = User> = GetStatelessSessionReturn<DefaultUser>
+
 /**
  * Abstraction layer for session management.
  */
@@ -272,6 +274,14 @@ export interface JWTStrategyOptions<DefaultUser extends User = User> {
     identity: SchemaRegistryContext
 }
 
+export interface DatabaseStrategyOptions<DefaultUser extends User = User> {
+    config: StatefulStrategyConfig
+    jose: JoseInstance<DefaultUser>
+    logger?: InternalLogger
+    cookies: () => InternalCookieStoreConfig
+    identity: SchemaRegistryContext
+}
+
 /** Minimal token issue/verify surface used by session code paths. */
 export type JWTManager<DefaultUser extends User = User> = {
     createToken(user: TypedJWTPayload<Partial<DefaultUser>>): Promise<string>

packages/core/src/jose.ts

@@ -24,14 +24,15 @@ import {
     isPEMFormattedKeyPairFromEnv,
     isSealedMode,
     isSignedMode,
+    isStatelessStrategy,
 } from "@/shared/assert.ts"
+import { AuraAuthError } from "@/shared/errors.ts"
 import { importPEMKeyPair } from "@/shared/crypto.ts"
 export { encoder, getRandomBytes, getSubtleCrypto } from "@aura-stack/jose/crypto"
 import type { User, SessionConfig, JWTKey, AsymmetricKeyPairFromEnv } from "@/@types/index.ts"
-import { AuraAuthError } from "./shared/errors.ts"
 
 const getJWTConfig = (config?: SessionConfig) => {
-    return config?.jwt
+    return isStatelessStrategy(config) ? config?.jwt : {}
 }
 
 export const getJWTClaims = (config?: SessionConfig) => {

packages/core/src/router/context.ts

@@ -10,6 +10,7 @@ import { getEnv, getEnvArray, getEnvBoolean } from "@/shared/env.ts"
 import { createRateLimiterInstance } from "@/router/rate-limiter.ts"
 import type { Identities, SchemaTypes } from "@/identity/index.ts"
 import type { AuthConfig, InternalContext, FromShapeToObject } from "@/@types/index.ts"
+import { isStatelessStrategy } from "@/shared/assert.ts"
 
 export const createContext = <Identity extends Identities, SignUpSchema extends SchemaTypes>(
     config?: AuthConfig<Identity, SignUpSchema>
@@ -60,7 +61,7 @@ export const createContext = <Identity extends Identities, SignUpSchema extends
             skipValidation,
         },
         signUp: config?.signUp,
-        jwtManager: createJoseManager(config?.session?.jwt, jose),
+        jwtManager: createJoseManager(isStatelessStrategy(config?.session) ? config?.session?.jwt : undefined, jose),
         rateLimiters: createRateLimiterInstance(config?.rateLimiter),
     } as InternalContext<Identity, SignUpSchema>
     ctx.sessionStrategy = createSessionStrategy<Identity>({