Class TimeoutSessionPolicy<U>

java.lang.Object

com.svenruppert.jsentinel.session.TimeoutSessionPolicy<U>

Type Parameters:

U - subject type

All Implemented Interfaces:

SessionPolicy<U>

public final class TimeoutSessionPolicy<U>
extends Object
implements SessionPolicy<U>

Minimal SessionPolicy with idle timeout, absolute lifetime, and optional session-id rotation after login.

The policy is Vaadin-free and stateless — it makes decisions purely from the SessionContext's timestamps. Tracking last-activity inside the session is the adapter's job.

Decisions

• onLogin(SessionContext) — emits SessionCreated. If TimeoutSessionPolicy.Config.rotateSessionAfterLogin() is true, returns SessionDecision.Invalidate so the adapter rotates the session id; otherwise SessionDecision.Continue.INSTANCE.
• beforeNavigation(SessionContext) — checks absolute lifetime first, then idle timeout. Either trip emits SessionExpired and returns SessionDecision.Invalidate.
• onLogout(SessionContext) — emits SessionInvalidated.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final record	TimeoutSessionPolicy.Config	Tunable thresholds.

Constructor Summary

Constructors

Constructor	Description
TimeoutSessionPolicy()
TimeoutSessionPolicy(TimeoutSessionPolicy.Config config, Clock clock, JSentinelAuditService auditService)

Method Summary

Modifier and Type	Method	Description
SessionDecision	beforeNavigation(SessionContext<U> context)	Called before each protected navigation.
SessionPolicyDecision	evaluate(SessionMetadata metadata)	Pure-query lifetime check called by the Vaadin SessionLifetimeListener and by the REST filters.
SessionDecision	onLogin(SessionContext<U> context)	Called after a successful login.
void	onLogout(SessionContext<U> context)	Called when the subject explicitly logs out.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

TimeoutSessionPolicy

public TimeoutSessionPolicy()

TimeoutSessionPolicy

public TimeoutSessionPolicy(TimeoutSessionPolicy.Config config,
 Clock clock,
 JSentinelAuditService auditService)

Parameters:

config - thresholds and post-login behaviour

clock - time source — fixed clocks make testing deterministic

auditService - audit sink, or null to resolve from JSentinelServiceResolver on each event

Method Details

onLogin

public SessionDecision onLogin(SessionContext<U> context)

Description copied from interface: SessionPolicy

Called after a successful login.

The default returns SessionDecision.Continue.INSTANCE. Implementations that want to rotate the session id after login should return SessionDecision.Invalidate with a target route — the adapter then closes the old session and the next request creates a fresh one.

Specified by:

onLogin in interface SessionPolicy<U>

Parameters:

context - session view at the moment of login

Returns:

decision for the post-login navigation

beforeNavigation

public SessionDecision beforeNavigation(SessionContext<U> context)

Description copied from interface: SessionPolicy

Called before each protected navigation. The implementation typically checks idle and absolute timeouts here and returns SessionDecision.RequireLogin or SessionDecision.Invalidate when a threshold has been exceeded.

Specified by:

beforeNavigation in interface SessionPolicy<U>

Parameters:

context - current session view

Returns:

decision for the navigation

evaluate

public SessionPolicyDecision evaluate(SessionMetadata metadata)

Pure-query lifetime check called by the Vaadin SessionLifetimeListener and by the REST filters.

Returns SessionPolicyDecision.AbsoluteLifetimeExceeded first when both bounds are tripped — the absolute lifetime trumps the idle timeout, mirroring the precedence in beforeNavigation(SessionContext).

Audit emit-sites are deliberately not duplicated here: beforeNavigation(SessionContext) is the audit boundary, since the lifecycle hooks carry the richer subject and sessionId. The Vaadin / REST adapter that calls evaluate(...) is expected to emit the audit event itself when it acts on the decision.

Specified by:

evaluate in interface SessionPolicy<U>

Parameters:

metadata - current session view

Returns:

decision; never null

onLogout

public void onLogout(SessionContext<U> context)

Description copied from interface: SessionPolicy

Called when the subject explicitly logs out.

The default is a no-op; implementations that emit audit events for logout should override or delegate.

Specified by:

onLogout in interface SessionPolicy<U>

Parameters:

context - session view at the moment of logout