Add OIDC back-channel logout with session indexes

2026-11-02 12:15:41 +08:00
parent ec056a15b9
commit 074e48a372
20 changed files with 1594 additions and 32 deletions
@@ -30,11 +30,21 @@ Sessions are stored under keys with the prefix `kaya:session:` (configurable
 via the `prefix` argument). Server-side expiry uses Redis key TTLs and slides
 on each access when the session mixin passes a `max_age`.

+## Session indexes
+
+`RedisSessionStore` supports `Session.add_index()`,
+`SessionStore.find_sessions()`, and `delete_by_index()`. Reverse memberships
+are Redis sets updated in the same transactional pipeline as session saves.
+They are removed on deletion, and stale members are pruned during lookups.
+Bucket keys use a SHA-256 digest of the index name and value.
+
 ## Serialization

 Session data is serialized with `pickle` by default, so arbitrary Python
-objects can be stored. A different serializer can be plugged in via the
-`dumps`/`loads` arguments:
+objects can be stored. The serialized value is an envelope containing the
+session dictionary and index metadata; legacy plain-dict values are still
+accepted. A different serializer can be plugged in via the `dumps`/`loads`
+arguments:

 ```python
 import json