# kaya-session-redis

Redis-backed session storage for the Kaya web framework.

Provides `RedisSessionStore`, a `SessionStore` implementation (from
`kaya-session`) that persists session data in Redis, so sessions are shared
across processes and hosts.

## Usage

```python
from redis.asyncio import Redis

from kaya.core import KayaApp, HttpContext
from kaya.session import SessionMixin
from kaya.session.redis import RedisSessionStore

client = Redis(host='localhost', port=6379)
session = SessionMixin(RedisSessionStore(client))
app = KayaApp(mixins=[session])

@app.GET('/')
async def home(ctx: HttpContext):
    n = ctx.session.get('visits', 0) + 1
    ctx.session['visits'] = n
    await ctx.send_str(200, f'visits: {n}')
```

Sessions are stored under keys with the prefix `kaya:session:` (configurable
via the `prefix` argument). Server-side expiry uses Redis key TTLs and slides
on each access when the session mixin passes a `max_age`.

## Session indexes

`RedisSessionStore` supports `Session.add_index()`,
`SessionStore.find_sessions()`, and `delete_by_index()`. Reverse memberships
are Redis sets updated in the same transactional pipeline as session saves.
They are removed on deletion, and stale members are pruned during lookups.
Bucket keys use a SHA-256 digest of the index name and value.

## Serialization

Session data is serialized with `pickle` by default, so arbitrary Python
objects can be stored. The serialized value is an envelope containing the
session dictionary and index metadata; legacy plain-dict values are still
accepted. A different serializer can be plugged in via the `dumps`/`loads`
arguments:

```python
import json

store = RedisSessionStore(
    client,
    dumps=lambda d: json.dumps(d).encode('utf-8'),
    loads=lambda b: json.loads(b.decode('utf-8')),
)
```

**Warning:** pickle deserialization of untrusted data is unsafe. Only use the
default serializer with a trusted Redis server.