Nova.Sessions.AspNetCore 10.4.0

Nova.Sessions.AspNetCore

ASP.NET Core middleware and services for activating, validating, and controlling Nova sessions.

Version 10.4.0

This is a breaking middleware release. Upgrade together to Nova.Model 10.1.0, Nova.Sessions.Model 10.1.0, Nova.Sessions.Abstractions 10.3.0, and Nova.Sessions.Data.Sql 10.3.0.

• Uses the standard OpenID Connect sid claim as the stable session key across access-token refreshes.

• Requires refreshed access tokens for the same login session to retain the same sid.

• Stops using the per-token jti claim for session lookup and creation.

• Allows access-token lifetime to be shorter than session expiration or idle timeout; authentication remains responsible for rejecting expired access tokens before this middleware runs.

• Keeps the existing SQL Jti column through persistence mapping, so no column rename is required.

• Uses Nova.Sessions.Model.NovaSessionOptions as the single options contract for middleware and licensing-client initialization.

• Validates at startup that LicensingBaseUrl is an absolute HTTP or HTTPS URL.

• Removes the duplicate Nova.Sessions.AspNetCore.Model.NovaSessionOptions type and its temporary mapping adapter.

• Adds structured validation-start diagnostics for client state and session settings, with password and salt values redacted.

• Returns a structured 401 Unauthorized response when the client must authenticate again.

• Returns a structured 403 Forbidden response for expected session-policy rejection.

• Includes the stable session error code and request trace identifier in error responses.

• Allows unexpected failures to reach the consuming application's global exception handler.

• Treats missing, malformed, or inconsistent JWT timing claims as reauthentication failures.

• Returns a generic structured 500 Internal Server Error for known session-configuration failures while logging diagnostic details internally.

• Returns 503 Service Unavailable with Retry-After for licensing and distributed-lock availability failures.

• Corrects the token-versus-session lifetime comparisons.

• Validates session option ranges and timeout relationships when the application starts.

• Uses the same NovaSessionOptions type in registration, validation, and runtime services.

• Uses IAuditLog for session audit events and awaits every audit operation.

• Preserves an application-provided IAuditLog; the package no-op logger is registered only as a fallback.

• Removes RayAudit, Graylog, and Serilog package dependencies from the session middleware package.

• Samples active-session license validation and distinguishes rejected licenses from temporary licensing-service failures.

• Lets consuming applications initialize application-specific ClientStateBase values in Program.cs without adding a separate middleware.

• Requires the consuming application to provide ClientStateBase.System; JWT, IP, user-agent, path, and server values are populated by Nova.

Client-state configuration

Configure session options and application-specific client-state values together:

builder.Services.AddNovaSessions(
    options => builder.Configuration
        .GetSection("NovaSessionOptions")
        .Bind(options),
    (context, state) =>
    {
        state.System = "accounting4";
        state.SystemVersion = "1405.1";
        state.Branch = 1;
        state.DbId = "main";
        state.DbName = "ERP";
        state.DbServer = "sql01";
        state.DbServerId = "primary";
    });

For request-dependent values, use the asynchronous overload and resolve scoped services through context.RequestServices. The separate ConfigureNovaClientState() extension remains available for advanced replacement and testing scenarios.

Place the session middleware after forwarded-header and authentication middleware:

app.UseForwardedHeaders();
app.UseAuthentication();
app.UseNovaSessions();
app.UseAuthorization();

No separate UseClientStateSetter() middleware is required.

Migration to 10.4.0

• Upgrade Nova.Model to 10.1.0, Nova.Sessions.Model to 10.1.0, Nova.Sessions.Abstractions and Nova.Sessions.Data.Sql to 10.3.0, and this package to 10.4.0.
• Replace explicit references to Nova.Sessions.AspNetCore.Model.NovaSessionOptions with Nova.Sessions.Model.NovaSessionOptions; inferred AddNovaSessions lambdas require no code change.
• Replace custom ISessionContextBuilder.Build implementations with BuildAsync and await audit operations.
• Configure the required ClientStateBase.System value through an AddNovaSessions client-state callback.
• Update direct construction of JwtSessionContextBuilder for its new dependencies; dependency injection is recommended.
• Do not rely on the package to register or resolve ISystemResolver; the consuming application now supplies the system value.
• Ensure issued access tokens contain a non-empty sid claim. Refreshing an access token must retain the same sid; a new login must receive a new sid.
• Replace application references to ClientStateBase.Jti, SessionContext.Jti, and Session.Jti with their Sid counterparts.
• At deployment, invalidate or clear active rows created by older versions. Their legacy Jti values are token IDs, not session IDs, and must not count as active sid sessions.
• Handle the middleware's structured 401, 403, and 503 responses where applicable. Unexpected exceptions continue to the application's global exception handler.