Nova.Sessions.AspNetCore 10.2.0

Nova.Sessions.AspNetCore

ASP.NET Core middleware and services for activating, validating, and controlling Nova sessions.

Version 10.2.0

This is a breaking middleware release and must be upgraded together with Nova.Sessions.Abstractions and Nova.Sessions.Data.Sql 10.2.0.

• Returns a structured 401 Unauthorized response when the client must authenticate again.
• Returns a structured 403 Forbidden response for expected session-policy rejection.
• Includes the stable session error code and request trace identifier in error responses.
• Allows unexpected failures to reach the consuming application's global exception handler.
• Treats missing, malformed, or inconsistent JWT timing claims as reauthentication failures.
• Returns a generic structured 500 Internal Server Error for known session-configuration failures while logging diagnostic details internally.
• Returns 503 Service Unavailable with Retry-After for licensing and distributed-lock availability failures.
• Corrects the token-versus-session lifetime comparisons.
• Validates session option ranges and timeout relationships when the application starts.
• Uses the same NovaSessionOptions type in registration, validation, and runtime services.
• Uses IAuditLog for session audit events and awaits every audit operation.
• Preserves an application-provided IAuditLog; the package no-op logger is registered only as a fallback.
• Removes RayAudit, Graylog, and Serilog package dependencies from the session middleware package.
• Samples active-session license validation and distinguishes rejected licenses from temporary licensing-service failures.
• Lets consuming applications initialize application-specific ClientStateBase values in Program.cs without adding a separate middleware.
• Requires the consuming application to provide ClientStateBase.System; JWT, IP, user-agent, path, and server values are populated by Nova.

Client-state configuration

Configure session options and application-specific client-state values together:

builder.Services.AddNovaSessions(
    options =>
    {
        options.MaxConcurrentSessions = 1;
        options.ExpireTimeoutMins = 15;
        options.IdleTimeoutMins = 20;
    },
    (context, state) =>
    {
        state.System = "accounting4";
        state.SystemVersion = "1405.1";
        state.Branch = 1;
        state.DbId = "main";
        state.DbName = "ERP";
        state.DbServer = "sql01";
        state.DbServerId = "primary";
    });

For request-dependent values, use the asynchronous overload and resolve scoped services through context.RequestServices. The separate ConfigureNovaClientState() extension remains available for advanced replacement and testing scenarios.

Place the session middleware after forwarded-header and authentication middleware:

app.UseForwardedHeaders();
app.UseAuthentication();
app.UseNovaSessions();
app.UseAuthorization();

No separate UseClientStateSetter() middleware is required.

Migration from 10.1.x

• Upgrade Nova.Sessions.Abstractions, Nova.Sessions.Data.Sql, and Nova.Sessions.AspNetCore together to 10.2.0.
• Replace custom ISessionContextBuilder.Build implementations with BuildAsync and await audit operations.
• Configure the required ClientStateBase.System value through an AddNovaSessions client-state callback.
• Update direct construction of JwtSessionContextBuilder for its new dependencies; dependency injection is recommended.
• Do not rely on the package to register or resolve ISystemResolver; the consuming application now supplies the system value.
• Ensure issued access tokens contain a jti claim.
• Handle the middleware's structured 401, 403, and 503 responses where applicable. Unexpected exceptions continue to the application's global exception handler.