Nova.Sessions.AspNetCore 10.3.0

Nova.Sessions.AspNetCore

ASP.NET Core middleware and services for activating, validating, and controlling Nova sessions.

Version 10.3.0

This is a breaking middleware release and must be upgraded together with Nova.Sessions.Abstractions and Nova.Sessions.Data.Sql 10.2.0.

• Uses Nova.Sessions.Model.NovaSessionOptions as the single options contract for middleware and licensing-client initialization.

• Validates at startup that LicensingBaseUrl is an absolute HTTP or HTTPS URL.

• Removes the duplicate Nova.Sessions.AspNetCore.Model.NovaSessionOptions type and its temporary mapping adapter.

• Adds structured validation-start diagnostics for client state and session settings, with password and salt values redacted.

• Returns a structured 401 Unauthorized response when the client must authenticate again.

• Returns a structured 403 Forbidden response for expected session-policy rejection.

• Includes the stable session error code and request trace identifier in error responses.

• Allows unexpected failures to reach the consuming application's global exception handler.

• Treats missing, malformed, or inconsistent JWT timing claims as reauthentication failures.

• Returns a generic structured 500 Internal Server Error for known session-configuration failures while logging diagnostic details internally.

• Returns 503 Service Unavailable with Retry-After for licensing and distributed-lock availability failures.

• Corrects the token-versus-session lifetime comparisons.

• Validates session option ranges and timeout relationships when the application starts.

• Uses the same NovaSessionOptions type in registration, validation, and runtime services.

• Uses IAuditLog for session audit events and awaits every audit operation.

• Preserves an application-provided IAuditLog; the package no-op logger is registered only as a fallback.

• Removes RayAudit, Graylog, and Serilog package dependencies from the session middleware package.

• Samples active-session license validation and distinguishes rejected licenses from temporary licensing-service failures.

• Lets consuming applications initialize application-specific ClientStateBase values in Program.cs without adding a separate middleware.

• Requires the consuming application to provide ClientStateBase.System; JWT, IP, user-agent, path, and server values are populated by Nova.

Client-state configuration

Configure session options and application-specific client-state values together:

builder.Services.AddNovaSessions(
    options => builder.Configuration
        .GetSection("NovaSessionOptions")
        .Bind(options),
    (context, state) =>
    {
        state.System = "accounting4";
        state.SystemVersion = "1405.1";
        state.Branch = 1;
        state.DbId = "main";
        state.DbName = "ERP";
        state.DbServer = "sql01";
        state.DbServerId = "primary";
    });

For request-dependent values, use the asynchronous overload and resolve scoped services through context.RequestServices. The separate ConfigureNovaClientState() extension remains available for advanced replacement and testing scenarios.

Place the session middleware after forwarded-header and authentication middleware:

app.UseForwardedHeaders();
app.UseAuthentication();
app.UseNovaSessions();
app.UseAuthorization();

No separate UseClientStateSetter() middleware is required.

Migration from 10.1.x

• Upgrade Nova.Sessions.Abstractions, Nova.Sessions.Data.Sql, and Nova.Sessions.AspNetCore together to 10.2.0.
• Replace explicit references to Nova.Sessions.AspNetCore.Model.NovaSessionOptions with Nova.Sessions.Model.NovaSessionOptions; inferred AddNovaSessions lambdas require no code change.
• Replace custom ISessionContextBuilder.Build implementations with BuildAsync and await audit operations.
• Configure the required ClientStateBase.System value through an AddNovaSessions client-state callback.
• Update direct construction of JwtSessionContextBuilder for its new dependencies; dependency injection is recommended.
• Do not rely on the package to register or resolve ISystemResolver; the consuming application now supplies the system value.
• Ensure issued access tokens contain a jti claim.
• Handle the middleware's structured 401, 403, and 503 responses where applicable. Unexpected exceptions continue to the application's global exception handler.