Stratara.Sessions
4.3.1
Prefix Reserved
See the version list below for details.
dotnet add package Stratara.Sessions --version 4.3.1
NuGet\Install-Package Stratara.Sessions -Version 4.3.1
<PackageReference Include="Stratara.Sessions" Version="4.3.1" />
<PackageVersion Include="Stratara.Sessions" Version="4.3.1" />
<PackageReference Include="Stratara.Sessions" />
paket add Stratara.Sessions --version 4.3.1
#r "nuget: Stratara.Sessions, 4.3.1"
#:package Stratara.Sessions@4.3.1
#addin nuget:?package=Stratara.Sessions&version=4.3.1
#tool nuget:?package=Stratara.Sessions&version=4.3.1
Stratara.Sessions
Derived. The behaviour described here is specified under
openspec/specs/. Those specifications are the source; this page explains and illustrates them.
License: MIT.
Concrete session-context provider + ASP.NET Core middleware for Stratara's Actor/Subject session model. Reads tenant + user identity from JWT claims (with optional X-Tenant-Id / X-Client-Id header fallbacks), populates the ambient ISessionContextProvider, and exposes the Actor/Subject pair to every request.
Since 3.0.10: the
X-Tenant-Idheader fallback is opt-in viaSessionContextOptions.AllowTenantHeader = true(defaultfalse). Without the gate, any authenticated principal could pick the tenant their request operated against in hosts whose JWT does not carry the tenant claim. Embed the tenant id in the JWT claim set, or opt in explicitly when an upstream platform-admin role check guards the header.
Quick start
// Program.cs / Startup.cs
builder.Services.AddSessionContext();
// In the middleware pipeline:
app.UseMiddleware<SessionContextMiddleware>();
Then resolve in any scoped service:
public sealed class SomeHandler(ISessionContextProvider sessionContextProvider)
{
public async Task HandleAsync(...) {
var session = sessionContextProvider.Current
?? throw new InvalidOperationException("Session context not set");
// session.TenantId = Subject (data owner) — used for filtering / encryption AAD
// session.UserId = Subject user (nullable)
// session.ActorTenantId = Actor (who triggered) — audit trail
// session.ActorUserId = Actor user — audit trail
}
}
What's in the box
SessionContextProvider—internal sealedimpl ofISessionContextProvider, scoped per request. Writes Activity tags (correlation.id,causation.id,tenant.id,user.id) automatically onSet/Clear.SessionContextMiddleware— ASP.NET Core middleware that extracts tenant + user fromClaimTypes.NameIdentifier+stratara:tenant_idclaim (with optionalX-Tenant-Idheader fallback gated bySessionContextOptions.AllowTenantHeader) and constructs aSessionContextwhose actor tenant and data-owner tenant are the claimed tenant, whose actor user is the claimed user, and whose data-owner user is left unset. It stays unset on purpose: the scope a protected field is encrypted under follows the data owner, so filling in the user would move every protected field written from a request to a per-user scope.SessionContextOptions— configuration controlling the header fallback gate.AddSessionContext()reads it from theSessionContextsection of the host's configuration;services.Configure<SessionContextOptions>(...)after that call takes precedence. Since 4.2.0 the section is read — an"AllowTenantHeader": truethat did nothing before turns the fallback on.StrataraClaimTypes— claim-name constants (stratara:tenant_id).DefaultTenantIdentifier— sentinelGuidused when no tenant claim or header is present (typically anonymous / system flows).AddSessionContext()DI extension — registers the concrete provider as a scoped service againstISessionContextProvider.
Adopting the Actor/Subject model
For most operations the actor's tenant is the data-owner tenant — a user acts on their own tenant's data — while the data-owner user stays unset unless the application sets it. The tenants only diverge for:
- PlatformAdmin cross-tenant operations (Subject = customer tenant, Actor = admin tenant)
- Anonymous endpoints (Actor =
Guid.Empty, Subject = the just-minted tenant) - System / saga flows (Actor =
SessionContext.SystemActorTenantId/SystemActorUserId)
Consumers that reject ambient context (libraries that prefer explicit TenantId parameters everywhere) do not need to take this package — Stratara.Mediator and the rest of the framework work without an ISessionContextProvider registered as long as no path requires it.
Dependencies
Stratara.Abstractions— forISessionContextProvider.Stratara.Contracts— for theSessionContextrecord (wire-level).Stratara.Diagnostics— forApplicationDiagnosticsactivity tags.Microsoft.AspNetCore.Http.Abstractions— forHttpContext/RequestDelegate.Microsoft.Extensions.DependencyInjection.Abstractions.OpenTelemetry.Api.
| Product | Versions Compatible and additional computed target framework versions. |
|---|---|
| .NET | net10.0 is compatible. net10.0-android was computed. net10.0-browser was computed. net10.0-ios was computed. net10.0-maccatalyst was computed. net10.0-macos was computed. net10.0-tvos was computed. net10.0-windows was computed. |
-
net10.0
- Microsoft.AspNetCore.Http.Abstractions (>= 2.3.12)
- Microsoft.Extensions.DependencyInjection.Abstractions (>= 10.0.11)
- Microsoft.Extensions.Options (>= 10.0.11)
- Microsoft.Extensions.Options.ConfigurationExtensions (>= 10.0.11)
- OpenTelemetry.Api (>= 1.18.0)
- Stratara.Abstractions (>= 4.3.1)
- Stratara.Contracts (>= 4.3.1)
- Stratara.Diagnostics (>= 4.3.1)
NuGet packages (3)
Showing the top 3 NuGet packages that depend on Stratara.Sessions:
| Package | Downloads |
|---|---|
|
Stratara.Shared
Umbrella package for the Stratara framework — source-generated logger extensions for command flows, domain-event helpers, merge primitives, and the Tier-A/B abstractions surface re-exported as one transitive bundle. |
|
|
Stratara.Outbox.RabbitMQ
Outbox-pattern command and event dispatch for the Stratara event-sourced stack — RabbitMQ IMessageBus implementation, retry worker, mediator command worker, and Redis-coordinated projection-replay state. Azure Service Bus support ships as the sibling Stratara.Outbox.AzureServiceBus package. |
|
|
Stratara.Infrastructure
Infrastructure glue for the Stratara framework — authorization decorators, configuration providers, and DI composition helpers that wire Mediator, Outbox, Identity, and EF Core into a hosted app. |
GitHub repositories
This package is not used by any popular GitHub repositories.
| Version | Downloads | Last Updated |
|---|---|---|
| 4.4.0 | 37 | 9/27/2026 |
| 4.3.1 | 197 | 9/25/2026 |
| 4.3.0 | 472 | 9/23/2026 |
| 4.2.0 | 293 | 9/18/2026 |
| 4.1.1 | 297 | 9/16/2026 |
| 4.1.0 | 222 | 9/16/2026 |
| 4.0.4 | 1,063 | 9/14/2026 |
| 4.0.3 | 326 | 9/3/2026 |
| 4.0.2 | 739 | 9/3/2026 |
| 4.0.1 | 364 | 9/2/2026 |
| 4.0.0 | 801 | 8/31/2026 |
| 4.0.0-preview.1 | 122 | 8/31/2026 |
| 3.4.0 | 315 | 8/28/2026 |
| 3.3.0 | 466 | 8/25/2026 |
| 3.2.3 | 284 | 8/22/2026 |
| 3.2.2 | 857 | 8/14/2026 |
| 3.2.1 | 862 | 8/2/2026 |
| 3.2.0 | 252 | 7/18/2026 |
| 3.1.7 | 691 | 7/1/2026 |
| 3.1.6 | 675 | 6/22/2026 |
A correctness release. A projection replay could apply a stream's later fact before its first and
then fail on every attempt, leaving the read models it had emptied empty; the two backfills that
prepare existing history for the Orleans execution model's commit-order readers took the same wrong
order. Beyond that, the setting store no longer needs declared settings, and a setting or permission
vocabulary can be declared in parts.
**Upgrading:**
- **If you replay projections, upgrade.** A store in which one save appended several versions of a
stream can hold sequence numbers that run against those versions, and a replay over it could not
complete. No entry is rewritten and no migration is needed.
- **If you implement `IEventStreamRepository` yourself,** override
`GetManyAfterSequenceInStreamOrderAsync` to give your replay the same guarantee; the default keeps
sequence order.
- **If you backfilled a store for a commit-order reader before this release,** the Orleans migration
guide gives the query that tells whether that history holds a stream out of version order, and how
to repair it.
- **A host that declared an empty `SettingCatalog` as a workaround can drop it.** A host that
registers a catalog through a factory and then calls `AddSettingCatalog` or `AddPermissionCatalog`
now fails at registration instead of replacing that catalog.
- No schema change.
### Added
- **`IEventStreamRepository.GetManyAfterSequenceInStreamOrderAsync`**: a range of the store in the order a
replay applies it — each stream's entries in version order, the streams interleaved as their sequence numbers
interleave them, and the range extended until it no longer ends between two versions of one stream. The default
implementation returns `GetManyAfterSequenceAsync`, sequence order, so a repository of your own compiles and
behaves as before; override the member to give your replay the guarantee.
### Fixed
- **A projection replay applies each stream in version order.** A save does not number its entries in version
order — EF Core chooses the statement order and the identity column numbers the rows as they arrive — and the
replay walked the store by sequence number, so it met a stream's later fact before its first. A projection that
reports a missing preceding fact then failed the batch on every attempt, and because a replay empties the read
models first, each attempt left the read side empty. On a store where many saves wrote several versions of one
stream, no replay could complete. The replay now reads through the new repository member; a batch can hold more
entries than `Projections:BatchSize`. No entry is rewritten and no migration is needed.
- **Both commit-order backfills keep each stream in version order.** `CommitTransactionIdBackfill` could end a
batch between two versions of one stream, stamping the later one with the earlier transaction.
`PartitionCounterBackfill` handed out positions in sequence order, so every save it positioned that the store
had numbered against its versions was read inverted by the portable reader. Both now extend a batch until it no
longer ends inside a stream, and the portable backfill positions each stream's entries in version order.
History backfilled with an earlier version is not revisited, because checkpoints stand on its commit records and
positions; the Orleans migration guide gives the query that tells whether a store holds such a stream.
- **The setting store works without declared settings.** `AddSettingStore<TContext>()` and
`AddSettingStoreFromContextFactory<TContext>()` resolved the `SettingCatalog` inside a factory, so a
host that registered the store and `AddStrataraErasure()` but declared no settings built, passed
`ValidateOnBuild` and every start-up check, and failed on its first erasure with *No service for type
`SettingCatalog` has been registered*. The store now registers an empty catalog when none is declared:
the store works, erasure included, and reading any setting through `ISettingProvider` fails as
undeclared. The example on `AddStrataraErasure` was exactly that composition. A host that declared an
empty catalog as a workaround can drop it.
- **A second `AddSettingCatalog` or `AddPermissionCatalog` call no longer replaces the first.** Each
call registered a new catalog and the last one won, so a host declaring its vocabulary per module kept
only the last module's — the others' settings failed as undeclared and their permissions were denied
without a word. Every call now adds to the one registered catalog, in whichever order it runs relative
to the setting store. A setting name declared in two parts throws as a duplicate; a redeclared
permission has no effect and grants to one role accumulate. A catalog registered as a factory cannot be
added to, and the next call now throws `InvalidOperationException` saying so instead of replacing it.