struct

KemalIdentity::Sessions::RememberToken

One link in a remember-me chain.

Every token descended from a single login shares a family_id. Presenting a token spends it and mints its successor in the same family, so at any moment exactly one token per family is live and the rest are spent history.

That history is the point. It is what turns theft from something nobody notices into something the next request detects.

Constructors

new(id : String, account_id : String, family_id : String, token_digest : Bytes, created_at : Time, expires_at : Time, used_at : Time | Nil = nil, revoked_at : Time | Nil = nil)

Source

Instance methods

account_id

Source

created_at

Source

expired?(now : Time) : Bool

Source

expires_at

Source

family_id

Shared by every token rotated from one original login. Revoking a family ends that browser's remembered state and leaves every other device alone.

Source

inspect(io : IO) : Nil

Never prints the digest.

Source

revoked?

Source

revoked_at

Killed, rather than spent. Distinct from used_at because the difference is exactly what an audit trail needs to tell "this rotated" from "we believe this was stolen".

Source

to_s(io : IO) : Nil

Same as #inspect(io).

Source

token_digest

Source

used?

Source

used_at

Spent normally: the holder presented it and received a successor.

Source