SessionManager

Owns the lifecycle of a caller's session and its stored SessionDetails.

The default implementation (HttpSessionManager) is backed by the servlet HTTP session (ctx.sessionAttribute(...)). Plug in a custom SessionManager to back sessions with something else (Redis, an in-memory store, a signed cookie payload, etc.) — the rest of the extension is agnostic to the storage strategy.

The three operations are:

• create — establishes a session for SessionDetails (call from your login handler after verifying credentials).

• validate — returns the SessionDetails for the current request, or null when the request has no valid session. Invoked by SessionAuthenticator on every request.

• invalidate — destroys the current session (call from your logout handler). Must be safe to call when there is no active session.

Implementations should not throw when no session exists: return null from validate and no-op from invalidate.

Inheritors