Struct AuthSessionManager 

pub struct AuthSessionManager {
    sessions: Arc<Mutex<HashMap<String, Session>>>,
    process_refs: Arc<Mutex<ProcessRefs>>,
}

Fields

sessions: Arc<Mutex<HashMap<String, Session>>>

process_refs: Arc<Mutex<ProcessRefs>>

Implementations

impl AuthSessionManager

pub fn new() -> Self

pub fn start_session( &self, provider_id: String, exclusive_key: Option<String>, ) -> StartSessionResult

Allocate a new session id and store the initial Pending state. The caller (handler) is responsible for spawning the CLI and feeding stdout lines into record_line.

exclusive_key is the account directory the login writes to. A live session for the same directory is cancelled first: two CLIs logging in to one directory at once race on its credential files (the desktop host’s single login slot has the same rule).

pub fn record_line( &self, session_id: &str, line: &str, ) -> Option<AuthPatternMatch>

Feed a single line of CLI stdout/stderr into the session. Returns the pattern match (if any) so the handler can decide to forward the URL elsewhere (e.g. broker event).

pub fn finish_success( &self, session_id: &str, bundle_id: String, account_id: Option<String>, ) -> bool

Handler-side completion hook. Called when the CLI exits or auth check confirms success. Transitions the session to a terminal state. account_id is None for the legacy bundle-mode path; Some(id) for a direct-account session (issue #1624 PR-C Part B) — see AuthSessionStatus::Success.

pub fn finish_failure(&self, session_id: &str, error: String) -> bool

pub fn poll_session(&self, session_id: &str) -> Option<PollSessionResult>

Poll a session’s current status. A session past SESSION_TIMEOUT_SECS is ended first (Failed, CLI killed).

pub fn sweep(&self)

End sessions past their timeout (Failed, CLI killed) and drop finished ones nobody has polled for FINISHED_RETENTION_SECS. Runs every SWEEP_INTERVAL_SECS (spawn_sweeper), so a login whose UI went away doesn’t leave its CLI running or its session behind.

pub fn spawn_sweeper(self: &Arc<Self>)

Run sweep every SWEEP_INTERVAL_SECS for as long as srv runs.

pub fn cancel_session(&self, session_id: &str) -> bool

Cancel a session: transition state to Failed + abort the spawned drain task (which kills the child via kill_on_drop). Returns true if the state transition happened (false on unknown / already-terminal session — the process refs are torn down either way so a re-fired cancel is a no-op).

fn end_session(&self, session_id: &str, error: String) -> bool

Fail a session with error and stop its CLI: abort the drain task (the pipe path’s child goes with it, kill_on_drop), drop its stdin, and kill a PTY child by PID. True if the state changed; the process refs go either way, so ending a session twice is harmless.

fn stop_process(&self, session_id: &str)

Stop a session’s CLI and drop its process refs: abort the drain task (the pipe path’s child goes with it, kill_on_drop), drop its stdin, and kill a PTY child by PID.

pub fn ended(&self, session_id: &str) -> bool

Has this session ended (or gone)? A login confirmed after its session was replaced, cancelled or timed out must not be saved: a newer sign-in owns the directory now.

fn is_terminal(&self, session_id: &str) -> bool

pub fn attach_pty_pid(&self, session_id: &str, pid: u32)

Register the PID of a PTY-backed auth subprocess so cancel_session can terminate it. Called by auth.start after spawning a PTY login (in addition to attach_process).

pub fn attach_process( &self, session_id: &str, drain_task: JoinHandle<()>, stdin_sender: Sender<String>, )

Register the drain task + stdin sender for a session. Called by the handler immediately after spawning the CLI.

pub async fn send_to_stdin(&self, session_id: &str, line: String) -> bool

Forward a pasted callback URL to the spawned CLI’s stdin. Returns true if the session has an attached stdin sender; false if the session never spawned a CLI or the sender’s receiver was dropped.

pub fn detach_process(&self, session_id: &str)

Drop a session’s process refs without aborting them. Called by the drain task itself when it exits normally so terminal state lookups still work but the resources are reclaimed.

pub fn captured_email(&self, session_id: &str) -> Option<String>

The account email scraped from this session’s login transcript, if the provider printed one.

Read before finish_success, which consumes the session — the account is persisted first (identity_auth_spawn) and needs the email at that point to record it on the account (SPEC_ACCOUNT_EMAIL_IN_ARMORY_2026_09_23.md). None when the provider reported no email, which is not an error: providers whose CLI does not surface one simply have no email to show.

pub fn transcript(&self, session_id: &str) -> Option<Vec<String>>

Read the full transcript of captured stdout/stderr lines. Used by integration tests; exposed for completeness even though no production caller currently reads it.

Trait Implementations

impl Default for AuthSessionManager

fn default() -> AuthSessionManager

Returns the “default value” for a type.