Documentation / zerotal / session / SessionManager

Class: SessionManager

Defined in: packages/session/src/SessionManager.ts:32

Per-request session store — the concrete object behind ctx.session.

Created by SessionMiddleware at the start of every request (its data loaded from the configured SessionDriver) and attached to the HttpContext. Exposes a small Map-like API over a plain Record<string, unknown>, plus flash storage and ID regeneration. All mutations happen in memory; the middleware persists them after the response.

Remarks

SessionAccessor (the Session facade / ctx.session surface most code uses) forwards to this class, so the public methods here mirror that API. Flash handling relies on two internal key-sets: keys flashed in the previous request are swept after the current response, and keys flashed in the current request are recorded (under _flash_keys) for the next request to sweep.

Example

const session = new SessionManager(id, data, driver);
session.set("user_id", 42);
session.flash("status", "Saved!");   // available on the next request only
const status = session.pull("status"); // read once, then removed

Do not instantiate directly — use the SessionMiddleware or Session facade.

Implements

SessionContract

Constructors

Constructor

new SessionManager(id, data, driver): SessionManager

Defined in: packages/session/src/SessionManager.ts:45

Parameters

id

string

data

Record<string, unknown>

driver

SessionDriver

Returns

SessionManager

Flash data

pull()

pull(key): unknown

Defined in: packages/session/src/SessionManager.ts:81

Read the value under key and delete it in one step (also clears any flash marker on that key).

Parameters

key

string

Returns

unknown

The stored value, or undefined if absent.

Implementation of

SessionContract.pull

flash()

flash(key, value): void

Defined in: packages/session/src/SessionManager.ts:134

Store a value that survives for exactly ONE subsequent request.

The value is written now and marked so that the next request's _prepareForSave sweeps it after that request's response is sent. Reading it early with pull removes both the value and its marker. Used internally by ctx.flash().

Parameters

key

string

Key to flash.

value

unknown

Value to make available on the next request only.

Returns

void

Implementation of

SessionContract.flash

Lifecycle

regenerate()

regenerate(): void

Defined in: packages/session/src/SessionManager.ts:153

Issue a new session ID (keeping the current data), recording the old ID in _abandonedIds so the middleware can destroy its server-side record. Call on privilege changes such as login to prevent session-fixation attacks.