session schema AccountSession { int $userId; String $displayName; String[] $roles; } function String authority() { return "127.0.0.1:" + env_int("GRAY_SESSION_DEMO_PORT", 8791); } function sessionPolicy() { return[ "cookie_name": "gray_demo", "secure": false, "same_site": "Lax", "idle_ms": 900000, "absolute_ms": 28800000, "authentication_ms": 3600000, "rotation_grace_ms": 5000, "rotation_grace_uses": 2, "maximum_user_sessions": 5 ]; } function browserPolicy() { return[ "allowed_hosts": [authority()], "allowed_origins": ["http://" + authority()] ]; } function respondJson($request, int $status, $value) { http_respond( $request, $status, "application/json; charset=utf-8", json_encode($value) ); return 0; } function respondHtml($request, String $body) { http_respond( $request, 200, "text/html; charset=utf-8", $body ); return 0; } function serveAsset( $request, String $relative, String $contentType ) { set String $root = env_get( "GRAY_SESSION_DEMO_ROOT" ); http_respond( $request, 200, $contentType, io_read($root + "/public/" + $relative) ); return 0; } function String shell( String $title, String $csrf, String $nonce, String $content ) { return "" + "" + "" + "" + "" + "" + $title + " - Gray Session Fabric" + "" + "

" + "GRAY NATIVE SESSION FABRIC

" + $title + "

" + "

Opaque server-side state, explicit browser " + "policy, typed data, and privacy-preserving signals.

" + $content + "
" + ""; } function home($request, $store) { set $browser = browser_protect( $request, browserPolicy() ); set $session = session_start( $request, $store, sessionPolicy() ); set $csrf = session_csrf_token( $session, "session-demo.action" ); set $userId = session_get($session, "user_id"); if ($userId = 42) { } else { return respondHtml( $request, shell( "Defensive sessions, alive", $csrf, $browser["csp_nonce"], "
" + "

Synthetic local account

" + "

Sign in as Ada. Authentication atomically rotates " + "the opaque identifier before the dashboard appears.

" + "
" + "

Encrypted at rest

SQLite records " + "use AES-256-GCM; the browser holds only an opaque cookie." + "

Bounded by design

" + "Expiry, replay grace, rate limits, risk retention, and " + "the event recorder all have hard limits.

" + "
" ) ); } set $account = AccountSession.read($session); set $risk = session_risk( $session, $request, "session-demo", [ "retention_ms": 3600000, "activity_threshold": 100, "privilege_sensitive": false ] ); set $recent = session_require_recent( $session, 300000, 2 ); set $stats = session_stats($store); set $sessions = session_list( $session, "session-demo" ); set $events = session_security_events(20); set String $sessionRows = ""; set int $sessionIndex = 0; while ($sessionIndex < $sessions.length) { set $listed = $sessions[$sessionIndex]; set String $sessionLabel = "other device"; if ($listed["current"]) { $sessionLabel = "this browser"; } set int $sessionNumber = $sessionIndex + 1; $sessionRows = $sessionRows + "
  • Session "; $sessionRows = $sessionRows + $sessionNumber; $sessionRows = $sessionRows + "" + $sessionLabel + ""; $sessionRows = $sessionRows + "
    • "; $sessionIndex++; } set $content = "
    " + "Authenticated as " + $account.displayName + "role: " + $account.roles[0] + "
    " + "

    Risk recommendation

    " + $risk["score"] + "

    " + $risk["recommendation"] + "

    " + json_encode($risk["reasons"]) +
        "

    Recent authentication

    " + json_encode($recent) + "

    " + "
    " + "

    Profile

    " + $account.displayName + "

    " + "" + "

    Session inventory

    " + $sessions.length + " session(s) belong to this synthetic account (" + $stats["active_sessions"] + " total in the store).

    " + "View redacted list" + "
    " + "

    Redacted security flight recorder

    " + "
    " + json_encode($events) +
        "

    JSON events - " + "Prometheus metrics

    " + "
    "; return respondHtml( $request, shell( "Ada's session dashboard", $csrf, $browser["csp_nonce"], $content ) ); } function requireAction($request, $store) { browser_protect($request, browserPolicy()); set $session = session_start( $request, $store, sessionPolicy() ); if (session_get($session, "user_id") = 42) { } else { return[ "allowed": false, "status": 401, "session": $session ]; } set $token = http_header($request, "x-csrf-token"); if (session_csrf_verify( $session, "session-demo.action", $token )) { } else { return[ "allowed": false, "status": 403, "session": $session ]; } return[ "allowed": true, "status": 200, "session": $session ]; } function login($request, $store) { browser_protect($request, browserPolicy()); set $session = session_start( $request, $store, sessionPolicy() ); set $token = http_header($request, "x-csrf-token"); if (session_csrf_verify( $session, "session-demo.action", $token )) { } else { return respondJson( $request, 403, ["error": "csrf"] ); } set $limit = session_rate_limit( $session, "demo.login", 5, 60000 ); if ($limit["allowed"]) { } else { return respondJson( $request, 429, ["error": "rate_limited"] ); } session_set($session, "user_id", 42); set AccountSession $account = AccountSession( 42, "Ada Lovelace", ["developer"] ); AccountSession.write($session, $account); session_authenticate($session, 2); return respondJson( $request, 200, ["ok": true, "rotated": true] ); } function updateProfile($request, $store) { set $action = requireAction($request, $store); if ($action["allowed"]) { } else { return respondJson( $request, $action["status"], ["error": "action_rejected"] ); } set $session = $action["session"]; if (session_require_recent($session, 300000, 2)) { } else { return respondJson( $request, 403, ["error": "recent_authentication_required"] ); } set String $name = text(http_body($request)); if ($name = "Ada Gray") { } else { if ($name = "Ada Lovelace") { } else { return respondJson( $request, 422, ["error": "invalid_demo_name"] ); } } set $account = AccountSession.read($session); set AccountSession $updated = AccountSession( $account.userId, $name, $account.roles ); AccountSession.write($session, $updated); return respondJson( $request, 200, ["ok": true, "name": $name] ); } function reauthenticate($request, $store) { set $action = requireAction($request, $store); if ($action["allowed"]) { } else { return respondJson( $request, $action["status"], ["error": "action_rejected"] ); } session_authenticate($action["session"], 3); return respondJson( $request, 200, ["ok": true, "level": 3, "rotated": true] ); } function sensitive($request, $store) { set $action = requireAction($request, $store); if ($action["allowed"]) { } else { return respondJson( $request, $action["status"], ["error": "action_rejected"] ); } if (session_require_recent( $action["session"], 300000, 3 )) { } else { return respondJson( $request, 403, ["error": "level_3_recent_authentication_required"] ); } return respondJson( $request, 200, ["ok": true, "message": "sensitive action allowed"] ); } function sessions($request, $store) { browser_protect($request, browserPolicy()); set $session = session_start( $request, $store, sessionPolicy() ); if (session_get($session, "user_id") = 42) { } else { return respondJson( $request, 401, ["error": "authentication_required"] ); } set $account = AccountSession.read($session); return respondJson( $request, 200, [ "sessions": session_list( $session, "session-demo" ), "userId": $account.userId, "identifiers_redacted": true ] ); } function revokeSession($request, $store) { set $action = requireAction($request, $store); if ($action["allowed"]) { } else { return respondJson( $request, $action["status"], ["error": "action_rejected"] ); } set String $identifier = text(http_body($request)); set $revoked = session_revoke( $action["session"], "session-demo", $identifier ); return respondJson( $request, 200, ["ok": true, "revoked": $revoked] ); } function revokeCurrent($request, $store) { set $action = requireAction($request, $store); if ($action["allowed"]) { } else { return respondJson( $request, $action["status"], ["error": "action_rejected"] ); } session_destroy($action["session"]); return respondJson( $request, 200, ["ok": true, "revoked": "current"] ); } function logoutEverywhere($request, $store) { set $action = requireAction($request, $store); if ($action["allowed"]) { } else { return respondJson( $request, $action["status"], ["error": "action_rejected"] ); } set $removed = session_destroy_user($store, 42); session_destroy($action["session"]); return respondJson( $request, 200, ["ok": true, "destroyed": $removed] ); } function events($request, $store) { browser_protect($request, browserPolicy()); set $session = session_start( $request, $store, sessionPolicy() ); if (session_get($session, "user_id") = 42) { } else { return respondJson( $request, 401, ["error": "authentication_required"] ); } return respondJson( $request, 200, session_security_events(100) ); } function metrics($request) { browser_protect($request, browserPolicy()); http_respond( $request, 200, "text/plain; version=0.0.4; charset=utf-8", prometheus_metrics("gray-session-demo") ); return 0; } set $database = sqlite_pool( env_get("GRAY_SESSION_DEMO_DATABASE"), 4, 1000 ); set $store = session_store_sqlite($database); set $server = tcp_listen( "127.0.0.1", env_int("GRAY_SESSION_DEMO_PORT", 8791) ); http_configure($server, 1024, 30000, 1048576); http_handler($server, "GET", "/", "home", [$store]); http_handler( $server, "GET", "/styles.css", "serveAsset", ["styles.css", "text/css; charset=utf-8"] ); http_handler( $server, "GET", "/app.js", "serveAsset", ["app.js", "text/javascript; charset=utf-8"] ); http_handler($server, "POST", "/login", "login", [$store]); http_handler( $server, "POST", "/profile", "updateProfile", [$store] ); http_handler( $server, "POST", "/reauthenticate", "reauthenticate", [$store] ); http_handler( $server, "POST", "/sensitive", "sensitive", [$store] ); http_handler( $server, "GET", "/sessions", "sessions", [$store] ); http_handler( $server, "POST", "/revoke-current", "revokeCurrent", [$store] ); http_handler( $server, "POST", "/revoke-session", "revokeSession", [$store] ); http_handler( $server, "POST", "/logout-everywhere", "logoutEverywhere", [$store] ); http_handler($server, "GET", "/events", "events", [$store]); http_handler($server, "GET", "/metrics", "metrics", []); while (true) { http_run($server, -1); }