sessions 0.2.2 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6ead91af5a7b6b9818df58d3c068ce4d59e09a5b865e80373ba2e7b7c5854e75
-  data.tar.gz: 6ad52d4780745c525de40a76cb462e5cedc87b3f54dfff7f9d803f69ad9f0033
+  metadata.gz: b7cca6c52bb926f1a07896ba44ec9cf3abba216dd8d49793febc1a405b27e6e1
+  data.tar.gz: 00770fa40d62a4e305df2b8a8530519873368fe097359d64d92fc8a19b522897
 SHA512:
-  metadata.gz: f32fb15dbbef609551071da2de77a4b6c0f9117e496a2405548d87a5fcddad11bb14b1e7c738e0bdd70112634ad92d7b5a1ecf3fb041b4b2d3420e8d0fba3e3b
-  data.tar.gz: fffa0d52b6c6353b1d326f0a76c7a3e49ea8bac0f3bf8b160923675c99bfa9d7a12db4f85e3120a532b677e4539fedb90b5aa80917eb88f6c87455699d52726e
+  metadata.gz: a3c27ee309a2d4a74c78e05b573068af4d5736cdaccf23e19f36565d58349ad550a344da601b1ce71c601e917c2c311405756b2af6cd7f314aeedc07502251c1
+  data.tar.gz: 4bd16a0366a8cdd01f69b426af63959d58f6e847b722e12f696ab196d3c9da3a540cec6ff6a7155040a51a823a9ba029f75828d04ffbb36f682b6bd9ed4687a8

data/Appraisals

@@ -7,16 +7,22 @@
 # fine on 7.1 because the concern only uses 7.1-era APIs).
 appraise "rails-7.1" do
   gem "rails", "~> 7.1.0"
+  # json 3 removed the quirks_mode option that ActiveSupport before 8.1 passes.
+  gem "json", "< 3"
 end
 
 appraise "rails-7.2" do
   gem "rails", "~> 7.2.0"
+  # json 3 removed the quirks_mode option that ActiveSupport before 8.1 passes.
+  gem "json", "< 3"
 end
 
 # The version that shipped `rails generate authentication` — the substrate
 # this gem decorates.
 appraise "rails-8.0" do
   gem "rails", "~> 8.0.0"
+  # json 3 removed the quirks_mode option that ActiveSupport before 8.1 passes.
+  gem "json", "< 3"
 end
 
 # The latest Rails — also adds the rate_limit.action_controller notification

data/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.3.0 (2026-10-18)
+
+Adds re-authentication assertions. This release is additive: it needs no migration, and existing installs change nothing until they call the new API.
+
+- **Record a fresh re-authentication on the session row.** Call `session.reauthenticated!(method: :password)` after your own credential check succeeds. The gem never checks credentials. The state lives in `auth_detail`, so no migration is needed. `session.reauthenticated_within?(5.minutes)` tells whether it is recent. `session.reauthenticated_at` and `session.reauthentication_method` read it back. An ended or expired session is never recent. Both methods reload the row under a lock, so a revocation in another process counts.
+- **Issue a short-lived signed assertion of it.** `session.reauthentication_assertion(audience:, purpose:)` returns a signed token for one audience and one purpose. It raises `Sessions::Reauthentication::NotRecent` when the re-authentication is not recent.
+- **Verify the assertion in another service.** `Sessions::Reauthentication.verify(token, audience:, key:, subject:, purpose:, max_age:)` returns an `Assertion` or `nil`. The other service needs only the shared key and `require "sessions/reauthentication"`: no database, no cookie, no models. `verify` refuses another key, audience, subject or purpose, a changed or expired token, a timestamp more than 30 seconds in the future, and a re-authentication older than `max_age`.
+- **Subjects carry the owner class.** A subject is `"<owner class>:<id>"`, so owners of two classes with the same id never match. A stored polymorphic type is resolved to its full class name, also when `store_full_class_name` is false.
+- **Replay protection is possible.** Each assertion has a unique `jti` and an `expires_at`. To refuse replays, record each accepted `jti` until `expires_at`.
+- **Opt-in controller helpers.** `include Sessions::ReauthenticationHelpers` gives `record_sessions_reauthentication!(owner, method:)`, `sessions_reauthenticated?(owner)` and `sessions_reauthentication_assertion(owner, audience:, purpose:)`. They act only on a current session of the named owner. Use `scope:` for apps with more than one Warden scope.
+- **New configuration.** `reauthentication_key` (a String of 32 bytes or more, or a callable), `reauthentication_window` (default 5 minutes) and `reauthentication_assertion_ttl` (default 1 minute).
+
 ## 0.2.2 (2026-07-06)
 
 Closes the revocation-semantics gaps found auditing the 0.2.x lifecycle model against production data.

data/README.md

@@ -365,6 +365,46 @@ rails generate sessions:madmin --user-panel
 
 That adds a reusable `Sessions::MadminUserPanel` concern and `app/views/madmin/users/sessions.html.erb`. Include the concern in `Madmin::UsersController`, add the printed member routes, and add a `member_action` link from your `UserResource`.
 
+## 🔐 Re-authentication assertions ("prove you just typed your password")
+
+Some actions deserve a fresh password: approving a payment, changing a payout account, confirming something another service will act on. `sessions` records that fresh re-authentication on the session row and can hand out a short-lived, signed **assertion** of it that another service verifies with a shared key — no database, no cookie, no models on the other side.
+
+```ruby
+# config/initializers/sessions.rb
+Sessions.configure do |config|
+  config.reauthentication_key = Rails.application.credentials.reauthentication_key # >= 32 bytes, shared with the verifier
+end
+
+# Your controller, after YOUR check succeeded (the gem never checks credentials):
+class ReauthenticationsController < ApplicationController
+  include Sessions::ReauthenticationHelpers
+
+  def create
+    return render(:new, status: :unprocessable_entity) unless current_user.valid_password?(params[:password])
+
+    record_sessions_reauthentication!(current_user, method: :password)
+    token = sessions_reauthentication_assertion(current_user, audience: "payments", purpose: "payout:42")
+    redirect_to payments_service_url(assertion: token), allow_other_host: true
+  end
+end
+```
+
+The other service needs only `require "sessions/reauthentication"` and the key:
+
+```ruby
+assertion = Sessions::Reauthentication.verify(token, audience: "payments", key: ENV["REAUTH_KEY"],
+                                              subject: "User:#{user_id}", purpose: "payout:42", max_age: 5.minutes)
+assertion&.method      # => "password"
+assertion&.jti         # unique per assertion
+assertion&.expires_at  # to refuse replays, check-and-insert each accepted jti and keep it until this time
+```
+
+The helpers take the owner whose credential you checked and act only on a current session of that owner (`scope:` picks the Warden scope when you sign in more than one). The subject of an assertion is the owner's class and id (`"User:42"`), so two owner classes with the same id never match; `verify` accepts the record or that string as `subject:`.
+
+On the model: `session.reauthenticated!(method: :password)`, `session.reauthenticated_within?(5.minutes)`, `session.reauthenticated_at`, and `session.reauthentication_assertion(audience:, purpose:)` (raises `Sessions::Reauthentication::NotRecent` without a recent re-authentication). An ended or expired session is never recent, and both methods reload the row under a lock first, so a revocation in another process counts. The state lives in `auth_detail`, so no migration is needed.
+
+What an assertion is not: a session or a bearer login. It expires after `reauthentication_assertion_ttl` (default one minute), it names one audience and one purpose, and `verify` returns `nil` for anything else — another key, audience, subject or purpose, a tampered or expired token, a timestamp more than 30 seconds in the future, or a re-authentication older than `max_age`.
+
 ## 🧹 Retention & the sweep
 
 The install generator drops a `SessionsSweepJob` into `app/jobs/` — schedule it daily:
@@ -430,6 +470,9 @@ Sessions.configure do |config|
   config.authenticate_method     = :authenticate_user!
   config.layout                  = nil             # nil, "app", or ->(controller) { ... }
   config.require_reauthentication = nil            # ->(controller) { ... } sudo gate
+  config.reauthentication_key    = nil             # shared secret (>= 32 bytes) for re-authentication assertions
+  config.reauthentication_window = 5.minutes       # how recent a re-authentication must be to assert it
+  config.reauthentication_assertion_ttl = 1.minute # how long an issued assertion stays valid
   config.session_class           = "Session"
   config.strategy_methods        = {}              # { "OtpAuthenticatable" => :otp }
 end

data/gemfiles/rails_7.1.gemfile

@@ -4,6 +4,7 @@ source "https://rubygems.org"
 
 gem "rake", "~> 13.0"
 gem "rails", "~> 7.1.0"
+gem "json", "< 3"
 
 group :development do
   gem "appraisal"

data/gemfiles/rails_7.2.gemfile

@@ -4,6 +4,7 @@ source "https://rubygems.org"
 
 gem "rake", "~> 13.0"
 gem "rails", "~> 7.2.0"
+gem "json", "< 3"
 
 group :development do
   gem "appraisal"

data/gemfiles/rails_8.0.gemfile

@@ -4,6 +4,7 @@ source "https://rubygems.org"
 
 gem "rake", "~> 13.0"
 gem "rails", "~> 8.0.0"
+gem "json", "< 3"
 
 group :development do
   gem "appraisal"

data/lib/sessions/configuration.rb

@@ -192,6 +192,12 @@ module Sessions
     # never through to the destructive action).
     attr_reader :require_reauthentication
 
+    # Re-authentication assertions (Sessions::Reauthentication): the shared
+    # secret that signs them (a String of at least 32 bytes, or a callable
+    # returning one; nil disables issuing), how recent a re-authentication
+    # must be to issue one, and how long an issued assertion stays valid.
+    attr_reader :reauthentication_key, :reauthentication_window, :reauthentication_assertion_ttl
+
     # The host's session-of-record model, as a string. "Session" matches
     # both the Rails 8 generator and the model our install generator writes
     # in Devise mode. Escape hatch for apps with a conflicting legacy
@@ -239,6 +245,9 @@ module Sessions
       @authenticate_method = :authenticate_user!
       @layout = nil
       @require_reauthentication = nil
+      @reauthentication_key = nil
+      @reauthentication_window = 5.minutes
+      @reauthentication_assertion_ttl = 1.minute
       @session_class = "Session"
       @strategy_methods = {}
     end
@@ -395,6 +404,31 @@ module Sessions
       @require_reauthentication = ensure_callable(value, "require_reauthentication")
     end
 
+    def reauthentication_key=(value)
+      if value.nil? || value.respond_to?(:call) || (value.is_a?(String) && value.bytesize >= 32)
+        @reauthentication_key = value
+        return
+      end
+
+      raise ConfigurationError, "reauthentication_key must be a String of at least 32 bytes, a callable, or nil"
+    end
+
+    # The signing key, resolved from a callable on use (so it can read credentials lazily).
+    def resolved_reauthentication_key
+      key = @reauthentication_key.respond_to?(:call) ? @reauthentication_key.call : @reauthentication_key
+      raise ConfigurationError, "config.reauthentication_key is not set" if key.to_s.empty?
+
+      key
+    end
+
+    def reauthentication_window=(value)
+      @reauthentication_window = ensure_positive_duration(value, "reauthentication_window")
+    end
+
+    def reauthentication_assertion_ttl=(value)
+      @reauthentication_assertion_ttl = ensure_positive_duration(value, "reauthentication_assertion_ttl")
+    end
+
     def session_class=(value)
       name = value.is_a?(Class) ? value.name : value.to_s
       raise ConfigurationError, "session_class can't be blank" if name.strip.empty?
@@ -440,6 +474,12 @@ module Sessions
       value
     end
 
+    def ensure_positive_duration(value, name)
+      return value if value.is_a?(Numeric) && value.positive?
+
+      raise ConfigurationError, "#{name} must be a positive duration (for example 5.minutes), got #{value.inspect}"
+    end
+
     def ensure_callable(value, name)
       unless value.respond_to?(:call)
         raise ConfigurationError, "#{name} must respond to #call (a proc/lambda), got #{value.inspect}"

data/lib/sessions/models/concerns/model.rb

@@ -144,6 +144,97 @@ module Sessions
       update!(auth_detail: detail.merge("second_factor" => kind.to_s))
     end
 
+    # --- Re-authentication ----------------------------------------------------
+
+    # Record that the person re-authenticated on THIS session just now (a
+    # password re-entry, a passkey or a second factor). Call it after your
+    # own check succeeded; the gem never checks credentials itself:
+    #
+    #   if current_user.valid_password?(params[:password])
+    #     Sessions.current(request)&.reauthenticated!(method: :password)
+    #   end
+    #
+    # Stored in `auth_detail` like `second_factor!`, so no migration is needed.
+    def reauthenticated!(method: :password, at: Time.current)
+      unless self.class.column_names.include?("auth_detail")
+        raise Sessions::Error, "re-authentication needs the auth_detail column (rails generate sessions:install)"
+      end
+
+      with_lock do # reloads the row: a revocation by another process counts
+        raise Sessions::Error, "an ended or expired session cannot be re-authenticated" unless reauthenticatable?
+
+        detail = (try(:auth_detail) || {}).to_h
+        update!(auth_detail: detail.merge("reauthenticated_at" => at.utc.iso8601(6),
+                                          "reauthentication_method" => method.to_s))
+      end
+    end
+
+    # When the person last re-authenticated on this session, or nil.
+    def reauthenticated_at
+      value = (try(:auth_detail) || {}).to_h["reauthenticated_at"]
+      value && Time.iso8601(value)
+    rescue ArgumentError
+      nil
+    end
+
+    def reauthentication_method = (try(:auth_detail) || {}).to_h["reauthentication_method"]
+
+    # True when this live, unexpired session re-authenticated within the
+    # duration (default: config.reauthentication_window), on this row as stored.
+    def reauthenticated_within?(duration = Sessions.config.reauthentication_window)
+      at = reauthenticated_at
+      reauthenticatable? && at.present? && at > duration.ago && at <= Time.current
+    end
+
+    # A short-lived signed assertion of the last re-authentication, for one
+    # audience (and optionally one purpose). Another service verifies it with
+    # Sessions::Reauthentication.verify and the shared key. Raises
+    # Sessions::Reauthentication::NotRecent unless the re-authentication is
+    # within config.reauthentication_window. The row is reloaded under a lock
+    # first, so an assertion never outlives a revocation it could see.
+    def reauthentication_assertion(audience:, purpose: nil, within: Sessions.config.reauthentication_window)
+      with_lock do
+        unless reauthenticated_within?(within)
+          raise Sessions::Reauthentication::NotRecent, "no re-authentication within #{within.inspect}"
+        end
+
+        config = Sessions.config
+        Sessions::Reauthentication.issue(
+          subject: reauthentication_subject, session_id: id, method: reauthentication_method,
+          authenticated_at: reauthenticated_at, audience: audience, purpose: purpose,
+          key: config.resolved_reauthentication_key, expires_in: config.reauthentication_assertion_ttl
+        )
+      end
+    end
+
+    # The owner's canonical subject ("User:42"), with the owner class even
+    # when the owner record is not loaded. A stored polymorphic type is
+    # resolved to its class first, so the subject is the full class name
+    # also when `store_full_class_name` is false; it then matches
+    # Sessions::Reauthentication.subject_for(owner).
+    def reauthentication_subject
+      stored_type = try(:user_type).presence
+      owner_class = if stored_type
+                      sessions_polymorphic_owner_class(stored_type)
+                    else
+                      self.class.reflect_on_association(:user)&.klass
+                    end
+      owner_type = owner_class.respond_to?(:base_class) ? owner_class.base_class.name : stored_type
+      "#{owner_type}:#{user_id}"
+    end
+
+    private
+
+    def reauthenticatable? = !ended? && !sessions_expired?
+
+    def sessions_polymorphic_owner_class(stored_type)
+      self.class.polymorphic_class_for(stored_type)
+    rescue NameError, ArgumentError
+      nil
+    end
+
+    public
+
     # --- Revocation -----------------------------------------------------------
 
     # End this registry row without deleting it. This is the core v0.2

data/lib/sessions/reauthentication.rb

@@ -0,0 +1,109 @@
+# frozen_string_literal: true
+
+require "json"
+require "securerandom"
+require "time"
+require "active_support"
+require "active_support/message_verifier"
+require "active_support/core_ext/time/calculations"
+require "active_support/core_ext/numeric/time" # 5.minutes for max_age: and fresh?(within:)
+require "active_support/security_utils"
+require_relative "errors"
+
+module Sessions
+  # Short-lived, signed proof that a person re-entered their password (or
+  # passed another re-authentication) on a given session a moment ago.
+  #
+  # The host records the re-authentication on the session row and issues an
+  # assertion for one audience; another service that holds the shared key
+  # verifies it without a database, without a session cookie, and without
+  # this app's models:
+  #
+  #   # The host, right after it checked the password:
+  #   session = Sessions.current(request)
+  #   session.reauthenticated!(method: :password)
+  #   token = session.reauthentication_assertion(audience: "billing", purpose: "refund:42")
+  #
+  #   # The other service (only `require "sessions/reauthentication"` is needed):
+  #   assertion = Sessions::Reauthentication.verify(token, audience: "billing", key: ENV["REAUTH_KEY"],
+  #                                                 subject: "User:#{user_id}", purpose: "refund:42")
+  #   assertion&.fresh?(within: 5.minutes)  # => true
+  #
+  # An assertion is a signed statement, not a session: it expires quickly
+  # (`reauthentication_assertion_ttl`), names its audience and purpose, and
+  # carries a unique `jti` so a verifier that must refuse replays can keep a
+  # short list of the ones it accepted.
+  module Reauthentication
+    # The claims of a verified assertion. `subject` is "<owner class>:<id>".
+    Assertion = Data.define(:subject, :session_id, :method, :authenticated_at, :audience, :purpose, :jti, :issued_at,
+                            :expires_at) do
+      # True when the re-authentication happened within the duration.
+      def fresh?(within:) = authenticated_at > Time.now - within
+    end
+
+    DIGEST = "SHA256"
+    CLOCK_SKEW = 30 # seconds of tolerance for the issuer's clock running ahead
+
+    # The session has no re-authentication recent enough to assert.
+    class NotRecent < Sessions::Error; end
+
+    module_function
+
+    # The canonical subject of an owner record ("User:42"), so owners of two
+    # classes with the same id never share a subject. A String passes through.
+    def subject_for(owner)
+      return owner.to_s if owner.is_a?(String) || !owner.respond_to?(:id)
+
+      klass = owner.class.respond_to?(:base_class) ? owner.class.base_class : owner.class
+      "#{klass.name}:#{owner.id}"
+    end
+
+    # A signed assertion. `key` is the shared secret (at least 32 bytes).
+    def issue(subject:, session_id:, method:, authenticated_at:, audience:, key:, purpose: nil, expires_in: 60)
+      now = Time.now.utc
+      claims = { "sub" => subject_for(subject), "sid" => session_id.to_s, "method" => method.to_s,
+                 "auth_at" => authenticated_at.utc.iso8601(6), "aud" => audience.to_s, "purpose" => purpose&.to_s,
+                 "jti" => SecureRandom.uuid, "iat" => now.iso8601(6), "exp" => (now + expires_in).iso8601(6) }
+      verifier(key).generate(claims, expires_in: expires_in, purpose: signing_purpose(audience))
+    end
+
+    # The Assertion of a token, or nil when the token is forged, expired, for
+    # another audience, purpose or subject, dated in the future beyond
+    # CLOCK_SKEW, or (with max_age) of a re-authentication older than max_age.
+    # A verifier that must refuse replays records each accepted `jti` until
+    # its `expires_at` (an atomic check-and-insert).
+    def verify(token, audience:, key:, subject: nil, purpose: nil, max_age: nil)
+      return nil if token.to_s.empty?
+
+      claims = verifier(key).verified(token.to_s, purpose: signing_purpose(audience))
+      return nil unless claims.is_a?(Hash) && claims["aud"] == audience.to_s
+      return nil if subject && !secure_equal?(claims["sub"], subject_for(subject))
+      return nil if purpose && !secure_equal?(claims["purpose"].to_s, purpose.to_s)
+
+      assertion = Assertion.new(subject: claims["sub"], session_id: claims["sid"], method: claims["method"],
+                                authenticated_at: Time.iso8601(claims["auth_at"]), audience: claims["aud"],
+                                purpose: claims["purpose"], jti: claims["jti"], issued_at: Time.iso8601(claims["iat"]),
+                                expires_at: Time.iso8601(claims["exp"]))
+      latest = Time.now + CLOCK_SKEW
+      return nil if assertion.authenticated_at > latest || assertion.issued_at > latest
+      return nil if assertion.authenticated_at > assertion.issued_at
+      return nil if max_age && !assertion.fresh?(within: max_age)
+
+      assertion
+    rescue ArgumentError, TypeError, KeyError
+      nil
+    end
+
+    def verifier(key)
+      raise Sessions::ConfigurationError, "a reauthentication key needs at least 32 bytes" if key.to_s.bytesize < 32
+
+      ActiveSupport::MessageVerifier.new(key.to_s, digest: DIGEST, serializer: JSON)
+    end
+
+    def signing_purpose(audience) = "sessions/reauthentication/#{audience}"
+
+    def secure_equal?(left, right)
+      left.to_s.bytesize == right.to_s.bytesize && ActiveSupport::SecurityUtils.secure_compare(left.to_s, right.to_s)
+    end
+  end
+end

data/lib/sessions/reauthentication_helpers.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+module Sessions
+  # Controller helpers for re-authentication assertions. Opt in where you
+  # check a password again, and name whose password you checked:
+  #
+  #   class ReauthenticationsController < ApplicationController
+  #     include Sessions::ReauthenticationHelpers
+  #
+  #     def create
+  #       if current_user.valid_password?(params[:password])
+  #         record_sessions_reauthentication!(current_user, method: :password)
+  #         token = sessions_reauthentication_assertion(current_user, audience: "approvals")
+  #       end
+  #     end
+  #   end
+  #
+  # Every helper takes the owner whose credential the controller checked and
+  # acts only on a current session of that owner (in `scope:` when the app
+  # signs in more than one Warden scope).
+  module ReauthenticationHelpers
+    private
+
+    # Records the re-authentication on the owner's current session. Returns the session, or nil.
+    def record_sessions_reauthentication!(owner, method: :password, scope: nil)
+      sessions_reauthentication_session(owner, scope)&.tap { |session| session.reauthenticated!(method: method) }
+    end
+
+    # True when the owner's current session re-authenticated within the window.
+    def sessions_reauthenticated?(owner, within: Sessions.config.reauthentication_window, scope: nil)
+      sessions_reauthentication_session(owner, scope)&.reauthenticated_within?(within) || false
+    end
+
+    # An assertion of the owner's recent re-authentication, or nil.
+    def sessions_reauthentication_assertion(owner, audience:, purpose: nil, scope: nil)
+      sessions_reauthentication_session(owner, scope)&.reauthentication_assertion(audience: audience, purpose: purpose)
+    rescue Sessions::Reauthentication::NotRecent
+      nil
+    end
+
+    def sessions_reauthentication_session(owner, scope)
+      session = Sessions.current(request, scope: scope)
+      return nil unless session && owner
+      return nil unless session.reauthentication_subject == Sessions::Reauthentication.subject_for(owner)
+
+      session
+    end
+  end
+end

data/lib/sessions/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Sessions
-  VERSION = "0.2.2"
+  VERSION = "0.3.0"
 end

data/lib/sessions.rb

@@ -13,6 +13,8 @@ require "active_support/security_utils"
 require_relative "sessions/version"
 require_relative "sessions/errors"
 require_relative "sessions/configuration"
+require_relative "sessions/reauthentication"
+require_relative "sessions/reauthentication_helpers"
 require_relative "sessions/current"
 require_relative "sessions/end_reason"
 require_relative "sessions/ip_address"

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: sessions
 version: !ruby/object:Gem::Version
-  version: 0.2.2
+  version: 0.3.0
 platform: ruby
 authors:
 - rameerez
 bindir: exe
 cert_chain: []
-date: 2026-07-06 00:00:00.000000000 Z
+date: 2026-10-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: actionpack
@@ -200,6 +200,8 @@ files:
 - lib/sessions/models/concerns/has_sessions.rb
 - lib/sessions/models/concerns/model.rb
 - lib/sessions/models/event.rb
+- lib/sessions/reauthentication.rb
+- lib/sessions/reauthentication_helpers.rb
 - lib/sessions/version.rb
 homepage: https://github.com/rameerez/sessions
 licenses: