webapp cookie rotation: who holds what
Three actors and two makers. Alice holds a reference to a store made by
makeMapStore, and to diigo-cache, which she wired up. She rotates the cookie
by saying: await E(store).set("cookie", freshCookie). The store, and its
read-only facets, both refer to the store's kv table, whose one row maps
"cookie" to the session; its shapes are keyShape "cookie" and valueShape
M.string(). makeWebApp makes access objects; each refers to its init
table: url, headers, and headerStore. headerStore refers to the store's
read-only facet, which access reads at every send. diigo-cache holds a
reference to access. Mallory, who learned the instance id, also holds a
reference to access, so she can use the cookie, but she has no reference
to the store, so she cannot rotate it or swap in her own session.