Problem

session.user and session.groups raise AttributeError in any session context other than a root AppSession — which means module sessions and Express apps both fail silently or crash when app code tries to read the authenticated user's identity.

Minimal reproducible example (Express):

from shiny.express import session

print(session.user)  # AttributeError: 'ExpressStubSession' object has no attribute 'user'

Module session:

@module.server
def mod(input, output, session):
    print(session.user)  # AttributeError: 'SessionProxy' object has no attribute 'user'

The root cause was twofold:

• ExpressStubSession never initialised user or groups
• SessionProxy (used for module sessions) never delegated user/groups to its root session

Fix

Beyond just adding the missing attributes, this exposed a design gap: user and groups were plain mutable instance attributes on AppSession, which means nothing in the type system prevented app code from reassigning them. Since these represent authenticated identity derived from immutable HTTP headers, they should be read-only.

user and groups are now abstract read-only properties on the Session ABC, implemented concretely across all three session types:

• AppSession: reads from private _user/_groups backing fields populated from credentials headers at connection time
• SessionProxy: delegates to _root_session.user / _root_session.groups via property, so module sessions always reflect the root session's identity (including nested modules)
• ExpressStubSession: returns None — no real HTTP connection, so no credentials