   return { model, id, method, token }
 
 
-
-verifySession = (Models, sessionToken, callback) ->
-
-  Models.JSession.one { clientId: sessionToken }, (err, session) ->
-
-    if err or not session
+updateSessionTimestamp = (session, callback) ->
+
+  session.lastAccess = lastAccess = new Date
+  session.update { $set: { lastAccess } }, (err) ->
+    return callback apiErrors.unauthorizedRequest  if err
+    callback null, session
+
+
+fetchSession = (Models, token, callback) ->
+
+  Models.JSession.one { clientId: token }, (err, session) ->
+
+    if err
       return callback apiErrors.unauthorizedRequest
 
-    { groupName: group } = session
-
-    callback null, { userArea: { group }, sessionToken }
+    if session
+
+      if session.getAt 'data.apiSession'
+        Models.JApiToken.fetchGroup (session.getAt 'groupName'), (err) ->
+          return callback err  if err
+          updateSessionTimestamp session, callback
+
+      else
+        updateSessionTimestamp session, callback
+
+      return
+
+    Models.JApiToken.createSessionByToken token, (err, session) ->
+
+      if err or not session
+        return callback apiErrors.unauthorizedRequest
+
+      updateSessionTimestamp session, callback
 
 
 sendSignatureErr = (signatures, method, res) ->

  return (req, res) ->

    return  unless parsedRequest = parseRequest req, res

    { model, id, method, sessionToken } = parsedRequest

    verifySession Models, sessionToken, (err, context) ->

      if err
        sendApiError res, err
        return

      constructorName = getConstructorName model, Models

      unless constructorName

    return model  if model.toLowerCase() is name.toLowerCase()


getContextFromSession = (session) ->

  { clientId: sessionToken, groupName: group } = session
  return { userArea: { group }, sessionToken }


sendApiError = (res, error) ->

  return res.status(error.status ? 403).send error
