session

type Config struct {
	// CookieName defaults to "vukem_session"; with Secure, Path "/" and no
	// Domain the "__Host-" prefix is added automatically.
	CookieName string
	// Path defaults to "/".
	Path string
	// Domain is empty (host-only cookie) by default.
	Domain string
	// Secure sends the cookie over HTTPS only. Required in production.
	Secure bool
	// SameSite defaults to Lax.
	SameSite http.SameSite
	// IdleTimeout ends sessions after inactivity (default 2h).
	IdleTimeout time.Duration
	// Lifetime ends sessions this long after creation (default 24h).
	Lifetime time.Duration
	// Store keeps sessions server-side; nil stores them in an encrypted
	// cookie (CookieKey required).
	Store Store
	// CookieKey is the 32-byte AES-256-GCM key for cookie sessions; derive
	// it from APP_KEY: app.Key.Derive("session.cookie", 32).
	CookieKey []byte
	// Production enables boot-time checks (Secure must be true).
	Production bool
	// Now is the clock (tests); defaults to time.Now. When set, New hands
	// it to the store so expiry and Prune follow the same clock: the
	// built-in MemoryStore and SQLStore, and any store (or wrapper
	// embedding one) with a setClock(func() time.Time) method.
	Now func() time.Time
	// Log receives security events and storage errors.
	Log *slog.Logger
}

type Manager struct {
	// contains filtered or unexported fields
}

type MemoryStore struct {
	// contains filtered or unexported fields
}

type SQLOption func(*SQLStore)

type SQLStore struct {
	// contains filtered or unexported fields
}

type Session struct {
	// contains filtered or unexported fields
}

type Store interface {
	// Load returns the data saved for id; found is false when the session
	// does not exist or expired.
	Load(ctx context.Context, id string) (data []byte, found bool, err error)
	// Save stores data for id until expiry.
	Save(ctx context.Context, id string, data []byte, expiry time.Time) error
	// Delete removes id.
	Delete(ctx context.Context, id string) error
}

type UserStore interface {
	Store
	// Create stores a new session owned by userID ("" for a guest).
	Create(ctx context.Context, id, userID string, data []byte, expiry time.Time) error
	// Update rewrites an existing session and returns ErrSessionNotFound
	// when it is gone (revoked, logged out, pruned): a request that was in
	// flight during a revocation must not write the session back.
	Update(ctx context.Context, id, userID string, data []byte, expiry time.Time) error
	// RevokeOthers deletes every session of userID except keepID ("" keeps
	// none).
	RevokeOthers(ctx context.Context, userID, keepID string) error
}