session

type SessionData struct {
	// State is the CSRF protection token (base64-encoded random 32 bytes)
	State string `json:"state"`

	// Verifier is the PKCE code verifier (oauth2.GenerateVerifier() output)
	Verifier string `json:"verifier"`

	// Provider identifies which provider initiated the flow (google, github, etc.)
	Provider string `json:"provider"`

	// ExpiresAt is the session expiry timestamp (10 minutes from creation)
	ExpiresAt time.Time `json:"expires_at"`
}

type SessionStore struct {
	// contains filtered or unexported fields
}

type UserSession struct {
	// UserID is the OIDC "sub" claim (unique identifier from identity provider)
	UserID string `json:"user_id"`

	// Email is the user's verified email address from OIDC claims
	Email string `json:"email"`

	// Role is the user's authorization level ("admin" or "readonly")
	// Derived from config role mapping based on email/groups
	Role string `json:"role"`

	// RememberMe determines session duration: false=7 days, true=30 days
	// Middleware validates against LastActive for 7-day sessions
	RememberMe bool `json:"remember_me"`

	// CreatedAt is the session creation timestamp (set once, never updated)
	CreatedAt time.Time `json:"created_at"`

	// LastActive is updated on each authenticated request for sliding window
	// expiration and security audit trail
	LastActive time.Time `json:"last_active"`

	// IPAddress is the client's IP address at session creation time
	// Used for security audit logs and suspicious activity detection
	IPAddress string `json:"ip_address"`

	// UserAgent is the browser's User-Agent header at session creation time
	// Used for session fingerprinting and audit logs
	UserAgent string `json:"user_agent"`
}