Author: Michael Lynch <git@mtlynch.io>
Committer: Michael Lynch <mtlynch@noreply.codeberg.org>
Refactor simpleauth for caller-owned sessions (#5) This is a breaking v3 API cleanup that removes simpleauth's built-in SQLite/jeff session storage and leaves persistence behind caller-provided interfaces. The previous API forced every application through a SQLite-backed session manager and stored opaque session bytes, which made the package harder to use with applications that already own their user tables, databases, caches, or deployment-specific session lifecycle. The sessions package now exposes the primitives the library actually needs: a validated server-side session ID, a stable user ID, a Session record with creation and expiration timestamps, and a Store interface for create, read, and delete operations. Manager now owns the browser-facing lifecycle by generating 32-byte random session IDs, setting and clearing HttpOnly SameSite=Lax cookies, loading optional users for public routes, requiring users for protected routes, logging users in and out, and deleting expired sessions when they are observed. Session expiry now belongs to Manager configuration instead of to callers, so a single clock and lifetime policy determines both persisted session metadata and the cookie expiration. Manager construction fails fast when required dependencies are missing: a store, a clock, and a positive lifetime. The dependency graph shrinks accordingly: jeff, SQLite, msgp, and the sqlite_json test tag are removed; the module path advances to codeberg.org/mtlynch/simpleauth/v3; x/crypto is updated; and the Nix vendor hash and tests move to the slimmer API. Tests cover creating and loading sessions, redirecting unauthenticated protected requests, and ignoring and deleting expired sessions. Reviewed-on: https://codeberg.org/mtlynch/simpleauth/pulls/5 Co-authored-by: Michael Lynch <git@mtlynch.io> Co-committed-by: Michael Lynch <git@mtlynch.io>