Feature 03 task 2: Server-side sessions, cookie and logout (#19)

Co-authored-by: dev_agent <dev_agent@cubecraftlabs.com>
Co-committed-by: dev_agent <dev_agent@cubecraftlabs.com>

cmd/server/main.go

@@ -52,13 +52,17 @@ func run(cfg config.Config, logger *slog.Logger) error {
 		}
 	}()
 
+	sessions, err := auth.NewSessionManager(db, cfg.SessionIdle, cfg.SessionMax)
+	if err != nil {
+		return err
+	}
 	authFlow, err := auth.New(ctx, auth.Config{
 		Issuer:       cfg.OIDCIssuer.String(),
 		ClientID:     cfg.OIDCClientID,
 		ClientSecret: cfg.OIDCClientSecret.Reveal(),
 		PublicURL:    cfg.PublicURL,
 		SecretKey:    []byte(cfg.SecretKey.Reveal()),
-	}, sessionsPending{}, logger)
+	}, sessions, logger)
 	if err != nil {
 		return err
 	}
@@ -115,14 +119,6 @@ func openStore(ctx context.Context, dataDir string) (*store.Store, error) {
 	return db, nil
 }
 
-// sessionsPending refuses every login until the session layer (Feature 03
-// task 2) replaces it.
-type sessionsPending struct{}
-
-func (sessionsPending) StartSession(http.ResponseWriter, *http.Request, auth.Claims) error {
-	return errors.New("session layer not implemented")
-}
-
 // logListening logs the startup line. Only the public URL's origin is logged
 // so no credential-bearing URL component can reach the log.
 func logListening(logger *slog.Logger, cfg config.Config) {