session

type Manager[D any] struct {
	// Clock can be used to override measurement of time in tests.
	Clock func() time.Time
	// contains filtered or unexported fields
}

type Options struct {
	// TTL is the duration that any given session is valid. Note that there is
	// no facility for session extension at this time.
	// Default if unspecified: 30m
	TTL time.Duration
	// IDLen is the length of random portion of user-facing identifiers (i.e.,
	// SIDs and CSRF tokens). Note that the full identifier will be extended
	// with its HMAC (32 bytes) and base64url enconded.
	// Default if unspecified: 16 bytes
	IDLen int
	// SessionCookieName is the name of the session ID cookie set by Manager.
	// For example, together with a suitable definition of CreateCookie (see
	// below), this can be used to configure a secure cookie name prefix (e.g.,
	// "__Host-").
	// Default if unspecified: "session"
	SessionCookieName string
	// CreateCookie is a user-supplied factory for creating session ID cookies
	// with the provided name, value, and expiration. This is provided as a
	// convenience for granular control of cookie attributes, such as Path.
	// Default if unspecified: CreateStrictCookie
	CreateCookie func(name, value string, expires time.Time) *http.Cookie
	// OnCreate is a user-supplied callback invoked on session creation, with
	// the associated ResponseWriter instance and newly created Session. May be
	// used, e.g., to inject a CSRF Token cookie into the response.
	// Default if unspecified: nil, in which case OnCreate is not invoked.
	OnCreate func(w http.ResponseWriter, session any)
}

type Session[D any] struct {
	// ID is a random unique identifier (authenticated).
	ID string `json:"id"`
	// Data is an arbitrary data payload. Type D must meet any requirements of
	// the chosen SessionStore (e.g., must marshal to / from JSON).
	Data *D `json:"data"`
	// Expiration is the time after which this session is no longer valid.
	Expiration time.Time `json:"expiration"`
	// CSRFToken is a random identifier (authenticated) bound to this session,
	// suitable for, e.g., embedding in a hidden form field.
	CSRFToken string `json:"csrf_token"`
}