feat: implement B.1 — persist login sessions in SQLite with sliding idle timeout

Sessions move from an in-memory map (absolute 12h TTL) to a `sessions`
table (migration 0002), storing only the SHA-256 of the token. Expiry is
now a sliding idle window (PANEL_SESSION_IDLE_DAYS, default 7, no
absolute cap), extended at most once an hour and never by the
monitoring screens' background polling (GET + HX-Request), so a
forgotten open tab doesn't keep a session alive indefinitely. A login
now survives a container restart or redeploy.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

internal/web/session.go

@@ -1,68 +1,125 @@
 package web
 
 import (
-	"sync"
+	"crypto/sha256"
+	"encoding/hex"
 	"time"
+
+	"codeberg.org/mix/selfpost/internal/store"
 )
 
-// sessionTTL bounds how long a login lasts before re-authentication is needed.
-const sessionTTL = 12 * time.Hour
+// renewThreshold bounds how often an active session's expiry is written back
+// to the database. Renewing on every request would mean a write (and a new
+// Set-Cookie) per click; renewing at most once an hour keeps that cost low
+// while still keeping a busy admin's session alive indefinitely (plan B.1).
+const renewThreshold = time.Hour
 
-// sessionStore keeps active sessions in memory. Sessions are deliberately not
-// persisted (spec 9 lists what must survive restart; sessions are not on it):
-// a restart simply logs the admin out, which is acceptable and avoids storing
-// bearer tokens on disk. Tokens are crypto-random (spec 7.6.6).
+// sessionStore persists login sessions in the database (plan B.1): a login
+// survives a container restart or redeploy. Only the SHA-256 of the token is
+// stored, never the token itself (spec 7.6.6's crypto-random bearer token), so
+// a stolen database file or backup archive cannot be replayed as a session —
+// it only extends the login of whichever browser still holds the original
+// cookie.
 type sessionStore struct {
-	mu       sync.Mutex
-	sessions map[string]session
+	store *store.Store
+	// idle is the sliding inactivity window (PANEL_SESSION_IDLE_DAYS). There is
+	// no absolute cap: an administrator who keeps coming back stays signed in
+	// indefinitely, deliberately.
+	idle time.Duration
 }
 
-type session struct {
-	username  string
-	expiresAt time.Time
+func newSessionStore(st *store.Store, idle time.Duration) *sessionStore {
+	return &sessionStore{store: st, idle: idle}
 }
 
-func newSessionStore() *sessionStore {
-	return &sessionStore{sessions: make(map[string]session)}
+// MaxAge is the session cookie's Max-Age in seconds, kept equal to the
+// sliding idle window so the browser drops the cookie no later than the
+// server would have expired it anyway.
+func (s *sessionStore) MaxAge() int {
+	return int(s.idle.Seconds())
+}
+
+func hashToken(token string) string {
+	sum := sha256.Sum256([]byte(token))
+	return hex.EncodeToString(sum[:])
 }
 
 // Create issues a new session for username and returns its token.
 func (s *sessionStore) Create(username string) string {
 	token := randomToken(32)
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	s.sessions[token] = session{username: username, expiresAt: time.Now().Add(sessionTTL)}
+	now := time.Now()
+	if err := s.store.CreateSession(hashToken(token), username, now.Add(s.idle)); err != nil {
+		logf("panel: session: create failed: %v", err)
+	}
+	// Opportunistic cleanup: a session nobody ever came back to otherwise sits
+	// in the table forever. Piggybacking on Create (the one write every login
+	// already pays for) avoids a dedicated background sweep for what is, on a
+	// single-admin panel, a handful of rows at most.
+	if _, err := s.store.DeleteExpiredSessions(now); err != nil {
+		logf("panel: session: prune expired failed: %v", err)
+	}
 	return token
 }
 
-// Lookup returns the session username for a token if it exists and is unexpired.
+// Lookup returns the session username for a token if it exists and is
+// unexpired.
 func (s *sessionStore) Lookup(token string) (string, bool) {
 	if token == "" {
 		return "", false
 	}
+	hash := hashToken(token)
+	row, found, err := s.store.LookupSession(hash)
+	if err != nil {
+		logf("panel: session: lookup failed: %v", err)
+		return "", false
+	}
+	if !found {
+		return "", false
+	}
+	if time.Now().After(row.ExpiresAt) {
+		if err := s.store.DeleteSession(hash); err != nil {
+			logf("panel: session: delete expired failed: %v", err)
+		}
+		return "", false
+	}
+	return row.Username, true
+}
+
+// Touch extends a session's sliding expiry if it has been at least
+// renewThreshold since the last extension, and reports whether it did so —
+// the caller uses that to decide whether the response needs a fresh
+// Set-Cookie. It assumes the caller has just confirmed the session is valid
+// (e.g. via Lookup); it does nothing for a token that no longer exists.
+func (s *sessionStore) Touch(token string) bool {
+	hash := hashToken(token)
+	row, found, err := s.store.LookupSession(hash)
+	if err != nil {
+		logf("panel: session: touch lookup failed: %v", err)
+		return false
+	}
+	if !found {
+		return false
+	}
+	// expiresAt = lastRenewal + idle, so this recovers when the session was
+	// last extended without a separate column.
+	lastRenewal := row.ExpiresAt.Add(-s.idle)
 	now := time.Now()
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	sess, ok := s.sessions[token]
-	if !ok {
-		return "", false
+	if now.Sub(lastRenewal) < renewThreshold {
+		return false
 	}
-	if now.After(sess.expiresAt) {
-		delete(s.sessions, token)
-		return "", false
+	if err := s.store.RenewSession(hash, now.Add(s.idle)); err != nil {
+		logf("panel: session: renew failed: %v", err)
+		return false
 	}
-	return sess.username, true
+	return true
 }
 
 // Rename updates the username carried by a session, keeping its expiry. It is
-// used when the administrator renames their own account so the current session
-// keeps working under the new name.
+// used when the administrator renames their own account so the current
+// session keeps working under the new name.
 func (s *sessionStore) Rename(token, username string) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	if sess, ok := s.sessions[token]; ok {
-		sess.username = username
-		s.sessions[token] = sess
+	if err := s.store.RenameSession(hashToken(token), username); err != nil {
+		logf("panel: session: rename failed: %v", err)
 	}
 }
 
@@ -71,18 +128,14 @@ func (s *sessionStore) Rename(token, username string) {
 // password must stop working, while the admin performing the change stays
 // signed in.
 func (s *sessionStore) DestroyOthers(keep string) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	for token := range s.sessions {
-		if token != keep {
-			delete(s.sessions, token)
-		}
+	if err := s.store.DeleteOtherSessions(hashToken(keep)); err != nil {
+		logf("panel: session: destroy others failed: %v", err)
 	}
 }
 
 // Destroy invalidates a session token (logout).
 func (s *sessionStore) Destroy(token string) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	delete(s.sessions, token)
+	if err := s.store.DeleteSession(hashToken(token)); err != nil {
+		logf("panel: session: destroy failed: %v", err)
+	}
 }