next -> main (1.0.0 milestone) (#105)

Accumulating milestone branch. One squashed commit per closed issue; `next` is kept green and mergeable to `main` at any time without notice.

Landed so far:

- `chore: update golangci-lint to v2.12.2 with canonical config` (#54) — canonical v2-schema `.golangci.yml`, pins bumped in `Dockerfile` and `script/bootstrap`, tree at `0 issues.`. Three behaviour deltas are recorded in that PR's body: `Cache.StoreVariant` takes a context, `MetadataStorage.Store` no longer leaks temp files on failure, and the `signing_key` too-short error text gained a `value too short:` prefix.

Sequencing for the milestone is tracked in #103.

Reviewed-on: #105
Co-authored-by: clawbot <clawbot@noreply.example.org>

internal/session/session_cookie_attributes_test.go

@@ -1,9 +1,11 @@
-package session
+package session_test
 
 import (
 	"net/http"
 	"net/http/httptest"
 	"testing"
+
+	"sneak.berlin/go/pixa/internal/session"
 )
 
 // TestSessionCookieAttributesAlwaysSecure verifies that every cookie
@@ -16,7 +18,9 @@ import (
 // This covers both cookie-writing paths: CreateSession (the login
 // set-cookie path) and ClearSession (the logout delete-cookie path).
 func TestSessionCookieAttributesAlwaysSecure(t *testing.T) {
-	mgr, err := NewManager("test-signing-key-12345")
+	t.Parallel()
+
+	mgr, err := session.NewManager("test-signing-key-12345")
 	if err != nil {
 		t.Fatalf("NewManager() error = %v", err)
 	}
@@ -29,7 +33,9 @@ func TestSessionCookieAttributesAlwaysSecure(t *testing.T) {
 			name: "CreateSession",
 			setCookie: func(t *testing.T, w http.ResponseWriter) {
 				t.Helper()
-				if err := mgr.CreateSession(w); err != nil {
+
+				err := mgr.CreateSession(w)
+				if err != nil {
 					t.Fatalf("CreateSession() error = %v", err)
 				}
 			},
@@ -45,12 +51,15 @@ func TestSessionCookieAttributesAlwaysSecure(t *testing.T) {
 
 	for _, writePath := range writePaths {
 		t.Run(writePath.name, func(t *testing.T) {
+			t.Parallel()
+
 			w := httptest.NewRecorder()
 			writePath.setCookie(t, w)
 
 			var sessionCookie *http.Cookie
+
 			for _, c := range w.Result().Cookies() {
-				if c.Name == CookieName {
+				if c.Name == session.CookieName {
 					sessionCookie = c
 
 					break
@@ -58,7 +67,7 @@ func TestSessionCookieAttributesAlwaysSecure(t *testing.T) {
 			}
 
 			if sessionCookie == nil {
-				t.Fatalf("no cookie named %q was set", CookieName)
+				t.Fatalf("no cookie named %q was set", session.CookieName)
 			}
 
 			t.Logf("cookie attributes: HttpOnly=%v Secure=%v SameSite=%v",