Deploy main eacf1e7 to prod

Replaces #559, which conflicted.

Model: opus-5-5

internal/session/export_test.go

@@ -1,6 +1,12 @@
 package session
 
-import "github.com/gorilla/sessions"
+import (
+	"log/slog"
+	"time"
+
+	"github.com/gorilla/sessions"
+	"sneak.berlin/go/webhooker/internal/config"
+)
 
 // NewStore exposes the production cookie-store constructor so tests
 // exercise the store the application actually runs with, rather than a
@@ -8,3 +14,32 @@ import "github.com/gorilla/sessions"
 func NewStore(key []byte) *sessions.CookieStore {
 	return newStore(key)
 }
+
+// NewForTest creates a Session with a pre-configured cookie store for use
+// in tests. This bypasses the fx lifecycle and database dependency. The key
+// parameter is the raw 32-byte authentication key used for session encryption
+// and CSRF cookie signing.
+//
+// The idle timeout is taken from cfg.SessionIdleTimeout, exactly as in
+// production. The now parameter supplies the clock used for expiry
+// checks so tests can advance time without sleeping; pass nil for the
+// real clock.
+func NewForTest(
+	store *sessions.CookieStore,
+	cfg *config.Config,
+	log *slog.Logger,
+	key []byte,
+	now func() time.Time,
+) *Session {
+	if now == nil {
+		now = time.Now
+	}
+
+	return &Session{
+		store:       store,
+		key:         key,
+		log:         log,
+		idleTimeout: cfg.SessionIdleTimeout,
+		now:         now,
+	}
+}

internal/session/session.go

@@ -16,7 +16,6 @@ import (
 	"go.uber.org/fx"
 	"sneak.berlin/go/webhooker/internal/config"
 	"sneak.berlin/go/webhooker/internal/database"
-	"sneak.berlin/go/webhooker/internal/logger"
 	"sneak.berlin/go/webhooker/internal/reqtls"
 )
 
@@ -80,7 +79,7 @@ type Params struct {
 
 	Config   *config.Config
 	Database *database.Database
-	Logger   *logger.Logger
+	Logger   *slog.Logger
 }
 
 // Session manages encrypted session storage.
@@ -180,7 +179,7 @@ func New(
 	params Params,
 ) (*Session, error) {
 	s := &Session{
-		log:         params.Logger.Get(),
+		log:         params.Logger,
 		idleTimeout: params.Config.SessionIdleTimeout,
 		now:         time.Now,
 	}
@@ -442,10 +441,9 @@ func (s *Session) Regenerate(
 //
 // Whichever comes first ends the session.
 //
-// A session that claims to be authenticated but carries no
-// timestamps predates this check; it is treated as expired so the
-// user re-authenticates rather than being granted an unbounded
-// session.
+// A session that claims to be authenticated but lacks the timestamp
+// a deadline is measured from is treated as expired, so the user
+// re-authenticates rather than being granted an unbounded session.
 func (s *Session) expired(sess *sessions.Session) bool {
 	now := s.now()
 

internal/session/testing.go

@@ -1,39 +0,0 @@
-package session
-
-import (
-	"log/slog"
-	"time"
-
-	"github.com/gorilla/sessions"
-	"sneak.berlin/go/webhooker/internal/config"
-)
-
-// NewForTest creates a Session with a pre-configured cookie store for use
-// in tests. This bypasses the fx lifecycle and database dependency, allowing
-// middleware and handler tests to use real session functionality. The key
-// parameter is the raw 32-byte authentication key used for session encryption
-// and CSRF cookie signing.
-//
-// The idle timeout is taken from cfg.SessionIdleTimeout, exactly as in
-// production. The now parameter supplies the clock used for expiry
-// checks so tests can advance time without sleeping; pass nil for the
-// real clock.
-func NewForTest(
-	store *sessions.CookieStore,
-	cfg *config.Config,
-	log *slog.Logger,
-	key []byte,
-	now func() time.Time,
-) *Session {
-	if now == nil {
-		now = time.Now
-	}
-
-	return &Session{
-		store:       store,
-		key:         key,
-		log:         log,
-		idleTimeout: cfg.SessionIdleTimeout,
-		now:         now,
-	}
-}