feat: persist authenticated sessions

server/store/session_sql_test.go

@@ -0,0 +1,33 @@
+package store
+
+import (
+	"testing"
+	"time"
+)
+
+func TestSessionSQLStoresDigestAndEnforcesRevocationBoundary(t *testing.T) {
+	for query, fragments := range map[string][]string{
+		SessionInsertSQL: {"token_digest", "expires_at", "created_at"},
+		SessionSelectSQL: {"token_digest", "revoked_at", "WHERE session_id = $1"},
+		SessionRevokeSQL: {"COALESCE(revoked_at", "WHERE session_id = $1"},
+	} {
+		for _, fragment := range fragments {
+			if !contains(query, fragment) {
+				t.Fatalf("query %q missing %q", query, fragment)
+			}
+		}
+	}
+}
+
+func TestPostgresSessionsRejectsInvalidArgumentsWithoutDatabase(t *testing.T) {
+	sessions := PostgresSessions{}
+	if _, _, err := sessions.Issue(nil, "player-1", time.Minute, time.Unix(1000, 0)); err == nil {
+		t.Fatal("invalid issue accepted")
+	}
+	if _, err := sessions.Authenticate(nil, "session-1", "token-1", time.Unix(1000, 0)); err == nil {
+		t.Fatal("invalid authentication accepted")
+	}
+	if err := sessions.Revoke(nil, "session-1", time.Unix(1000, 0)); err == nil {
+		t.Fatal("invalid revoke accepted")
+	}
+}