From e5c4e0b89a6a921e752f9f24bade3a33e9967a21 Mon Sep 17 00:00:00 2001
From: Josh Creek <8179928+jcreek@users.noreply.github.com>
Date: Tue, 1 Sep 2026 14:04:10 +0100
Subject: [PATCH] fix(multiplayer): wire SessionIssuer in the real
 control-plane binary

Same pattern and same discovery method as the ResultSubmitter fix:
store.PostgresSessions already implements SessionIssuer.Issue (used by
steamSession() to mint sessions) as well as SessionBackend.Authenticate
(used to verify them), and was already wired for the latter -- but not
the former, so /v1/session/steam always 503'd with auth_unavailable
even before considering whether SteamLogin (the real, still-correctly-
unwired Steam blocker) was available. Wire it: same struct value,
second field.

Not independently visible via a black-box HTTP test yet -- SteamLogin
still nil means the handler's first guard clause still 503s before
ever reaching SessionIssuer, so the observable symptom is unchanged
until Steam access exists. Verified by reading the handler's actual
branch order, not by a test that would currently pass for the wrong
reason.
---
 server/cmd/control-plane/main.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/server/cmd/control-plane/main.go b/server/cmd/control-plane/main.go
index 71bed570..55136f73 100644
--- a/server/cmd/control-plane/main.go
+++ b/server/cmd/control-plane/main.go
@@ -83,6 +83,7 @@ func newAPIHandler(db *sql.DB, indexes ...api.CandidateIndex) http.Handler {
 	}
 	return (&api.Service{
 		SessionBackend:   store.PostgresSessions{DB: db},
+		SessionIssuer:    store.PostgresSessions{DB: db},
 		QueueBackend:     store.PostgresQueue{DB: db},
 		ProposalBackend:  api.ProposalProviderFromStore(db),
 		ProposalPromoter: api.ProposalPromoterFromStore(db),