Add ability to set cookie max age - issue #91

session/core/session_manager.go

@@ -18,15 +18,16 @@ const (
 
 // SessionManager handles session creation, management and cleanup
 type SessionManager struct {
-	sessionPool  sync.Pool
-	store        sessions.Store
-	logger       Logger
-	chunkManager ChunkManager
-	cookieDomain string
-	cookiePrefix string // Prefix for cookie names (default: "_oidc_raczylo_")
-	cleanupMutex sync.RWMutex
-	forceHTTPS   bool
-	cleanupDone  bool
+	sessionPool   sync.Pool
+	store         sessions.Store
+	logger        Logger
+	chunkManager  ChunkManager
+	cookieDomain  string
+	cookiePrefix  string        // Prefix for cookie names (default: "_oidc_raczylo_")
+	sessionMaxAge time.Duration // Maximum session age (default: 24 hours)
+	cleanupMutex  sync.RWMutex
+	forceHTTPS    bool
+	cleanupDone   bool
 }
 
 // Logger interface for dependency injection
@@ -70,7 +71,7 @@ type SessionData interface {
 // NewSessionManager creates a new SessionManager instance with secure defaults.
 // It initializes the cookie store with encryption, sets up session pooling,
 // and configures chunk management for large tokens.
-func NewSessionManager(encryptionKey string, forceHTTPS bool, cookieDomain string, cookiePrefix string, logger Logger, chunkManager ChunkManager) (*SessionManager, error) {
+func NewSessionManager(encryptionKey string, forceHTTPS bool, cookieDomain string, cookiePrefix string, sessionMaxAge time.Duration, logger Logger, chunkManager ChunkManager) (*SessionManager, error) {
 	if len(encryptionKey) < minEncryptionKeyLength {
 		return nil, fmt.Errorf("encryption key must be at least %d bytes long", minEncryptionKeyLength)
 	}
@@ -80,13 +81,19 @@ func NewSessionManager(encryptionKey string, forceHTTPS bool, cookieDomain strin
 		cookiePrefix = "_oidc_raczylo_"
 	}
 
+	// Set default session max age if not provided (24 hours for backward compatibility)
+	if sessionMaxAge == 0 {
+		sessionMaxAge = absoluteSessionTimeout
+	}
+
 	sm := &SessionManager{
-		store:        sessions.NewCookieStore([]byte(encryptionKey)),
-		forceHTTPS:   forceHTTPS,
-		cookieDomain: cookieDomain,
-		cookiePrefix: cookiePrefix,
-		logger:       logger,
-		chunkManager: chunkManager,
+		store:         sessions.NewCookieStore([]byte(encryptionKey)),
+		forceHTTPS:    forceHTTPS,
+		cookieDomain:  cookieDomain,
+		cookiePrefix:  cookiePrefix,
+		sessionMaxAge: sessionMaxAge,
+		logger:        logger,
+		chunkManager:  chunkManager,
 	}
 
 	sm.sessionPool.New = func() interface{} {
@@ -322,7 +329,7 @@ func (sm *SessionManager) getSessionOptions(isSecure bool) *sessions.Options {
 	return &sessions.Options{
 		Path:     "/",
 		Domain:   sm.cookieDomain,
-		MaxAge:   int(absoluteSessionTimeout.Seconds()),
+		MaxAge:   int(sm.sessionMaxAge.Seconds()),
 		Secure:   isSecure,
 		HttpOnly: true,
 		SameSite: http.SameSiteLaxMode,