Method createAuthSession

internal/server/handlers_auth.go:331–352

(w http.ResponseWriter, r *http.Request, user *models.User, ttl time.Duration)

}

func (s *Server) createAuthSession(w http.ResponseWriter, r *http.Request, user *models.User, ttl time.Duration) (string, error) {
	token, err := s.store.CreateSession(user.ID, "web", clientIP(r), r.UserAgent(), ttl)
	if err != nil {
		writeError(w, http.StatusInternalServerError, "internal_error", "Failed to create session")
		return "", err
	}

	http.SetCookie(w, &http.Cookie{
		Name:     sessionCookieName(s.secureCookies),
		Value:    token,
		Path:     "/",
		MaxAge:   int(ttl.Seconds()),
		HttpOnly: true,
		Secure:   s.secureCookies,
		SameSite: http.SameSiteLaxMode,
	})

	// Set CSRF cookie alongside the session cookie
	setCSRFCookie(w, int(ttl.Seconds()), s.secureCookies)

	return token, nil
}

// handleBootstrap creates the first admin account for a fresh instance.
//