Method createSessionLocked

src/node/services/serverAuthService.ts:788–815

(opts?: {
    userAgent?: string;
    ipAddress?: string;
  })

  }

  private async createSessionLocked(opts?: {
    userAgent?: string;
    ipAddress?: string;
  }): Promise<Result<{ sessionId: string; sessionToken: string }, string>> {
    const sessionToken = crypto.randomBytes(32).toString("hex");
    const tokenHash = hashSessionToken(sessionToken);
    const now = Date.now();

    const userAgent = normalizeOptionalString(opts?.userAgent);
    const ipAddress = normalizeIpAddress(opts?.ipAddress);

    const session: PersistedServerAuthSession = {
      id: crypto.randomUUID(),
      tokenHash,
      createdAtMs: now,
      lastUsedAtMs: now,
      userAgent,
      ipAddress,
      label: buildSessionLabel(userAgent),
    };

    await using _lock = await this.sessionsMutex.acquire();
    const data = await this.loadPersistedSessionsLocked();
    data.sessions.push(session);
    await this.savePersistedSessionsLocked(data);

    return Ok({ sessionId: session.id, sessionToken });
  }

  private finishGithubDeviceFlow(
    flowId: string,