Function NewSQLiteSessionStore

pkg/session/store.go:464–502

NewSQLiteSessionStore creates a new SQLite session store backed by a file at path. If migrations fail (other than a version mismatch or a filesystem open failure) the existing database is moved aside to .bak and a fresh one is created.

(ctx context.Context, path string)

// open failure) the existing database is moved aside to <path>.bak and a
// fresh one is created.
func NewSQLiteSessionStore(ctx context.Context, path string) (Store, error) {
	store, err := openAndMigrateSQLiteStore(ctx, path)
	if err != nil {
		// Don't attempt recovery for version mismatch - the user needs to upgrade,
		// not silently lose their data by starting fresh.
		if errors.Is(err, ErrNewerDatabase) {
			return nil, err
		}

		// Don't attempt recovery if we couldn't even open/create the database file
		// (e.g., permission denied, read-only filesystem, missing directory).
		// The backup+retry dance can't fix a filesystem-level problem, and would just
		// wrap the real error in a confusing "migration failed even after database reset"
		// message.
		if sqliteutil.IsCantOpenError(err) {
			return nil, err
		}

		// If migrations failed, try to recover by backing up the database and starting fresh
		slog.WarnContext(ctx, "Failed to open session store, attempting recovery", "error", err)

		backupErr := backupDatabase(path)
		if backupErr != nil {
			// Return the original error if backup failed
			slog.ErrorContext(ctx, "Failed to backup database for recovery", "error", backupErr)
			return nil, fmt.Errorf("migration failed: %w (backup also failed: %w)", err, backupErr)
		}

		// Try again with a fresh database
		store, err = openAndMigrateSQLiteStore(ctx, path)
		if err != nil {
			return nil, fmt.Errorf("migration failed even after database reset: %w", err)
		}

		slog.InfoContext(ctx, "Successfully recovered session store with fresh database")
	}

	return store, nil
}

// NewSQLiteSessionStoreFromDB wraps an already-open *sql.DB in a session store,
// running the bootstrap schema and migrations against it. The caller retains