Session store: hash session ids into storage keys; publish the PostgreSQL schema (KOF22 integration) #24

Merged

james.maes merged 2 commits from kof22/session-codec-integration into develop 2026-11-07 00:17:38 +00:00

Conversation 0 Commits 2 Files Changed 14

+1639 -191

james.maes commented 2026-11-07 00:06:35 +00:00

Owner

Copy link

Copy source

The canonical session-store (develop and 0.1.0-RC.1) is missing behaviour the KOF22 application depends on and that production already runs:

• SessionCodec: storage keys are a SHA-256 of a domain-separated session id, so raw session ids are never stored or logged.
• StoredSessionSchema: the PostgreSQL DDL for the stored-session table (the host's schema-drift test needs it).
• the in-memory, Redis, shared-Redis and table-based providers and the stored-session metadata use them.

Without this, moving the host from its source-built copy to the published artifact would silently change session storage back to storing raw ids, and the host's SourceOnlyQbitsPostgresTest fails to compile.

Source and tests only; POM keeps develop's Core RC.22 / qbit-redis 0.1.0-RC.1 pins and adds the PostgreSQL test dependency and a UTC test JVM. Carried over from the earlier KOF22 integration with line endings normalised.

Co-Authored-By: Claude Sonnet 5.5 noreply@anthropic.com

The canonical session-store (develop and 0.1.0-RC.1) is missing behaviour the KOF22 application depends on and that production already runs: - **SessionCodec**: storage keys are a SHA-256 of a domain-separated session id, so raw session ids are never stored or logged. - **StoredSessionSchema**: the PostgreSQL DDL for the stored-session table (the host's schema-drift test needs it). - the in-memory, Redis, shared-Redis and table-based providers and the stored-session metadata use them. Without this, moving the host from its source-built copy to the published artifact would silently change session storage back to storing raw ids, and the host's SourceOnlyQbitsPostgresTest fails to compile. Source and tests only; POM keeps develop's Core RC.22 / qbit-redis 0.1.0-RC.1 pins and adds the PostgreSQL test dependency and a UTC test JVM. Carried over from the earlier KOF22 integration with line endings normalised. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

james.maes added 1 commit 2026-11-07 00:06:36 +00:00

feat: hash session ids into storage keys and publish the PostgreSQL schema (KOF22 session-store integration) ... 54e780e9f9

Brings the KOF22-validated session-store behaviour onto develop:

- SessionCodec derives the storage key from a SHA-256 of a domain-separated
  session id, so a raw session id is never stored or logged.
- StoredSessionSchema publishes the PostgreSQL DDL for the stored-session table.
- The in-memory, Redis, shared-Redis and table-based providers and the
  stored-session table metadata use them.
- Tests: SessionCodecTest, a PostgreSQL integration test for the table
  provider, and the fixture endpoint; the PostgreSQL test needs
  qqq-backend-module-postgres (test scope) and a UTC JVM.

Source and test changes only; the POM keeps develop's Core RC.22 and
qbit-redis 0.1.0-RC.1 pins.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

james.maes added 1 commit 2026-11-07 00:10:35 +00:00

build: keep the JaCoCo agent on the unit tests; run the PostgreSQL IT under a UTC JVM in failsafe ... 375cf053a1

The UTC argLine was set on surefire, replacing the argLine that jacoco prepare-agent
injects, so the unit tests ran without the agent and the class-coverage gate fell to
0.70 (min 0.80). The UTC setting belongs to failsafe, which runs the PostgreSQL IT;
it now appends to the jacoco argLine with @{argLine}, with an empty default property.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

james.maes merged commit b85b9555bf into develop 2026-11-07 00:17:38 +00:00

james.maes deleted branch kof22/session-codec-integration 2026-11-07 00:17:39 +00:00

james.maes referenced this pull request 2026-11-07 00:18:11 +00:00

Release 0.1: session-id hashing and PostgreSQL schema for the next RC #25

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

bug

Something isn't working

dependencies

documentation

Improvements or additions to documentation

duplicate

This issue or pull request already exists

enhancement

New feature or request

good first issue

Good for newcomers

help wanted

Extra attention is needed

invalid

This doesn't seem right

java

Pull requests that update java code

question

Further information is requested

release:rc

Merging this develop PR cuts the next release candidate

secuurity

wontfix

This will not be worked on

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

forge-recovery (Forge Recovery) james.maes (James Maes)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qbit-session-store#24