feat(backend): Discord OAuth login with DB-backed sessions (#23)

The browser UI signs in with a Discord authorization code grant
(identify + guilds.members.read) instead of a shared password. Guild
membership is the gate; the owner's Discord ID is the only identity
allowed in while registration is closed. Sessions become rows in a
sessions table with opaque random ids — the cookie carries only the id,
looked up and expiry-checked per request — so deleting a row revokes a
session. HMAC cookie signing, its derived key, and WEB_PASSWORD are
gone, and no replacement signing secret is introduced (ADR-0002).

Discord's API base is configurable (DISCORD_API_BASE); the full flow is
tested through the real router against a local stub, including the
form-encoded token exchange Discord rejects if sent as JSON.

backend/internal/session/session_test.go

@@ -9,66 +9,19 @@ import (
 	"time"
 )
 
-func TestSessionRoundTrip(t *testing.T) {
-	key := Key("token-abc", "pw-abc")
-	now := time.Now().UnixMilli()
-	value := Sign(key, now+60_000)
-	if !Verify(key, value, now) {
-		t.Fatal("Verify = false for a freshly signed cookie, want true")
+func TestNewID(t *testing.T) {
+	a := NewID()
+	b := NewID()
+	if a == b {
+		t.Fatal("NewID returned the same value twice")
 	}
-}
-
-func TestSessionRejects(t *testing.T) {
-	key := Key("token-abc", "pw-abc")
-	now := time.Now().UnixMilli()
-	valid := Sign(key, now+60_000)
-	payload, sig, _ := strings.Cut(valid, ".")
-
-	cases := []struct {
-		name  string
-		value string
-	}{
-		{"empty", ""},
-		{"no separator", payload + sig},
-		{"unparseable expiry", "notanumber." + sig},
-		{"expired", Sign(key, now-1)},
-		{"tampered signature", payload + "." + flipLastChar(sig)},
-		{"tampered expiry", "99999999999999." + sig},
-		{"signed with another key", Sign(Key("other-token", "pw-abc"), now+60_000)},
+	if len(a) != 64 { // 32 random bytes, hex
+		t.Fatalf("NewID() length = %d, want 64", len(a))
 	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			if Verify(key, tc.value, now) {
-				t.Fatalf("Verify(%q) = true, want false", tc.value)
-			}
-		})
-	}
-}
-
-func flipLastChar(s string) string {
-	if s == "" {
-		return "x"
-	}
-	last := s[len(s)-1]
-	if last == 'A' {
-		return s[:len(s)-1] + "B"
-	}
-	return s[:len(s)-1] + "A"
-}
-
-func TestSessionKeyDependsOnToken(t *testing.T) {
-	a := Key("token-a", "pw-abc")
-	b := Key("token-b", "pw-abc")
-	if string(a) == string(b) {
-		t.Fatal("Key collided for different API tokens")
-	}
-}
-
-func TestSessionKeyDependsOnWebPassword(t *testing.T) {
-	a := Key("token-abc", "pw-a")
-	b := Key("token-abc", "pw-b")
-	if string(a) == string(b) {
-		t.Fatal("Key collided for different web passwords with the same API token")
+	for _, r := range a {
+		if !strings.ContainsRune("0123456789abcdef", r) {
+			t.Fatalf("NewID() = %q, want hex", a)
+		}
 	}
 }
 
@@ -94,7 +47,7 @@ func TestSetSessionCookieAttributes(t *testing.T) {
 				r.Header.Set("X-Forwarded-Proto", tc.forwarded)
 			}
 			rr := httptest.NewRecorder()
-			SetCookie(rr, r, Key("token-abc", "pw-abc"))
+			SetCookie(rr, r, "abc123")
 
 			cookies := rr.Result().Cookies()
 			if len(cookies) != 1 {
@@ -104,6 +57,9 @@ func TestSetSessionCookieAttributes(t *testing.T) {
 			if c.Name != CookieName {
 				t.Fatalf("cookie name = %q, want %q", c.Name, CookieName)
 			}
+			if c.Value != "abc123" {
+				t.Fatalf("cookie value = %q, want the session id verbatim", c.Value)
+			}
 			if !c.HttpOnly {
 				t.Fatal("cookie HttpOnly = false, want true")
 			}
@@ -116,8 +72,8 @@ func TestSetSessionCookieAttributes(t *testing.T) {
 			if c.Secure != tc.wantSecure {
 				t.Fatalf("cookie Secure = %v, want %v", c.Secure, tc.wantSecure)
 			}
-			if c.MaxAge != int(sessionTTL/time.Second) {
-				t.Fatalf("cookie MaxAge = %d, want %d", c.MaxAge, int(sessionTTL/time.Second))
+			if c.MaxAge != int(SessionTTL/time.Second) {
+				t.Fatalf("cookie MaxAge = %d, want %d", c.MaxAge, int(SessionTTL/time.Second))
 			}
 		})
 	}