simplify

src/tbd/auth/middleware.clj

@@ -10,15 +10,13 @@
   "Cookie-backed sessions (encrypted and signed, so nothing is stored server-side). Lax, not
   Strict: the OAuth callback is a cross-site redirect from Gitea and must still carry the
   cookie that holds the login `state`."
-  [config]
-  (let [store (cookie-store {:key (auth/session-key (:session-secret config))})]
-    (fn [handler]
-      (wrap-session handler {:store store
+  [handler config]
+  (wrap-session handler {:store (cookie-store {:key (auth/session-key (:session-secret config))})
                          :cookie-name "tbd-session"
                          :cookie-attrs {:http-only true
                                         :same-site :lax
                                         :secure (:secure-cookies? config)
-                                            :max-age (quot session-ttl-ms 1000)}}))))
+                                        :max-age (quot session-ttl-ms 1000)}}))
 
 (defn current-user
   "The logged-in user from the session, or nil when there is none or it has expired. The

src/tbd/core.clj

@@ -115,7 +115,7 @@
           (ring/create-default-handler)))
       wrap-head
       http/wrap-browser-viewable-edn
-      ((auth-mw/session-middleware auth))))
+      (auth-mw/session-middleware auth)))
 
 (def config
   {:auth (auth/env-config)