simplify

.gitignore

@@ -5,6 +5,9 @@ node_modules
 # Compiled UI (script/ui-build)
 resources/public/js
 .nrepl-port
+# clj-kondo / clojure-lsp caches
+.clj-kondo
+.lsp
 # Local SQLite databases (TODO_DB_PATH, OAUTH_DB_PATH)
 data
 # Local secrets (copy .env-template to .env)

src/tbd/auth/middleware.clj

@@ -10,15 +10,13 @@
   "Cookie-backed sessions (encrypted and signed, so nothing is stored server-side). Lax, not
   Strict: the OAuth callback is a cross-site redirect from Gitea and must still carry the
   cookie that holds the login `state`."
-  [config]
+  [handler config]
-  (let [store (cookie-store {:key (auth/session-key (:session-secret config))})]
+  (wrap-session handler {:store (cookie-store {:key (auth/session-key (:session-secret config))})
-    (fn [handler]
+                         :cookie-name "tbd-session"
-      (wrap-session handler {:store store
+                         :cookie-attrs {:http-only true
-                             :cookie-name "tbd-session"
+                                        :same-site :lax
-                             :cookie-attrs {:http-only true
+                                        :secure (:secure-cookies? config)
-                                            :same-site :lax
+                                        :max-age (quot session-ttl-ms 1000)}}))
-                                            :secure (:secure-cookies? config)
-                                            :max-age (quot session-ttl-ms 1000)}}))))
 
 (defn current-user
   "The logged-in user from the session, or nil when there is none or it has expired. The

src/tbd/core.clj

@@ -115,7 +115,7 @@
           (ring/create-default-handler)))
       wrap-head
       http/wrap-browser-viewable-edn
-      ((auth-mw/session-middleware auth))))
+      (auth-mw/session-middleware auth)))
 
 (def config
   {:auth (auth/env-config)