# T01 — Session lifecycle

**Threat model.** An attacker with no session, or with a session that should
have ended, tries to act as a signed-in person.

**Slice.** `internal/auth/auth.go` (Middleware, bounceToLogin,
sessionPersonExists, endSession, LogoutHandler, LogoutCallbackHandler,
GetUserSession and the accessors), the session store wiring in
`internal/server/server.go`, and `internal/middleware/csrf.go` for cookie
attributes.

**Questions.**
1. Is the session identifier rotated when a person signs in, so a
   pre-authentication session id cannot be reused after login?
2. Does signing out destroy server-side session state, or only clear a cookie?
   Can the pre-logout session id still authenticate afterwards?
3. What are the session and CSRF cookie attributes actually set in production
   configuration, and can either be sent over plain HTTP?
4. Do the session cookie and the CSRF token expire together? If one outlives
   the other, what breaks?
5. Can any authenticated route be reached without the per-request person
   lookup running?

**Not in scope.** Role checks (T02). OIDC token handling (T06).