[usernane]

Summary

Migrate the full per-key session state to the new ID inside reGenerateID() so regenerating the session ID during a request no longer orphans data.

Motivation

reGenerateID() only changed the session cookie value; it did not migrate any per-key rows to the new ID. In the standard session-fixation login flow — reGenerateID() then setUser() without a close() before the request ends (the start-session middleware's afterSend() only calls validateStorage()) — the new ID ended up with only the eagerly-written _user key, while _meta, the user's companion state and all previously stored application keys stayed under the old ID. On the next request, start() reads _meta for the new ID, finds null, treats it as a brand-new session and loses the authenticated user and all session data. Fixes #422 (follow-up to the #418 user-persistence fix).

Changes

• Session::reGenerateID() now migrates the entire session state to the new ID:
  1. Snapshot all rows under the old ID via readAll(), decrypting each value with the old ID (_meta is a plain array and is copied as-is).
  2. Switch the cookie to the new ID.
  3. Re-write every key under the new ID, re-encrypting with the new ID (encryption is keyed by session ID, so raw values can't be copied directly).
  4. destroy() the old ID's rows so no orphaned/duplicate state remains.

UI Changes

Not applicable.

How to Test / Verify

New regression test in tests/WebFiori/Framework/Tests/Session/SessionTest.php:

• testSessionStateSurvivesRegenerateIdWithoutClose — sets custom keys (csrf, cart, lang_pref), runs reGenerateID() then setUser() with no close(), resumes the new ID, and asserts the user AND all custom keys survive, and that getVars() excludes reserved keys.

Verified the related session tests together (user persistence, reserved-key guards, and this regression): 4 tests / 32 assertions passing. The regression test fails on the pre-fix code and passes after.

Breaking Changes and Migration Steps

None. This only changes internal behavior of reGenerateID() to preserve state that previously would have been lost.

Checklist

• I reviewed my own diff before requesting review
• My commits follow Conventional Commits
• I added/updated tests (or explained why not)
• I updated docs (if needed) Docs Repo
• I considered backward compatibility
• I considered security

Related issues

Closes #422

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.94%. Comparing base (1517dd3) to head (971c662).
⚠️ Report is 7 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff              @@
##               main     #423      +/-   ##
============================================
+ Coverage     81.75%   81.94%   +0.19%     
- Complexity     3288     3293       +5     
============================================
  Files           106      106              
  Lines          9721     9735      +14     
============================================
+ Hits           7947     7977      +30     
+ Misses         1774     1758      -16     

Flag	Coverage Δ
php-8.1	80.80% <100.00%> (+0.22%)	⬆️
php-8.2	80.80% <100.00%> (+0.22%)	⬆️
php-8.3	89.18% <100.00%> (+0.22%)	⬆️
php-8.4	89.18% <100.00%> (+0.22%)	⬆️
php-8.5	89.07% <100.00%> (+0.22%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.