kdlb9zs9n: Scaffold Next.js app and create the server session from a Minnect login

src/lib/session-store.ts

@@ -0,0 +1,48 @@
+import { randomBytes } from "node:crypto";
+
+// Server-side session store. The browser never sees any of this; it only holds
+// the opaque id (see cookie.ts). Keyed by a random 256-bit session id.
+//
+// NOTE: this is in-memory and per-process. It is fine for now but does not
+// survive a restart and is not shared across instances. A durable store
+// (e.g. Redis) is a later concern, tracked outside this task.
+
+export interface SessionPerson {
+  userId: string;
+  name: string;
+  email: string;
+  pictureUrl: string | null;
+}
+
+export interface SessionData {
+  profileAccessToken: string;
+  /** Epoch milliseconds when the profile access token expires, or null if unknown. */
+  profileAccessTokenExpiresAt: number | null;
+  profileRefreshToken: string;
+  feedAccessToken: string;
+  person: SessionPerson;
+  createdAt: number;
+}
+
+// Survive Next.js dev HMR by stashing the map on globalThis.
+const globalRef = globalThis as typeof globalThis & {
+  __mfbSessionStore?: Map<string, SessionData>;
+};
+
+const store: Map<string, SessionData> =
+  globalRef.__mfbSessionStore ?? new Map<string, SessionData>();
+globalRef.__mfbSessionStore = store;
+
+export function createSession(data: SessionData): string {
+  const id = randomBytes(32).toString("hex");
+  store.set(id, data);
+  return id;
+}
+
+export function getSession(id: string): SessionData | null {
+  return store.get(id) ?? null;
+}
+
+export function deleteSession(id: string): void {
+  store.delete(id);
+}