fix: address branch review issues (json tags, share lockout, session expiry, file unlink)

internal/server/middleware.go

@@ -2,8 +2,11 @@ package server
 
 import (
 	"net/http"
+	"time"
 )
 
+const sessionMaxAge = 7 * 86400
+
 func (s *Server) requireAuth(next http.HandlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		cookie, err := r.Cookie("ydropbox_session")
@@ -13,7 +16,14 @@ func (s *Server) requireAuth(next http.HandlerFunc) http.HandlerFunc {
 		}
 
 		s.mu.Lock()
-		_, exists := s.sessions[cookie.Value]
+		createdAt, exists := s.sessions[cookie.Value]
+		if exists && time.Now().Unix()-createdAt > sessionMaxAge {
+			delete(s.sessions, cookie.Value)
+			exists = false
+		}
+		if exists {
+			s.sessions[cookie.Value] = time.Now().Unix()
+		}
 		s.mu.Unlock()
 
 		if !exists {
@@ -34,7 +44,14 @@ func (s *Server) requireAuthPage(next http.HandlerFunc) http.HandlerFunc {
 		}
 
 		s.mu.Lock()
-		_, exists := s.sessions[cookie.Value]
+		createdAt, exists := s.sessions[cookie.Value]
+		if exists && time.Now().Unix()-createdAt > sessionMaxAge {
+			delete(s.sessions, cookie.Value)
+			exists = false
+		}
+		if exists {
+			s.sessions[cookie.Value] = time.Now().Unix()
+		}
 		s.mu.Unlock()
 
 		if !exists {