feat: 完整游戏运维功能

platform/api/session_cookie.go

@@ -0,0 +1,48 @@
+package api
+
+import (
+	"net/http"
+	"strings"
+	"time"
+
+	"browser.local/platform/domain"
+	"browser.local/platform/dto"
+)
+
+const platformSessionCookieName = "platform_session"
+
+func (h *coreHandlers) writeAuthSession(w http.ResponseWriter, r *http.Request, session domain.AuthSession) {
+	response := dto.AuthSessionFromDomain(session)
+	if h.enforceAuthorization && strings.TrimSpace(session.SessionID) != "" {
+		h.setSessionCookie(w, r, session.SessionID, session.ExpiresAt)
+		if r.Header.Get("X-Auth-Token-Response") != "bearer" {
+			response.SessionID = ""
+		}
+	}
+	writeJSON(w, http.StatusOK, response)
+}
+
+func (h *coreHandlers) setSessionCookie(w http.ResponseWriter, r *http.Request, token string, expiresAt time.Time) {
+	http.SetCookie(w, &http.Cookie{
+		Name:     platformSessionCookieName,
+		Value:    token,
+		Path:     "/api/v1",
+		Expires:  expiresAt,
+		MaxAge:   int(time.Until(expiresAt).Seconds()),
+		HttpOnly: true,
+		Secure:   r.TLS != nil,
+		SameSite: http.SameSiteStrictMode,
+	})
+}
+
+func (h *coreHandlers) clearSessionCookie(w http.ResponseWriter, r *http.Request) {
+	http.SetCookie(w, &http.Cookie{
+		Name:     platformSessionCookieName,
+		Value:    "",
+		Path:     "/api/v1",
+		MaxAge:   -1,
+		HttpOnly: true,
+		Secure:   r.TLS != nil,
+		SameSite: http.SameSiteStrictMode,
+	})
+}