First commit, phased 1 and 2 created but untested

src/middleware/session.js

@@ -0,0 +1,50 @@
+const session = require('express-session');
+const SessionStore = require('better-sqlite3-session-store')(session);
+const config = require('../config');
+const { getDb } = require('../db');
+const { AppError } = require('../utils/errors');
+
+function createSessionMiddleware() {
+  const db = getDb();
+
+  return session({
+    store: new SessionStore({
+      client: db,
+      table: 'sessions',
+      expired: {
+        clear: true,
+        intervalMs: 900000, // 15 min cleanup
+      },
+    }),
+    secret: config.sessionSecret,
+    resave: false,
+    saveUninitialized: false,
+    cookie: {
+      httpOnly: true,
+      sameSite: 'lax',
+      maxAge: 7 * 24 * 60 * 60 * 1000, // 7 days
+      secure: config.nodeEnv === 'production',
+    },
+    name: 'emberfall_session',
+    rolling: true,
+  });
+}
+
+function requireAuth(req, res, next) {
+  if (!req.session || !req.session.userId) {
+    // Return JSON error for API requests
+    if (req.path.startsWith('/api/') || req.xhr) {
+      return res.status(401).json({
+        error: {
+          code: 'UNAUTHENTICATED',
+          message: 'Authentication required.',
+        },
+      });
+    }
+    // Redirect to login for page requests
+    return res.redirect('/login.html');
+  }
+  next();
+}
+
+module.exports = { createSessionMiddleware, requireAuth };