go-authcrunch: Skill for Codex

Authentication Portal Cookies

Ownership and Configuration

pkg/authn/cookie.Config and Factory own shared cookie names and attributes. configuration.go owns validation, cloning, the complete role list, and prefix changes. cookie_config.go owns the public suffix constants and defaults. OIDC and opaque refresh transports retain their own security and lifetime rules. The SAML browser-binding cookie retains its fixed cross-site callback security and five-minute lifetime independently of common attributes.

pkg/authn/cookie/parser.NewCookieConfigFromDirectives(statements []string) accepts complete cookie ... statements encoded with cfgutil.EncodeArgs, decodes them with cfgutil.DecodeArgs, and returns a validated *cookie.Config. Empty input returns ordinary defaults. Use (*authn.PortalConfig).ConfigureCookies(config) before runtime construction to install an independent snapshot. It replaces the complete cookie configuration, preserves unrelated portal settings, and leaves the portal unchanged on error. See directive grammar and application.

Names and Prefixes

Generated names use AUTHP_<SUFFIX> unless configuration specifies another prefix. Default...CookieName constants are suffixes, not complete names. Use cookie.NewConfig() or the effective factory fields when selecting a default; never issue or select bare SESSION_ID or ID_TOKEN as defaults.

NewConfig eagerly initializes every role. Assigning CookieNamePrefix directly is suitable only before default application on a fresh config literal. Use Config.SetCookieNamePrefix after initialization to update all omitted or previously defaulted names, including both OIDC names, without losing other overrides. Empty typed prefixes reset to AUTHP; empty directive values fail. An explicit name equal to the old default is indistinguishable from a generated name, so typed callers apply that override after changing the prefix. The parser applies the prefix before explicit names regardless of statement order.