Mutare.Plug.Session (mutare_plug v0.1.0)

Copy Markdown View Source

:plug_session — removes Plug.Conn session mutations. A surviving mutant means no test depends on this code writing, deleting, clearing, or reconfiguring session state.

put_session(conn, :user_id, user.id)      # → conn
conn |> delete_session(:user_id)          # → conn |> Function.identity()
clear_session(conn)                       # → conn
configure_session(conn, renew: true)      # → conn

Removing configure_session(conn, renew: true) on login is the classic session-fixation bypass (the session id survives authentication); removing configure_session(conn, drop: true) on logout is its twin (the session survives sign-out). A survivor here means no test pins that lifecycle behaviour.

Matches put_session/3, delete_session/2, clear_session/1, and configure_session/2 written directly (Plug.Conn.put_session(conn, ...)), aliased, or bare-imported. The boolean option values inside configure_session/2 are still left to Mutare's built-in boolean mutators; this family owns only the call's presence.