changed cookie session store to valkey too

dev.compose.yml

···
 services:
+  postgres:
+    image: postgres:18
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: ${DB_USER}
+      POSTGRES_PASSWORD: ${DB_PASSWORD}
+      POSTGRES_DB: ${DB_NAME}
+    ports:
+      - "5432:5432"
+    volumes:
+      - postgres_data:/var/lib/postgresql
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    networks:
+      - services-network
   valkey:
     image: valkey/valkey:9.0
     ports:
···
       - services-network
 volumes:
   valkey_data:
-  app_data:
+  postgres_data:
 networks:
   services-network:
     driver: bridge

src/lib/server/cache.ts

···
         return undefined;
     }
 
-    async set(key: string, value: string) {
-        const expiryOptions = this.expire ?
+    async set(key: string, value: string, customExpire?: number) {
+        const expireSeconds = customExpire ?? this.expire;
+        const expiryOptions = expireSeconds ?
             {
                 expiry: {
                     type: TimeUnit.Seconds,
-                    count: this.expire as number
+                    count: expireSeconds
                 }
             } : undefined;
         return await this.valKeyClient.set(this.$key(key), value, expiryOptions);
···
 
     async delete(key: string) {
         await this.valKeyClient.del([this.$key(key)]);
+    }
+
+    async refreshExpiry(key: string, seconds: number) {
+        await this.valKeyClient.expire(this.$key(key), seconds);
     }
 
 }

src/lib/server/session.ts

···
 // A cookie session store based on https://lucia-auth.com/ examples which is recommended from Svelte's docs
-// Creates a cookie that links to a session store inside the database allowing the atproto oauth session to be loaded
+// Creates a cookie that links to a session store inside Valkey allowing the atproto oauth session to be loaded
 
-import { db } from './db';
 import { atpOAuthClient } from './atproto/client';
 import { encodeBase32LowerCaseNoPadding, encodeHexLowerCase } from '@oslojs/encoding';
 import { sha256 } from '@oslojs/crypto/sha2';
 import { DAY } from '@atproto/common';
-import { sessionStore } from '$lib/server/db/schema';
 import type { RequestEvent } from '@sveltejs/kit';
-import { eq } from 'drizzle-orm';
 import { Agent } from '@atproto/api';
 import type { NodeOAuthClient } from '@atproto/oauth-client-node';
 import { logger } from '$lib/server/logger';
+import { Cache, getAValKeyClient } from '$lib/server/cache';
+
+const COOKIE_SESSION_STORE = 'cookie_sessions:';
 
 export class SessionRestorationError extends Error {
     constructor(message: string) {
···
 // This is a sliding expiration for the cookie session. Can change it if you want it to be less or more.
 // The actual atproto session goes for a while if it's a confidential client as long as it's refreshed
 // https://atproto.com/specs/oauth#tokens-and-session-lifetime
-const DEFAULT_EXPIRY = 30 * DAY;
+const DEFAULT_EXPIRY_MS = 30 * DAY;
+const DEFAULT_EXPIRY_SECONDS = Math.floor(DEFAULT_EXPIRY_MS / 1000);
+
 
 const NULL_SESSION_RESPONSE = { atpAgent: null, did: null, handle: null };
 
+interface StoredSession {
+    did: string;
+    handle: string;
+    createdAt: number; // timestamp in milliseconds
+}
 
 export class Session {
-    db: typeof db;
+    cache: Cache;
     atpOAuthClient: NodeOAuthClient;
 
-    constructor(database: typeof db, oauthClient: NodeOAuthClient) {
-        this.db = database;
+    constructor(cache: Cache, oauthClient: NodeOAuthClient) {
+        this.cache = cache;
         this.atpOAuthClient = oauthClient;
     }
 
 
     async validateSessionToken(token: string): Promise<SessionValidationResult> {
         const sessionId = encodeHexLowerCase(sha256(new TextEncoder().encode(token)));
-        const result = await this.db.select().from(sessionStore).where(eq(sessionStore.id, sessionId)).limit(1);
-        if(result.length > 1){
-            throw new Error('Multiple sessions found for token. Should not happen');
-        }
-        if(result.length === 0){
-            return NULL_SESSION_RESPONSE;
-        }
-        const session = result[0];
+        const sessionData = await this.cache.get(sessionId);
 
-        if (Date.now() >= session.expiresAt.getTime()) {
-            await this.invalidateSession(session.id);
-            logger.warn(`Session expired for the did: ${session.did}`);
+        // If session doesn't exist or has expired, Valkey returns undefined
+        if (!sessionData) {
             return NULL_SESSION_RESPONSE;
         }
-        if (Date.now() >= session.expiresAt.getTime() - 1000 * 60 * 60 * 24 * 15) {
-            session.expiresAt = new Date(Date.now() + DEFAULT_EXPIRY);
-            await this.db.update(sessionStore).set(session).where(eq(sessionStore.id, sessionId));
-        }
-        try{
+
+        const session: StoredSession = JSON.parse(sessionData);
+
+        // Refresh TTL on each access (sliding window)
+        await this.cache.refreshExpiry(sessionId, DEFAULT_EXPIRY_SECONDS);
+
+        try {
             const oAuthSession = await this.atpOAuthClient.restore(session.did);
-
             const agent = new Agent(oAuthSession);
             return { atpAgent: agent, did: session.did, handle: session.handle };
-        }catch (err){
+        } catch (err) {
             const errorMessage = (err as Error).message;
             logger.warn(`Error restoring session for did: ${session.did}, error: ${errorMessage}`);
-            //Counting any error when restoring a session as a failed session resume and deleting the users web browser session
+            //Counting any error when restoring a session as a failed session resume and deleting the user's web browser session
             //You can go further and capture different types of errors
-            await this.invalidateUserSessions(session.did);
+            await this.invalidateSession(sessionId);
             throw new SessionRestorationError(`Failed to restore your session: ${errorMessage}. Please log in again.`);
         }
     }
 
-    private setSessionTokenCookie(event: RequestEvent, token: string, expiresAt: Date): void {
+    private setSessionTokenCookie(event: RequestEvent, token: string): void {
         event.cookies.set('session', token, {
             httpOnly: true,
             path: '/',
             secure: import.meta.env.PROD,
             sameSite: 'lax',
-            expires: expiresAt
+            maxAge: DEFAULT_EXPIRY_SECONDS
         });
     }
 
···
     }
 
     async invalidateSession(sessionId: string) {
-        await this.db.delete(sessionStore).where(eq(sessionStore.id, sessionId));
+        await this.cache.delete(sessionId);
     }
 
     async invalidateSessionByToken(token: string) {
···
         await this.invalidateSession(sessionId);
     }
 
-    async invalidateUserSessions(did: string) {
-        await this.db.delete(sessionStore).where(eq(sessionStore.did, did));
-    }
-
     private async createSession(token: string, did: string, handle: string) {
         const sessionId = encodeHexLowerCase(sha256(new TextEncoder().encode(token)));
-        const expiresAt = new Date(Date.now() + DEFAULT_EXPIRY);
-        const session = { id: sessionId, did, handle, expiresAt, createdAt: new Date() };
-        await this.db.insert(sessionStore).values(session);
+        const session: StoredSession = {
+            did,
+            handle,
+            createdAt: Date.now()
+        };
+        // Set with TTL - Valkey will automatically expire after DEFAULT_EXPIRY_SECONDS
+        await this.cache.set(sessionId, JSON.stringify(session), DEFAULT_EXPIRY_SECONDS);
         return session;
     }
 
···
     async createAndSetSession(event: RequestEvent, did: string, handle: string) {
         const token = this.generateSessionToken();
         const session = await this.createSession(token, did, handle);
-        this.setSessionTokenCookie(event, token, session.expiresAt);
+        this.setSessionTokenCookie(event, token);
         return session;
     }
 
···
 export const getSessionManager = async (): Promise<Session> => {
     if (!sessionManager) {
         sessionManager = (async () => {
+            const valKeyClient = await getAValKeyClient();
+            const cache = new Cache(valKeyClient, COOKIE_SESSION_STORE);
             const client = await atpOAuthClient();
-            return new Session(db, client);
+            return new Session(cache, client);
         })();
     }
     return sessionManager;

src/routes/logout/+page.server.ts

···
             sessionManager.deleteSessionTokenCookie(event);
 
             const oauthClient = await atpOAuthClient();
-            if(event.locals.did) {
-                await oauthClient.revoke(event.locals.did);
+            if(event.locals.session?.did) {
+                await oauthClient.revoke(event.locals.session.did);
             }
         }