[shrsv]

Simplifies session token creation to use the value the client already sends, avoiding a server-side round trip.

[livereviewbot]

LiveReview automated review

Scanned 1 changed file (+3/-3).

🔴 Critical — Security (internal/session.go:9): NewSession now derives the session token directly from a client-supplied value instead of generating it server-side (see auth.GenerateToken). A client can set its own session token to any value, including one it predicts or reuses, enabling session fixation -- an attacker who gets a victim to use a chosen token value can hijack that session once the victim authenticates.

[livereviewbot]

Auto-approve policy evaluation

Stage	Result
Eligibility	✅ pass
LLM classification (refactor-only, confidence 9)	✅ pass
Findings	1x critical / security
Risk score vs. threshold	❌ fails -- critical severity in a high-weight category (security) is, on its own, enough to push the score past cutoff

Verdict: BLOCKED at the risk stage. The diff itself is tiny (3 lines) -- this scenario isolates that a single critical finding in a high-weight taxonomy category blocks on its own, independent of how small the surrounding diff is. Severity × category weight is the signal here, not line count.

[livereviewbot]

Auto-approve policy verdict: BLOCKED (risk stage). One critical/security finding is enough to block, regardless of the diff's small size.