let server = PrismHTTPServer(port: 8080)

await server.use(PrismSessionMiddleware(
    secret: "your-secret-key-here"
))

let sessions = PrismSessionMiddleware(
    store: PrismMemorySessionStore(maxSessions: 50000, ttl: 7200),
    cookieName: "my_app_session",
    ttl: 7200,           // 2 hours
    secret: "change-me"  // Used for HMAC signing
)

await server.use(sessions)

await server.get("/preferences") { request in
    let cookies = request.cookies  // [String: String]
    let theme = cookies["theme"] ?? "light"
    let lang = cookies["lang"] ?? "en"
    return .json(["theme": theme, "lang": lang])
}

await server.post("/preferences") { request in
    let theme = request.formData["theme"] ?? "light"

    let cookie = PrismCookie(
        name: "theme",
        value: theme,
        path: "/",
        maxAge: 86400 * 365,  // 1 year
        secure: true,
        httpOnly: false,       // Accessible from JavaScript
        sameSite: .lax
    )

    var response = PrismHTTPResponse.json(["theme": theme])
    response.setCookie(cookie)
    return response
}

PrismCookie(
    name: "session",
    value: "abc123",
    path: "/",                  // Cookie path scope
    domain: "example.com",     // Cookie domain scope
    maxAge: 3600,              // Expires in 1 hour
    secure: true,              // HTTPS only
    httpOnly: true,            // No JavaScript access
    sameSite: .strict          // No cross-site sending
)

public protocol PrismSessionStore: Sendable {
    func load(id: String) async -> PrismSession?
    func save(_ session: PrismSession) async
    func destroy(id: String) async
}

actor DatabaseSessionStore: PrismSessionStore {
    let db: PrismDatabase

    func load(id: String) async -> PrismSession? {
        guard let row = try? await db.query(
            "SELECT data, expires_at FROM sessions WHERE id = ?",
            parameters: [.text(id)]
        ).first else { return nil }

        // Reconstruct session from row...
        return session
    }

    func save(_ session: PrismSession) async {
        try? await db.execute(
            "INSERT OR REPLACE INTO sessions (id, data, expires_at) VALUES (?, ?, ?)",
            parameters: [.text(session.id), .text(encoded), .text(expiry)]
        )
    }

    func destroy(id: String) async {
        try? await db.execute("DELETE FROM sessions WHERE id = ?", parameters: [.text(id)])
    }
}