Add user session management and auditing

modules/session/store.go

@@ -22,6 +22,24 @@ type mockStoreContextKeyStruct struct{}
 
 var MockStoreContextKey = mockStoreContextKeyStruct{}
 
+// globalProvider holds a reference to the active VirtualSessionProvider
+// so we can destroy sessions by ID without needing the http request/response.
+var globalProvider *VirtualSessionProvider
+
+// SetGlobalProvider stores the active session provider for use by DestroySessionByID.
+func SetGlobalProvider(p *VirtualSessionProvider) {
+	globalProvider = p
+}
+
+// DestroySessionByID destroys a session by its ID through the underlying provider.
+// This works regardless of which session backend is configured (file, db, redis, etc).
+func DestroySessionByID(sid string) error {
+	if globalProvider == nil {
+		return nil
+	}
+	return globalProvider.Destroy(sid)
+}
+
 // RegenerateSession regenerates the underlying session and returns the new store
 func RegenerateSession(resp http.ResponseWriter, req *http.Request) (Store, error) {
 	for _, f := range BeforeRegenerateSession {