Add auto_regenerate option to CacheSessionPersistence

[michal-izewski]

Q	A
Documentation	yes
Bugfix	no
BC Break	no
New Feature	yes
RFC	no
QA	no

Description

Allow to turn off automatic session ID regeneration on each session data change.

• Why should it be added?
  • In some custom implementations (for example, when a session is shared between two or more backend applications written in different languages) there may be a need to handle session ID regeneration manually and allow session data to be changed without regenerating ID, it gives more flexibility of implementation.
• What will it enable?
  • Change allows to turn off automatic session ID regeneration when session data changes but leaves it on as a default behavior to keep BC

[gsteel]

Can you please add tests to cover behaviour when $autoRegenerate is false?

As this is similar to #44 but without the BC problems, I'll defer to @weierophinney for review.

Fixing the psalm issues in the factory will require verifying that $config['auto_regenerate'] is either bool | null, or adding assert(is_bool($autoRegenerate)) directly after the assignment.

[michal-izewski]

Can you please add tests to cover behaviour when $autoRegenerate is false?

As this is similar to #44 but without the BC problems, I'll defer to @weierophinney for review.

Fixing the psalm issues in the factory will require verifying that $config['auto_regenerate'] is either bool | null, or adding assert(is_bool($autoRegenerate)) directly after the assignment.

Thanks for the comment, I've updated both unit tests and the psalm baseline to cover the auto_regenerate option

[gsteel]

Thank you @michal-izewski - This looks good to me with a couple of minor tweaks 👍

[weierophinney]

One minor tweak suggested, to give a little more type certainty in the factory. Otherwise, this looks good! I'm happy with an opt-in solution for this; the regeneration was done for a defense-in-depth approach, but obviously there are cases where this is not desired. Leaving the default as regeneration will work well for this.

[weierophinney]

I'd cast this to boolean here (and do the same for $cookieSameSite while you're at it):

(bool) $cookieSameSite,
(bool) $autoRegenerate,

This will remove one more baseline item, and prevent some common errors.

[michal-izewski]

I've introduced type casting for all boolean arguments (as suggested) - $cookieSameSite is expected to be a string so I left it as is for now