Skip check_session_expiry in SessionsController

[JuanVqz]

Problem

SessionsController skipped check_user_token but not check_session_expiry, leaving a gap in the auth filter setup. Both callbacks are defined in ApplicationController and both need to be skipped on the OAuth endpoint:

class SessionsController < ApplicationController
  skip_before_action :check_user_token
  # check_session_expiry was NOT skipped

As a result, a user whose session had expired would hit check_session_expiry before reaching SessionsController#create. The callback resets the session and renders puzzles/login, so the OAuth flow never completes — the user can't log back in.

This is a particularly bad failure mode: it's triggered exactly when the user needs to re-authenticate, making it impossible to recover a session through normal login.

Fix

Add the missing skip_before_action alongside the existing one:

class SessionsController < ApplicationController
  skip_before_action :check_user_token
  skip_before_action :check_session_expiry

Test

The test signs in (establishing a session with expires_at), then uses travel_to to jump 2 hours into the future so the session is expired. A second sign-in attempt then asserts a redirect to root_path, confirming the OAuth callback completes instead of being blocked.

travel_to 2.hours.from_now do
  sign_in
  assert_redirected_to root_path
end

[JuanVqz]

Superseded by #71 which addresses this and three other related bugs with a more robust design.