fix: preserve login session across refreshes

cmd/chfs/main.go

@@ -122,17 +122,30 @@ func main() {
 	} else if !filepath.IsAbs(userFile) {
 		userFile = filepath.Join(root, userFile)
 	}
+	if err := os.MkdirAll(filepath.Dir(userFile), 0700); err != nil {
+		log.Fatal(err)
+	}
 	users := &auth.UserStore{Path: userFile}
 	if err := users.Load(mgr, cfg.UserHome); err != nil {
 		log.Fatal(err)
 	}
 	jwtSecret := cfg.JWTSecret
 	if jwtSecret == "" {
-		buf := make([]byte, 32)
-		if _, err := rand.Read(buf); err != nil {
-			log.Fatal(err)
+		// Keep sessions valid across process restarts. A random in-memory secret
+		// would invalidate every login whenever the service is restarted.
+		secretPath := userFile + ".jwt-secret"
+		if saved, err := os.ReadFile(secretPath); err == nil && len(strings.TrimSpace(string(saved))) >= 32 {
+			jwtSecret = strings.TrimSpace(string(saved))
+		} else {
+			buf := make([]byte, 32)
+			if _, err := rand.Read(buf); err != nil {
+				log.Fatal(err)
+			}
+			jwtSecret = hex.EncodeToString(buf)
+			if err := os.WriteFile(secretPath, []byte(jwtSecret+"\n"), 0600); err != nil {
+				log.Printf("warning: could not persist JWT secret at %s: %v", secretPath, err)
+			}
 		}
-		jwtSecret = hex.EncodeToString(buf)
 	}
 	for _, a := range mgr.Accounts {
 		if a.Home != "" {