fix: send Set-Cookie when only the session cookie changes

[saadkhantareen]

Summary

Fixes #1002. When a handler extends an existing session by changing only the cookie (for example setting req.session.cookie.maxAge to a larger value, then calling req.session.touch() and req.session.save()), the response contains no Set-Cookie header, so the browser keeps the old expiry and the session is never actually extended client-side.

The session data hash used for change detection (hash()) deliberately ignores the cookie property, which is correct for save/resave decisions, but it also makes cookie-only changes invisible to shouldSetCookie(). For an existing session with rolling: false, the cookie was therefore only re-sent when the session data itself changed.

Changes

• index.js: snapshot a hash of the session cookie when the session is generated or inflated, and treat the cookie as modified when that snapshot no longer matches. shouldSetCookie() now also returns true for an existing session whose cookie changed during the request.
• The cookie hash is computed from cookie.data with expires excluded, because the expiry is refreshed by the automatic touch on every request and cannot take part in change detection. Changing maxAge still registers, since setting it updates originalMaxAge through the expires setter in session/cookie.js.
• test/session.js: regression tests covering the reported flow, plus a control test that an untouched session still receives no Set-Cookie.

Tests

• npm test — 175 passing, 0 failing (includes 2 new tests under "cookie option > .maxAge changed without modifying the session": "should set-cookie when only the cookie is extended and saved" and "should not set-cookie when nothing changed").
• The new positive test was verified to fail without the index.js change (AssertionError: should have a cookie header) and pass with it.
• npm run lint — clean.
• Manual reproduction of the scenario from Set cookie is not being passed in header when session is extended, due to which browser cookie is never extended #1002 (login, then a request that only extends cookie.maxAge to 24h, touches and saves): before the fix the second response had no Set-Cookie; after the fix it carries Set-Cookie with an expiry ~24 hours out.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.