module Roda::RodaPlugins::Sessions::RequestMethods

def _deserialize_rack_session(data)
  opts = roda_class.opts[:sessions]
  key = opts[:upgrade_from_rack_session_cookie_key]
  secret = opts[:upgrade_from_rack_session_cookie_secret]
  data, digest = data.split("--", 2)
  unless digest
    return _session_serialization_error("Not decoding Rack::Session::Cookie session: invalid format")
  end
  unless Rack::Utils.secure_compare(digest, OpenSSL::HMAC.hexdigest(OpenSSL::Digest::SHA1.new, opts[:upgrade_from_rack_session_cookie_secret], data))
    return _session_serialization_error("Not decoding Rack::Session::Cookie session: HMAC invalid")
  end
  begin
    session = Marshal.load(data.unpack('m').first)
  rescue
    return _session_serialization_error("Error decoding Rack::Session::Cookie session: not base64 encoded marshal dump")
  end
  # Mark rack session cookie for deletion on success
  env[SESSION_DELETE_RACK_COOKIE] = true
  # Convert the rack session by roundtripping it through
  # the parser and serializer, so that you would get the
  # same result as you would if the session was handled
  # by this plugin.
  env[SESSION_SERIALIZED] = data = opts[:serializer].call(session)
  env[SESSION_CREATED_AT] = Time.now.to_i
  opts[:parser].call(data)
end