fix(session): reuse cookie ID when session storage is empty

When a browser sends a session cookie but storage has been cleared,
the framework now reuses the existing cookie ID for the new session
instead of generating a new one. This prevents the infinite
new-session loop where the browser perpetually sends the old cookie.

- Session::start() only regenerates ID when status is KILLED
- SessionManager::start() passes cookie ID to new session

Closes #389
Closes #388

Author: Ibrahim BinAlshikh

WebFiori/Framework/Session/Session.php

@@ -668,9 +668,11 @@ public function start() {
         if (!$this->isRunning()) {
             $sessionStr = SessionsManager::getStorage()->read($this->getId());
 
-            if ($this->getStatus() == SessionStatus::KILLED || $sessionStr === null || !$this->deserialize($sessionStr)) {
+            if ($this->getStatus() == SessionStatus::KILLED) {
                 $this->reGenerateID();
                 $this->initNewSessionVars();
+            } else if ($sessionStr === null || !$this->deserialize($sessionStr)) {
+                $this->initNewSessionVars();
             } else {
                 $this->checkIfExpired();
             }

WebFiori/Framework/Session/SessionManager.php

@@ -385,6 +385,13 @@ public function start(string $sessionName, array $options = []): void {
 
         if (!$this->hasSession($sessionName)) {
             $options[SessionOption::NAME] = $sessionName;
+
+            $cookieId = $this->getSessionIDFromRequest($sessionName);
+
+            if ($cookieId !== false && !isset($options[SessionOption::SESSION_ID])) {
+                $options[SessionOption::SESSION_ID] = $cookieId;
+            }
+
             $s = new Session($options);
             $s->start();
             $this->sessionsArr[] = $s;

tests/WebFiori/Framework/Tests/Session/SessionsManagerTest.php

@@ -567,4 +567,37 @@ public function testFacadePauseAll() {
     public function testGetSessionIDFromCookieNotSet() {
         $this->assertFalse(SessionsManager::getSessionIDFromCookie('nonexistent'));
     }
+
+    /**
+     * @test
+     * Verifies bug #389: When a session cookie exists but storage is empty,
+     * the framework should reuse the cookie ID instead of generating a new one.
+     */
+    public function testReuseCookieIdWhenStorageEmpty() {
+        SessionsManager::reset();
+        App::getRequest()->setRequestMethod('GET');
+
+        // Simulate: browser has a session cookie with ID 'old-session-id-abc'
+        $sessionName = 'wf-test-session';
+        $_GET[$sessionName] = 'old-session-id-abc';
+
+        // Storage is empty (no session data for this ID — simulates cleared storage)
+        // Start the session
+        SessionsManager::start($sessionName);
+
+        $active = SessionsManager::getActiveSession();
+        $this->assertNotNull($active);
+
+        // BUG: The session should reuse 'old-session-id-abc' from the cookie,
+        // not generate a brand new ID
+        $this->assertEquals(
+            'old-session-id-abc',
+            $active->getId(),
+            'Session ID should match the cookie value when storage is empty (bug #389)'
+        );
+
+        // Cleanup
+        SessionsManager::reset();
+        unset($_GET[$sessionName]);
+    }
 }