Phoenix Auth: test-friendly session and redirect flow
When auth logic gets hidden behind too many branches, the tests become fragile and the user experience starts to drift. I prefer to keep the current scope explicit, then let controllers and components read from that one source of truth.
That pattern makes it easier to reason about redirects, flash messages, and edge cases like sudo mode because the same state drives both the implementation and the expectations in tests.
- Keep the auth state in one place instead of branching across templates.
- Assert the exact flash and redirect path in tests so regressions are obvious.
- Prefer small helpers that make the controller flow easier to scan.