From 9daec9cc456e6fb47ee3b07516187e7b5722919b Mon Sep 17 00:00:00 2001
From: soyuka <soyuka@users.noreply.github.com>
Date: Wed, 4 Mar 2026 18:04:30 +0100
Subject: [PATCH] fix(session): initialize data lazily in save() to prevent
 uninitialized property access

---
 src/Server/Session/Session.php            | 2 +-
 tests/Unit/Server/Session/SessionTest.php | 9 +++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/src/Server/Session/Session.php b/src/Server/Session/Session.php
index 3ca8d808..f777c22b 100644
--- a/src/Server/Session/Session.php
+++ b/src/Server/Session/Session.php
@@ -51,7 +51,7 @@ public function getStore(): SessionStoreInterface
 
     public function save(): bool
     {
-        return $this->store->write($this->id, json_encode($this->data, \JSON_THROW_ON_ERROR));
+        return $this->store->write($this->id, json_encode($this->readData(), \JSON_THROW_ON_ERROR));
     }
 
     public function get(string $key, mixed $default = null): mixed
diff --git a/tests/Unit/Server/Session/SessionTest.php b/tests/Unit/Server/Session/SessionTest.php
index 01e88bc3..4d16e1a1 100644
--- a/tests/Unit/Server/Session/SessionTest.php
+++ b/tests/Unit/Server/Session/SessionTest.php
@@ -34,6 +34,15 @@ public function testAll()
         $this->assertEquals(['foo' => 'bar'], $result);
     }
 
+    public function testSaveBeforeReadInitializesData()
+    {
+        $store = new InMemorySessionStore();
+        $session = new Session($store);
+
+        // save() before any get()/set() should not crash
+        $this->assertTrue($session->save());
+    }
+
     public function testAllReturnsEmptyArrayForNullPayload()
     {
         $store = $this->getMockBuilder(InMemorySessionStore::class)