From 61c20f1450e326bcb2519d76f2658a3bee20af7d Mon Sep 17 00:00:00 2001
From: Antoine Bluchet <soyuka@users.noreply.github.com>
Date: Thu, 5 Mar 2026 00:07:49 +0100
Subject: [PATCH] fix(session): initialize data lazily in save() to prevent
 uninitialized property access (#252)

---
 src/Server/Session/Session.php            | 2 +-
 tests/Unit/Server/Session/SessionTest.php | 9 +++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/src/Server/Session/Session.php b/src/Server/Session/Session.php
index 3ca8d80..f777c22 100644
--- a/src/Server/Session/Session.php
+++ b/src/Server/Session/Session.php
@@ -51,7 +51,7 @@ class Session implements SessionInterface
 
     public function save(): bool
     {
-        return $this->store->write($this->id, json_encode($this->data, \JSON_THROW_ON_ERROR));
+        return $this->store->write($this->id, json_encode($this->readData(), \JSON_THROW_ON_ERROR));
     }
 
     public function get(string $key, mixed $default = null): mixed
diff --git a/tests/Unit/Server/Session/SessionTest.php b/tests/Unit/Server/Session/SessionTest.php
index 01e88bc..4d16e1a 100644
--- a/tests/Unit/Server/Session/SessionTest.php
+++ b/tests/Unit/Server/Session/SessionTest.php
@@ -34,6 +34,15 @@ class SessionTest extends TestCase
         $this->assertEquals(['foo' => 'bar'], $result);
     }
 
+    public function testSaveBeforeReadInitializesData()
+    {
+        $store = new InMemorySessionStore();
+        $session = new Session($store);
+
+        // save() before any get()/set() should not crash
+        $this->assertTrue($session->save());
+    }
+
     public function testAllReturnsEmptyArrayForNullPayload()
     {
         $store = $this->getMockBuilder(InMemorySessionStore::class)