diff --git a/internal/entity/auth_session_cache_test.go b/internal/entity/auth_session_cache_test.go
index 31da82ace..27500f326 100644
--- a/internal/entity/auth_session_cache_test.go
+++ b/internal/entity/auth_session_cache_test.go
@@ -2,6 +2,7 @@ package entity
 
 import (
 	"testing"
+	"time"
 
 	"github.com/photoprism/photoprism/pkg/rnd"
 
@@ -79,3 +80,70 @@ func TestFindSession(t *testing.T) {
 		}
 	})
 }
+
+func TestCacheSession(t *testing.T) {
+	t.Run("bob", func(t *testing.T) {
+		sessionCache.Flush()
+		r, b := sessionCache.Get("69be27ac5ca305b394046a83f6fda18167ca3d3f2dbe7ac1")
+		assert.Empty(t, r)
+		assert.False(t, b)
+		bob := FindSessionByRefID("sessxkkcabce")
+		CacheSession(bob, time.Hour)
+		r2, b2 := sessionCache.Get("69be27ac5ca305b394046a83f6fda18167ca3d3f2dbe7ac1")
+		assert.NotEmpty(t, r2)
+		assert.True(t, b2)
+		sessionCache.Flush()
+		r3, b3 := sessionCache.Get("69be27ac5ca305b394046a83f6fda18167ca3d3f2dbe7ac1")
+		assert.Empty(t, r3)
+		assert.False(t, b3)
+	})
+	t.Run("duration 0", func(t *testing.T) {
+		r, b := sessionCache.Get("69be27ac5ca305b394046a83f6fda18167ca3d3f2dbe7ac0")
+		assert.Empty(t, r)
+		assert.False(t, b)
+		alice := FindSessionByRefID("sessxkkcabcd")
+		CacheSession(alice, 0)
+		r2, b2 := sessionCache.Get("69be27ac5ca305b394046a83f6fda18167ca3d3f2dbe7ac0")
+		assert.NotEmpty(t, r2)
+		assert.True(t, b2)
+		sessionCache.Flush()
+	})
+	t.Run("invalid ID", func(t *testing.T) {
+		r, b := sessionCache.Get("xxx")
+		assert.Empty(t, r)
+		assert.False(t, b)
+		m := &Session{ID: "xxx"}
+		CacheSession(m, 0)
+		r2, b2 := sessionCache.Get("xxx")
+		assert.Empty(t, r2)
+		assert.False(t, b2)
+		sessionCache.Flush()
+	})
+}
+
+func TestDeleteSession(t *testing.T) {
+	m := &Session{ID: "77be27ac5ca305b394046a83f6fda18167ca3d3f2dbe7ac1", DownloadToken: "download123", PreviewToken: "preview123"}
+	CacheSession(m, time.Hour)
+	r, _ := sessionCache.Get("77be27ac5ca305b394046a83f6fda18167ca3d3f2dbe7ac1")
+	assert.NotEmpty(t, r)
+	DeleteSession(m)
+	r2, _ := sessionCache.Get("77be27ac5ca305b394046a83f6fda18167ca3d3f2dbe7ac1")
+	assert.Empty(t, r2)
+}
+
+func TestDeleteFromSessionCache(t *testing.T) {
+	sessionCache.Flush()
+	bob := FindSessionByRefID("sessxkkcabce")
+	CacheSession(bob, time.Hour)
+	r, b := sessionCache.Get("69be27ac5ca305b394046a83f6fda18167ca3d3f2dbe7ac1")
+	assert.NotEmpty(t, r)
+	assert.True(t, b)
+	DeleteFromSessionCache("")
+	r2, b2 := sessionCache.Get("69be27ac5ca305b394046a83f6fda18167ca3d3f2dbe7ac1")
+	assert.NotEmpty(t, r2)
+	assert.True(t, b2)
+	DeleteFromSessionCache("69be27ac5ca305b394046a83f6fda18167ca3d3f2dbe7ac1")
+	r3, b3 := sessionCache.Get("69be27ac5ca305b394046a83f6fda18167ca3d3f2dbe7ac1")
+	assert.Empty(t, r3)
+	assert.False(t, b3)
+}
diff --git a/internal/entity/auth_session_data_test.go b/internal/entity/auth_session_data_test.go
index 7896efa65..14edbf3e6 100644
--- a/internal/entity/auth_session_data_test.go
+++ b/internal/entity/auth_session_data_test.go
@@ -21,3 +21,24 @@ func TestData_HasShare(t *testing.T) {
 	assert.True(t, data.HasShare("def444"))
 	assert.False(t, data.HasShare("xxx"))
 }
+
+func TestSessionData_RedeemToken(t *testing.T) {
+	data := SessionData{Shares: []string{"abc123", "def444"}}
+	assert.True(t, data.HasShare("def444"))
+	assert.False(t, data.HasShare("at9lxuqxpogaaba8"))
+	data.RedeemToken("xxx")
+	assert.False(t, data.HasShare("xxx"))
+	data.RedeemToken("1jxf3jfn2k")
+	assert.True(t, data.HasShare("def444"))
+	assert.True(t, data.HasShare("at9lxuqxpogaaba8"))
+}
+
+func TestSessionData_SharedUIDs(t *testing.T) {
+	data := SessionData{Shares: []string{"abc123", "def444"},
+		Tokens: []string{"5jxf3jfn2k"}}
+	assert.Equal(t, "abc123", data.SharedUIDs()[0])
+	data2 := SessionData{Shares: []string{},
+		Tokens: []string{"5jxf3jfn2k"}}
+	assert.Equal(t, "ft2es39w45bnlqdw", data2.SharedUIDs()[0])
+
+}
diff --git a/internal/entity/auth_session_fixtures_test.go b/internal/entity/auth_session_fixtures_test.go
new file mode 100644
index 000000000..257024cce
--- /dev/null
+++ b/internal/entity/auth_session_fixtures_test.go
@@ -0,0 +1,39 @@
+package entity
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestSessionMap_Get(t *testing.T) {
+	t.Run("Alice", func(t *testing.T) {
+		r := SessionFixtures.Get("alice")
+		assert.Equal(t, "alice", r.UserName)
+		assert.Equal(t, "69be27ac5ca305b394046a83f6fda18167ca3d3f2dbe7ac0", r.ID)
+		assert.IsType(t, Session{}, r)
+	})
+
+	t.Run("Invalid", func(t *testing.T) {
+		r := SessionFixtures.Get("xxx")
+		assert.Equal(t, "", r.UserName)
+		assert.Equal(t, "", r.ID)
+		assert.IsType(t, Session{}, r)
+	})
+}
+
+func TestSessionMap_Pointer(t *testing.T) {
+	t.Run("Alice", func(t *testing.T) {
+		r := SessionFixtures.Pointer("alice")
+		assert.Equal(t, "69be27ac5ca305b394046a83f6fda18167ca3d3f2dbe7ac0", r.ID)
+		assert.Equal(t, "alice", r.UserName)
+		assert.IsType(t, &Session{}, r)
+	})
+
+	t.Run("Invalid", func(t *testing.T) {
+		r := SessionFixtures.Pointer("xxx")
+		assert.Equal(t, "", r.UserName)
+		assert.Equal(t, "", r.ID)
+		assert.IsType(t, &Session{}, r)
+	})
+}