iron-session 1.0.3 → 2.0.0-alpha.10

package/LICENSE

@@ -1,9 +1,21 @@
 MIT License
 
-Copyright (c) CodeAgain SASU
+Copyright (c) 2021 Vincent Voyer
 
-Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
 
-The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,114 +1,103 @@
-# iron-session [![GitHub license](https://img.shields.io/github/license/vvo/iron-session?style=flat)](https://github.com/vvo/iron-session/blob/master/LICENSE) ![Tests](https://github.com/vvo/iron-session/workflows/Tests/badge.svg) [![codecov](https://codecov.io/gh/vvo/iron-session/branch/master/graph/badge.svg)](https://codecov.io/gh/vvo/iron-session) ![npm](https://img.shields.io/npm/v/iron-session)
+# TSDX User Guide
 
-**This JavaScript backend utility** allows you to create a session to then be stored in browser cookies via a signed and encrypted token value. This provides client sessions that are ⚒️ iron-strong.
+Congrats! You just saved yourself hours of work by bootstrapping this project with TSDX. Let’s get you oriented with what’s here and how to use it.
 
-The token stored on the client contains the session data, not your server, making it a "stateless" session from the server point of view. The token is signed and encrypted using [@hapi/iron](https://github.com/hapijs/iron).
+> This TSDX setup is meant for developing libraries (not apps!) that can be published to NPM. If you’re looking to build a Node app, you could use `ts-node-dev`, plain `ts-node`, or simple `tsc`.
 
-**⚡️ Flash session data is supported**. It means you can store some data which will be deleted when read. This is useful for temporary tokens, redirects or notices on your UI.
+> If you’re new to TypeScript, checkout [this handy cheatsheet](https://devhints.io/typescript)
 
-**By default the cookie has an ⏰ expiration time of 15 days**, set via [`maxAge`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#Directives). After that, even if someone tries to reuse the cookie, @hapi/iron will not accept the underlying token. Because the expiration is also part of the token value. See https://hapi.dev/family/iron for more information on @hapi/iron mechanisms.
+## Commands
 
-**Why use pure 🍪 cookies for sessions?** This makes your sessions stateless: you do not have to store session data on your server. This is particularly useful in serverless architectures. Still, there are some drawbacks to this approach:
+TSDX scaffolds your new library inside `/src`.
 
-- you cannot invalidate a cookie when needed because there's no state stored on the server-side about the tokens. We consider that the way the cookie is stored reduces the possibility for this eventuality to happen.
-- application not supporting cookies won't work, this could be solved in the future by exposing the underlying token instead of signed and encrypted cookies. Open an issue if you're interested.
-- on most browsers, you're limited to 4,096 bytes per cookie. To give you an idea, an `iron-session` containing `{user: {id: 230, admin: true}}` is 358 bytes signed and encrypted: still plenty of available cookie space in here.
+To run TSDX, use:
 
-Now that you know the drawbacks, you can decide if they are an issue for your application or not.
+```bash
+npm start # or yarn start
+```
 
-**🤓 References:**
+This builds to `/dist` and runs the project in watch mode so any edits you save inside `src` causes a rebuild to `/dist`.
 
-- https://owasp.org/www-project-cheat-sheets/cheatsheets/Session_Management_Cheat_Sheet.html#cookies
-- https://owasp.org/www-project-cheat-sheets/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#encryption-based-token-pattern
+To do a one-off build, use `npm run build` or `yarn build`.
 
-## How is this different from [JWT](https://jwt.io/)?
+To run tests, use `npm test` or `yarn test`.
 
-Not so much:
+## Configuration
 
-- JWT is a standard, it stores metadata in the JWT token themselves to ensure communication between different systems is flawless.
-- JWT tokens are not encrypted, the payload is visible by customers if they manage to inspect the token. You would have to use [JWE](https://tools.ietf.org/html/rfc7516) to achieve the same.
-- @hapi/iron mechanism is not a standard, it's a way to sign and encrypt data into tokens
+Code quality is set up for you with `prettier`, `husky`, and `lint-staged`. Adjust the respective fields in `package.json` accordingly.
 
-Depending on your own needs and preferences, `iron-session-cookie` may or may not fit you.
+### Jest
 
-## Instalation
+Jest tests are set up to run with `npm test` or `yarn test`.
 
-```bash
-npm add iron-session
+### Bundle Analysis
+
+[`size-limit`](https://github.com/ai/size-limit) is set up to calculate the real cost of your library with `npm run size` and visualize the bundle with `npm run analyze`.
+
+#### Setup Files
+
+This is the folder structure we set up for you:
+
+```txt
+/src
+  index.tsx       # EDIT THIS
+/test
+  blah.test.tsx   # EDIT THIS
+.gitignore
+package.json
+README.md         # EDIT THIS
+tsconfig.json
 ```
 
-## Usage
+### Rollup
 
-The examples are using a user login flow: login, verify, log out. But you can use `iron-session` for any other session need.
+TSDX uses [Rollup](https://rollupjs.org) as a bundler and generates multiple rollup configs for various module formats and build settings. See [Optimizations](#optimizations) for details.
 
-The password is a private key you must pass at runtime, it has to be at least 32 characters long. https://1password.com/password-generator/ is a good way to generate a strong password.
+### TypeScript
 
-### When the user logs in
+`tsconfig.json` is set up to interpret `dom` and `esnext` types, as well as `react` for `jsx`. Adjust according to your needs.
 
-```js
-import { createSession } from "iron-session";
-export default async (req, res) => {
-  // when user successfully logs in using email/password, oauth, ... then we create a session
-  // const user = ...
+## Continuous Integration
 
-  const session = await createSession({
-    password: process.env.SECRET_SESSION_PASSWORD
-  });
+### GitHub Actions
 
-  session.set({ name: "user", value: { id: 230, admin: true } });
-  session.set({ name: "message", value: "Login success", flash: true });
+Two actions are added by default:
 
-  res.writeHead(200, {
-    "set-cookie": await session.serializeCookie()
-  });
+- `main` which installs deps w/ cache, lints, tests, and builds on all pushes against a Node and OS matrix
+- `size` which comments cost comparison of your library on every pull request using [`size-limit`](https://github.com/ai/size-limit)
 
-  res.end("ok");
-};
-```
+## Optimizations
 
-`serializeCookie` accepts all the options from https://github.com/jshttp/cookie#cookieserializename-value-options, merged with `iron-session` defaults. The defaults are:
+Please see the main `tsdx` [optimizations docs](https://github.com/palmerhq/tsdx#optimizations). In particular, know that you can take advantage of development-only optimizations:
 
 ```js
-{
-  httpOnly: true,
-  secure: true,
-  sameSite: "lax",
-  maxAge: (ttl === 0 ? 2147483647 : ttl) - 60, // For Iron, ttl 0 means it will never expire. For browser cookies, maxAge 0 means it will expire immediately. WhilCookie must expire before the seal, otherwise you could have expired seals stored in a cookie
+// ./types/index.d.ts
+declare var __DEV__: boolean;
+
+// inside your code...
+if (__DEV__) {
+  console.log('foo');
 }
 ```
 
-### Checking if the user is logged in
+You can also choose to install and use [invariant](https://github.com/palmerhq/tsdx#invariant) and [warning](https://github.com/palmerhq/tsdx#warning) functions.
 
-```js
-import { getSession, parseCookie } from "iron-session";
-export default async (req, res) => {
-  const session = await getSession({
-    password: process.env.SECRET_SESSION_PASSWORD,
-    sealed: parseCookie({ cookie: req.getHeader("cookie") })
-  });
-
-  const user = session.get({ name: "user" });
-  const flashMessage = session.get({ name: "message" });
-
-  res.end("ok");
-};
-```
+## Module Formats
 
-### When the user logs out
+CJS, ESModules, and UMD module formats are supported.
 
-```js
-import { deleteCookie } from "iron-session";
-export default async (req, res) => {
-  res.writeHead(200, {
-    "set-cookie": deleteCookie()
-  });
-
-  res.end("ok");
-};
-```
+The appropriate paths are configured in `package.json` and `dist/index.js` accordingly. Please report if any issues are found.
+
+## Named Exports
+
+Per Palmer Group guidelines, [always use named exports.](https://github.com/palmerhq/typescript#exports) Code split inside your React app instead of your React library.
+
+## Including Styles
+
+There are many ways to ship styles, including with CSS-in-JS. TSDX has no opinion on this, configure how you like.
 
-## Project status
+For vanilla CSS, you can include it at the root directory and add it to the `files` section in your `package.json`, so that it can be imported separately by your users and run through their bundler's loader.
 
-This is a recent library I authored because I needed it. While @hapi/iron is battle-tested and [used in production on a lot of websites](https://hapi.dev/), this library is not. Please use it at your own risk.
+## Publishing to NPM
 
-If you find bugs or have API ideas, create an issue.
+We recommend using [np](https://github.com/sindresorhus/np).

package/dist/index.d.ts

@@ -0,0 +1,29 @@
+import { CookieSerializeOptions } from 'cookie';
+import { IncomingMessage, ServerResponse } from 'http';
+
+declare type password = string | {
+    id: number;
+    password: string;
+}[];
+interface IronSessionOptions {
+    cookieName: string;
+    password: password;
+    ttl?: number;
+    cookieOptions?: CookieSerializeOptions;
+}
+interface IronSession {
+    set: <T = unknown>(name: string, value: T) => T;
+    get: <T = unknown>(name: string) => T | undefined;
+    unset: (name: string) => void;
+    destroy: () => void;
+    save: () => Promise<string>;
+}
+declare function getIronSession<RequestType extends IncomingMessage, ResponseType extends ServerResponse>(req: RequestType, res: ResponseType, userOptions: IronSessionOptions): Promise<{
+    set: <T = any>(name: string, value: T) => T;
+    get: (name?: string | undefined) => any;
+    unset: (name: string) => void;
+    save(): Promise<string>;
+    destroy(): void;
+}>;
+
+export { IronSession, IronSessionOptions, getIronSession };

package/dist/index.js

@@ -0,0 +1,127 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __markAsModule = (target) => __defProp(target, "__esModule", { value: true });
+var __export = (target, all) => {
+  __markAsModule(target);
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __reExport = (target, module2, desc) => {
+  if (module2 && typeof module2 === "object" || typeof module2 === "function") {
+    for (let key of __getOwnPropNames(module2))
+      if (!__hasOwnProp.call(target, key) && key !== "default")
+        __defProp(target, key, { get: () => module2[key], enumerable: !(desc = __getOwnPropDesc(module2, key)) || desc.enumerable });
+  }
+  return target;
+};
+var __toModule = (module2) => {
+  return __reExport(__markAsModule(__defProp(module2 != null ? __create(__getProtoOf(module2)) : {}, "default", module2 && module2.__esModule && "default" in module2 ? { get: () => module2.default, enumerable: true } : { value: module2, enumerable: true })), module2);
+};
+
+// src/index.ts
+__export(exports, {
+  getIronSession: () => getIronSession
+});
+var import_iron_store = __toModule(require("iron-store"));
+var import_cookie = __toModule(require("cookie"));
+var timestampSkewSec = 60;
+var defaultOptions = {
+  ttl: 15 * 24 * 3600,
+  cookieOptions: {
+    httpOnly: true,
+    secure: true,
+    sameSite: "lax",
+    path: "/"
+  }
+};
+async function getIronSession(req, res, userOptions) {
+  var _a, _b;
+  if (!req || !res || !userOptions || !userOptions.cookieName || !userOptions.password) {
+    throw new Error(`iron-session: Bad usage. Minimum usage is const session = await getIronSession(req, res, { cookieName: "...", password: "...". Check the usage here: https://github.com/vvo/iron-session`);
+  }
+  const passwordAsAnArray = Array.isArray(userOptions.password) ? userOptions.password : [{ id: 1, password: userOptions.password }];
+  passwordAsAnArray.forEach(({ password }) => {
+    if (password.length < 32) {
+      throw new Error(`iron-session: Bad usage. Password must be at least 32 characters long.`);
+    }
+  });
+  const options = {
+    ...defaultOptions,
+    ...userOptions,
+    cookieOptions: {
+      ...defaultOptions.cookieOptions,
+      ...userOptions.cookieOptions || {}
+    }
+  };
+  if (options.ttl === 0) {
+    options.ttl = 2147483647;
+  }
+  options.cookieOptions.maxAge = computeCookieMaxAge((_b = (_a = userOptions.cookieOptions) == null ? void 0 : _a.maxAge) != null ? _b : options.ttl);
+  const store = await getOrCreateStore({
+    sealed: import_cookie.default.parse(req.headers.cookie || "")[options.cookieName],
+    password: passwordAsAnArray,
+    ttl: options.ttl * 1e3
+  });
+  return {
+    set: store.set,
+    get: store.get,
+    unset: store.unset,
+    async save() {
+      const seal = await store.seal();
+      const cookieValue = import_cookie.default.serialize(options.cookieName, seal, options.cookieOptions);
+      if (cookieValue.length > 4096) {
+        throw new Error(`iron-session: Cookie length is too big ${cookieValue.length}, browsers will refuse it. Try to remove some data.`);
+      }
+      addToCookies(cookieValue, res);
+      return cookieValue;
+    },
+    destroy() {
+      store.clear();
+      const cookieValue = import_cookie.default.serialize(options.cookieName, "", {
+        ...options.cookieOptions,
+        maxAge: 0
+      });
+      addToCookies(cookieValue, res);
+    }
+  };
+}
+function addToCookies(cookieValue, res) {
+  var _a;
+  let existingSetCookie = (_a = res.getHeader("set-cookie")) != null ? _a : [];
+  if (typeof existingSetCookie === "string") {
+    existingSetCookie = [existingSetCookie];
+  }
+  res.setHeader("set-cookie", [...existingSetCookie, cookieValue]);
+}
+function computeCookieMaxAge(ttl) {
+  return ttl - timestampSkewSec;
+}
+async function getOrCreateStore({
+  sealed,
+  password,
+  ttl
+}) {
+  try {
+    return await (0, import_iron_store.default)({
+      sealed,
+      password,
+      ttl
+    });
+  } catch (error) {
+    if (error instanceof Error) {
+      if (error.message === "Expired seal" || error.message === "Bad hmac value" || error.message === "Cannot find password: ") {
+        return await (0, import_iron_store.default)({ password, ttl });
+      }
+    }
+    throw error;
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  getIronSession
+});
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/index.ts"],
+  "sourcesContent": ["import ironStore from \"iron-store\";\nimport cookie, { CookieSerializeOptions } from \"cookie\";\nimport type { IncomingMessage, ServerResponse } from \"http\";\n\n// default time allowed to check for iron seal validity when ttl passed\n// see https://hapi.dev/family/iron/api/?v=6.0.0#options\nconst timestampSkewSec = 60;\n\ntype password = string | { id: number; password: string }[];\n\nconst defaultOptions: {\n  ttl: number;\n  cookieOptions: CookieSerializeOptions;\n} = {\n  ttl: 15 * 24 * 3600,\n  cookieOptions: {\n    httpOnly: true,\n    secure: true,\n    sameSite: \"lax\",\n    path: \"/\",\n  },\n};\n\nexport interface IronSessionOptions {\n  cookieName: string;\n  password: password;\n  ttl?: number;\n  cookieOptions?: CookieSerializeOptions;\n}\n\nexport interface IronSession {\n  set: <T = unknown>(name: string, value: T) => T;\n  get: <T = unknown>(name: string) => T | undefined;\n  unset: (name: string) => void;\n  destroy: () => void;\n  save: () => Promise<string>;\n}\n\nexport async function getIronSession<\n  RequestType extends IncomingMessage,\n  ResponseType extends ServerResponse,\n>(req: RequestType, res: ResponseType, userOptions: IronSessionOptions) {\n  if (\n    !req ||\n    !res ||\n    !userOptions ||\n    !userOptions.cookieName ||\n    !userOptions.password\n  ) {\n    throw new Error(\n      `iron-session: Bad usage. Minimum usage is const session = await getIronSession(req, res, { cookieName: \"...\", password: \"...\". Check the usage here: https://github.com/vvo/iron-session`,\n    );\n  }\n\n  const passwordAsAnArray = Array.isArray(userOptions.password)\n    ? userOptions.password\n    : [{ id: 1, password: userOptions.password }];\n\n  passwordAsAnArray.forEach(({ password }) => {\n    if (password.length < 32) {\n      throw new Error(\n        `iron-session: Bad usage. Password must be at least 32 characters long.`,\n      );\n    }\n  });\n\n  const options: Required<IronSessionOptions> = {\n    ...defaultOptions,\n    ...userOptions,\n    cookieOptions: {\n      ...defaultOptions.cookieOptions,\n      ...(userOptions.cookieOptions || {}),\n    },\n  };\n\n  if (options.ttl === 0) {\n    // ttl = 0 means no expiration\n    // but in reality cookies have to expire (can't have no max-age)\n    // 2147483647 is the max value for max-age in cookies\n    // see https://stackoverflow.com/a/11685301/147079\n    options.ttl = 2147483647;\n  }\n\n  options.cookieOptions.maxAge = computeCookieMaxAge(\n    userOptions.cookieOptions?.maxAge ?? options.ttl,\n  );\n\n  const store = await getOrCreateStore({\n    sealed: cookie.parse(req.headers.cookie || \"\")[options.cookieName],\n    password: passwordAsAnArray,\n    ttl: options.ttl * 1000,\n  });\n\n  return {\n    set: store.set,\n    get: store.get,\n    unset: store.unset,\n    async save() {\n      const seal = await store.seal();\n      const cookieValue = cookie.serialize(\n        options.cookieName,\n        seal,\n        options.cookieOptions,\n      );\n\n      if (cookieValue.length > 4096) {\n        throw new Error(\n          `iron-session: Cookie length is too big ${cookieValue.length}, browsers will refuse it. Try to remove some data.`,\n        );\n      }\n\n      addToCookies(cookieValue, res);\n      return cookieValue;\n    },\n    destroy() {\n      store.clear();\n      const cookieValue = cookie.serialize(options.cookieName, \"\", {\n        ...options.cookieOptions,\n        maxAge: 0,\n      });\n      addToCookies(cookieValue, res);\n    },\n  };\n}\n\nfunction addToCookies(cookieValue: string, res: ServerResponse) {\n  let existingSetCookie =\n    (res.getHeader(\"set-cookie\") as string[] | string) ?? [];\n  if (typeof existingSetCookie === \"string\") {\n    existingSetCookie = [existingSetCookie];\n  }\n  res.setHeader(\"set-cookie\", [...existingSetCookie, cookieValue]);\n}\n\nfunction computeCookieMaxAge(ttl: number) {\n  // The next line makes sure browser will expire cookies before seals are considered expired by the server.\n  // It also allows for clock difference of 60 seconds maximum between server and clients.\n  // It also makes sure to expire the cookie immediately when value is 0\n  return ttl - timestampSkewSec;\n}\n\nasync function getOrCreateStore({\n  sealed,\n  password,\n  ttl,\n}: {\n  sealed: string;\n  password: password;\n  ttl: number;\n}) {\n  try {\n    return await ironStore({\n      sealed,\n      password,\n      ttl,\n    });\n  } catch (error) {\n    if (error instanceof Error) {\n      if (\n        error.message === \"Expired seal\" ||\n        error.message === \"Bad hmac value\" ||\n        error.message === \"Cannot find password: \"\n      ) {\n        // if seal expired or\n        // if seal is not valid (encrypted using a different password, when passwords are updated) or\n        // if we can't find back the password in the seal\n        // then we just start a new session over\n        return await ironStore({ password, ttl });\n      }\n    }\n\n    throw error;\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA,wBAAsB;AACtB,oBAA+C;AAK/C,IAAM,mBAAmB;AAIzB,IAAM,iBAGF;AAAA,EACF,KAAK,KAAK,KAAK;AAAA,EACf,eAAe;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA;AAAA;AAmBV,8BAGE,KAAkB,KAAmB,aAAiC;AAzCxE;AA0CE,MACE,CAAC,OACD,CAAC,OACD,CAAC,eACD,CAAC,YAAY,cACb,CAAC,YAAY,UACb;AACA,UAAM,IAAI,MACR;AAAA;AAIJ,QAAM,oBAAoB,MAAM,QAAQ,YAAY,YAChD,YAAY,WACZ,CAAC,EAAE,IAAI,GAAG,UAAU,YAAY;AAEpC,oBAAkB,QAAQ,CAAC,EAAE,eAAe;AAC1C,QAAI,SAAS,SAAS,IAAI;AACxB,YAAM,IAAI,MACR;AAAA;AAAA;AAKN,QAAM,UAAwC;AAAA,OACzC;AAAA,OACA;AAAA,IACH,eAAe;AAAA,SACV,eAAe;AAAA,SACd,YAAY,iBAAiB;AAAA;AAAA;AAIrC,MAAI,QAAQ,QAAQ,GAAG;AAKrB,YAAQ,MAAM;AAAA;AAGhB,UAAQ,cAAc,SAAS,oBAC7B,wBAAY,kBAAZ,mBAA2B,WAA3B,YAAqC,QAAQ;AAG/C,QAAM,QAAQ,MAAM,iBAAiB;AAAA,IACnC,QAAQ,sBAAO,MAAM,IAAI,QAAQ,UAAU,IAAI,QAAQ;AAAA,IACvD,UAAU;AAAA,IACV,KAAK,QAAQ,MAAM;AAAA;AAGrB,SAAO;AAAA,IACL,KAAK,MAAM;AAAA,IACX,KAAK,MAAM;AAAA,IACX,OAAO,MAAM;AAAA,UACP,OAAO;AACX,YAAM,OAAO,MAAM,MAAM;AACzB,YAAM,cAAc,sBAAO,UACzB,QAAQ,YACR,MACA,QAAQ;AAGV,UAAI,YAAY,SAAS,MAAM;AAC7B,cAAM,IAAI,MACR,0CAA0C,YAAY;AAAA;AAI1D,mBAAa,aAAa;AAC1B,aAAO;AAAA;AAAA,IAET,UAAU;AACR,YAAM;AACN,YAAM,cAAc,sBAAO,UAAU,QAAQ,YAAY,IAAI;AAAA,WACxD,QAAQ;AAAA,QACX,QAAQ;AAAA;AAEV,mBAAa,aAAa;AAAA;AAAA;AAAA;AAKhC,sBAAsB,aAAqB,KAAqB;AA7HhE;AA8HE,MAAI,oBACD,UAAI,UAAU,kBAAd,YAAqD;AACxD,MAAI,OAAO,sBAAsB,UAAU;AACzC,wBAAoB,CAAC;AAAA;AAEvB,MAAI,UAAU,cAAc,CAAC,GAAG,mBAAmB;AAAA;AAGrD,6BAA6B,KAAa;AAIxC,SAAO,MAAM;AAAA;AAGf,gCAAgC;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,GAKC;AACD,MAAI;AACF,WAAO,MAAM,+BAAU;AAAA,MACrB;AAAA,MACA;AAAA,MACA;AAAA;AAAA,WAEK,OAAP;AACA,QAAI,iBAAiB,OAAO;AAC1B,UACE,MAAM,YAAY,kBAClB,MAAM,YAAY,oBAClB,MAAM,YAAY,0BAClB;AAKA,eAAO,MAAM,+BAAU,EAAE,UAAU;AAAA;AAAA;AAIvC,UAAM;AAAA;AAAA;",
+  "names": []
+}

package/dist/index.mjs

@@ -0,0 +1,99 @@
+// src/index.ts
+import ironStore from "iron-store";
+import cookie from "cookie";
+var timestampSkewSec = 60;
+var defaultOptions = {
+  ttl: 15 * 24 * 3600,
+  cookieOptions: {
+    httpOnly: true,
+    secure: true,
+    sameSite: "lax",
+    path: "/"
+  }
+};
+async function getIronSession(req, res, userOptions) {
+  var _a, _b;
+  if (!req || !res || !userOptions || !userOptions.cookieName || !userOptions.password) {
+    throw new Error(`iron-session: Bad usage. Minimum usage is const session = await getIronSession(req, res, { cookieName: "...", password: "...". Check the usage here: https://github.com/vvo/iron-session`);
+  }
+  const passwordAsAnArray = Array.isArray(userOptions.password) ? userOptions.password : [{ id: 1, password: userOptions.password }];
+  passwordAsAnArray.forEach(({ password }) => {
+    if (password.length < 32) {
+      throw new Error(`iron-session: Bad usage. Password must be at least 32 characters long.`);
+    }
+  });
+  const options = {
+    ...defaultOptions,
+    ...userOptions,
+    cookieOptions: {
+      ...defaultOptions.cookieOptions,
+      ...userOptions.cookieOptions || {}
+    }
+  };
+  if (options.ttl === 0) {
+    options.ttl = 2147483647;
+  }
+  options.cookieOptions.maxAge = computeCookieMaxAge((_b = (_a = userOptions.cookieOptions) == null ? void 0 : _a.maxAge) != null ? _b : options.ttl);
+  const store = await getOrCreateStore({
+    sealed: cookie.parse(req.headers.cookie || "")[options.cookieName],
+    password: passwordAsAnArray,
+    ttl: options.ttl * 1e3
+  });
+  return {
+    set: store.set,
+    get: store.get,
+    unset: store.unset,
+    async save() {
+      const seal = await store.seal();
+      const cookieValue = cookie.serialize(options.cookieName, seal, options.cookieOptions);
+      if (cookieValue.length > 4096) {
+        throw new Error(`iron-session: Cookie length is too big ${cookieValue.length}, browsers will refuse it. Try to remove some data.`);
+      }
+      addToCookies(cookieValue, res);
+      return cookieValue;
+    },
+    destroy() {
+      store.clear();
+      const cookieValue = cookie.serialize(options.cookieName, "", {
+        ...options.cookieOptions,
+        maxAge: 0
+      });
+      addToCookies(cookieValue, res);
+    }
+  };
+}
+function addToCookies(cookieValue, res) {
+  var _a;
+  let existingSetCookie = (_a = res.getHeader("set-cookie")) != null ? _a : [];
+  if (typeof existingSetCookie === "string") {
+    existingSetCookie = [existingSetCookie];
+  }
+  res.setHeader("set-cookie", [...existingSetCookie, cookieValue]);
+}
+function computeCookieMaxAge(ttl) {
+  return ttl - timestampSkewSec;
+}
+async function getOrCreateStore({
+  sealed,
+  password,
+  ttl
+}) {
+  try {
+    return await ironStore({
+      sealed,
+      password,
+      ttl
+    });
+  } catch (error) {
+    if (error instanceof Error) {
+      if (error.message === "Expired seal" || error.message === "Bad hmac value" || error.message === "Cannot find password: ") {
+        return await ironStore({ password, ttl });
+      }
+    }
+    throw error;
+  }
+}
+export {
+  getIronSession
+};
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/index.ts"],
+  "sourcesContent": ["import ironStore from \"iron-store\";\nimport cookie, { CookieSerializeOptions } from \"cookie\";\nimport type { IncomingMessage, ServerResponse } from \"http\";\n\n// default time allowed to check for iron seal validity when ttl passed\n// see https://hapi.dev/family/iron/api/?v=6.0.0#options\nconst timestampSkewSec = 60;\n\ntype password = string | { id: number; password: string }[];\n\nconst defaultOptions: {\n  ttl: number;\n  cookieOptions: CookieSerializeOptions;\n} = {\n  ttl: 15 * 24 * 3600,\n  cookieOptions: {\n    httpOnly: true,\n    secure: true,\n    sameSite: \"lax\",\n    path: \"/\",\n  },\n};\n\nexport interface IronSessionOptions {\n  cookieName: string;\n  password: password;\n  ttl?: number;\n  cookieOptions?: CookieSerializeOptions;\n}\n\nexport interface IronSession {\n  set: <T = unknown>(name: string, value: T) => T;\n  get: <T = unknown>(name: string) => T | undefined;\n  unset: (name: string) => void;\n  destroy: () => void;\n  save: () => Promise<string>;\n}\n\nexport async function getIronSession<\n  RequestType extends IncomingMessage,\n  ResponseType extends ServerResponse,\n>(req: RequestType, res: ResponseType, userOptions: IronSessionOptions) {\n  if (\n    !req ||\n    !res ||\n    !userOptions ||\n    !userOptions.cookieName ||\n    !userOptions.password\n  ) {\n    throw new Error(\n      `iron-session: Bad usage. Minimum usage is const session = await getIronSession(req, res, { cookieName: \"...\", password: \"...\". Check the usage here: https://github.com/vvo/iron-session`,\n    );\n  }\n\n  const passwordAsAnArray = Array.isArray(userOptions.password)\n    ? userOptions.password\n    : [{ id: 1, password: userOptions.password }];\n\n  passwordAsAnArray.forEach(({ password }) => {\n    if (password.length < 32) {\n      throw new Error(\n        `iron-session: Bad usage. Password must be at least 32 characters long.`,\n      );\n    }\n  });\n\n  const options: Required<IronSessionOptions> = {\n    ...defaultOptions,\n    ...userOptions,\n    cookieOptions: {\n      ...defaultOptions.cookieOptions,\n      ...(userOptions.cookieOptions || {}),\n    },\n  };\n\n  if (options.ttl === 0) {\n    // ttl = 0 means no expiration\n    // but in reality cookies have to expire (can't have no max-age)\n    // 2147483647 is the max value for max-age in cookies\n    // see https://stackoverflow.com/a/11685301/147079\n    options.ttl = 2147483647;\n  }\n\n  options.cookieOptions.maxAge = computeCookieMaxAge(\n    userOptions.cookieOptions?.maxAge ?? options.ttl,\n  );\n\n  const store = await getOrCreateStore({\n    sealed: cookie.parse(req.headers.cookie || \"\")[options.cookieName],\n    password: passwordAsAnArray,\n    ttl: options.ttl * 1000,\n  });\n\n  return {\n    set: store.set,\n    get: store.get,\n    unset: store.unset,\n    async save() {\n      const seal = await store.seal();\n      const cookieValue = cookie.serialize(\n        options.cookieName,\n        seal,\n        options.cookieOptions,\n      );\n\n      if (cookieValue.length > 4096) {\n        throw new Error(\n          `iron-session: Cookie length is too big ${cookieValue.length}, browsers will refuse it. Try to remove some data.`,\n        );\n      }\n\n      addToCookies(cookieValue, res);\n      return cookieValue;\n    },\n    destroy() {\n      store.clear();\n      const cookieValue = cookie.serialize(options.cookieName, \"\", {\n        ...options.cookieOptions,\n        maxAge: 0,\n      });\n      addToCookies(cookieValue, res);\n    },\n  };\n}\n\nfunction addToCookies(cookieValue: string, res: ServerResponse) {\n  let existingSetCookie =\n    (res.getHeader(\"set-cookie\") as string[] | string) ?? [];\n  if (typeof existingSetCookie === \"string\") {\n    existingSetCookie = [existingSetCookie];\n  }\n  res.setHeader(\"set-cookie\", [...existingSetCookie, cookieValue]);\n}\n\nfunction computeCookieMaxAge(ttl: number) {\n  // The next line makes sure browser will expire cookies before seals are considered expired by the server.\n  // It also allows for clock difference of 60 seconds maximum between server and clients.\n  // It also makes sure to expire the cookie immediately when value is 0\n  return ttl - timestampSkewSec;\n}\n\nasync function getOrCreateStore({\n  sealed,\n  password,\n  ttl,\n}: {\n  sealed: string;\n  password: password;\n  ttl: number;\n}) {\n  try {\n    return await ironStore({\n      sealed,\n      password,\n      ttl,\n    });\n  } catch (error) {\n    if (error instanceof Error) {\n      if (\n        error.message === \"Expired seal\" ||\n        error.message === \"Bad hmac value\" ||\n        error.message === \"Cannot find password: \"\n      ) {\n        // if seal expired or\n        // if seal is not valid (encrypted using a different password, when passwords are updated) or\n        // if we can't find back the password in the seal\n        // then we just start a new session over\n        return await ironStore({ password, ttl });\n      }\n    }\n\n    throw error;\n  }\n}\n"],
+  "mappings": ";AAAA;AACA;AAKA,IAAM,mBAAmB;AAIzB,IAAM,iBAGF;AAAA,EACF,KAAK,KAAK,KAAK;AAAA,EACf,eAAe;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA;AAAA;AAmBV,8BAGE,KAAkB,KAAmB,aAAiC;AAzCxE;AA0CE,MACE,CAAC,OACD,CAAC,OACD,CAAC,eACD,CAAC,YAAY,cACb,CAAC,YAAY,UACb;AACA,UAAM,IAAI,MACR;AAAA;AAIJ,QAAM,oBAAoB,MAAM,QAAQ,YAAY,YAChD,YAAY,WACZ,CAAC,EAAE,IAAI,GAAG,UAAU,YAAY;AAEpC,oBAAkB,QAAQ,CAAC,EAAE,eAAe;AAC1C,QAAI,SAAS,SAAS,IAAI;AACxB,YAAM,IAAI,MACR;AAAA;AAAA;AAKN,QAAM,UAAwC;AAAA,OACzC;AAAA,OACA;AAAA,IACH,eAAe;AAAA,SACV,eAAe;AAAA,SACd,YAAY,iBAAiB;AAAA;AAAA;AAIrC,MAAI,QAAQ,QAAQ,GAAG;AAKrB,YAAQ,MAAM;AAAA;AAGhB,UAAQ,cAAc,SAAS,oBAC7B,wBAAY,kBAAZ,mBAA2B,WAA3B,YAAqC,QAAQ;AAG/C,QAAM,QAAQ,MAAM,iBAAiB;AAAA,IACnC,QAAQ,OAAO,MAAM,IAAI,QAAQ,UAAU,IAAI,QAAQ;AAAA,IACvD,UAAU;AAAA,IACV,KAAK,QAAQ,MAAM;AAAA;AAGrB,SAAO;AAAA,IACL,KAAK,MAAM;AAAA,IACX,KAAK,MAAM;AAAA,IACX,OAAO,MAAM;AAAA,UACP,OAAO;AACX,YAAM,OAAO,MAAM,MAAM;AACzB,YAAM,cAAc,OAAO,UACzB,QAAQ,YACR,MACA,QAAQ;AAGV,UAAI,YAAY,SAAS,MAAM;AAC7B,cAAM,IAAI,MACR,0CAA0C,YAAY;AAAA;AAI1D,mBAAa,aAAa;AAC1B,aAAO;AAAA;AAAA,IAET,UAAU;AACR,YAAM;AACN,YAAM,cAAc,OAAO,UAAU,QAAQ,YAAY,IAAI;AAAA,WACxD,QAAQ;AAAA,QACX,QAAQ;AAAA;AAEV,mBAAa,aAAa;AAAA;AAAA;AAAA;AAKhC,sBAAsB,aAAqB,KAAqB;AA7HhE;AA8HE,MAAI,oBACD,UAAI,UAAU,kBAAd,YAAqD;AACxD,MAAI,OAAO,sBAAsB,UAAU;AACzC,wBAAoB,CAAC;AAAA;AAEvB,MAAI,UAAU,cAAc,CAAC,GAAG,mBAAmB;AAAA;AAGrD,6BAA6B,KAAa;AAIxC,SAAO,MAAM;AAAA;AAGf,gCAAgC;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,GAKC;AACD,MAAI;AACF,WAAO,MAAM,UAAU;AAAA,MACrB;AAAA,MACA;AAAA,MACA;AAAA;AAAA,WAEK,OAAP;AACA,QAAI,iBAAiB,OAAO;AAC1B,UACE,MAAM,YAAY,kBAClB,MAAM,YAAY,oBAClB,MAAM,YAAY,0BAClB;AAKA,eAAO,MAAM,UAAU,EAAE,UAAU;AAAA;AAAA;AAIvC,UAAM;AAAA;AAAA;",
+  "names": []
+}

package/next/dist/index.d.ts

@@ -0,0 +1,15 @@
+import { NextApiRequest, NextApiResponse, GetServerSidePropsResult, GetServerSidePropsContext } from 'next';
+import { IronSession, IronSessionOptions } from 'iron-session';
+
+interface NextApiRequestWithIronSession extends NextApiRequest {
+    session: IronSession;
+}
+declare type NextApiHandlerWithIronSession<T = unknown> = (req: NextApiRequestWithIronSession, res: NextApiResponse<T>) => void | Promise<void>;
+interface NextGetSeverSideContextWithIronSession extends GetServerSidePropsContext {
+    req: NextApiRequestWithIronSession;
+}
+declare type NextGetServerSidePropsHandlerWithIronSession<P> = (context: NextGetSeverSideContextWithIronSession) => Promise<GetServerSidePropsResult<P>>;
+declare function withIronSessionApiRoute(handler: NextApiHandlerWithIronSession, options: IronSessionOptions): NextApiHandlerWithIronSession;
+declare function withIronSessionSsr<P>(handler: NextGetServerSidePropsHandlerWithIronSession<P>, options: IronSessionOptions): NextGetServerSidePropsHandlerWithIronSession<P>;
+
+export { NextApiHandlerWithIronSession, NextApiRequestWithIronSession, NextGetServerSidePropsHandlerWithIronSession, withIronSessionApiRoute, withIronSessionSsr };

package/next/dist/index.js

@@ -0,0 +1,48 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __markAsModule = (target) => __defProp(target, "__esModule", { value: true });
+var __export = (target, all) => {
+  __markAsModule(target);
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __reExport = (target, module2, desc) => {
+  if (module2 && typeof module2 === "object" || typeof module2 === "function") {
+    for (let key of __getOwnPropNames(module2))
+      if (!__hasOwnProp.call(target, key) && key !== "default")
+        __defProp(target, key, { get: () => module2[key], enumerable: !(desc = __getOwnPropDesc(module2, key)) || desc.enumerable });
+  }
+  return target;
+};
+var __toModule = (module2) => {
+  return __reExport(__markAsModule(__defProp(module2 != null ? __create(__getProtoOf(module2)) : {}, "default", module2 && module2.__esModule && "default" in module2 ? { get: () => module2.default, enumerable: true } : { value: module2, enumerable: true })), module2);
+};
+
+// next/index.ts
+__export(exports, {
+  withIronSessionApiRoute: () => withIronSessionApiRoute,
+  withIronSessionSsr: () => withIronSessionSsr
+});
+var import_iron_session = __toModule(require("iron-session"));
+function withIronSessionApiRoute(handler, options) {
+  return async function nextApiHandlerWrappedWithIronSession(req, res) {
+    req.session = await (0, import_iron_session.getIronSession)(req, res, options);
+    return handler(req, res);
+  };
+}
+function withIronSessionSsr(handler, options) {
+  return async function nextGetServerSidePropsHandlerWrappedWithIronSession(context) {
+    context.req.session = await (0, import_iron_session.getIronSession)(context.req, context.res, options);
+    return handler(context);
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  withIronSessionApiRoute,
+  withIronSessionSsr
+});
+//# sourceMappingURL=index.js.map

package/next/dist/index.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../index.ts"],
+  "sourcesContent": ["import type {\n  GetServerSidePropsContext,\n  GetServerSidePropsResult,\n  NextApiRequest,\n  NextApiResponse,\n} from \"next\";\nimport type { IronSession, IronSessionOptions } from \"iron-session\";\nimport { getIronSession } from \"iron-session\";\n\nexport interface NextApiRequestWithIronSession extends NextApiRequest {\n  session: IronSession;\n}\n\nexport declare type NextApiHandlerWithIronSession<T = unknown> = (\n  req: NextApiRequestWithIronSession,\n  res: NextApiResponse<T>,\n) => void | Promise<void>;\n\ninterface NextGetSeverSideContextWithIronSession\n  extends GetServerSidePropsContext {\n  req: NextApiRequestWithIronSession;\n}\n\nexport declare type NextGetServerSidePropsHandlerWithIronSession<P> = (\n  context: NextGetSeverSideContextWithIronSession,\n) => Promise<GetServerSidePropsResult<P>>;\n\nexport function withIronSessionApiRoute(\n  handler: NextApiHandlerWithIronSession,\n  options: IronSessionOptions,\n): NextApiHandlerWithIronSession {\n  return async function nextApiHandlerWrappedWithIronSession(req, res) {\n    req.session = await getIronSession(req, res, options);\n    return handler(req, res);\n  };\n}\n\nexport function withIronSessionSsr<P>(\n  handler: NextGetServerSidePropsHandlerWithIronSession<P>,\n  options: IronSessionOptions,\n): NextGetServerSidePropsHandlerWithIronSession<P> {\n  return async function nextGetServerSidePropsHandlerWrappedWithIronSession(\n    context: NextGetSeverSideContextWithIronSession,\n  ) {\n    context.req.session = await getIronSession(\n      context.req,\n      context.res,\n      options,\n    );\n    return handler(context);\n  };\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAOA,0BAA+B;AAoBxB,iCACL,SACA,SAC+B;AAC/B,SAAO,oDAAoD,KAAK,KAAK;AACnE,QAAI,UAAU,MAAM,wCAAe,KAAK,KAAK;AAC7C,WAAO,QAAQ,KAAK;AAAA;AAAA;AAIjB,4BACL,SACA,SACiD;AACjD,SAAO,mEACL,SACA;AACA,YAAQ,IAAI,UAAU,MAAM,wCAC1B,QAAQ,KACR,QAAQ,KACR;AAEF,WAAO,QAAQ;AAAA;AAAA;",
+  "names": []
+}

package/next/dist/index.mjs

@@ -0,0 +1,19 @@
+// next/index.ts
+import { getIronSession } from "iron-session";
+function withIronSessionApiRoute(handler, options) {
+  return async function nextApiHandlerWrappedWithIronSession(req, res) {
+    req.session = await getIronSession(req, res, options);
+    return handler(req, res);
+  };
+}
+function withIronSessionSsr(handler, options) {
+  return async function nextGetServerSidePropsHandlerWrappedWithIronSession(context) {
+    context.req.session = await getIronSession(context.req, context.res, options);
+    return handler(context);
+  };
+}
+export {
+  withIronSessionApiRoute,
+  withIronSessionSsr
+};
+//# sourceMappingURL=index.mjs.map

package/next/dist/index.mjs.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../index.ts"],
+  "sourcesContent": ["import type {\n  GetServerSidePropsContext,\n  GetServerSidePropsResult,\n  NextApiRequest,\n  NextApiResponse,\n} from \"next\";\nimport type { IronSession, IronSessionOptions } from \"iron-session\";\nimport { getIronSession } from \"iron-session\";\n\nexport interface NextApiRequestWithIronSession extends NextApiRequest {\n  session: IronSession;\n}\n\nexport declare type NextApiHandlerWithIronSession<T = unknown> = (\n  req: NextApiRequestWithIronSession,\n  res: NextApiResponse<T>,\n) => void | Promise<void>;\n\ninterface NextGetSeverSideContextWithIronSession\n  extends GetServerSidePropsContext {\n  req: NextApiRequestWithIronSession;\n}\n\nexport declare type NextGetServerSidePropsHandlerWithIronSession<P> = (\n  context: NextGetSeverSideContextWithIronSession,\n) => Promise<GetServerSidePropsResult<P>>;\n\nexport function withIronSessionApiRoute(\n  handler: NextApiHandlerWithIronSession,\n  options: IronSessionOptions,\n): NextApiHandlerWithIronSession {\n  return async function nextApiHandlerWrappedWithIronSession(req, res) {\n    req.session = await getIronSession(req, res, options);\n    return handler(req, res);\n  };\n}\n\nexport function withIronSessionSsr<P>(\n  handler: NextGetServerSidePropsHandlerWithIronSession<P>,\n  options: IronSessionOptions,\n): NextGetServerSidePropsHandlerWithIronSession<P> {\n  return async function nextGetServerSidePropsHandlerWrappedWithIronSession(\n    context: NextGetSeverSideContextWithIronSession,\n  ) {\n    context.req.session = await getIronSession(\n      context.req,\n      context.res,\n      options,\n    );\n    return handler(context);\n  };\n}\n"],
+  "mappings": ";AAOA;AAoBO,iCACL,SACA,SAC+B;AAC/B,SAAO,oDAAoD,KAAK,KAAK;AACnE,QAAI,UAAU,MAAM,eAAe,KAAK,KAAK;AAC7C,WAAO,QAAQ,KAAK;AAAA;AAAA;AAIjB,4BACL,SACA,SACiD;AACjD,SAAO,mEACL,SACA;AACA,YAAQ,IAAI,UAAU,MAAM,eAC1B,QAAQ,KACR,QAAQ,KACR;AAEF,WAAO,QAAQ;AAAA;AAAA;",
+  "names": []
+}

package/package.json

@@ -1,83 +1,142 @@
 {
   "name": "iron-session",
-  "version": "1.0.3",
-  "private": false,
-  "description": "Backend agnostic session utility based on @hapi/iron with signed and encrypted cookie serialization ability",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/vvo/iron-session.git"
-  },
+  "version": "2.0.0-alpha.10",
   "license": "MIT",
   "author": "Vincent Voyer <vincent@codeagain.com>",
+  "exports": {
+    ".": {
+      "import": "./dist/index.mjs",
+      "require": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    },
+    "./next": {
+      "import": "./next/dist/index.mjs",
+      "require": "./next/dist/index.js",
+      "types": "./next/dist/index.d.ts"
+    }
+  },
+  "main": "./dist/index.js",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
   "files": [
-    "index.dist.js",
-    "index.dist.js.map",
-    "LICENSE",
-    "README.md"
+    "dist",
+    "next/dist"
+  ],
+  "workspaces": [
+    "examples/next.js",
+    "examples/next.js-typescript"
   ],
-  "main": "index.dist.js",
   "scripts": {
-    "build": "babel index.js -o index.dist.js --source-maps",
-    "prepublishOnly": "yarn build",
-    "semantic-release": "semantic-release",
-    "test": "jest --coverage && prettier --check './**/*.?(json|js|md|css)' && eslint ."
+    "build": "rimraf dist/ next/dist && tsup src/index.ts && tsup next/index.ts -d next/dist",
+    "lint": "eslint . && (cd examples/next.js && npm run lint) && (cd examples/next.js-typescript && npm run lint)",
+    "prepublishOnly": "npm run build",
+    "test": "jest --coverage && npm run lint"
   },
-  "babel": {
-    "presets": [
-      [
-        "@babel/preset-env",
-        {
-          "targets": {
-            "node": "12"
-          }
-        }
-      ]
-    ]
+  "prettier": {
+    "trailingComma": "all"
   },
   "eslintConfig": {
-    "env": {
-      "jest": true,
-      "node": true
-    },
+    "parser": "@typescript-eslint/parser",
     "parserOptions": {
-      "ecmaVersion": 2019,
+      "ecmaVersion": 2021,
       "sourceType": "module"
     },
     "plugins": [
-      "jest"
+      "@typescript-eslint"
     ],
     "extends": [
       "eslint:recommended",
-      "plugin:jest/recommended"
-    ]
+      "plugin:@typescript-eslint/recommended"
+    ],
+    "rules": {
+      "@typescript-eslint/ban-ts-comment": [
+        "warn",
+        {
+          "ts-ignore": "allow-with-description"
+        }
+      ]
+    }
   },
   "jest": {
-    "setupFiles": [
-      "jest-date-mock"
-    ]
+    "collectCoverageFrom": [
+      "src/*.ts",
+      "next/*.ts"
+    ],
+    "coverageProvider": "v8",
+    "coverageReporters": [
+      "text"
+    ],
+    "transform": {
+      ".ts$": [
+        "@swc-node/jest",
+        {
+          "jsc": {
+            "minify": false
+          }
+        }
+      ]
+    }
   },
   "dependencies": {
-    "@hapi/iron": "^6.0.0",
-    "clone": "^2.1.2",
-    "cookie": "^0.4.0"
+    "@types/cookie": "^0.4.0",
+    "@types/node": "^16.11.1",
+    "cookie": "^0.4.1",
+    "iron-store": "^1.3.5"
   },
   "devDependencies": {
-    "@babel/cli": "7.8.4",
-    "@babel/core": "7.8.7",
-    "@babel/preset-env": "7.8.7",
-    "@types/jest": "25.1.3",
-    "babel-jest": "25.1.0",
-    "eslint": "6.8.0",
-    "eslint-plugin-jest": "23.8.1",
-    "jest": "25.1.0",
+    "@swc-node/jest": "1.3.3",
+    "@tsconfig/node12": "1.0.9",
+    "@types/jest": "27.0.2",
+    "@typescript-eslint/eslint-plugin": "5.1.0",
+    "@typescript-eslint/parser": "5.1.0",
+    "eslint": "8.0.1",
+    "jest": "27.3.1",
     "jest-date-mock": "1.0.8",
-    "prettier": "1.19.1",
-    "prettier-plugin-packagejson": "2.0.10",
-    "semantic-release": "17.0.4"
+    "prettier": "2.4.1",
+    "prettier-plugin-packagejson": "2.2.13",
+    "rimraf": "3.0.2",
+    "tsup": "5.4.1",
+    "typescript": "4.4.4"
+  },
+  "peerDependencies": {
+    "next": ">=10"
+  },
+  "peerDependenciesMeta": {
+    "next": {
+      "optional": true
+    }
+  },
+  "engines": {
+    "node": ">=12"
   },
   "renovate": {
     "extends": [
-      "config:js-lib"
+      "config:js-lib",
+      ":automergePatch",
+      ":automergeBranch",
+      ":automergePatch",
+      ":automergeBranch",
+      ":automergeLinters",
+      ":automergeTesters",
+      ":automergeTypes"
+    ],
+    "timezone": "Europe/Paris",
+    "schedule": [
+      "before 3am on Monday"
+    ]
+  },
+  "tsup": {
+    "splitting": false,
+    "sourcemap": true,
+    "clean": true,
+    "dts": true,
+    "target": "es2019",
+    "format": [
+      "esm",
+      "cjs"
+    ],
+    "external": [
+      "iron-session"
     ]
   }
 }

package/index.dist.js

@@ -1,103 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.createSession = createSession;
-exports.getSession = getSession;
-exports.parseCookie = parseCookie;
-exports.deleteCookie = deleteCookie;
-
-var _iron = _interopRequireDefault(require("@hapi/iron"));
-
-var _cookie = _interopRequireDefault(require("cookie"));
-
-var _clone = _interopRequireDefault(require("clone"));
-
-function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
-
-const defaultTtl = 15 * 24 * 3600;
-const cookieName = "__ironSession";
-
-async function createSession({
-  password,
-  ttl = defaultTtl
-}) {
-  return getSession({
-    password,
-    ttl
-  });
-}
-
-async function getSession({
-  sealed,
-  password,
-  ttl = defaultTtl
-}) {
-  const options = { ..._iron.default.defaults,
-    ttl
-  };
-  const store = sealed !== undefined ? await _iron.default.unseal(sealed, password, options) : {
-    persistent: {},
-    flash: {}
-  };
-  return {
-    set({
-      name,
-      value,
-      flash = false
-    }) {
-      if (flash === true) {
-        store.flash[name] = (0, _clone.default)(value);
-      } else {
-        store.persistent[name] = (0, _clone.default)(value);
-      }
-    },
-
-    get({
-      name = undefined
-    } = {}) {
-      if (name === undefined) {
-        const flash = store.flash;
-        store.flash = {};
-        return (0, _clone.default)({ ...flash,
-          ...store.persistent
-        });
-      }
-
-      if (store.flash[name] !== undefined) {
-        const value = store.flash[name];
-        delete store.flash[name];
-        return value; // no need to clone, we removed the reference from the flash store
-      } else {
-        return (0, _clone.default)(store.persistent[name]);
-      }
-    },
-
-    async serializeCookie(cookieOptions = {}) {
-      return _cookie.default.serialize(cookieName, (await _iron.default.seal(store, password, options)), {
-        httpOnly: true,
-        secure: true,
-        sameSite: "lax",
-        maxAge: (ttl === 0 ? 2147483647 : ttl) - 60,
-        // For Iron, ttl 0 means it will never expire. For browser cookies, maxAge 0 means it will expire immediately. WhilCookie must expire before the seal, otherwise you could have expired seals stored in a cookie
-        ...cookieOptions
-      });
-    }
-
-  };
-}
-
-function parseCookie({
-  cookie: cookieValue
-}) {
-  return _cookie.default.parse(cookieValue)[cookieName];
-}
-
-function deleteCookie() {
-  return _cookie.default.serialize(cookieName, "", {
-    maxAge: 0
-  });
-}
-
-//# sourceMappingURL=index.dist.js.map

package/index.dist.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["index.js"],"names":[],"mappings":";;;;;;;;;;AAAA;;AACA;;AACA;;;;AAEA,MAAM,UAAU,GAAG,KAAK,EAAL,GAAU,IAA7B;AACA,MAAM,UAAU,GAAG,eAAnB;;AAEO,eAAe,aAAf,CAA6B;AAAE,EAAA,QAAF;AAAY,EAAA,GAAG,GAAG;AAAlB,CAA7B,EAA6D;AAClE,SAAO,UAAU,CAAC;AAAE,IAAA,QAAF;AAAY,IAAA;AAAZ,GAAD,CAAjB;AACD;;AAEM,eAAe,UAAf,CAA0B;AAAE,EAAA,MAAF;AAAU,EAAA,QAAV;AAAoB,EAAA,GAAG,GAAG;AAA1B,CAA1B,EAAkE;AACvE,QAAM,OAAO,GAAG,EAAE,GAAG,cAAK,QAAV;AAAoB,IAAA;AAApB,GAAhB;AACA,QAAM,KAAK,GACT,MAAM,KAAK,SAAX,GACI,MAAM,cAAK,MAAL,CAAY,MAAZ,EAAoB,QAApB,EAA8B,OAA9B,CADV,GAEI;AAAE,IAAA,UAAU,EAAE,EAAd;AAAkB,IAAA,KAAK,EAAE;AAAzB,GAHN;AAKA,SAAO;AACL,IAAA,GAAG,CAAC;AAAE,MAAA,IAAF;AAAQ,MAAA,KAAR;AAAe,MAAA,KAAK,GAAG;AAAvB,KAAD,EAAiC;AAClC,UAAI,KAAK,KAAK,IAAd,EAAoB;AAClB,QAAA,KAAK,CAAC,KAAN,CAAY,IAAZ,IAAoB,oBAAM,KAAN,CAApB;AACD,OAFD,MAEO;AACL,QAAA,KAAK,CAAC,UAAN,CAAiB,IAAjB,IAAyB,oBAAM,KAAN,CAAzB;AACD;AACF,KAPI;;AAQL,IAAA,GAAG,CAAC;AAAE,MAAA,IAAI,GAAG;AAAT,QAAuB,EAAxB,EAA4B;AAC7B,UAAI,IAAI,KAAK,SAAb,EAAwB;AACtB,cAAM,KAAK,GAAG,KAAK,CAAC,KAApB;AACA,QAAA,KAAK,CAAC,KAAN,GAAc,EAAd;AACA,eAAO,oBAAM,EACX,GAAG,KADQ;AAEX,aAAG,KAAK,CAAC;AAFE,SAAN,CAAP;AAID;;AAED,UAAI,KAAK,CAAC,KAAN,CAAY,IAAZ,MAAsB,SAA1B,EAAqC;AACnC,cAAM,KAAK,GAAG,KAAK,CAAC,KAAN,CAAY,IAAZ,CAAd;AACA,eAAO,KAAK,CAAC,KAAN,CAAY,IAAZ,CAAP;AACA,eAAO,KAAP,CAHmC,CAGrB;AACf,OAJD,MAIO;AACL,eAAO,oBAAM,KAAK,CAAC,UAAN,CAAiB,IAAjB,CAAN,CAAP;AACD;AACF,KAzBI;;AA0BL,UAAM,eAAN,CAAsB,aAAa,GAAG,EAAtC,EAA0C;AACxC,aAAO,gBAAO,SAAP,CACL,UADK,GAEL,MAAM,cAAK,IAAL,CAAU,KAAV,EAAiB,QAAjB,EAA2B,OAA3B,CAFD,GAGL;AACE,QAAA,QAAQ,EAAE,IADZ;AAEE,QAAA,MAAM,EAAE,IAFV;AAGE,QAAA,QAAQ,EAAE,KAHZ;AAIE,QAAA,MAAM,EAAE,CAAC,GAAG,KAAK,CAAR,GAAY,UAAZ,GAAyB,GAA1B,IAAiC,EAJ3C;AAI+C;AAC7C,WAAG;AALL,OAHK,CAAP;AAWD;;AAtCI,GAAP;AAwCD;;AAEM,SAAS,WAAT,CAAqB;AAAE,EAAA,MAAM,EAAE;AAAV,CAArB,EAA8C;AACnD,SAAO,gBAAO,KAAP,CAAa,WAAb,EAA0B,UAA1B,CAAP;AACD;;AAEM,SAAS,YAAT,GAAwB;AAC7B,SAAO,gBAAO,SAAP,CAAiB,UAAjB,EAA6B,EAA7B,EAAiC;AACtC,IAAA,MAAM,EAAE;AAD8B,GAAjC,CAAP;AAGD","file":"index.dist.js","sourcesContent":["import Iron from \"@hapi/iron\";\nimport cookie from \"cookie\";\nimport clone from \"clone\";\n\nconst defaultTtl = 15 * 24 * 3600;\nconst cookieName = \"__ironSession\";\n\nexport async function createSession({ password, ttl = defaultTtl }) {\n  return getSession({ password, ttl });\n}\n\nexport async function getSession({ sealed, password, ttl = defaultTtl }) {\n  const options = { ...Iron.defaults, ttl };\n  const store =\n    sealed !== undefined\n      ? await Iron.unseal(sealed, password, options)\n      : { persistent: {}, flash: {} };\n\n  return {\n    set({ name, value, flash = false }) {\n      if (flash === true) {\n        store.flash[name] = clone(value);\n      } else {\n        store.persistent[name] = clone(value);\n      }\n    },\n    get({ name = undefined } = {}) {\n      if (name === undefined) {\n        const flash = store.flash;\n        store.flash = {};\n        return clone({\n          ...flash,\n          ...store.persistent\n        });\n      }\n\n      if (store.flash[name] !== undefined) {\n        const value = store.flash[name];\n        delete store.flash[name];\n        return value; // no need to clone, we removed the reference from the flash store\n      } else {\n        return clone(store.persistent[name]);\n      }\n    },\n    async serializeCookie(cookieOptions = {}) {\n      return cookie.serialize(\n        cookieName,\n        await Iron.seal(store, password, options),\n        {\n          httpOnly: true,\n          secure: true,\n          sameSite: \"lax\",\n          maxAge: (ttl === 0 ? 2147483647 : ttl) - 60, // For Iron, ttl 0 means it will never expire. For browser cookies, maxAge 0 means it will expire immediately. WhilCookie must expire before the seal, otherwise you could have expired seals stored in a cookie\n          ...cookieOptions\n        }\n      );\n    }\n  };\n}\n\nexport function parseCookie({ cookie: cookieValue }) {\n  return cookie.parse(cookieValue)[cookieName];\n}\n\nexport function deleteCookie() {\n  return cookie.serialize(cookieName, \"\", {\n    maxAge: 0\n  });\n}\n"]}