iron-session 2.0.0-alpha.17 → 2.0.0-alpha.18

package/dist/index.cjs

@@ -0,0 +1,181 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __markAsModule = (target) => __defProp(target, "__esModule", { value: true });
+var __export = (target, all) => {
+  __markAsModule(target);
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __reExport = (target, module2, desc) => {
+  if (module2 && typeof module2 === "object" || typeof module2 === "function") {
+    for (let key of __getOwnPropNames(module2))
+      if (!__hasOwnProp.call(target, key) && key !== "default")
+        __defProp(target, key, { get: () => module2[key], enumerable: !(desc = __getOwnPropDesc(module2, key)) || desc.enumerable });
+  }
+  return target;
+};
+var __toModule = (module2) => {
+  return __reExport(__markAsModule(__defProp(module2 != null ? __create(__getProtoOf(module2)) : {}, "default", module2 && module2.__esModule && "default" in module2 ? { get: () => module2.default, enumerable: true } : { value: module2, enumerable: true })), module2);
+};
+
+// src/index.ts
+__export(exports, {
+  getIronSession: () => getIronSession,
+  sealData: () => sealData,
+  unsealData: () => unsealData
+});
+var import_iron = __toModule(require("@hapi/iron"));
+var import_cookie = __toModule(require("cookie"));
+var timestampSkewSec = 60;
+var fourteenDaysInSeconds = 15 * 24 * 3600;
+var currentMajorVersion = 2;
+var versionDelimiter = "#";
+var defaultOptions = {
+  ttl: fourteenDaysInSeconds,
+  cookieOptions: {
+    httpOnly: true,
+    secure: true,
+    sameSite: "lax",
+    path: "/"
+  }
+};
+async function getIronSession(req, res, userSessionOptions) {
+  var _a, _b;
+  if (!req || !res || !userSessionOptions || !userSessionOptions.cookieName || !userSessionOptions.password) {
+    throw new Error(`iron-session: Bad usage. Minimum usage is const session = await getIronSession(req, res, { cookieName: "...", password: "...". Check the usage here: https://github.com/vvo/iron-session`);
+  }
+  const passwordsAsMap = normalizeStringPasswordToMap(userSessionOptions.password);
+  Object.values(normalizeStringPasswordToMap(userSessionOptions.password)).forEach((password) => {
+    if (password.length < 32) {
+      throw new Error(`iron-session: Bad usage. Password must be at least 32 characters long.`);
+    }
+  });
+  const isHttps = req.socket.encrypted === true;
+  if (((_a = userSessionOptions.cookieOptions) == null ? void 0 : _a.secure) === true && isHttps === false) {
+    throw new Error(`iron-session: Can't use secure cookies when not in https. See usage at https://github.com/vvo/iron-session/`);
+  }
+  const options = {
+    ...defaultOptions,
+    ...userSessionOptions,
+    cookieOptions: {
+      ...defaultOptions.cookieOptions,
+      ...userSessionOptions.cookieOptions || {}
+    }
+  };
+  if (((_b = userSessionOptions.cookieOptions) == null ? void 0 : _b.secure) === void 0) {
+    options.cookieOptions.secure = isHttps;
+  }
+  if (options.ttl === 0) {
+    options.ttl = 2147483647;
+  }
+  if (userSessionOptions.cookieOptions && "maxAge" in userSessionOptions.cookieOptions) {
+    if (userSessionOptions.cookieOptions.maxAge === void 0) {
+      options.ttl = 0;
+    } else {
+      options.cookieOptions.maxAge = computeCookieMaxAge(userSessionOptions.cookieOptions.maxAge);
+    }
+  } else {
+    options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);
+  }
+  const sealFromCookies = (0, import_cookie.parse)(req.headers.cookie || "")[options.cookieName];
+  const session = sealFromCookies === void 0 ? {} : await unsealData(sealFromCookies, passwordsAsMap, options.ttl);
+  Object.defineProperties(session, {
+    save: {
+      value: async function save() {
+        if (res.headersSent === true) {
+          throw new Error(`iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()`);
+        }
+        const seal = await sealData(session, passwordsAsMap, options.ttl);
+        const cookieValue = (0, import_cookie.serialize)(options.cookieName, seal, options.cookieOptions);
+        if (cookieValue.length > 4096) {
+          throw new Error(`iron-session: Cookie length is too big ${cookieValue.length}, browsers will refuse it. Try to remove some data.`);
+        }
+        addToCookies(cookieValue, res);
+      }
+    },
+    destroy: {
+      value: function destroy() {
+        Object.keys(session).forEach((key) => {
+          delete session[key];
+        });
+        const cookieValue = (0, import_cookie.serialize)(options.cookieName, "", {
+          ...options.cookieOptions,
+          maxAge: 0
+        });
+        addToCookies(cookieValue, res);
+      }
+    }
+  });
+  return session;
+}
+function addToCookies(cookieValue, res) {
+  var _a;
+  let existingSetCookie = (_a = res.getHeader("set-cookie")) != null ? _a : [];
+  if (typeof existingSetCookie === "string") {
+    existingSetCookie = [existingSetCookie];
+  }
+  res.setHeader("set-cookie", [...existingSetCookie, cookieValue]);
+}
+function computeCookieMaxAge(ttl) {
+  return ttl - timestampSkewSec;
+}
+async function unsealData(seal, password, ttl = fourteenDaysInSeconds) {
+  const passwordsAsMap = normalizeStringPasswordToMap(password);
+  const { sealWithoutVersion, tokenVersion } = parseSeal(seal);
+  try {
+    const data = await import_iron.default.unseal(sealWithoutVersion, passwordsAsMap, {
+      ...import_iron.default.defaults,
+      ttl: ttl * 1e3
+    });
+    if (tokenVersion === 2) {
+      return data;
+    }
+    return {
+      ...data.persistent
+    };
+  } catch (error) {
+    if (error instanceof Error) {
+      if (error.message === "Expired seal" || error.message === "Bad hmac value" || error.message === "Cannot find password: " || error.message === "Incorrect number of sealed components") {
+        return {};
+      }
+    }
+    throw error;
+  }
+}
+function parseSeal(seal) {
+  if (seal[seal.length - 2] === versionDelimiter) {
+    const [sealWithoutVersion, tokenVersionAsString] = seal.split(versionDelimiter);
+    return {
+      sealWithoutVersion,
+      tokenVersion: parseInt(tokenVersionAsString, 10)
+    };
+  }
+  return { sealWithoutVersion: seal, tokenVersion: null };
+}
+async function sealData(data, password, ttl = fourteenDaysInSeconds) {
+  const passwordsAsMap = normalizeStringPasswordToMap(password);
+  const mostRecentPasswordId = Math.max(...Object.keys(passwordsAsMap).map((id) => parseInt(id, 10)));
+  const passwordForSeal = {
+    id: mostRecentPasswordId.toString(),
+    secret: passwordsAsMap[mostRecentPasswordId]
+  };
+  const seal = await import_iron.default.seal(data, passwordForSeal, {
+    ...import_iron.default.defaults,
+    ttl: ttl * 1e3
+  });
+  return `${seal}${versionDelimiter}${currentMajorVersion}`;
+}
+function normalizeStringPasswordToMap(password) {
+  return typeof password === "string" ? { 1: password } : password;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  getIronSession,
+  sealData,
+  unsealData
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/index.ts"],
+  "sourcesContent": ["import Iron from \"@hapi/iron\";\nimport type { CookieSerializeOptions } from \"cookie\";\nimport { parse as parseCookie, serialize as serializeCookie } from \"cookie\";\nimport type { IncomingMessage, ServerResponse } from \"http\";\nimport type { TLSSocket } from \"tls\";\n\n// default time allowed to check for iron seal validity when ttl passed\n// see https://hapi.dev/family/iron/api/?v=6.0.0#options\nconst timestampSkewSec = 60;\n\ntype passwordsMap = { [id: string]: string };\ntype password = string | passwordsMap;\n\nconst fourteenDaysInSeconds = 15 * 24 * 3600;\n\n// We store a token major version to handle data format changes when any. So that when you upgrade the cookies\n// can be kept alive between upgrades, no need to disconnect everyone.\nconst currentMajorVersion = 2;\nconst versionDelimiter = \"#\";\n\nconst defaultOptions: {\n  ttl: number;\n  cookieOptions: CookieSerializeOptions;\n} = {\n  ttl: fourteenDaysInSeconds,\n  cookieOptions: {\n    httpOnly: true,\n    secure: true,\n    sameSite: \"lax\",\n    path: \"/\",\n  },\n};\n\nexport interface IronSessionOptions {\n  /**\n   * This is the cookie name that will be used inside the browser. You should make sure it's unique given\n   * your application. Example: vercel-session\n   */\n  cookieName: string;\n\n  /**\n   * This is the password(s) that will be used to encrypt the cookie. It can be either a string or an object\n   * like {1: \"password\", 2: password}.\n   *\n   * When you provide multiple passwords then all of them will be used to decrypt the cookie and only the most\n   * recent (= highest key, 2 in this example) password will be used to encrypt the cookie. This allow you\n   * to use password rotation (security)\n   */\n  password: password;\n\n  /**\n   * This is the time in seconds that the session will be valid for. This also set the max-age attribute of\n   * the cookie automatically (minus 60 seconds so that the cookie always expire before the session).\n   */\n  ttl?: number;\n\n  /**\n   * This is the options that will be passed to the cookie library.\n   * You can see all of them here: https://github.com/jshttp/cookie#options-1.\n   *\n   * If you want to use \"session cookies\" (cookies that are deleted when the browser is closed) then you need\n   * to pass cookieOptions: { maxAge: undefined }.\n   */\n  cookieOptions?: CookieSerializeOptions;\n}\n\n// eslint-disable-next-line @typescript-eslint/no-empty-interface\nexport interface IronSessionData {\n  // If we allow for any keys, then there's no more type check on unknown properties which is not good\n  // If we allow for any keys, the later delete will work but I prefer to disable the check at this stage and\n  // provide good type checking instead\n  // [key: string]: unknown;\n}\n\nexport type IronSession = IronSessionData & {\n  /**\n   * Destroys the session data and removes the cookie.\n   */\n  destroy: () => void;\n\n  /**\n   * Encrypts the session data and sets the cookie.\n   */\n  save: () => Promise<void>;\n};\n\ndeclare module \"http\" {\n  interface IncomingMessage {\n    session: IronSession;\n  }\n}\n\nexport async function getIronSession(\n  req: IncomingMessage,\n  res: ServerResponse,\n  userSessionOptions: IronSessionOptions,\n): Promise<IronSession> {\n  if (\n    !req ||\n    !res ||\n    !userSessionOptions ||\n    !userSessionOptions.cookieName ||\n    !userSessionOptions.password\n  ) {\n    throw new Error(\n      `iron-session: Bad usage. Minimum usage is const session = await getIronSession(req, res, { cookieName: \"...\", password: \"...\". Check the usage here: https://github.com/vvo/iron-session`,\n    );\n  }\n\n  const passwordsAsMap = normalizeStringPasswordToMap(\n    userSessionOptions.password,\n  );\n\n  Object.values(\n    normalizeStringPasswordToMap(userSessionOptions.password),\n  ).forEach((password) => {\n    if (password.length < 32) {\n      throw new Error(\n        `iron-session: Bad usage. Password must be at least 32 characters long.`,\n      );\n    }\n  });\n\n  const isHttps = (req.socket as TLSSocket).encrypted === true;\n\n  if (userSessionOptions.cookieOptions?.secure === true && isHttps === false) {\n    throw new Error(\n      `iron-session: Can't use secure cookies when not in https. See usage at https://github.com/vvo/iron-session/`,\n    );\n  }\n\n  const options: Required<IronSessionOptions> = {\n    ...defaultOptions,\n    ...userSessionOptions,\n    cookieOptions: {\n      ...defaultOptions.cookieOptions,\n      ...(userSessionOptions.cookieOptions || {}),\n    },\n  };\n\n  // if the user did not set the secure flag themselves, we automatically configure it\n  if (userSessionOptions.cookieOptions?.secure === undefined) {\n    options.cookieOptions.secure = isHttps;\n  }\n\n  if (options.ttl === 0) {\n    // ttl = 0 means no expiration\n    // but in reality cookies have to expire (can't have no max-age)\n    // 2147483647 is the max value for max-age in cookies\n    // see https://stackoverflow.com/a/11685301/147079\n    options.ttl = 2147483647;\n  }\n\n  if (\n    userSessionOptions.cookieOptions &&\n    \"maxAge\" in userSessionOptions.cookieOptions\n  ) {\n    // session cookie, do not set maxAge, consider token as infinite\n    if (userSessionOptions.cookieOptions.maxAge === undefined) {\n      options.ttl = 0;\n    } else {\n      options.cookieOptions.maxAge = computeCookieMaxAge(\n        userSessionOptions.cookieOptions.maxAge,\n      );\n    }\n  } else {\n    options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);\n  }\n\n  const sealFromCookies = parseCookie(req.headers.cookie || \"\")[\n    options.cookieName\n  ];\n\n  const session =\n    sealFromCookies === undefined\n      ? {}\n      : await unsealData(sealFromCookies, passwordsAsMap, options.ttl);\n\n  Object.defineProperties(session, {\n    save: {\n      value: async function save() {\n        if (res.headersSent === true) {\n          throw new Error(\n            `iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()`,\n          );\n        }\n        const seal = await sealData(session, passwordsAsMap, options.ttl);\n        const cookieValue = serializeCookie(\n          options.cookieName,\n          seal,\n          options.cookieOptions,\n        );\n\n        if (cookieValue.length > 4096) {\n          throw new Error(\n            `iron-session: Cookie length is too big ${cookieValue.length}, browsers will refuse it. Try to remove some data.`,\n          );\n        }\n\n        addToCookies(cookieValue, res);\n      },\n    },\n    destroy: {\n      value: function destroy() {\n        Object.keys(session).forEach((key) => {\n          // @ts-ignore See comment on the IronSessionData interface\n          delete session[key];\n        });\n\n        const cookieValue = serializeCookie(options.cookieName, \"\", {\n          ...options.cookieOptions,\n          maxAge: 0,\n        });\n        addToCookies(cookieValue, res);\n      },\n    },\n  });\n\n  return session as IronSession;\n}\n\nfunction addToCookies(cookieValue: string, res: ServerResponse) {\n  let existingSetCookie =\n    (res.getHeader(\"set-cookie\") as string[] | string) ?? [];\n  if (typeof existingSetCookie === \"string\") {\n    existingSetCookie = [existingSetCookie];\n  }\n  res.setHeader(\"set-cookie\", [...existingSetCookie, cookieValue]);\n}\n\nfunction computeCookieMaxAge(ttl: number) {\n  // The next line makes sure browser will expire cookies before seals are considered expired by the server.\n  // It also allows for clock difference of 60 seconds maximum between server and clients.\n  // It also makes sure to expire the cookie immediately when value is 0\n  return ttl - timestampSkewSec;\n}\n\nexport async function unsealData(\n  seal: string,\n  password: password,\n  ttl: number = fourteenDaysInSeconds,\n): Promise<IronSessionData> {\n  const passwordsAsMap = normalizeStringPasswordToMap(password);\n  const { sealWithoutVersion, tokenVersion } = parseSeal(seal);\n\n  try {\n    const data = await Iron.unseal(sealWithoutVersion, passwordsAsMap, {\n      ...Iron.defaults,\n      ttl: ttl * 1000,\n    });\n\n    if (tokenVersion === 2) {\n      return data;\n    }\n\n    return {\n      ...data.persistent,\n    };\n  } catch (error) {\n    if (error instanceof Error) {\n      if (\n        error.message === \"Expired seal\" ||\n        error.message === \"Bad hmac value\" ||\n        error.message === \"Cannot find password: \" ||\n        error.message === \"Incorrect number of sealed components\"\n      ) {\n        // if seal expired or\n        // if seal is not valid (encrypted using a different password, when passwords are badly rotated) or\n        // if we can't find back the password in the seal\n        // then we just start a new session over\n        return {};\n      }\n    }\n\n    throw error;\n  }\n}\n\nfunction parseSeal(seal: string): {\n  sealWithoutVersion: string;\n  tokenVersion: number | null;\n} {\n  if (seal[seal.length - 2] === versionDelimiter) {\n    const [sealWithoutVersion, tokenVersionAsString] =\n      seal.split(versionDelimiter);\n    return {\n      sealWithoutVersion,\n      tokenVersion: parseInt(tokenVersionAsString, 10),\n    };\n  }\n\n  return { sealWithoutVersion: seal, tokenVersion: null };\n}\n\nexport async function sealData(\n  data: IronSessionData,\n  password: password,\n  ttl: number = fourteenDaysInSeconds,\n) {\n  const passwordsAsMap = normalizeStringPasswordToMap(password);\n\n  const mostRecentPasswordId = Math.max(\n    ...Object.keys(passwordsAsMap).map((id) => parseInt(id, 10)),\n  );\n\n  const passwordForSeal = {\n    id: mostRecentPasswordId.toString(),\n    secret: passwordsAsMap[mostRecentPasswordId],\n  };\n\n  const seal = await Iron.seal(data, passwordForSeal, {\n    ...Iron.defaults,\n    ttl: ttl * 1000,\n  });\n\n  return `${seal}${versionDelimiter}${currentMajorVersion}`;\n}\n\nfunction normalizeStringPasswordToMap(password: password) {\n  return typeof password === \"string\" ? { 1: password } : password;\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kBAAiB;AAEjB,oBAAmE;AAMnE,IAAM,mBAAmB;AAKzB,IAAM,wBAAwB,KAAK,KAAK;AAIxC,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AAEzB,IAAM,iBAGF;AAAA,EACF,KAAK;AAAA,EACL,eAAe;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA;AAAA;AA+DV,8BACE,KACA,KACA,oBACsB;AAhGxB;AAiGE,MACE,CAAC,OACD,CAAC,OACD,CAAC,sBACD,CAAC,mBAAmB,cACpB,CAAC,mBAAmB,UACpB;AACA,UAAM,IAAI,MACR;AAAA;AAIJ,QAAM,iBAAiB,6BACrB,mBAAmB;AAGrB,SAAO,OACL,6BAA6B,mBAAmB,WAChD,QAAQ,CAAC,aAAa;AACtB,QAAI,SAAS,SAAS,IAAI;AACxB,YAAM,IAAI,MACR;AAAA;AAAA;AAKN,QAAM,UAAW,IAAI,OAAqB,cAAc;AAExD,MAAI,0BAAmB,kBAAnB,mBAAkC,YAAW,QAAQ,YAAY,OAAO;AAC1E,UAAM,IAAI,MACR;AAAA;AAIJ,QAAM,UAAwC;AAAA,OACzC;AAAA,OACA;AAAA,IACH,eAAe;AAAA,SACV,eAAe;AAAA,SACd,mBAAmB,iBAAiB;AAAA;AAAA;AAK5C,MAAI,0BAAmB,kBAAnB,mBAAkC,YAAW,QAAW;AAC1D,YAAQ,cAAc,SAAS;AAAA;AAGjC,MAAI,QAAQ,QAAQ,GAAG;AAKrB,YAAQ,MAAM;AAAA;AAGhB,MACE,mBAAmB,iBACnB,YAAY,mBAAmB,eAC/B;AAEA,QAAI,mBAAmB,cAAc,WAAW,QAAW;AACzD,cAAQ,MAAM;AAAA,WACT;AACL,cAAQ,cAAc,SAAS,oBAC7B,mBAAmB,cAAc;AAAA;AAAA,SAGhC;AACL,YAAQ,cAAc,SAAS,oBAAoB,QAAQ;AAAA;AAG7D,QAAM,kBAAkB,yBAAY,IAAI,QAAQ,UAAU,IACxD,QAAQ;AAGV,QAAM,UACJ,oBAAoB,SAChB,KACA,MAAM,WAAW,iBAAiB,gBAAgB,QAAQ;AAEhE,SAAO,iBAAiB,SAAS;AAAA,IAC/B,MAAM;AAAA,MACJ,OAAO,sBAAsB;AAC3B,YAAI,IAAI,gBAAgB,MAAM;AAC5B,gBAAM,IAAI,MACR;AAAA;AAGJ,cAAM,OAAO,MAAM,SAAS,SAAS,gBAAgB,QAAQ;AAC7D,cAAM,cAAc,6BAClB,QAAQ,YACR,MACA,QAAQ;AAGV,YAAI,YAAY,SAAS,MAAM;AAC7B,gBAAM,IAAI,MACR,0CAA0C,YAAY;AAAA;AAI1D,qBAAa,aAAa;AAAA;AAAA;AAAA,IAG9B,SAAS;AAAA,MACP,OAAO,mBAAmB;AACxB,eAAO,KAAK,SAAS,QAAQ,CAAC,QAAQ;AAEpC,iBAAO,QAAQ;AAAA;AAGjB,cAAM,cAAc,6BAAgB,QAAQ,YAAY,IAAI;AAAA,aACvD,QAAQ;AAAA,UACX,QAAQ;AAAA;AAEV,qBAAa,aAAa;AAAA;AAAA;AAAA;AAKhC,SAAO;AAAA;AAGT,sBAAsB,aAAqB,KAAqB;AA7NhE;AA8NE,MAAI,oBACD,UAAI,UAAU,kBAAd,YAAqD;AACxD,MAAI,OAAO,sBAAsB,UAAU;AACzC,wBAAoB,CAAC;AAAA;AAEvB,MAAI,UAAU,cAAc,CAAC,GAAG,mBAAmB;AAAA;AAGrD,6BAA6B,KAAa;AAIxC,SAAO,MAAM;AAAA;AAGf,0BACE,MACA,UACA,MAAc,uBACY;AAC1B,QAAM,iBAAiB,6BAA6B;AACpD,QAAM,EAAE,oBAAoB,iBAAiB,UAAU;AAEvD,MAAI;AACF,UAAM,OAAO,MAAM,oBAAK,OAAO,oBAAoB,gBAAgB;AAAA,SAC9D,oBAAK;AAAA,MACR,KAAK,MAAM;AAAA;AAGb,QAAI,iBAAiB,GAAG;AACtB,aAAO;AAAA;AAGT,WAAO;AAAA,SACF,KAAK;AAAA;AAAA,WAEH,OAAP;AACA,QAAI,iBAAiB,OAAO;AAC1B,UACE,MAAM,YAAY,kBAClB,MAAM,YAAY,oBAClB,MAAM,YAAY,4BAClB,MAAM,YAAY,yCAClB;AAKA,eAAO;AAAA;AAAA;AAIX,UAAM;AAAA;AAAA;AAIV,mBAAmB,MAGjB;AACA,MAAI,KAAK,KAAK,SAAS,OAAO,kBAAkB;AAC9C,UAAM,CAAC,oBAAoB,wBACzB,KAAK,MAAM;AACb,WAAO;AAAA,MACL;AAAA,MACA,cAAc,SAAS,sBAAsB;AAAA;AAAA;AAIjD,SAAO,EAAE,oBAAoB,MAAM,cAAc;AAAA;AAGnD,wBACE,MACA,UACA,MAAc,uBACd;AACA,QAAM,iBAAiB,6BAA6B;AAEpD,QAAM,uBAAuB,KAAK,IAChC,GAAG,OAAO,KAAK,gBAAgB,IAAI,CAAC,OAAO,SAAS,IAAI;AAG1D,QAAM,kBAAkB;AAAA,IACtB,IAAI,qBAAqB;AAAA,IACzB,QAAQ,eAAe;AAAA;AAGzB,QAAM,OAAO,MAAM,oBAAK,KAAK,MAAM,iBAAiB;AAAA,OAC/C,oBAAK;AAAA,IACR,KAAK,MAAM;AAAA;AAGb,SAAO,GAAG,OAAO,mBAAmB;AAAA;AAGtC,sCAAsC,UAAoB;AACxD,SAAO,OAAO,aAAa,WAAW,EAAE,GAAG,aAAa;AAAA;",
+  "names": []
+}

package/dist/index.d.ts

@@ -2,51 +2,57 @@ import { CookieSerializeOptions } from 'cookie';
 import { IncomingMessage, ServerResponse } from 'http';
 
 declare type passwordsMap = {
-    [id: number]: string;
+    [id: string]: string;
 };
 declare type password = string | passwordsMap;
 interface IronSessionOptions {
+    /**
+     * This is the cookie name that will be used inside the browser. You should make sure it's unique given
+     * your application. Example: vercel-session
+     */
     cookieName: string;
+    /**
+     * This is the password(s) that will be used to encrypt the cookie. It can be either a string or an object
+     * like {1: "password", 2: password}.
+     *
+     * When you provide multiple passwords then all of them will be used to decrypt the cookie and only the most
+     * recent (= highest key, 2 in this example) password will be used to encrypt the cookie. This allow you
+     * to use password rotation (security)
+     */
     password: password;
+    /**
+     * This is the time in seconds that the session will be valid for. This also set the max-age attribute of
+     * the cookie automatically (minus 60 seconds so that the cookie always expire before the session).
+     */
     ttl?: number;
+    /**
+     * This is the options that will be passed to the cookie library.
+     * You can see all of them here: https://github.com/jshttp/cookie#options-1.
+     *
+     * If you want to use "session cookies" (cookies that are deleted when the browser is closed) then you need
+     * to pass cookieOptions: { maxAge: undefined }.
+     */
     cookieOptions?: CookieSerializeOptions;
 }
-declare module "iron-session" {
-    interface IronSessionData {
-        [key: string]: unknown;
-    }
+interface IronSessionData {
 }
-interface IronSessionBase {
+declare type IronSession = IronSessionData & {
+    /**
+     * Destroys the session data and removes the cookie.
+     */
     destroy: () => void;
+    /**
+     * Encrypts the session data and sets the cookie.
+     */
     save: () => Promise<void>;
-}
-declare type IronSession<T = IronSessionData> = T & IronSessionBase;
+};
 declare module "http" {
     interface IncomingMessage {
-        /**
-         * This request's `Session` object.
-         * Even though this property isn't marked as optional, it won't exist until you use the `express-session` middleware
-         * [Declaration merging](https://www.typescriptlang.org/docs/handbook/declaration-merging.html) can be used to add your own properties.
-         *
-         * @see SessionData
-         */
         session: IronSession;
     }
 }
-declare module "http" {
-    interface IncomingMessage {
-        /**
-         * This request's `Session` object.
-         * Even though this property isn't marked as optional, it won't exist until you use the `express-session` middleware
-         * [Declaration merging](https://www.typescriptlang.org/docs/handbook/declaration-merging.html) can be used to add your own properties.
-         *
-         * @see SessionData
-         */
-        session: IronSession<IronSessionData>;
-    }
-}
-declare function getIronSession<T = IronSessionData>(req: IncomingMessage, res: ServerResponse, userSessionOptions: IronSessionOptions): Promise<IronSession<Partial<T>>>;
-declare function unsealSession(seal: string, password: passwordsMap, ttl: number): Promise<IronSessionData>;
-declare function sealSession(data: Record<string, unknown>, password: passwordsMap, ttl: number): Promise<string>;
+declare function getIronSession(req: IncomingMessage, res: ServerResponse, userSessionOptions: IronSessionOptions): Promise<IronSession>;
+declare function unsealData(seal: string, password: password, ttl?: number): Promise<IronSessionData>;
+declare function sealData(data: IronSessionData, password: password, ttl?: number): Promise<string>;
 
-export { IronSession, IronSessionOptions, getIronSession, sealSession, unsealSession };
+export { IronSession, IronSessionData, IronSessionOptions, getIronSession, sealData, unsealData };

package/dist/index.js

@@ -1,38 +1,12 @@
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __markAsModule = (target) => __defProp(target, "__esModule", { value: true });
-var __export = (target, all) => {
-  __markAsModule(target);
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __reExport = (target, module2, desc) => {
-  if (module2 && typeof module2 === "object" || typeof module2 === "function") {
-    for (let key of __getOwnPropNames(module2))
-      if (!__hasOwnProp.call(target, key) && key !== "default")
-        __defProp(target, key, { get: () => module2[key], enumerable: !(desc = __getOwnPropDesc(module2, key)) || desc.enumerable });
-  }
-  return target;
-};
-var __toModule = (module2) => {
-  return __reExport(__markAsModule(__defProp(module2 != null ? __create(__getProtoOf(module2)) : {}, "default", module2 && module2.__esModule && "default" in module2 ? { get: () => module2.default, enumerable: true } : { value: module2, enumerable: true })), module2);
-};
-
 // src/index.ts
-__export(exports, {
-  getIronSession: () => getIronSession,
-  sealSession: () => sealSession,
-  unsealSession: () => unsealSession
-});
-var import_iron = __toModule(require("@hapi/iron"));
-var import_cookie = __toModule(require("cookie"));
+import Iron from "@hapi/iron";
+import { parse as parseCookie, serialize as serializeCookie } from "cookie";
 var timestampSkewSec = 60;
+var fourteenDaysInSeconds = 15 * 24 * 3600;
+var currentMajorVersion = 2;
+var versionDelimiter = "#";
 var defaultOptions = {
-  ttl: 15 * 24 * 3600,
+  ttl: fourteenDaysInSeconds,
   cookieOptions: {
     httpOnly: true,
     secure: true,
@@ -41,15 +15,20 @@ var defaultOptions = {
   }
 };
 async function getIronSession(req, res, userSessionOptions) {
+  var _a, _b;
   if (!req || !res || !userSessionOptions || !userSessionOptions.cookieName || !userSessionOptions.password) {
     throw new Error(`iron-session: Bad usage. Minimum usage is const session = await getIronSession(req, res, { cookieName: "...", password: "...". Check the usage here: https://github.com/vvo/iron-session`);
   }
-  const passwordsAsMap = typeof userSessionOptions.password === "string" ? { 1: userSessionOptions.password } : userSessionOptions.password;
-  Object.values(passwordsAsMap).forEach((password) => {
+  const passwordsAsMap = normalizeStringPasswordToMap(userSessionOptions.password);
+  Object.values(normalizeStringPasswordToMap(userSessionOptions.password)).forEach((password) => {
     if (password.length < 32) {
       throw new Error(`iron-session: Bad usage. Password must be at least 32 characters long.`);
     }
   });
+  const isHttps = req.socket.encrypted === true;
+  if (((_a = userSessionOptions.cookieOptions) == null ? void 0 : _a.secure) === true && isHttps === false) {
+    throw new Error(`iron-session: Can't use secure cookies when not in https. See usage at https://github.com/vvo/iron-session/`);
+  }
   const options = {
     ...defaultOptions,
     ...userSessionOptions,
@@ -58,8 +37,8 @@ async function getIronSession(req, res, userSessionOptions) {
       ...userSessionOptions.cookieOptions || {}
     }
   };
-  if (!req.socket.encrypted && options.cookieOptions.secure === true) {
-    throw new Error(`iron-session: Can't use secure cookies when not in https. See usage at https://github.com/vvo/iron-session/`);
+  if (((_b = userSessionOptions.cookieOptions) == null ? void 0 : _b.secure) === void 0) {
+    options.cookieOptions.secure = isHttps;
   }
   if (options.ttl === 0) {
     options.ttl = 2147483647;
@@ -73,26 +52,28 @@ async function getIronSession(req, res, userSessionOptions) {
   } else {
     options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);
   }
-  const sealFromCookies = (0, import_cookie.parse)(req.headers.cookie || "")[options.cookieName];
-  const sessionData = await unsealSession(sealFromCookies, passwordsAsMap, options.ttl * 1e3);
-  const session = Object.defineProperties(sessionData, {
+  const sealFromCookies = parseCookie(req.headers.cookie || "")[options.cookieName];
+  const session = sealFromCookies === void 0 ? {} : await unsealData(sealFromCookies, passwordsAsMap, options.ttl);
+  Object.defineProperties(session, {
     save: {
       value: async function save() {
         if (res.headersSent === true) {
           throw new Error(`iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()`);
         }
-        const seal = await sealSession(sessionData, passwordsAsMap, options.ttl * 1e3);
-        const cookieValue = (0, import_cookie.serialize)(options.cookieName, seal, options.cookieOptions);
+        const seal = await sealData(session, passwordsAsMap, options.ttl);
+        const cookieValue = serializeCookie(options.cookieName, seal, options.cookieOptions);
         if (cookieValue.length > 4096) {
           throw new Error(`iron-session: Cookie length is too big ${cookieValue.length}, browsers will refuse it. Try to remove some data.`);
         }
         addToCookies(cookieValue, res);
-        return cookieValue;
       }
     },
     destroy: {
       value: function destroy() {
-        const cookieValue = (0, import_cookie.serialize)(options.cookieName, "", {
+        Object.keys(session).forEach((key) => {
+          delete session[key];
+        });
+        const cookieValue = serializeCookie(options.cookieName, "", {
           ...options.cookieOptions,
           maxAge: 0
         });
@@ -113,12 +94,20 @@ function addToCookies(cookieValue, res) {
 function computeCookieMaxAge(ttl) {
   return ttl - timestampSkewSec;
 }
-async function unsealSession(seal, password, ttl) {
+async function unsealData(seal, password, ttl = fourteenDaysInSeconds) {
+  const passwordsAsMap = normalizeStringPasswordToMap(password);
+  const { sealWithoutVersion, tokenVersion } = parseSeal(seal);
   try {
-    await import_iron.default.unseal(seal, password, {
-      ...import_iron.default.defaults,
-      ttl
+    const data = await Iron.unseal(sealWithoutVersion, passwordsAsMap, {
+      ...Iron.defaults,
+      ttl: ttl * 1e3
     });
+    if (tokenVersion === 2) {
+      return data;
+    }
+    return {
+      ...data.persistent
+    };
   } catch (error) {
     if (error instanceof Error) {
       if (error.message === "Expired seal" || error.message === "Bad hmac value" || error.message === "Cannot find password: " || error.message === "Incorrect number of sealed components") {
@@ -127,20 +116,36 @@ async function unsealSession(seal, password, ttl) {
     }
     throw error;
   }
-  return {};
 }
-async function sealSession(data, password, ttl) {
-  const mostRecentPasswordId = Math.max(...Object.keys(password).map((id) => parseInt(id, 10)));
-  const seal = await import_iron.default.seal(data, password[mostRecentPasswordId], {
-    ...import_iron.default.defaults,
-    ttl
+function parseSeal(seal) {
+  if (seal[seal.length - 2] === versionDelimiter) {
+    const [sealWithoutVersion, tokenVersionAsString] = seal.split(versionDelimiter);
+    return {
+      sealWithoutVersion,
+      tokenVersion: parseInt(tokenVersionAsString, 10)
+    };
+  }
+  return { sealWithoutVersion: seal, tokenVersion: null };
+}
+async function sealData(data, password, ttl = fourteenDaysInSeconds) {
+  const passwordsAsMap = normalizeStringPasswordToMap(password);
+  const mostRecentPasswordId = Math.max(...Object.keys(passwordsAsMap).map((id) => parseInt(id, 10)));
+  const passwordForSeal = {
+    id: mostRecentPasswordId.toString(),
+    secret: passwordsAsMap[mostRecentPasswordId]
+  };
+  const seal = await Iron.seal(data, passwordForSeal, {
+    ...Iron.defaults,
+    ttl: ttl * 1e3
   });
-  return seal;
+  return `${seal}${versionDelimiter}${currentMajorVersion}`;
+}
+function normalizeStringPasswordToMap(password) {
+  return typeof password === "string" ? { 1: password } : password;
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
+export {
   getIronSession,
-  sealSession,
-  unsealSession
-});
+  sealData,
+  unsealData
+};
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/index.ts"],
-  "sourcesContent": ["import Iron from \"@hapi/iron\";\nimport {\n  parse as parseCookie,\n  serialize as serializeCookie,\n  CookieSerializeOptions,\n} from \"cookie\";\nimport type { IncomingMessage, ServerResponse } from \"http\";\nimport { TLSSocket } from \"tls\";\n\n// default time allowed to check for iron seal validity when ttl passed\n// see https://hapi.dev/family/iron/api/?v=6.0.0#options\nconst timestampSkewSec = 60;\n\ntype passwordsMap = { [id: number]: string };\ntype password = string | passwordsMap;\n\nconst defaultOptions: {\n  ttl: number;\n  cookieOptions: CookieSerializeOptions;\n} = {\n  ttl: 15 * 24 * 3600,\n  cookieOptions: {\n    httpOnly: true,\n    secure: true,\n    sameSite: \"lax\",\n    path: \"/\",\n  },\n};\n\nexport interface IronSessionOptions {\n  cookieName: string;\n  password: password;\n  ttl?: number;\n  cookieOptions?: CookieSerializeOptions;\n}\n\ndeclare module \"iron-session\" {\n  interface IronSessionData {\n    [key: string]: unknown;\n  }\n}\n\ndeclare module \"http\" {\n  interface IncomingMessage {\n    /**\n     * This request's `Session` object.\n     * Even though this property isn't marked as optional, it won't exist until you use the `express-session` middleware\n     * [Declaration merging](https://www.typescriptlang.org/docs/handbook/declaration-merging.html) can be used to add your own properties.\n     *\n     * @see SessionData\n     */\n    session: IronSession;\n  }\n}\ninterface IronSessionBase {\n  destroy: () => void;\n  save: () => Promise<void>;\n}\n\nexport type IronSession<T = IronSessionData> = T & IronSessionBase;\n\ndeclare module \"http\" {\n  interface IncomingMessage {\n    /**\n     * This request's `Session` object.\n     * Even though this property isn't marked as optional, it won't exist until you use the `express-session` middleware\n     * [Declaration merging](https://www.typescriptlang.org/docs/handbook/declaration-merging.html) can be used to add your own properties.\n     *\n     * @see SessionData\n     */\n    session: IronSession<IronSessionData>;\n  }\n}\n\nexport async function getIronSession<T = IronSessionData>(\n  req: IncomingMessage,\n  res: ServerResponse,\n  userSessionOptions: IronSessionOptions,\n): Promise<IronSession<Partial<T>>> {\n  if (\n    !req ||\n    !res ||\n    !userSessionOptions ||\n    !userSessionOptions.cookieName ||\n    !userSessionOptions.password\n  ) {\n    throw new Error(\n      `iron-session: Bad usage. Minimum usage is const session = await getIronSession(req, res, { cookieName: \"...\", password: \"...\". Check the usage here: https://github.com/vvo/iron-session`,\n    );\n  }\n\n  const passwordsAsMap =\n    typeof userSessionOptions.password === \"string\"\n      ? { 1: userSessionOptions.password }\n      : userSessionOptions.password;\n\n  Object.values(passwordsAsMap).forEach((password) => {\n    if (password.length < 32) {\n      throw new Error(\n        `iron-session: Bad usage. Password must be at least 32 characters long.`,\n      );\n    }\n  });\n\n  const options: Required<IronSessionOptions> = {\n    ...defaultOptions,\n    ...userSessionOptions,\n    cookieOptions: {\n      ...defaultOptions.cookieOptions,\n      ...(userSessionOptions.cookieOptions || {}),\n    },\n  };\n\n  if (\n    !(req.socket as TLSSocket).encrypted &&\n    options.cookieOptions.secure === true\n  ) {\n    throw new Error(\n      `iron-session: Can't use secure cookies when not in https. See usage at https://github.com/vvo/iron-session/`,\n    );\n  }\n\n  if (options.ttl === 0) {\n    // ttl = 0 means no expiration\n    // but in reality cookies have to expire (can't have no max-age)\n    // 2147483647 is the max value for max-age in cookies\n    // see https://stackoverflow.com/a/11685301/147079\n    options.ttl = 2147483647;\n  }\n\n  if (\n    userSessionOptions.cookieOptions &&\n    \"maxAge\" in userSessionOptions.cookieOptions\n  ) {\n    // session cookie, do not set maxAge, consider token as infinite\n    if (userSessionOptions.cookieOptions.maxAge === undefined) {\n      options.ttl = 0;\n    } else {\n      options.cookieOptions.maxAge = computeCookieMaxAge(\n        userSessionOptions.cookieOptions.maxAge,\n      );\n    }\n  } else {\n    options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);\n  }\n\n  const sealFromCookies = parseCookie(req.headers.cookie || \"\")[\n    options.cookieName\n  ];\n\n  const sessionData = await unsealSession(\n    sealFromCookies,\n    passwordsAsMap,\n    options.ttl * 1000,\n  );\n\n  const session = Object.defineProperties(sessionData, {\n    save: {\n      value: async function save() {\n        if (res.headersSent === true) {\n          throw new Error(\n            `iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()`,\n          );\n        }\n        const seal = await sealSession(\n          sessionData,\n          passwordsAsMap,\n          options.ttl * 1000,\n        );\n        const cookieValue = serializeCookie(\n          options.cookieName,\n          seal,\n          options.cookieOptions,\n        );\n\n        if (cookieValue.length > 4096) {\n          throw new Error(\n            `iron-session: Cookie length is too big ${cookieValue.length}, browsers will refuse it. Try to remove some data.`,\n          );\n        }\n\n        addToCookies(cookieValue, res);\n        return cookieValue;\n      },\n    },\n    destroy: {\n      value: function destroy() {\n        const cookieValue = serializeCookie(options.cookieName, \"\", {\n          ...options.cookieOptions,\n          maxAge: 0,\n        });\n        addToCookies(cookieValue, res);\n      },\n    },\n  }) as IronSession<Partial<T>>;\n\n  return session;\n}\n\nfunction addToCookies(cookieValue: string, res: ServerResponse) {\n  let existingSetCookie =\n    (res.getHeader(\"set-cookie\") as string[] | string) ?? [];\n  if (typeof existingSetCookie === \"string\") {\n    existingSetCookie = [existingSetCookie];\n  }\n  res.setHeader(\"set-cookie\", [...existingSetCookie, cookieValue]);\n}\n\nfunction computeCookieMaxAge(ttl: number) {\n  // The next line makes sure browser will expire cookies before seals are considered expired by the server.\n  // It also allows for clock difference of 60 seconds maximum between server and clients.\n  // It also makes sure to expire the cookie immediately when value is 0\n  return ttl - timestampSkewSec;\n}\n\nexport async function unsealSession(\n  seal: string,\n  password: passwordsMap,\n  ttl: number,\n): Promise<IronSessionData> {\n  try {\n    await Iron.unseal(seal, password, {\n      ...Iron.defaults,\n      ttl,\n    });\n  } catch (error) {\n    if (error instanceof Error) {\n      if (\n        error.message === \"Expired seal\" ||\n        error.message === \"Bad hmac value\" ||\n        error.message === \"Cannot find password: \" ||\n        error.message === \"Incorrect number of sealed components\"\n      ) {\n        // if seal expired or\n        // if seal is not valid (encrypted using a different password, when passwords are updated) or\n        // if we can't find back the password in the seal\n        // then we just start a new session over\n        return {};\n      }\n    }\n\n    throw error;\n  }\n\n  return {};\n}\n\nexport async function sealSession(\n  data: Record<string, unknown>,\n  password: passwordsMap,\n  ttl: number,\n) {\n  const mostRecentPasswordId = Math.max(\n    ...Object.keys(password).map((id) => parseInt(id, 10)),\n  );\n\n  const seal = await Iron.seal(data, password[mostRecentPasswordId], {\n    ...Iron.defaults,\n    ttl,\n  });\n\n  return seal;\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kBAAiB;AACjB,oBAIO;AAMP,IAAM,mBAAmB;AAKzB,IAAM,iBAGF;AAAA,EACF,KAAK,KAAK,KAAK;AAAA,EACf,eAAe;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA;AAAA;AAiDV,8BACE,KACA,KACA,oBACkC;AAClC,MACE,CAAC,OACD,CAAC,OACD,CAAC,sBACD,CAAC,mBAAmB,cACpB,CAAC,mBAAmB,UACpB;AACA,UAAM,IAAI,MACR;AAAA;AAIJ,QAAM,iBACJ,OAAO,mBAAmB,aAAa,WACnC,EAAE,GAAG,mBAAmB,aACxB,mBAAmB;AAEzB,SAAO,OAAO,gBAAgB,QAAQ,CAAC,aAAa;AAClD,QAAI,SAAS,SAAS,IAAI;AACxB,YAAM,IAAI,MACR;AAAA;AAAA;AAKN,QAAM,UAAwC;AAAA,OACzC;AAAA,OACA;AAAA,IACH,eAAe;AAAA,SACV,eAAe;AAAA,SACd,mBAAmB,iBAAiB;AAAA;AAAA;AAI5C,MACE,CAAE,IAAI,OAAqB,aAC3B,QAAQ,cAAc,WAAW,MACjC;AACA,UAAM,IAAI,MACR;AAAA;AAIJ,MAAI,QAAQ,QAAQ,GAAG;AAKrB,YAAQ,MAAM;AAAA;AAGhB,MACE,mBAAmB,iBACnB,YAAY,mBAAmB,eAC/B;AAEA,QAAI,mBAAmB,cAAc,WAAW,QAAW;AACzD,cAAQ,MAAM;AAAA,WACT;AACL,cAAQ,cAAc,SAAS,oBAC7B,mBAAmB,cAAc;AAAA;AAAA,SAGhC;AACL,YAAQ,cAAc,SAAS,oBAAoB,QAAQ;AAAA;AAG7D,QAAM,kBAAkB,yBAAY,IAAI,QAAQ,UAAU,IACxD,QAAQ;AAGV,QAAM,cAAc,MAAM,cACxB,iBACA,gBACA,QAAQ,MAAM;AAGhB,QAAM,UAAU,OAAO,iBAAiB,aAAa;AAAA,IACnD,MAAM;AAAA,MACJ,OAAO,sBAAsB;AAC3B,YAAI,IAAI,gBAAgB,MAAM;AAC5B,gBAAM,IAAI,MACR;AAAA;AAGJ,cAAM,OAAO,MAAM,YACjB,aACA,gBACA,QAAQ,MAAM;AAEhB,cAAM,cAAc,6BAClB,QAAQ,YACR,MACA,QAAQ;AAGV,YAAI,YAAY,SAAS,MAAM;AAC7B,gBAAM,IAAI,MACR,0CAA0C,YAAY;AAAA;AAI1D,qBAAa,aAAa;AAC1B,eAAO;AAAA;AAAA;AAAA,IAGX,SAAS;AAAA,MACP,OAAO,mBAAmB;AACxB,cAAM,cAAc,6BAAgB,QAAQ,YAAY,IAAI;AAAA,aACvD,QAAQ;AAAA,UACX,QAAQ;AAAA;AAEV,qBAAa,aAAa;AAAA;AAAA;AAAA;AAKhC,SAAO;AAAA;AAGT,sBAAsB,aAAqB,KAAqB;AAvMhE;AAwME,MAAI,oBACD,UAAI,UAAU,kBAAd,YAAqD;AACxD,MAAI,OAAO,sBAAsB,UAAU;AACzC,wBAAoB,CAAC;AAAA;AAEvB,MAAI,UAAU,cAAc,CAAC,GAAG,mBAAmB;AAAA;AAGrD,6BAA6B,KAAa;AAIxC,SAAO,MAAM;AAAA;AAGf,6BACE,MACA,UACA,KAC0B;AAC1B,MAAI;AACF,UAAM,oBAAK,OAAO,MAAM,UAAU;AAAA,SAC7B,oBAAK;AAAA,MACR;AAAA;AAAA,WAEK,OAAP;AACA,QAAI,iBAAiB,OAAO;AAC1B,UACE,MAAM,YAAY,kBAClB,MAAM,YAAY,oBAClB,MAAM,YAAY,4BAClB,MAAM,YAAY,yCAClB;AAKA,eAAO;AAAA;AAAA;AAIX,UAAM;AAAA;AAGR,SAAO;AAAA;AAGT,2BACE,MACA,UACA,KACA;AACA,QAAM,uBAAuB,KAAK,IAChC,GAAG,OAAO,KAAK,UAAU,IAAI,CAAC,OAAO,SAAS,IAAI;AAGpD,QAAM,OAAO,MAAM,oBAAK,KAAK,MAAM,SAAS,uBAAuB;AAAA,OAC9D,oBAAK;AAAA,IACR;AAAA;AAGF,SAAO;AAAA;",
+  "sourcesContent": ["import Iron from \"@hapi/iron\";\nimport type { CookieSerializeOptions } from \"cookie\";\nimport { parse as parseCookie, serialize as serializeCookie } from \"cookie\";\nimport type { IncomingMessage, ServerResponse } from \"http\";\nimport type { TLSSocket } from \"tls\";\n\n// default time allowed to check for iron seal validity when ttl passed\n// see https://hapi.dev/family/iron/api/?v=6.0.0#options\nconst timestampSkewSec = 60;\n\ntype passwordsMap = { [id: string]: string };\ntype password = string | passwordsMap;\n\nconst fourteenDaysInSeconds = 15 * 24 * 3600;\n\n// We store a token major version to handle data format changes when any. So that when you upgrade the cookies\n// can be kept alive between upgrades, no need to disconnect everyone.\nconst currentMajorVersion = 2;\nconst versionDelimiter = \"#\";\n\nconst defaultOptions: {\n  ttl: number;\n  cookieOptions: CookieSerializeOptions;\n} = {\n  ttl: fourteenDaysInSeconds,\n  cookieOptions: {\n    httpOnly: true,\n    secure: true,\n    sameSite: \"lax\",\n    path: \"/\",\n  },\n};\n\nexport interface IronSessionOptions {\n  /**\n   * This is the cookie name that will be used inside the browser. You should make sure it's unique given\n   * your application. Example: vercel-session\n   */\n  cookieName: string;\n\n  /**\n   * This is the password(s) that will be used to encrypt the cookie. It can be either a string or an object\n   * like {1: \"password\", 2: password}.\n   *\n   * When you provide multiple passwords then all of them will be used to decrypt the cookie and only the most\n   * recent (= highest key, 2 in this example) password will be used to encrypt the cookie. This allow you\n   * to use password rotation (security)\n   */\n  password: password;\n\n  /**\n   * This is the time in seconds that the session will be valid for. This also set the max-age attribute of\n   * the cookie automatically (minus 60 seconds so that the cookie always expire before the session).\n   */\n  ttl?: number;\n\n  /**\n   * This is the options that will be passed to the cookie library.\n   * You can see all of them here: https://github.com/jshttp/cookie#options-1.\n   *\n   * If you want to use \"session cookies\" (cookies that are deleted when the browser is closed) then you need\n   * to pass cookieOptions: { maxAge: undefined }.\n   */\n  cookieOptions?: CookieSerializeOptions;\n}\n\n// eslint-disable-next-line @typescript-eslint/no-empty-interface\nexport interface IronSessionData {\n  // If we allow for any keys, then there's no more type check on unknown properties which is not good\n  // If we allow for any keys, the later delete will work but I prefer to disable the check at this stage and\n  // provide good type checking instead\n  // [key: string]: unknown;\n}\n\nexport type IronSession = IronSessionData & {\n  /**\n   * Destroys the session data and removes the cookie.\n   */\n  destroy: () => void;\n\n  /**\n   * Encrypts the session data and sets the cookie.\n   */\n  save: () => Promise<void>;\n};\n\ndeclare module \"http\" {\n  interface IncomingMessage {\n    session: IronSession;\n  }\n}\n\nexport async function getIronSession(\n  req: IncomingMessage,\n  res: ServerResponse,\n  userSessionOptions: IronSessionOptions,\n): Promise<IronSession> {\n  if (\n    !req ||\n    !res ||\n    !userSessionOptions ||\n    !userSessionOptions.cookieName ||\n    !userSessionOptions.password\n  ) {\n    throw new Error(\n      `iron-session: Bad usage. Minimum usage is const session = await getIronSession(req, res, { cookieName: \"...\", password: \"...\". Check the usage here: https://github.com/vvo/iron-session`,\n    );\n  }\n\n  const passwordsAsMap = normalizeStringPasswordToMap(\n    userSessionOptions.password,\n  );\n\n  Object.values(\n    normalizeStringPasswordToMap(userSessionOptions.password),\n  ).forEach((password) => {\n    if (password.length < 32) {\n      throw new Error(\n        `iron-session: Bad usage. Password must be at least 32 characters long.`,\n      );\n    }\n  });\n\n  const isHttps = (req.socket as TLSSocket).encrypted === true;\n\n  if (userSessionOptions.cookieOptions?.secure === true && isHttps === false) {\n    throw new Error(\n      `iron-session: Can't use secure cookies when not in https. See usage at https://github.com/vvo/iron-session/`,\n    );\n  }\n\n  const options: Required<IronSessionOptions> = {\n    ...defaultOptions,\n    ...userSessionOptions,\n    cookieOptions: {\n      ...defaultOptions.cookieOptions,\n      ...(userSessionOptions.cookieOptions || {}),\n    },\n  };\n\n  // if the user did not set the secure flag themselves, we automatically configure it\n  if (userSessionOptions.cookieOptions?.secure === undefined) {\n    options.cookieOptions.secure = isHttps;\n  }\n\n  if (options.ttl === 0) {\n    // ttl = 0 means no expiration\n    // but in reality cookies have to expire (can't have no max-age)\n    // 2147483647 is the max value for max-age in cookies\n    // see https://stackoverflow.com/a/11685301/147079\n    options.ttl = 2147483647;\n  }\n\n  if (\n    userSessionOptions.cookieOptions &&\n    \"maxAge\" in userSessionOptions.cookieOptions\n  ) {\n    // session cookie, do not set maxAge, consider token as infinite\n    if (userSessionOptions.cookieOptions.maxAge === undefined) {\n      options.ttl = 0;\n    } else {\n      options.cookieOptions.maxAge = computeCookieMaxAge(\n        userSessionOptions.cookieOptions.maxAge,\n      );\n    }\n  } else {\n    options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);\n  }\n\n  const sealFromCookies = parseCookie(req.headers.cookie || \"\")[\n    options.cookieName\n  ];\n\n  const session =\n    sealFromCookies === undefined\n      ? {}\n      : await unsealData(sealFromCookies, passwordsAsMap, options.ttl);\n\n  Object.defineProperties(session, {\n    save: {\n      value: async function save() {\n        if (res.headersSent === true) {\n          throw new Error(\n            `iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()`,\n          );\n        }\n        const seal = await sealData(session, passwordsAsMap, options.ttl);\n        const cookieValue = serializeCookie(\n          options.cookieName,\n          seal,\n          options.cookieOptions,\n        );\n\n        if (cookieValue.length > 4096) {\n          throw new Error(\n            `iron-session: Cookie length is too big ${cookieValue.length}, browsers will refuse it. Try to remove some data.`,\n          );\n        }\n\n        addToCookies(cookieValue, res);\n      },\n    },\n    destroy: {\n      value: function destroy() {\n        Object.keys(session).forEach((key) => {\n          // @ts-ignore See comment on the IronSessionData interface\n          delete session[key];\n        });\n\n        const cookieValue = serializeCookie(options.cookieName, \"\", {\n          ...options.cookieOptions,\n          maxAge: 0,\n        });\n        addToCookies(cookieValue, res);\n      },\n    },\n  });\n\n  return session as IronSession;\n}\n\nfunction addToCookies(cookieValue: string, res: ServerResponse) {\n  let existingSetCookie =\n    (res.getHeader(\"set-cookie\") as string[] | string) ?? [];\n  if (typeof existingSetCookie === \"string\") {\n    existingSetCookie = [existingSetCookie];\n  }\n  res.setHeader(\"set-cookie\", [...existingSetCookie, cookieValue]);\n}\n\nfunction computeCookieMaxAge(ttl: number) {\n  // The next line makes sure browser will expire cookies before seals are considered expired by the server.\n  // It also allows for clock difference of 60 seconds maximum between server and clients.\n  // It also makes sure to expire the cookie immediately when value is 0\n  return ttl - timestampSkewSec;\n}\n\nexport async function unsealData(\n  seal: string,\n  password: password,\n  ttl: number = fourteenDaysInSeconds,\n): Promise<IronSessionData> {\n  const passwordsAsMap = normalizeStringPasswordToMap(password);\n  const { sealWithoutVersion, tokenVersion } = parseSeal(seal);\n\n  try {\n    const data = await Iron.unseal(sealWithoutVersion, passwordsAsMap, {\n      ...Iron.defaults,\n      ttl: ttl * 1000,\n    });\n\n    if (tokenVersion === 2) {\n      return data;\n    }\n\n    return {\n      ...data.persistent,\n    };\n  } catch (error) {\n    if (error instanceof Error) {\n      if (\n        error.message === \"Expired seal\" ||\n        error.message === \"Bad hmac value\" ||\n        error.message === \"Cannot find password: \" ||\n        error.message === \"Incorrect number of sealed components\"\n      ) {\n        // if seal expired or\n        // if seal is not valid (encrypted using a different password, when passwords are badly rotated) or\n        // if we can't find back the password in the seal\n        // then we just start a new session over\n        return {};\n      }\n    }\n\n    throw error;\n  }\n}\n\nfunction parseSeal(seal: string): {\n  sealWithoutVersion: string;\n  tokenVersion: number | null;\n} {\n  if (seal[seal.length - 2] === versionDelimiter) {\n    const [sealWithoutVersion, tokenVersionAsString] =\n      seal.split(versionDelimiter);\n    return {\n      sealWithoutVersion,\n      tokenVersion: parseInt(tokenVersionAsString, 10),\n    };\n  }\n\n  return { sealWithoutVersion: seal, tokenVersion: null };\n}\n\nexport async function sealData(\n  data: IronSessionData,\n  password: password,\n  ttl: number = fourteenDaysInSeconds,\n) {\n  const passwordsAsMap = normalizeStringPasswordToMap(password);\n\n  const mostRecentPasswordId = Math.max(\n    ...Object.keys(passwordsAsMap).map((id) => parseInt(id, 10)),\n  );\n\n  const passwordForSeal = {\n    id: mostRecentPasswordId.toString(),\n    secret: passwordsAsMap[mostRecentPasswordId],\n  };\n\n  const seal = await Iron.seal(data, passwordForSeal, {\n    ...Iron.defaults,\n    ttl: ttl * 1000,\n  });\n\n  return `${seal}${versionDelimiter}${currentMajorVersion}`;\n}\n\nfunction normalizeStringPasswordToMap(password: password) {\n  return typeof password === \"string\" ? { 1: password } : password;\n}\n"],
+  "mappings": ";AAAA;AAEA;AAMA,IAAM,mBAAmB;AAKzB,IAAM,wBAAwB,KAAK,KAAK;AAIxC,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AAEzB,IAAM,iBAGF;AAAA,EACF,KAAK;AAAA,EACL,eAAe;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA;AAAA;AA+DV,8BACE,KACA,KACA,oBACsB;AAhGxB;AAiGE,MACE,CAAC,OACD,CAAC,OACD,CAAC,sBACD,CAAC,mBAAmB,cACpB,CAAC,mBAAmB,UACpB;AACA,UAAM,IAAI,MACR;AAAA;AAIJ,QAAM,iBAAiB,6BACrB,mBAAmB;AAGrB,SAAO,OACL,6BAA6B,mBAAmB,WAChD,QAAQ,CAAC,aAAa;AACtB,QAAI,SAAS,SAAS,IAAI;AACxB,YAAM,IAAI,MACR;AAAA;AAAA;AAKN,QAAM,UAAW,IAAI,OAAqB,cAAc;AAExD,MAAI,0BAAmB,kBAAnB,mBAAkC,YAAW,QAAQ,YAAY,OAAO;AAC1E,UAAM,IAAI,MACR;AAAA;AAIJ,QAAM,UAAwC;AAAA,OACzC;AAAA,OACA;AAAA,IACH,eAAe;AAAA,SACV,eAAe;AAAA,SACd,mBAAmB,iBAAiB;AAAA;AAAA;AAK5C,MAAI,0BAAmB,kBAAnB,mBAAkC,YAAW,QAAW;AAC1D,YAAQ,cAAc,SAAS;AAAA;AAGjC,MAAI,QAAQ,QAAQ,GAAG;AAKrB,YAAQ,MAAM;AAAA;AAGhB,MACE,mBAAmB,iBACnB,YAAY,mBAAmB,eAC/B;AAEA,QAAI,mBAAmB,cAAc,WAAW,QAAW;AACzD,cAAQ,MAAM;AAAA,WACT;AACL,cAAQ,cAAc,SAAS,oBAC7B,mBAAmB,cAAc;AAAA;AAAA,SAGhC;AACL,YAAQ,cAAc,SAAS,oBAAoB,QAAQ;AAAA;AAG7D,QAAM,kBAAkB,YAAY,IAAI,QAAQ,UAAU,IACxD,QAAQ;AAGV,QAAM,UACJ,oBAAoB,SAChB,KACA,MAAM,WAAW,iBAAiB,gBAAgB,QAAQ;AAEhE,SAAO,iBAAiB,SAAS;AAAA,IAC/B,MAAM;AAAA,MACJ,OAAO,sBAAsB;AAC3B,YAAI,IAAI,gBAAgB,MAAM;AAC5B,gBAAM,IAAI,MACR;AAAA;AAGJ,cAAM,OAAO,MAAM,SAAS,SAAS,gBAAgB,QAAQ;AAC7D,cAAM,cAAc,gBAClB,QAAQ,YACR,MACA,QAAQ;AAGV,YAAI,YAAY,SAAS,MAAM;AAC7B,gBAAM,IAAI,MACR,0CAA0C,YAAY;AAAA;AAI1D,qBAAa,aAAa;AAAA;AAAA;AAAA,IAG9B,SAAS;AAAA,MACP,OAAO,mBAAmB;AACxB,eAAO,KAAK,SAAS,QAAQ,CAAC,QAAQ;AAEpC,iBAAO,QAAQ;AAAA;AAGjB,cAAM,cAAc,gBAAgB,QAAQ,YAAY,IAAI;AAAA,aACvD,QAAQ;AAAA,UACX,QAAQ;AAAA;AAEV,qBAAa,aAAa;AAAA;AAAA;AAAA;AAKhC,SAAO;AAAA;AAGT,sBAAsB,aAAqB,KAAqB;AA7NhE;AA8NE,MAAI,oBACD,UAAI,UAAU,kBAAd,YAAqD;AACxD,MAAI,OAAO,sBAAsB,UAAU;AACzC,wBAAoB,CAAC;AAAA;AAEvB,MAAI,UAAU,cAAc,CAAC,GAAG,mBAAmB;AAAA;AAGrD,6BAA6B,KAAa;AAIxC,SAAO,MAAM;AAAA;AAGf,0BACE,MACA,UACA,MAAc,uBACY;AAC1B,QAAM,iBAAiB,6BAA6B;AACpD,QAAM,EAAE,oBAAoB,iBAAiB,UAAU;AAEvD,MAAI;AACF,UAAM,OAAO,MAAM,KAAK,OAAO,oBAAoB,gBAAgB;AAAA,SAC9D,KAAK;AAAA,MACR,KAAK,MAAM;AAAA;AAGb,QAAI,iBAAiB,GAAG;AACtB,aAAO;AAAA;AAGT,WAAO;AAAA,SACF,KAAK;AAAA;AAAA,WAEH,OAAP;AACA,QAAI,iBAAiB,OAAO;AAC1B,UACE,MAAM,YAAY,kBAClB,MAAM,YAAY,oBAClB,MAAM,YAAY,4BAClB,MAAM,YAAY,yCAClB;AAKA,eAAO;AAAA;AAAA;AAIX,UAAM;AAAA;AAAA;AAIV,mBAAmB,MAGjB;AACA,MAAI,KAAK,KAAK,SAAS,OAAO,kBAAkB;AAC9C,UAAM,CAAC,oBAAoB,wBACzB,KAAK,MAAM;AACb,WAAO;AAAA,MACL;AAAA,MACA,cAAc,SAAS,sBAAsB;AAAA;AAAA;AAIjD,SAAO,EAAE,oBAAoB,MAAM,cAAc;AAAA;AAGnD,wBACE,MACA,UACA,MAAc,uBACd;AACA,QAAM,iBAAiB,6BAA6B;AAEpD,QAAM,uBAAuB,KAAK,IAChC,GAAG,OAAO,KAAK,gBAAgB,IAAI,CAAC,OAAO,SAAS,IAAI;AAG1D,QAAM,kBAAkB;AAAA,IACtB,IAAI,qBAAqB;AAAA,IACzB,QAAQ,eAAe;AAAA;AAGzB,QAAM,OAAO,MAAM,KAAK,KAAK,MAAM,iBAAiB;AAAA,OAC/C,KAAK;AAAA,IACR,KAAK,MAAM;AAAA;AAGb,SAAO,GAAG,OAAO,mBAAmB;AAAA;AAGtC,sCAAsC,UAAoB;AACxD,SAAO,OAAO,aAAa,WAAW,EAAE,GAAG,aAAa;AAAA;",
   "names": []
 }

package/express/dist/index.cjs

@@ -0,0 +1,65 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __markAsModule = (target) => __defProp(target, "__esModule", { value: true });
+var __export = (target, all) => {
+  __markAsModule(target);
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __reExport = (target, module2, desc) => {
+  if (module2 && typeof module2 === "object" || typeof module2 === "function") {
+    for (let key of __getOwnPropNames(module2))
+      if (!__hasOwnProp.call(target, key) && key !== "default")
+        __defProp(target, key, { get: () => module2[key], enumerable: !(desc = __getOwnPropDesc(module2, key)) || desc.enumerable });
+  }
+  return target;
+};
+var __toModule = (module2) => {
+  return __reExport(__markAsModule(__defProp(module2 != null ? __create(__getProtoOf(module2)) : {}, "default", module2 && module2.__esModule && "default" in module2 ? { get: () => module2.default, enumerable: true } : { value: module2, enumerable: true })), module2);
+};
+
+// express/index.ts
+__export(exports, {
+  ironSession: () => ironSession
+});
+var import_iron_session = __toModule(require("iron-session"));
+
+// src/getPropertyDescriptorForReqSession.ts
+function getPropertyDescriptorForReqSession(session) {
+  return {
+    enumerable: true,
+    get() {
+      return session;
+    },
+    set(value) {
+      const keys = Object.keys(value);
+      const currentKeys = Object.keys(session);
+      currentKeys.forEach((key) => {
+        if (!keys.includes(key)) {
+          delete session[key];
+        }
+      });
+      keys.forEach((key) => {
+        session[key] = value[key];
+      });
+    }
+  };
+}
+
+// express/index.ts
+function ironSession(sessionOptions) {
+  return async function ironSessionMiddleware(req, res, next) {
+    const session = await (0, import_iron_session.getIronSession)(req, res, sessionOptions);
+    Object.defineProperty(req, "session", getPropertyDescriptorForReqSession(session));
+    next();
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ironSession
+});
+//# sourceMappingURL=index.cjs.map

package/express/dist/index.cjs.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../index.ts", "../../src/getPropertyDescriptorForReqSession.ts"],
+  "sourcesContent": ["import type { IronSessionOptions } from \"iron-session\";\nimport { getIronSession } from \"iron-session\";\nimport type { Request, Response, NextFunction } from \"express\";\nimport getPropertyDescriptorForReqSession from \"../src/getPropertyDescriptorForReqSession\";\n\nexport function ironSession(\n  sessionOptions: IronSessionOptions,\n): (req: Request, res: Response, next: NextFunction) => Promise<void> {\n  return async function ironSessionMiddleware(req, res, next) {\n    const session = await getIronSession(req, res, sessionOptions);\n    Object.defineProperty(\n      req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n\n    next();\n  };\n}\n", "import type { IronSession } from \".\";\n\nexport default function getPropertyDescriptorForReqSession(\n  session: IronSession,\n): PropertyDescriptor {\n  return {\n    enumerable: true,\n    get() {\n      return session;\n    },\n    set(value) {\n      const keys = Object.keys(value);\n      const currentKeys = Object.keys(session);\n\n      currentKeys.forEach((key) => {\n        if (!keys.includes(key)) {\n          // @ts-ignore See comment in IronSessionData interface\n          delete session[key];\n        }\n      });\n\n      keys.forEach((key) => {\n        // @ts-ignore See comment in IronSessionData interface\n        session[key] = value[key];\n      });\n    },\n  };\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AACA,0BAA+B;;;ACChB,4CACb,SACoB;AACpB,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AACJ,aAAO;AAAA;AAAA,IAET,IAAI,OAAO;AACT,YAAM,OAAO,OAAO,KAAK;AACzB,YAAM,cAAc,OAAO,KAAK;AAEhC,kBAAY,QAAQ,CAAC,QAAQ;AAC3B,YAAI,CAAC,KAAK,SAAS,MAAM;AAEvB,iBAAO,QAAQ;AAAA;AAAA;AAInB,WAAK,QAAQ,CAAC,QAAQ;AAEpB,gBAAQ,OAAO,MAAM;AAAA;AAAA;AAAA;AAAA;;;ADlBtB,qBACL,gBACoE;AACpE,SAAO,qCAAqC,KAAK,KAAK,MAAM;AAC1D,UAAM,UAAU,MAAM,wCAAe,KAAK,KAAK;AAC/C,WAAO,eACL,KACA,WACA,mCAAmC;AAGrC;AAAA;AAAA;",
+  "names": []
+}

package/express/dist/index.d.ts

@@ -0,0 +1,6 @@
+import { IronSessionOptions } from 'iron-session';
+import { Request, Response, NextFunction } from 'express';
+
+declare function ironSession(sessionOptions: IronSessionOptions): (req: Request, res: Response, next: NextFunction) => Promise<void>;
+
+export { ironSession };

package/express/dist/index.js

@@ -0,0 +1,37 @@
+// express/index.ts
+import { getIronSession } from "iron-session";
+
+// src/getPropertyDescriptorForReqSession.ts
+function getPropertyDescriptorForReqSession(session) {
+  return {
+    enumerable: true,
+    get() {
+      return session;
+    },
+    set(value) {
+      const keys = Object.keys(value);
+      const currentKeys = Object.keys(session);
+      currentKeys.forEach((key) => {
+        if (!keys.includes(key)) {
+          delete session[key];
+        }
+      });
+      keys.forEach((key) => {
+        session[key] = value[key];
+      });
+    }
+  };
+}
+
+// express/index.ts
+function ironSession(sessionOptions) {
+  return async function ironSessionMiddleware(req, res, next) {
+    const session = await getIronSession(req, res, sessionOptions);
+    Object.defineProperty(req, "session", getPropertyDescriptorForReqSession(session));
+    next();
+  };
+}
+export {
+  ironSession
+};
+//# sourceMappingURL=index.js.map

package/express/dist/index.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../index.ts", "../../src/getPropertyDescriptorForReqSession.ts"],
+  "sourcesContent": ["import type { IronSessionOptions } from \"iron-session\";\nimport { getIronSession } from \"iron-session\";\nimport type { Request, Response, NextFunction } from \"express\";\nimport getPropertyDescriptorForReqSession from \"../src/getPropertyDescriptorForReqSession\";\n\nexport function ironSession(\n  sessionOptions: IronSessionOptions,\n): (req: Request, res: Response, next: NextFunction) => Promise<void> {\n  return async function ironSessionMiddleware(req, res, next) {\n    const session = await getIronSession(req, res, sessionOptions);\n    Object.defineProperty(\n      req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n\n    next();\n  };\n}\n", "import type { IronSession } from \".\";\n\nexport default function getPropertyDescriptorForReqSession(\n  session: IronSession,\n): PropertyDescriptor {\n  return {\n    enumerable: true,\n    get() {\n      return session;\n    },\n    set(value) {\n      const keys = Object.keys(value);\n      const currentKeys = Object.keys(session);\n\n      currentKeys.forEach((key) => {\n        if (!keys.includes(key)) {\n          // @ts-ignore See comment in IronSessionData interface\n          delete session[key];\n        }\n      });\n\n      keys.forEach((key) => {\n        // @ts-ignore See comment in IronSessionData interface\n        session[key] = value[key];\n      });\n    },\n  };\n}\n"],
+  "mappings": ";AACA;;;ACCe,4CACb,SACoB;AACpB,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AACJ,aAAO;AAAA;AAAA,IAET,IAAI,OAAO;AACT,YAAM,OAAO,OAAO,KAAK;AACzB,YAAM,cAAc,OAAO,KAAK;AAEhC,kBAAY,QAAQ,CAAC,QAAQ;AAC3B,YAAI,CAAC,KAAK,SAAS,MAAM;AAEvB,iBAAO,QAAQ;AAAA;AAAA;AAInB,WAAK,QAAQ,CAAC,QAAQ;AAEpB,gBAAQ,OAAO,MAAM;AAAA;AAAA;AAAA;AAAA;;;ADlBtB,qBACL,gBACoE;AACpE,SAAO,qCAAqC,KAAK,KAAK,MAAM;AAC1D,UAAM,UAAU,MAAM,eAAe,KAAK,KAAK;AAC/C,WAAO,eACL,KACA,WACA,mCAAmC;AAGrC;AAAA;AAAA;",
+  "names": []
+}

package/next/dist/index.cjs

@@ -0,0 +1,74 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __markAsModule = (target) => __defProp(target, "__esModule", { value: true });
+var __export = (target, all) => {
+  __markAsModule(target);
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __reExport = (target, module2, desc) => {
+  if (module2 && typeof module2 === "object" || typeof module2 === "function") {
+    for (let key of __getOwnPropNames(module2))
+      if (!__hasOwnProp.call(target, key) && key !== "default")
+        __defProp(target, key, { get: () => module2[key], enumerable: !(desc = __getOwnPropDesc(module2, key)) || desc.enumerable });
+  }
+  return target;
+};
+var __toModule = (module2) => {
+  return __reExport(__markAsModule(__defProp(module2 != null ? __create(__getProtoOf(module2)) : {}, "default", module2 && module2.__esModule && "default" in module2 ? { get: () => module2.default, enumerable: true } : { value: module2, enumerable: true })), module2);
+};
+
+// next/index.ts
+__export(exports, {
+  withIronSessionApiRoute: () => withIronSessionApiRoute,
+  withIronSessionSsr: () => withIronSessionSsr
+});
+var import_iron_session = __toModule(require("iron-session"));
+
+// src/getPropertyDescriptorForReqSession.ts
+function getPropertyDescriptorForReqSession(session) {
+  return {
+    enumerable: true,
+    get() {
+      return session;
+    },
+    set(value) {
+      const keys = Object.keys(value);
+      const currentKeys = Object.keys(session);
+      currentKeys.forEach((key) => {
+        if (!keys.includes(key)) {
+          delete session[key];
+        }
+      });
+      keys.forEach((key) => {
+        session[key] = value[key];
+      });
+    }
+  };
+}
+
+// next/index.ts
+function withIronSessionApiRoute(handler, options) {
+  return async function nextApiHandlerWrappedWithIronSession(req, res) {
+    const session = await (0, import_iron_session.getIronSession)(req, res, options);
+    Object.defineProperty(req, "session", getPropertyDescriptorForReqSession(session));
+    return handler(req, res);
+  };
+}
+function withIronSessionSsr(handler, options) {
+  return async function nextGetServerSidePropsHandlerWrappedWithIronSession(context) {
+    const session = await (0, import_iron_session.getIronSession)(context.req, context.res, options);
+    Object.defineProperty(context.req, "session", getPropertyDescriptorForReqSession(session));
+    return handler(context);
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  withIronSessionApiRoute,
+  withIronSessionSsr
+});
+//# sourceMappingURL=index.cjs.map

package/next/dist/index.cjs.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../index.ts", "../../src/getPropertyDescriptorForReqSession.ts"],
+  "sourcesContent": ["import type {\n  NextApiHandler,\n  GetServerSidePropsContext,\n  GetServerSidePropsResult,\n} from \"next\";\nimport type { IronSessionOptions } from \"iron-session\";\nimport { getIronSession } from \"iron-session\";\nimport getPropertyDescriptorForReqSession from \"../src/getPropertyDescriptorForReqSession\";\n\nexport function withIronSessionApiRoute(\n  handler: NextApiHandler,\n  options: IronSessionOptions,\n): NextApiHandler {\n  return async function nextApiHandlerWrappedWithIronSession(req, res) {\n    const session = await getIronSession(req, res, options);\n\n    // we define req.session as being enumerable (so console.log(req) shows it)\n    // and we also want to allow people to do:\n    // req.session = { admin: true }; or req.session = {...req.session, admin: true};\n    // req.session.save();\n    Object.defineProperty(\n      req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n    return handler(req, res);\n  };\n}\n\nexport function withIronSessionSsr<\n  P extends { [key: string]: unknown } = { [key: string]: unknown },\n>(\n  handler: (\n    context: GetServerSidePropsContext,\n  ) => GetServerSidePropsResult<P> | Promise<GetServerSidePropsResult<P>>,\n  options: IronSessionOptions,\n) {\n  return async function nextGetServerSidePropsHandlerWrappedWithIronSession(\n    context: GetServerSidePropsContext,\n  ) {\n    const session = await getIronSession(context.req, context.res, options);\n    Object.defineProperty(\n      context.req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n    return handler(context);\n  };\n}\n", "import type { IronSession } from \".\";\n\nexport default function getPropertyDescriptorForReqSession(\n  session: IronSession,\n): PropertyDescriptor {\n  return {\n    enumerable: true,\n    get() {\n      return session;\n    },\n    set(value) {\n      const keys = Object.keys(value);\n      const currentKeys = Object.keys(session);\n\n      currentKeys.forEach((key) => {\n        if (!keys.includes(key)) {\n          // @ts-ignore See comment in IronSessionData interface\n          delete session[key];\n        }\n      });\n\n      keys.forEach((key) => {\n        // @ts-ignore See comment in IronSessionData interface\n        session[key] = value[key];\n      });\n    },\n  };\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAMA,0BAA+B;;;ACJhB,4CACb,SACoB;AACpB,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AACJ,aAAO;AAAA;AAAA,IAET,IAAI,OAAO;AACT,YAAM,OAAO,OAAO,KAAK;AACzB,YAAM,cAAc,OAAO,KAAK;AAEhC,kBAAY,QAAQ,CAAC,QAAQ;AAC3B,YAAI,CAAC,KAAK,SAAS,MAAM;AAEvB,iBAAO,QAAQ;AAAA;AAAA;AAInB,WAAK,QAAQ,CAAC,QAAQ;AAEpB,gBAAQ,OAAO,MAAM;AAAA;AAAA;AAAA;AAAA;;;ADdtB,iCACL,SACA,SACgB;AAChB,SAAO,oDAAoD,KAAK,KAAK;AACnE,UAAM,UAAU,MAAM,wCAAe,KAAK,KAAK;AAM/C,WAAO,eACL,KACA,WACA,mCAAmC;AAErC,WAAO,QAAQ,KAAK;AAAA;AAAA;AAIjB,4BAGL,SAGA,SACA;AACA,SAAO,mEACL,SACA;AACA,UAAM,UAAU,MAAM,wCAAe,QAAQ,KAAK,QAAQ,KAAK;AAC/D,WAAO,eACL,QAAQ,KACR,WACA,mCAAmC;AAErC,WAAO,QAAQ;AAAA;AAAA;",
+  "names": []
+}

package/next/dist/index.d.ts

@@ -1,6 +1,11 @@
-import { NextApiHandler } from 'next';
-import { IronSessionData, IronSessionOptions } from 'iron-session';
+import { NextApiHandler, GetServerSidePropsContext, GetServerSidePropsResult } from 'next';
+import { IronSessionOptions } from 'iron-session';
 
-declare function withIronSessionApiRoute<T = IronSessionData>(handler: NextApiHandler, options: IronSessionOptions): NextApiHandler;
+declare function withIronSessionApiRoute(handler: NextApiHandler, options: IronSessionOptions): NextApiHandler;
+declare function withIronSessionSsr<P extends {
+    [key: string]: unknown;
+} = {
+    [key: string]: unknown;
+}>(handler: (context: GetServerSidePropsContext) => GetServerSidePropsResult<P> | Promise<GetServerSidePropsResult<P>>, options: IronSessionOptions): (context: GetServerSidePropsContext) => Promise<GetServerSidePropsResult<P>>;
 
-export { withIronSessionApiRoute };
+export { withIronSessionApiRoute, withIronSessionSsr };

package/next/dist/index.js

@@ -1,44 +1,45 @@
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __markAsModule = (target) => __defProp(target, "__esModule", { value: true });
-var __export = (target, all) => {
-  __markAsModule(target);
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __reExport = (target, module2, desc) => {
-  if (module2 && typeof module2 === "object" || typeof module2 === "function") {
-    for (let key of __getOwnPropNames(module2))
-      if (!__hasOwnProp.call(target, key) && key !== "default")
-        __defProp(target, key, { get: () => module2[key], enumerable: !(desc = __getOwnPropDesc(module2, key)) || desc.enumerable });
-  }
-  return target;
-};
-var __toModule = (module2) => {
-  return __reExport(__markAsModule(__defProp(module2 != null ? __create(__getProtoOf(module2)) : {}, "default", module2 && module2.__esModule && "default" in module2 ? { get: () => module2.default, enumerable: true } : { value: module2, enumerable: true })), module2);
-};
+// next/index.ts
+import { getIronSession } from "iron-session";
+
+// src/getPropertyDescriptorForReqSession.ts
+function getPropertyDescriptorForReqSession(session) {
+  return {
+    enumerable: true,
+    get() {
+      return session;
+    },
+    set(value) {
+      const keys = Object.keys(value);
+      const currentKeys = Object.keys(session);
+      currentKeys.forEach((key) => {
+        if (!keys.includes(key)) {
+          delete session[key];
+        }
+      });
+      keys.forEach((key) => {
+        session[key] = value[key];
+      });
+    }
+  };
+}
 
 // next/index.ts
-__export(exports, {
-  withIronSessionApiRoute: () => withIronSessionApiRoute
-});
-var import_iron_session = __toModule(require("iron-session"));
 function withIronSessionApiRoute(handler, options) {
   return async function nextApiHandlerWrappedWithIronSession(req, res) {
-    const session = await (0, import_iron_session.getIronSession)(req, res, options);
-    Object.defineProperty(req, "session", {
-      enumerable: true,
-      value: session
-    });
+    const session = await getIronSession(req, res, options);
+    Object.defineProperty(req, "session", getPropertyDescriptorForReqSession(session));
     return handler(req, res);
   };
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  withIronSessionApiRoute
-});
+function withIronSessionSsr(handler, options) {
+  return async function nextGetServerSidePropsHandlerWrappedWithIronSession(context) {
+    const session = await getIronSession(context.req, context.res, options);
+    Object.defineProperty(context.req, "session", getPropertyDescriptorForReqSession(session));
+    return handler(context);
+  };
+}
+export {
+  withIronSessionApiRoute,
+  withIronSessionSsr
+};
 //# sourceMappingURL=index.js.map

package/next/dist/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
-  "sources": ["../index.ts"],
-  "sourcesContent": ["import type { NextApiHandler } from \"next\";\nimport type { IronSessionData, IronSessionOptions } from \"iron-session\";\nimport { getIronSession } from \"iron-session\";\n\nexport function withIronSessionApiRoute<T = IronSessionData>(\n  handler: NextApiHandler,\n  options: IronSessionOptions,\n): NextApiHandler {\n  return async function nextApiHandlerWrappedWithIronSession(req, res) {\n    const session = await getIronSession<T>(req, res, options);\n    Object.defineProperty(req, \"session\", {\n      enumerable: true,\n      value: session,\n    });\n    return handler(req, res);\n  };\n}\n\n// export function withIronSessionSsr<P = unknown>(\n//   handler: NextGetServerSidePropsHandlerWithIronSession<P>,\n//   options: IronSessionOptions,\n// ): NextGetServerSidePropsHandlerWithIronSession<P> {\n//   return async function nextGetServerSidePropsHandlerWrappedWithIronSession(\n//     context: NextGetServerSideContextWithIronSession,\n//   ) {\n//     context.req.session = await getIronSession(\n//       context.req,\n//       context.res,\n//       options,\n//     );\n//     return handler(context);\n//   };\n// }\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAEA,0BAA+B;AAExB,iCACL,SACA,SACgB;AAChB,SAAO,oDAAoD,KAAK,KAAK;AACnE,UAAM,UAAU,MAAM,wCAAkB,KAAK,KAAK;AAClD,WAAO,eAAe,KAAK,WAAW;AAAA,MACpC,YAAY;AAAA,MACZ,OAAO;AAAA;AAET,WAAO,QAAQ,KAAK;AAAA;AAAA;",
+  "sources": ["../index.ts", "../../src/getPropertyDescriptorForReqSession.ts"],
+  "sourcesContent": ["import type {\n  NextApiHandler,\n  GetServerSidePropsContext,\n  GetServerSidePropsResult,\n} from \"next\";\nimport type { IronSessionOptions } from \"iron-session\";\nimport { getIronSession } from \"iron-session\";\nimport getPropertyDescriptorForReqSession from \"../src/getPropertyDescriptorForReqSession\";\n\nexport function withIronSessionApiRoute(\n  handler: NextApiHandler,\n  options: IronSessionOptions,\n): NextApiHandler {\n  return async function nextApiHandlerWrappedWithIronSession(req, res) {\n    const session = await getIronSession(req, res, options);\n\n    // we define req.session as being enumerable (so console.log(req) shows it)\n    // and we also want to allow people to do:\n    // req.session = { admin: true }; or req.session = {...req.session, admin: true};\n    // req.session.save();\n    Object.defineProperty(\n      req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n    return handler(req, res);\n  };\n}\n\nexport function withIronSessionSsr<\n  P extends { [key: string]: unknown } = { [key: string]: unknown },\n>(\n  handler: (\n    context: GetServerSidePropsContext,\n  ) => GetServerSidePropsResult<P> | Promise<GetServerSidePropsResult<P>>,\n  options: IronSessionOptions,\n) {\n  return async function nextGetServerSidePropsHandlerWrappedWithIronSession(\n    context: GetServerSidePropsContext,\n  ) {\n    const session = await getIronSession(context.req, context.res, options);\n    Object.defineProperty(\n      context.req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n    return handler(context);\n  };\n}\n", "import type { IronSession } from \".\";\n\nexport default function getPropertyDescriptorForReqSession(\n  session: IronSession,\n): PropertyDescriptor {\n  return {\n    enumerable: true,\n    get() {\n      return session;\n    },\n    set(value) {\n      const keys = Object.keys(value);\n      const currentKeys = Object.keys(session);\n\n      currentKeys.forEach((key) => {\n        if (!keys.includes(key)) {\n          // @ts-ignore See comment in IronSessionData interface\n          delete session[key];\n        }\n      });\n\n      keys.forEach((key) => {\n        // @ts-ignore See comment in IronSessionData interface\n        session[key] = value[key];\n      });\n    },\n  };\n}\n"],
+  "mappings": ";AAMA;;;ACJe,4CACb,SACoB;AACpB,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AACJ,aAAO;AAAA;AAAA,IAET,IAAI,OAAO;AACT,YAAM,OAAO,OAAO,KAAK;AACzB,YAAM,cAAc,OAAO,KAAK;AAEhC,kBAAY,QAAQ,CAAC,QAAQ;AAC3B,YAAI,CAAC,KAAK,SAAS,MAAM;AAEvB,iBAAO,QAAQ;AAAA;AAAA;AAInB,WAAK,QAAQ,CAAC,QAAQ;AAEpB,gBAAQ,OAAO,MAAM;AAAA;AAAA;AAAA;AAAA;;;ADdtB,iCACL,SACA,SACgB;AAChB,SAAO,oDAAoD,KAAK,KAAK;AACnE,UAAM,UAAU,MAAM,eAAe,KAAK,KAAK;AAM/C,WAAO,eACL,KACA,WACA,mCAAmC;AAErC,WAAO,QAAQ,KAAK;AAAA;AAAA;AAIjB,4BAGL,SAGA,SACA;AACA,SAAO,mEACL,SACA;AACA,UAAM,UAAU,MAAM,eAAe,QAAQ,KAAK,QAAQ,KAAK;AAC/D,WAAO,eACL,QAAQ,KACR,WACA,mCAAmC;AAErC,WAAO,QAAQ;AAAA;AAAA;",
   "names": []
 }

package/package.json

@@ -1,8 +1,10 @@
 {
   "name": "iron-session",
-  "version": "2.0.0-alpha.17",
+  "version": "2.0.0-alpha.18",
+  "description": "Node.js stateless session utility using signed and encrypted cookies to store data. Works with Next.js, Express, NestJs, Fastify, and any Node.js HTTP framework.",
   "license": "MIT",
   "author": "Vincent Voyer <vincent@codeagain.com>",
+  "type": "module",
   "exports": {
     ".": {
       "import": "./dist/index.mjs",
@@ -28,46 +30,79 @@
     "next/dist",
     "express/dist"
   ],
-  "workspaces": [
-    "examples/next.js",
-    "examples/next.js-typescript"
-  ],
   "scripts": {
-    "build": "npm run build:clean && npm run build:src && npm run build:next",
+    "build": "npm run build:clean && npm run build:src && npm run build:next && npm run build:express",
     "build:clean": "rimraf dist/ next/dist express/dist",
     "build:express": "tsup express/index.ts -d express/dist",
     "build:next": "tsup next/index.ts -d next/dist",
     "build:src": "tsup src/index.ts",
-    "build:watch": "npm run build:clean && tsup src/index.ts --watch src/index.ts && tsup next/index.ts -d next/dist && tsup express/index.ts -d express/dist --watch express/index.ts",
     "lint": "eslint --ext ts,js,jsx,tsx src/ next/ express/ examples/",
     "prepublishOnly": "npm run build",
-    "test": "jest --coverage && npm run lint && tsc --noEmit"
+    "test": "jest --coverage && npm run lint && tsc --noEmit",
+    "watch": "npm run build:clean && concurrently \"npm:watch:*\"",
+    "watch:express": "tsup express/index.ts -d express/dist --watch express/index.ts",
+    "watch:next": "tsup next/index.ts -d next/dist --watch next/index.ts",
+    "watch:src": "tsup src/index.ts --watch src/index.ts"
   },
   "prettier": {
     "trailingComma": "all"
   },
   "eslintConfig": {
-    "parser": "@typescript-eslint/parser",
-    "plugins": [
-      "@typescript-eslint"
-    ],
     "extends": [
-      "eslint:recommended",
-      "plugin:@typescript-eslint/recommended"
+      "eslint:recommended"
     ],
-    "rules": {
-      "@typescript-eslint/ban-ts-comment": [
-        "warn",
-        {
-          "ts-ignore": "allow-with-description"
+    "overrides": [
+      {
+        "files": [
+          "**/*.ts",
+          "**/*.tsx"
+        ],
+        "parser": "@typescript-eslint/parser",
+        "plugins": [
+          "@typescript-eslint"
+        ],
+        "extends": [
+          "eslint:recommended",
+          "plugin:@typescript-eslint/recommended"
+        ],
+        "rules": {
+          "@typescript-eslint/ban-ts-comment": [
+            "warn",
+            {
+              "ts-ignore": "allow-with-description"
+            }
+          ]
         }
-      ]
-    }
+      },
+      {
+        "files": "**/*.js",
+        "env": {
+          "node": true
+        },
+        "parser": "espree",
+        "parserOptions": {
+          "ecmaVersion": 2019
+        }
+      }
+    ]
   },
   "jest": {
     "transform": {
       "^.+\\.(t|j)sx?$": [
-        "@swc/jest"
+        "@swc/jest",
+        {
+          "sourceMaps": true,
+          "jsc": {
+            "parser": {
+              "syntax": "typescript"
+            },
+            "paths": {
+              "iron-session": [
+                "../src/index.ts"
+              ]
+            }
+          }
+        }
       ]
     }
   },
@@ -75,24 +110,24 @@
     "@hapi/iron": "^6.0.0",
     "@types/cookie": "^0.4.0",
     "@types/express": "^4.17.13",
-    "@types/node": "^16.11.1",
-    "cookie": "^0.4.1",
-    "iron-store": "^1.3.5"
+    "@types/node": "^16.11.6",
+    "cookie": "^0.4.1"
   },
   "devDependencies": {
-    "@swc/core": "^1.2.101",
-    "@swc/jest": "^0.2.5",
+    "@swc/core": "^1.2.104",
+    "@swc/core-darwin-x64": "^1.2.104",
+    "@swc/jest": "0.2.5",
     "@tsconfig/node12": "1.0.9",
-    "@types/jest": "27.0.2",
-    "@typescript-eslint/eslint-plugin": "5.1.0",
-    "@typescript-eslint/parser": "5.1.0",
-    "eslint": "8.0.1",
+    "@types/jest": "^27.0.2",
+    "@typescript-eslint/eslint-plugin": "5.2.0",
+    "@typescript-eslint/parser": "5.2.0",
+    "concurrently": "6.3.0",
+    "eslint": "^8.1.0",
     "jest": "27.3.1",
-    "jest-date-mock": "1.0.8",
     "prettier": "2.4.1",
     "prettier-plugin-packagejson": "2.2.13",
     "rimraf": "3.0.2",
-    "tsup": "5.4.1",
+    "tsup": "5.5.0",
     "typescript": "4.4.4"
   },
   "peerDependencies": {

package/dist/index.mjs

@@ -1,119 +0,0 @@
-// src/index.ts
-import Iron from "@hapi/iron";
-import {
-  parse as parseCookie,
-  serialize as serializeCookie
-} from "cookie";
-var timestampSkewSec = 60;
-var defaultOptions = {
-  ttl: 15 * 24 * 3600,
-  cookieOptions: {
-    httpOnly: true,
-    secure: true,
-    sameSite: "lax",
-    path: "/"
-  }
-};
-async function getIronSession(req, res, userSessionOptions) {
-  if (!req || !res || !userSessionOptions || !userSessionOptions.cookieName || !userSessionOptions.password) {
-    throw new Error(`iron-session: Bad usage. Minimum usage is const session = await getIronSession(req, res, { cookieName: "...", password: "...". Check the usage here: https://github.com/vvo/iron-session`);
-  }
-  const passwordsAsMap = typeof userSessionOptions.password === "string" ? { 1: userSessionOptions.password } : userSessionOptions.password;
-  Object.values(passwordsAsMap).forEach((password) => {
-    if (password.length < 32) {
-      throw new Error(`iron-session: Bad usage. Password must be at least 32 characters long.`);
-    }
-  });
-  const options = {
-    ...defaultOptions,
-    ...userSessionOptions,
-    cookieOptions: {
-      ...defaultOptions.cookieOptions,
-      ...userSessionOptions.cookieOptions || {}
-    }
-  };
-  if (!req.socket.encrypted && options.cookieOptions.secure === true) {
-    throw new Error(`iron-session: Can't use secure cookies when not in https. See usage at https://github.com/vvo/iron-session/`);
-  }
-  if (options.ttl === 0) {
-    options.ttl = 2147483647;
-  }
-  if (userSessionOptions.cookieOptions && "maxAge" in userSessionOptions.cookieOptions) {
-    if (userSessionOptions.cookieOptions.maxAge === void 0) {
-      options.ttl = 0;
-    } else {
-      options.cookieOptions.maxAge = computeCookieMaxAge(userSessionOptions.cookieOptions.maxAge);
-    }
-  } else {
-    options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);
-  }
-  const sealFromCookies = parseCookie(req.headers.cookie || "")[options.cookieName];
-  const sessionData = await unsealSession(sealFromCookies, passwordsAsMap, options.ttl * 1e3);
-  const session = Object.defineProperties(sessionData, {
-    save: {
-      value: async function save() {
-        if (res.headersSent === true) {
-          throw new Error(`iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()`);
-        }
-        const seal = await sealSession(sessionData, passwordsAsMap, options.ttl * 1e3);
-        const cookieValue = serializeCookie(options.cookieName, seal, options.cookieOptions);
-        if (cookieValue.length > 4096) {
-          throw new Error(`iron-session: Cookie length is too big ${cookieValue.length}, browsers will refuse it. Try to remove some data.`);
-        }
-        addToCookies(cookieValue, res);
-        return cookieValue;
-      }
-    },
-    destroy: {
-      value: function destroy() {
-        const cookieValue = serializeCookie(options.cookieName, "", {
-          ...options.cookieOptions,
-          maxAge: 0
-        });
-        addToCookies(cookieValue, res);
-      }
-    }
-  });
-  return session;
-}
-function addToCookies(cookieValue, res) {
-  var _a;
-  let existingSetCookie = (_a = res.getHeader("set-cookie")) != null ? _a : [];
-  if (typeof existingSetCookie === "string") {
-    existingSetCookie = [existingSetCookie];
-  }
-  res.setHeader("set-cookie", [...existingSetCookie, cookieValue]);
-}
-function computeCookieMaxAge(ttl) {
-  return ttl - timestampSkewSec;
-}
-async function unsealSession(seal, password, ttl) {
-  try {
-    await Iron.unseal(seal, password, {
-      ...Iron.defaults,
-      ttl
-    });
-  } catch (error) {
-    if (error instanceof Error) {
-      if (error.message === "Expired seal" || error.message === "Bad hmac value" || error.message === "Cannot find password: " || error.message === "Incorrect number of sealed components") {
-        return {};
-      }
-    }
-    throw error;
-  }
-  return {};
-}
-async function sealSession(data, password, ttl) {
-  const mostRecentPasswordId = Math.max(...Object.keys(password).map((id) => parseInt(id, 10)));
-  const seal = await Iron.seal(data, password[mostRecentPasswordId], {
-    ...Iron.defaults,
-    ttl
-  });
-  return seal;
-}
-export {
-  getIronSession,
-  sealSession,
-  unsealSession
-};
-//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../src/index.ts"],
-  "sourcesContent": ["import Iron from \"@hapi/iron\";\nimport {\n  parse as parseCookie,\n  serialize as serializeCookie,\n  CookieSerializeOptions,\n} from \"cookie\";\nimport type { IncomingMessage, ServerResponse } from \"http\";\nimport { TLSSocket } from \"tls\";\n\n// default time allowed to check for iron seal validity when ttl passed\n// see https://hapi.dev/family/iron/api/?v=6.0.0#options\nconst timestampSkewSec = 60;\n\ntype passwordsMap = { [id: number]: string };\ntype password = string | passwordsMap;\n\nconst defaultOptions: {\n  ttl: number;\n  cookieOptions: CookieSerializeOptions;\n} = {\n  ttl: 15 * 24 * 3600,\n  cookieOptions: {\n    httpOnly: true,\n    secure: true,\n    sameSite: \"lax\",\n    path: \"/\",\n  },\n};\n\nexport interface IronSessionOptions {\n  cookieName: string;\n  password: password;\n  ttl?: number;\n  cookieOptions?: CookieSerializeOptions;\n}\n\ndeclare module \"iron-session\" {\n  interface IronSessionData {\n    [key: string]: unknown;\n  }\n}\n\ndeclare module \"http\" {\n  interface IncomingMessage {\n    /**\n     * This request's `Session` object.\n     * Even though this property isn't marked as optional, it won't exist until you use the `express-session` middleware\n     * [Declaration merging](https://www.typescriptlang.org/docs/handbook/declaration-merging.html) can be used to add your own properties.\n     *\n     * @see SessionData\n     */\n    session: IronSession;\n  }\n}\ninterface IronSessionBase {\n  destroy: () => void;\n  save: () => Promise<void>;\n}\n\nexport type IronSession<T = IronSessionData> = T & IronSessionBase;\n\ndeclare module \"http\" {\n  interface IncomingMessage {\n    /**\n     * This request's `Session` object.\n     * Even though this property isn't marked as optional, it won't exist until you use the `express-session` middleware\n     * [Declaration merging](https://www.typescriptlang.org/docs/handbook/declaration-merging.html) can be used to add your own properties.\n     *\n     * @see SessionData\n     */\n    session: IronSession<IronSessionData>;\n  }\n}\n\nexport async function getIronSession<T = IronSessionData>(\n  req: IncomingMessage,\n  res: ServerResponse,\n  userSessionOptions: IronSessionOptions,\n): Promise<IronSession<Partial<T>>> {\n  if (\n    !req ||\n    !res ||\n    !userSessionOptions ||\n    !userSessionOptions.cookieName ||\n    !userSessionOptions.password\n  ) {\n    throw new Error(\n      `iron-session: Bad usage. Minimum usage is const session = await getIronSession(req, res, { cookieName: \"...\", password: \"...\". Check the usage here: https://github.com/vvo/iron-session`,\n    );\n  }\n\n  const passwordsAsMap =\n    typeof userSessionOptions.password === \"string\"\n      ? { 1: userSessionOptions.password }\n      : userSessionOptions.password;\n\n  Object.values(passwordsAsMap).forEach((password) => {\n    if (password.length < 32) {\n      throw new Error(\n        `iron-session: Bad usage. Password must be at least 32 characters long.`,\n      );\n    }\n  });\n\n  const options: Required<IronSessionOptions> = {\n    ...defaultOptions,\n    ...userSessionOptions,\n    cookieOptions: {\n      ...defaultOptions.cookieOptions,\n      ...(userSessionOptions.cookieOptions || {}),\n    },\n  };\n\n  if (\n    !(req.socket as TLSSocket).encrypted &&\n    options.cookieOptions.secure === true\n  ) {\n    throw new Error(\n      `iron-session: Can't use secure cookies when not in https. See usage at https://github.com/vvo/iron-session/`,\n    );\n  }\n\n  if (options.ttl === 0) {\n    // ttl = 0 means no expiration\n    // but in reality cookies have to expire (can't have no max-age)\n    // 2147483647 is the max value for max-age in cookies\n    // see https://stackoverflow.com/a/11685301/147079\n    options.ttl = 2147483647;\n  }\n\n  if (\n    userSessionOptions.cookieOptions &&\n    \"maxAge\" in userSessionOptions.cookieOptions\n  ) {\n    // session cookie, do not set maxAge, consider token as infinite\n    if (userSessionOptions.cookieOptions.maxAge === undefined) {\n      options.ttl = 0;\n    } else {\n      options.cookieOptions.maxAge = computeCookieMaxAge(\n        userSessionOptions.cookieOptions.maxAge,\n      );\n    }\n  } else {\n    options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);\n  }\n\n  const sealFromCookies = parseCookie(req.headers.cookie || \"\")[\n    options.cookieName\n  ];\n\n  const sessionData = await unsealSession(\n    sealFromCookies,\n    passwordsAsMap,\n    options.ttl * 1000,\n  );\n\n  const session = Object.defineProperties(sessionData, {\n    save: {\n      value: async function save() {\n        if (res.headersSent === true) {\n          throw new Error(\n            `iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()`,\n          );\n        }\n        const seal = await sealSession(\n          sessionData,\n          passwordsAsMap,\n          options.ttl * 1000,\n        );\n        const cookieValue = serializeCookie(\n          options.cookieName,\n          seal,\n          options.cookieOptions,\n        );\n\n        if (cookieValue.length > 4096) {\n          throw new Error(\n            `iron-session: Cookie length is too big ${cookieValue.length}, browsers will refuse it. Try to remove some data.`,\n          );\n        }\n\n        addToCookies(cookieValue, res);\n        return cookieValue;\n      },\n    },\n    destroy: {\n      value: function destroy() {\n        const cookieValue = serializeCookie(options.cookieName, \"\", {\n          ...options.cookieOptions,\n          maxAge: 0,\n        });\n        addToCookies(cookieValue, res);\n      },\n    },\n  }) as IronSession<Partial<T>>;\n\n  return session;\n}\n\nfunction addToCookies(cookieValue: string, res: ServerResponse) {\n  let existingSetCookie =\n    (res.getHeader(\"set-cookie\") as string[] | string) ?? [];\n  if (typeof existingSetCookie === \"string\") {\n    existingSetCookie = [existingSetCookie];\n  }\n  res.setHeader(\"set-cookie\", [...existingSetCookie, cookieValue]);\n}\n\nfunction computeCookieMaxAge(ttl: number) {\n  // The next line makes sure browser will expire cookies before seals are considered expired by the server.\n  // It also allows for clock difference of 60 seconds maximum between server and clients.\n  // It also makes sure to expire the cookie immediately when value is 0\n  return ttl - timestampSkewSec;\n}\n\nexport async function unsealSession(\n  seal: string,\n  password: passwordsMap,\n  ttl: number,\n): Promise<IronSessionData> {\n  try {\n    await Iron.unseal(seal, password, {\n      ...Iron.defaults,\n      ttl,\n    });\n  } catch (error) {\n    if (error instanceof Error) {\n      if (\n        error.message === \"Expired seal\" ||\n        error.message === \"Bad hmac value\" ||\n        error.message === \"Cannot find password: \" ||\n        error.message === \"Incorrect number of sealed components\"\n      ) {\n        // if seal expired or\n        // if seal is not valid (encrypted using a different password, when passwords are updated) or\n        // if we can't find back the password in the seal\n        // then we just start a new session over\n        return {};\n      }\n    }\n\n    throw error;\n  }\n\n  return {};\n}\n\nexport async function sealSession(\n  data: Record<string, unknown>,\n  password: passwordsMap,\n  ttl: number,\n) {\n  const mostRecentPasswordId = Math.max(\n    ...Object.keys(password).map((id) => parseInt(id, 10)),\n  );\n\n  const seal = await Iron.seal(data, password[mostRecentPasswordId], {\n    ...Iron.defaults,\n    ttl,\n  });\n\n  return seal;\n}\n"],
-  "mappings": ";AAAA;AACA;AAAA;AAAA;AAAA;AAUA,IAAM,mBAAmB;AAKzB,IAAM,iBAGF;AAAA,EACF,KAAK,KAAK,KAAK;AAAA,EACf,eAAe;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA;AAAA;AAiDV,8BACE,KACA,KACA,oBACkC;AAClC,MACE,CAAC,OACD,CAAC,OACD,CAAC,sBACD,CAAC,mBAAmB,cACpB,CAAC,mBAAmB,UACpB;AACA,UAAM,IAAI,MACR;AAAA;AAIJ,QAAM,iBACJ,OAAO,mBAAmB,aAAa,WACnC,EAAE,GAAG,mBAAmB,aACxB,mBAAmB;AAEzB,SAAO,OAAO,gBAAgB,QAAQ,CAAC,aAAa;AAClD,QAAI,SAAS,SAAS,IAAI;AACxB,YAAM,IAAI,MACR;AAAA;AAAA;AAKN,QAAM,UAAwC;AAAA,OACzC;AAAA,OACA;AAAA,IACH,eAAe;AAAA,SACV,eAAe;AAAA,SACd,mBAAmB,iBAAiB;AAAA;AAAA;AAI5C,MACE,CAAE,IAAI,OAAqB,aAC3B,QAAQ,cAAc,WAAW,MACjC;AACA,UAAM,IAAI,MACR;AAAA;AAIJ,MAAI,QAAQ,QAAQ,GAAG;AAKrB,YAAQ,MAAM;AAAA;AAGhB,MACE,mBAAmB,iBACnB,YAAY,mBAAmB,eAC/B;AAEA,QAAI,mBAAmB,cAAc,WAAW,QAAW;AACzD,cAAQ,MAAM;AAAA,WACT;AACL,cAAQ,cAAc,SAAS,oBAC7B,mBAAmB,cAAc;AAAA;AAAA,SAGhC;AACL,YAAQ,cAAc,SAAS,oBAAoB,QAAQ;AAAA;AAG7D,QAAM,kBAAkB,YAAY,IAAI,QAAQ,UAAU,IACxD,QAAQ;AAGV,QAAM,cAAc,MAAM,cACxB,iBACA,gBACA,QAAQ,MAAM;AAGhB,QAAM,UAAU,OAAO,iBAAiB,aAAa;AAAA,IACnD,MAAM;AAAA,MACJ,OAAO,sBAAsB;AAC3B,YAAI,IAAI,gBAAgB,MAAM;AAC5B,gBAAM,IAAI,MACR;AAAA;AAGJ,cAAM,OAAO,MAAM,YACjB,aACA,gBACA,QAAQ,MAAM;AAEhB,cAAM,cAAc,gBAClB,QAAQ,YACR,MACA,QAAQ;AAGV,YAAI,YAAY,SAAS,MAAM;AAC7B,gBAAM,IAAI,MACR,0CAA0C,YAAY;AAAA;AAI1D,qBAAa,aAAa;AAC1B,eAAO;AAAA;AAAA;AAAA,IAGX,SAAS;AAAA,MACP,OAAO,mBAAmB;AACxB,cAAM,cAAc,gBAAgB,QAAQ,YAAY,IAAI;AAAA,aACvD,QAAQ;AAAA,UACX,QAAQ;AAAA;AAEV,qBAAa,aAAa;AAAA;AAAA;AAAA;AAKhC,SAAO;AAAA;AAGT,sBAAsB,aAAqB,KAAqB;AAvMhE;AAwME,MAAI,oBACD,UAAI,UAAU,kBAAd,YAAqD;AACxD,MAAI,OAAO,sBAAsB,UAAU;AACzC,wBAAoB,CAAC;AAAA;AAEvB,MAAI,UAAU,cAAc,CAAC,GAAG,mBAAmB;AAAA;AAGrD,6BAA6B,KAAa;AAIxC,SAAO,MAAM;AAAA;AAGf,6BACE,MACA,UACA,KAC0B;AAC1B,MAAI;AACF,UAAM,KAAK,OAAO,MAAM,UAAU;AAAA,SAC7B,KAAK;AAAA,MACR;AAAA;AAAA,WAEK,OAAP;AACA,QAAI,iBAAiB,OAAO;AAC1B,UACE,MAAM,YAAY,kBAClB,MAAM,YAAY,oBAClB,MAAM,YAAY,4BAClB,MAAM,YAAY,yCAClB;AAKA,eAAO;AAAA;AAAA;AAIX,UAAM;AAAA;AAGR,SAAO;AAAA;AAGT,2BACE,MACA,UACA,KACA;AACA,QAAM,uBAAuB,KAAK,IAChC,GAAG,OAAO,KAAK,UAAU,IAAI,CAAC,OAAO,SAAS,IAAI;AAGpD,QAAM,OAAO,MAAM,KAAK,KAAK,MAAM,SAAS,uBAAuB;AAAA,OAC9D,KAAK;AAAA,IACR;AAAA;AAGF,SAAO;AAAA;",
-  "names": []
-}

package/next/dist/index.mjs

@@ -1,16 +0,0 @@
-// next/index.ts
-import { getIronSession } from "iron-session";
-function withIronSessionApiRoute(handler, options) {
-  return async function nextApiHandlerWrappedWithIronSession(req, res) {
-    const session = await getIronSession(req, res, options);
-    Object.defineProperty(req, "session", {
-      enumerable: true,
-      value: session
-    });
-    return handler(req, res);
-  };
-}
-export {
-  withIronSessionApiRoute
-};
-//# sourceMappingURL=index.mjs.map

package/next/dist/index.mjs.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../index.ts"],
-  "sourcesContent": ["import type { NextApiHandler } from \"next\";\nimport type { IronSessionData, IronSessionOptions } from \"iron-session\";\nimport { getIronSession } from \"iron-session\";\n\nexport function withIronSessionApiRoute<T = IronSessionData>(\n  handler: NextApiHandler,\n  options: IronSessionOptions,\n): NextApiHandler {\n  return async function nextApiHandlerWrappedWithIronSession(req, res) {\n    const session = await getIronSession<T>(req, res, options);\n    Object.defineProperty(req, \"session\", {\n      enumerable: true,\n      value: session,\n    });\n    return handler(req, res);\n  };\n}\n\n// export function withIronSessionSsr<P = unknown>(\n//   handler: NextGetServerSidePropsHandlerWithIronSession<P>,\n//   options: IronSessionOptions,\n// ): NextGetServerSidePropsHandlerWithIronSession<P> {\n//   return async function nextGetServerSidePropsHandlerWrappedWithIronSession(\n//     context: NextGetServerSideContextWithIronSession,\n//   ) {\n//     context.req.session = await getIronSession(\n//       context.req,\n//       context.res,\n//       options,\n//     );\n//     return handler(context);\n//   };\n// }\n"],
-  "mappings": ";AAEA;AAEO,iCACL,SACA,SACgB;AAChB,SAAO,oDAAoD,KAAK,KAAK;AACnE,UAAM,UAAU,MAAM,eAAkB,KAAK,KAAK;AAClD,WAAO,eAAe,KAAK,WAAW;AAAA,MACpC,YAAY;AAAA,MACZ,OAAO;AAAA;AAET,WAAO,QAAQ,KAAK;AAAA;AAAA;",
-  "names": []
-}