iron-session 6.0.3 → 6.1.0

package/README.md

@@ -1,4 +1,4 @@
-# iron-session [![GitHub license](https://img.shields.io/github/license/vvo/iron-session?style=flat)](https://github.com/vvo/iron-session/blob/master/LICENSE) [![Tests](https://github.com/vvo/iron-session/workflows/Tests/badge.svg)](https://github.com/vvo/iron-session/actions) ![npm](https://img.shields.io/npm/v/iron-session) [![Downloads](https://img.shields.io/npm/dm/next-iron-session.svg)](http://npm-stat.com/charts.html?package=iron-session)
+# iron-session [![GitHub license](https://img.shields.io/github/license/vvo/iron-session?style=flat)](https://github.com/vvo/iron-session/blob/master/LICENSE) [![Tests](https://github.com/vvo/iron-session/workflows/Tests/badge.svg)](https://github.com/vvo/iron-session/actions) [![npm](https://img.shields.io/npm/v/iron-session)](https://www.npmjs.com/package/iron-session) [![Downloads](https://img.shields.io/npm/dm/next-iron-session.svg)](http://npm-stat.com/charts.html?package=iron-session)
 
 <p align="center"><b>⭐️ Featured in the <a href="https://nextjs.org/docs/authentication">Next.js documentation</a></b></p>
 
@@ -186,15 +186,14 @@ import { ironOptions } from "lib/config";
 export default withIronSessionApiRoute(loginRoute, ironOptions);
 
 async function loginRoute(req, res) {
-    // get user from database then:
-    req.session.user = {
-      id: 230,
-      admin: true,
-    };
-    await req.session.save();
-    res.send({ ok: true });
-  }
-);
+  // get user from database then:
+  req.session.user = {
+    id: 230,
+    admin: true,
+  };
+  await req.session.save();
+  res.send({ ok: true });
+}
 ```
 
 ```ts
@@ -418,6 +417,22 @@ export default async function sendEmailRoute(req, res) {
 }
 ```
 
+The default `ttl` for such seals is 14 days. To specify a `ttl`, provide it in seconds like so:
+
+```ts
+const fifteenMinutesInSeconds = 15 * 60;
+
+const seal = await sealData(
+  {
+    userId: user.id,
+  },
+  {
+    password: "complex_password_at_least_32_characters_long",
+    ttl: fifteenMinutesInSeconds,
+  },
+);
+```
+
 **Login the user automatically and redirect:**
 
 ```ts
@@ -571,7 +586,7 @@ Only two options are required: `password` and `cookieName`. Everything else is a
 }
 ```
 
-### Next.js: withIronSessionApiRoute(handler, ironOptions)
+### Next.js: withIronSessionApiRoute(handler, ironOptions | (req: NextApiRequest, res: NextApiResponse) => IronSessionOptions | Promise\<IronSessionOptions\>)
 
 Wraps a [Next.js API Route](https://nextjs.org/docs/api-routes/dynamic-api-routes) and adds a `session` object to the request.
 
@@ -591,9 +606,30 @@ export default withIronSessionApiRoute(
     },
   },
 );
+
+// You can also pass an async or sync function which takes request and response object and return IronSessionOptions
+export default withIronSessionApiRoute(
+  function userRoute(req, res) {
+    res.send({ user: req.session.user });
+  },
+  (req, res) => {
+    // Infer max cookie from request
+    const maxCookieAge = getMaxCookieAge(req);
+    return {
+      cookieName: "myapp_cookiename",
+      password: "complex_password_at_least_32_characters_long",
+      // secure: true should be used in production (HTTPS) but can't be used in development (HTTP)
+      cookieOptions: {
+        // setMaxCookie age here.
+        maxCookieAge,
+        secure: process.env.NODE_ENV === "production",
+      },
+    };
+  },
+);
 ```
 
-### Next.js: withIronSessionSsr(handler, ironOptions)
+### Next.js: withIronSessionSsr(handler, ironOptions | (req: IncomingMessage, res: ServerResponse) => IronSessionOptions | Promise\<IronSessionOptions\>)
 
 Wraps a [Next.js getServerSideProps](https://nextjs.org/docs/basic-features/data-fetching#getserversideprops-server-side-rendering) and adds a `session` object to the request of the context.
 
@@ -617,6 +653,27 @@ export const getServerSideProps = withIronSessionSsr(
     },
   },
 );
+
+// You can also pass an async or sync function which takes request and response object and return IronSessionOptions
+export const getServerSideProps = withIronSessionSsr(
+  async function getServerSideProps({ req }) {
+    return {
+      props: {
+        user: req.session.user,
+      },
+    };
+  },
+  (req, res) => {
+    return {
+      cookieName: "myapp_cookiename",
+      password: "complex_password_at_least_32_characters_long",
+      // secure: true should be used in production (HTTPS) but can't be used in development (HTTP)
+      cookieOptions: {
+        secure: process.env.NODE_ENV === "production",
+      },
+    };
+  },
+);
 ```
 
 ### Express: ironSession(ironOptions)

package/dist/index.js

@@ -73,7 +73,7 @@ async function getIronSession(req, res, userSessionOptions) {
   } else {
     options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);
   }
-  const sealFromCookies = (0, import_cookie.parse)(req.headers.cookie || "")[options.cookieName];
+  const sealFromCookies = import_cookie.default.parse(req.headers.cookie || "")[options.cookieName];
   const session = sealFromCookies === void 0 ? {} : await unsealData(sealFromCookies, {
     password: passwordsAsMap,
     ttl: options.ttl
@@ -88,7 +88,7 @@ async function getIronSession(req, res, userSessionOptions) {
           password: passwordsAsMap,
           ttl: options.ttl
         });
-        const cookieValue = (0, import_cookie.serialize)(options.cookieName, seal, options.cookieOptions);
+        const cookieValue = import_cookie.default.serialize(options.cookieName, seal, options.cookieOptions);
         if (cookieValue.length > 4096) {
           throw new Error(`iron-session: Cookie length is too big ${cookieValue.length}, browsers will refuse it. Try to remove some data.`);
         }
@@ -100,7 +100,7 @@ async function getIronSession(req, res, userSessionOptions) {
         Object.keys(session).forEach((key) => {
           delete session[key];
         });
-        const cookieValue = (0, import_cookie.serialize)(options.cookieName, "", {
+        const cookieValue = import_cookie.default.serialize(options.cookieName, "", {
           ...options.cookieOptions,
           maxAge: 0
         });

package/dist/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/index.ts"],
-  "sourcesContent": ["import Iron from \"@hapi/iron\";\nimport type { CookieSerializeOptions } from \"cookie\";\nimport { parse as parseCookie, serialize as serializeCookie } from \"cookie\";\nimport type { IncomingMessage, ServerResponse } from \"http\";\n\n// default time allowed to check for iron seal validity when ttl passed\n// see https://hapi.dev/family/iron/api/?v=6.0.0#options\nconst timestampSkewSec = 60;\n\ntype passwordsMap = { [id: string]: string };\ntype password = string | passwordsMap;\n\nconst fourteenDaysInSeconds = 15 * 24 * 3600;\n\n// We store a token major version to handle data format changes when any. So that when you upgrade the cookies\n// can be kept alive between upgrades, no need to disconnect everyone.\nconst currentMajorVersion = 2;\nconst versionDelimiter = \"~\";\n\nconst defaultOptions: {\n  ttl: number;\n  cookieOptions: CookieSerializeOptions;\n} = {\n  ttl: fourteenDaysInSeconds,\n  cookieOptions: {\n    httpOnly: true,\n    secure: true,\n    sameSite: \"lax\",\n    path: \"/\",\n  },\n};\n\nexport interface IronSessionOptions {\n  /**\n   * This is the cookie name that will be used inside the browser. You should make sure it's unique given\n   * your application. Example: vercel-session\n   */\n  cookieName: string;\n\n  /**\n   * This is the password(s) that will be used to encrypt the cookie. It can be either a string or an object\n   * like {1: \"password\", 2: password}.\n   *\n   * When you provide multiple passwords then all of them will be used to decrypt the cookie and only the most\n   * recent (= highest key, 2 in this example) password will be used to encrypt the cookie. This allow you\n   * to use password rotation (security)\n   */\n  password: password;\n\n  /**\n   * This is the time in seconds that the session will be valid for. This also set the max-age attribute of\n   * the cookie automatically (minus 60 seconds so that the cookie always expire before the session).\n   */\n  ttl?: number;\n\n  /**\n   * This is the options that will be passed to the cookie library.\n   * You can see all of them here: https://github.com/jshttp/cookie#options-1.\n   *\n   * If you want to use \"session cookies\" (cookies that are deleted when the browser is closed) then you need\n   * to pass cookieOptions: { maxAge: undefined }.\n   */\n  cookieOptions?: CookieSerializeOptions;\n}\n\n// eslint-disable-next-line @typescript-eslint/no-empty-interface\nexport interface IronSessionData {\n  // If we allow for any keys, then there's no more type check on unknown properties\n  // which is not good\n  // If we allow for any keys, the later delete will work but I prefer to disable the\n  // check at this stage and\n  // provide good type checking instead\n  // [key: string]: unknown;\n}\n\nexport type IronSession = IronSessionData & {\n  /**\n   * Destroys the session data and removes the cookie.\n   */\n  destroy: () => void;\n\n  /**\n   * Encrypts the session data and sets the cookie.\n   */\n  save: () => Promise<void>;\n};\n\ndeclare module \"http\" {\n  interface IncomingMessage {\n    session: IronSession;\n  }\n}\n\nexport async function getIronSession(\n  req: IncomingMessage,\n  res: ServerResponse,\n  userSessionOptions: IronSessionOptions,\n): Promise<IronSession> {\n  if (\n    !req ||\n    !res ||\n    !userSessionOptions ||\n    !userSessionOptions.cookieName ||\n    !userSessionOptions.password\n  ) {\n    throw new Error(\n      `iron-session: Bad usage. Minimum usage is const session = await getIronSession(req, res, { cookieName: \"...\", password: \"...\". Check the usage here: https://github.com/vvo/iron-session`,\n    );\n  }\n\n  const passwordsAsMap = normalizeStringPasswordToMap(\n    userSessionOptions.password,\n  );\n\n  Object.values(\n    normalizeStringPasswordToMap(userSessionOptions.password),\n  ).forEach((password) => {\n    if (password.length < 32) {\n      throw new Error(\n        `iron-session: Bad usage. Password must be at least 32 characters long.`,\n      );\n    }\n  });\n\n  const options: Required<IronSessionOptions> = {\n    ...defaultOptions,\n    ...userSessionOptions,\n    cookieOptions: {\n      ...defaultOptions.cookieOptions,\n      ...(userSessionOptions.cookieOptions || {}),\n    },\n  };\n\n  if (options.ttl === 0) {\n    // ttl = 0 means no expiration\n    // but in reality cookies have to expire (can't have no max-age)\n    // 2147483647 is the max value for max-age in cookies\n    // see https://stackoverflow.com/a/11685301/147079\n    options.ttl = 2147483647;\n  }\n\n  if (\n    userSessionOptions.cookieOptions &&\n    \"maxAge\" in userSessionOptions.cookieOptions\n  ) {\n    // session cookie, do not set maxAge, consider token as infinite\n    if (userSessionOptions.cookieOptions.maxAge === undefined) {\n      options.ttl = 0;\n    } else {\n      options.cookieOptions.maxAge = computeCookieMaxAge(\n        userSessionOptions.cookieOptions.maxAge,\n      );\n    }\n  } else {\n    options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);\n  }\n\n  const sealFromCookies = parseCookie(req.headers.cookie || \"\")[\n    options.cookieName\n  ];\n\n  const session =\n    sealFromCookies === undefined\n      ? {}\n      : await unsealData<IronSessionData>(sealFromCookies, {\n          password: passwordsAsMap,\n          ttl: options.ttl,\n        });\n\n  Object.defineProperties(session, {\n    save: {\n      value: async function save() {\n        if (res.headersSent === true) {\n          throw new Error(\n            `iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()`,\n          );\n        }\n        const seal = await sealData(session, {\n          password: passwordsAsMap,\n          ttl: options.ttl,\n        });\n        const cookieValue = serializeCookie(\n          options.cookieName,\n          seal,\n          options.cookieOptions,\n        );\n\n        if (cookieValue.length > 4096) {\n          throw new Error(\n            `iron-session: Cookie length is too big ${cookieValue.length}, browsers will refuse it. Try to remove some data.`,\n          );\n        }\n\n        addToCookies(cookieValue, res);\n      },\n    },\n    destroy: {\n      value: function destroy() {\n        Object.keys(session).forEach((key) => {\n          // @ts-ignore See comment on the IronSessionData interface\n          delete session[key];\n        });\n\n        const cookieValue = serializeCookie(options.cookieName, \"\", {\n          ...options.cookieOptions,\n          maxAge: 0,\n        });\n        addToCookies(cookieValue, res);\n      },\n    },\n  });\n\n  return session as IronSession;\n}\n\nfunction addToCookies(cookieValue: string, res: ServerResponse) {\n  let existingSetCookie =\n    (res.getHeader(\"set-cookie\") as string[] | string) ?? [];\n  if (typeof existingSetCookie === \"string\") {\n    existingSetCookie = [existingSetCookie];\n  }\n  res.setHeader(\"set-cookie\", [...existingSetCookie, cookieValue]);\n}\n\nfunction computeCookieMaxAge(ttl: number) {\n  // The next line makes sure browser will expire cookies before seals are considered expired by the server.\n  // It also allows for clock difference of 60 seconds maximum between server and clients.\n  // It also makes sure to expire the cookie immediately when value is 0\n  return ttl - timestampSkewSec;\n}\n\nexport async function unsealData<T = Record<string, unknown>>(\n  seal: string,\n  {\n    password,\n    ttl = fourteenDaysInSeconds,\n  }: { password: password; ttl?: number },\n): Promise<T> {\n  const passwordsAsMap = normalizeStringPasswordToMap(password);\n  const { sealWithoutVersion, tokenVersion } = parseSeal(seal);\n\n  try {\n    const data = await Iron.unseal(sealWithoutVersion, passwordsAsMap, {\n      ...Iron.defaults,\n      ttl: ttl * 1000,\n    });\n\n    if (tokenVersion === 2) {\n      return data;\n    }\n\n    return {\n      ...data.persistent,\n    };\n  } catch (error) {\n    if (error instanceof Error) {\n      if (\n        error.message === \"Expired seal\" ||\n        error.message === \"Bad hmac value\" ||\n        error.message === \"Cannot find password: \" ||\n        error.message === \"Incorrect number of sealed components\"\n      ) {\n        // if seal expired or\n        // if seal is not valid (encrypted using a different password, when passwords are badly rotated) or\n        // if we can't find back the password in the seal\n        // then we just start a new session over\n        return {} as T;\n      }\n    }\n\n    throw error;\n  }\n}\n\nfunction parseSeal(seal: string): {\n  sealWithoutVersion: string;\n  tokenVersion: number | null;\n} {\n  if (seal[seal.length - 2] === versionDelimiter) {\n    const [sealWithoutVersion, tokenVersionAsString] =\n      seal.split(versionDelimiter);\n    return {\n      sealWithoutVersion,\n      tokenVersion: parseInt(tokenVersionAsString, 10),\n    };\n  }\n\n  return { sealWithoutVersion: seal, tokenVersion: null };\n}\n\nexport async function sealData(\n  data: unknown,\n  {\n    password,\n    ttl = fourteenDaysInSeconds,\n  }: { password: password; ttl?: number },\n) {\n  const passwordsAsMap = normalizeStringPasswordToMap(password);\n\n  const mostRecentPasswordId = Math.max(\n    ...Object.keys(passwordsAsMap).map((id) => parseInt(id, 10)),\n  );\n\n  const passwordForSeal = {\n    id: mostRecentPasswordId.toString(),\n    secret: passwordsAsMap[mostRecentPasswordId],\n  };\n\n  const seal = await Iron.seal(data, passwordForSeal, {\n    ...Iron.defaults,\n    ttl: ttl * 1000,\n  });\n\n  return `${seal}${versionDelimiter}${currentMajorVersion}`;\n}\n\nfunction normalizeStringPasswordToMap(password: password) {\n  return typeof password === \"string\" ? { 1: password } : password;\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kBAAiB;AAEjB,oBAAmE;AAKnE,IAAM,mBAAmB;AAKzB,IAAM,wBAAwB,KAAK,KAAK;AAIxC,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AAEzB,IAAM,iBAGF;AAAA,EACF,KAAK;AAAA,EACL,eAAe;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA;AAAA;AAiEV,8BACE,KACA,KACA,oBACsB;AACtB,MACE,CAAC,OACD,CAAC,OACD,CAAC,sBACD,CAAC,mBAAmB,cACpB,CAAC,mBAAmB,UACpB;AACA,UAAM,IAAI,MACR;AAAA;AAIJ,QAAM,iBAAiB,6BACrB,mBAAmB;AAGrB,SAAO,OACL,6BAA6B,mBAAmB,WAChD,QAAQ,CAAC,aAAa;AACtB,QAAI,SAAS,SAAS,IAAI;AACxB,YAAM,IAAI,MACR;AAAA;AAAA;AAKN,QAAM,UAAwC;AAAA,OACzC;AAAA,OACA;AAAA,IACH,eAAe;AAAA,SACV,eAAe;AAAA,SACd,mBAAmB,iBAAiB;AAAA;AAAA;AAI5C,MAAI,QAAQ,QAAQ,GAAG;AAKrB,YAAQ,MAAM;AAAA;AAGhB,MACE,mBAAmB,iBACnB,YAAY,mBAAmB,eAC/B;AAEA,QAAI,mBAAmB,cAAc,WAAW,QAAW;AACzD,cAAQ,MAAM;AAAA,WACT;AACL,cAAQ,cAAc,SAAS,oBAC7B,mBAAmB,cAAc;AAAA;AAAA,SAGhC;AACL,YAAQ,cAAc,SAAS,oBAAoB,QAAQ;AAAA;AAG7D,QAAM,kBAAkB,yBAAY,IAAI,QAAQ,UAAU,IACxD,QAAQ;AAGV,QAAM,UACJ,oBAAoB,SAChB,KACA,MAAM,WAA4B,iBAAiB;AAAA,IACjD,UAAU;AAAA,IACV,KAAK,QAAQ;AAAA;AAGrB,SAAO,iBAAiB,SAAS;AAAA,IAC/B,MAAM;AAAA,MACJ,OAAO,sBAAsB;AAC3B,YAAI,IAAI,gBAAgB,MAAM;AAC5B,gBAAM,IAAI,MACR;AAAA;AAGJ,cAAM,OAAO,MAAM,SAAS,SAAS;AAAA,UACnC,UAAU;AAAA,UACV,KAAK,QAAQ;AAAA;AAEf,cAAM,cAAc,6BAClB,QAAQ,YACR,MACA,QAAQ;AAGV,YAAI,YAAY,SAAS,MAAM;AAC7B,gBAAM,IAAI,MACR,0CAA0C,YAAY;AAAA;AAI1D,qBAAa,aAAa;AAAA;AAAA;AAAA,IAG9B,SAAS;AAAA,MACP,OAAO,mBAAmB;AACxB,eAAO,KAAK,SAAS,QAAQ,CAAC,QAAQ;AAEpC,iBAAO,QAAQ;AAAA;AAGjB,cAAM,cAAc,6BAAgB,QAAQ,YAAY,IAAI;AAAA,aACvD,QAAQ;AAAA,UACX,QAAQ;AAAA;AAEV,qBAAa,aAAa;AAAA;AAAA;AAAA;AAKhC,SAAO;AAAA;AAGT,sBAAsB,aAAqB,KAAqB;AAvNhE;AAwNE,MAAI,oBACD,UAAI,UAAU,kBAAd,YAAqD;AACxD,MAAI,OAAO,sBAAsB,UAAU;AACzC,wBAAoB,CAAC;AAAA;AAEvB,MAAI,UAAU,cAAc,CAAC,GAAG,mBAAmB;AAAA;AAGrD,6BAA6B,KAAa;AAIxC,SAAO,MAAM;AAAA;AAGf,0BACE,MACA;AAAA,EACE;AAAA,EACA,MAAM;AAAA,GAEI;AACZ,QAAM,iBAAiB,6BAA6B;AACpD,QAAM,EAAE,oBAAoB,iBAAiB,UAAU;AAEvD,MAAI;AACF,UAAM,OAAO,MAAM,oBAAK,OAAO,oBAAoB,gBAAgB;AAAA,SAC9D,oBAAK;AAAA,MACR,KAAK,MAAM;AAAA;AAGb,QAAI,iBAAiB,GAAG;AACtB,aAAO;AAAA;AAGT,WAAO;AAAA,SACF,KAAK;AAAA;AAAA,WAEH,OAAP;AACA,QAAI,iBAAiB,OAAO;AAC1B,UACE,MAAM,YAAY,kBAClB,MAAM,YAAY,oBAClB,MAAM,YAAY,4BAClB,MAAM,YAAY,yCAClB;AAKA,eAAO;AAAA;AAAA;AAIX,UAAM;AAAA;AAAA;AAIV,mBAAmB,MAGjB;AACA,MAAI,KAAK,KAAK,SAAS,OAAO,kBAAkB;AAC9C,UAAM,CAAC,oBAAoB,wBACzB,KAAK,MAAM;AACb,WAAO;AAAA,MACL;AAAA,MACA,cAAc,SAAS,sBAAsB;AAAA;AAAA;AAIjD,SAAO,EAAE,oBAAoB,MAAM,cAAc;AAAA;AAGnD,wBACE,MACA;AAAA,EACE;AAAA,EACA,MAAM;AAAA,GAER;AACA,QAAM,iBAAiB,6BAA6B;AAEpD,QAAM,uBAAuB,KAAK,IAChC,GAAG,OAAO,KAAK,gBAAgB,IAAI,CAAC,OAAO,SAAS,IAAI;AAG1D,QAAM,kBAAkB;AAAA,IACtB,IAAI,qBAAqB;AAAA,IACzB,QAAQ,eAAe;AAAA;AAGzB,QAAM,OAAO,MAAM,oBAAK,KAAK,MAAM,iBAAiB;AAAA,OAC/C,oBAAK;AAAA,IACR,KAAK,MAAM;AAAA;AAGb,SAAO,GAAG,OAAO,mBAAmB;AAAA;AAGtC,sCAAsC,UAAoB;AACxD,SAAO,OAAO,aAAa,WAAW,EAAE,GAAG,aAAa;AAAA;",
+  "sourcesContent": ["import Iron from \"@hapi/iron\";\nimport type { CookieSerializeOptions } from \"cookie\";\nimport cookie from \"cookie\";\nimport type { IncomingMessage, ServerResponse } from \"http\";\n\n// default time allowed to check for iron seal validity when ttl passed\n// see https://hapi.dev/family/iron/api/?v=6.0.0#options\nconst timestampSkewSec = 60;\n\ntype passwordsMap = { [id: string]: string };\ntype password = string | passwordsMap;\n\nconst fourteenDaysInSeconds = 15 * 24 * 3600;\n\n// We store a token major version to handle data format changes when any. So that when you upgrade the cookies\n// can be kept alive between upgrades, no need to disconnect everyone.\nconst currentMajorVersion = 2;\nconst versionDelimiter = \"~\";\n\nconst defaultOptions: {\n  ttl: number;\n  cookieOptions: CookieSerializeOptions;\n} = {\n  ttl: fourteenDaysInSeconds,\n  cookieOptions: {\n    httpOnly: true,\n    secure: true,\n    sameSite: \"lax\",\n    path: \"/\",\n  },\n};\n\nexport interface IronSessionOptions {\n  /**\n   * This is the cookie name that will be used inside the browser. You should make sure it's unique given\n   * your application. Example: vercel-session\n   */\n  cookieName: string;\n\n  /**\n   * This is the password(s) that will be used to encrypt the cookie. It can be either a string or an object\n   * like {1: \"password\", 2: password}.\n   *\n   * When you provide multiple passwords then all of them will be used to decrypt the cookie and only the most\n   * recent (= highest key, 2 in this example) password will be used to encrypt the cookie. This allow you\n   * to use password rotation (security)\n   */\n  password: password;\n\n  /**\n   * This is the time in seconds that the session will be valid for. This also set the max-age attribute of\n   * the cookie automatically (minus 60 seconds so that the cookie always expire before the session).\n   */\n  ttl?: number;\n\n  /**\n   * This is the options that will be passed to the cookie library.\n   * You can see all of them here: https://github.com/jshttp/cookie#options-1.\n   *\n   * If you want to use \"session cookies\" (cookies that are deleted when the browser is closed) then you need\n   * to pass cookieOptions: { maxAge: undefined }.\n   */\n  cookieOptions?: CookieSerializeOptions;\n}\n\n// eslint-disable-next-line @typescript-eslint/no-empty-interface\nexport interface IronSessionData {\n  // If we allow for any keys, then there's no more type check on unknown properties\n  // which is not good\n  // If we allow for any keys, the later delete will work but I prefer to disable the\n  // check at this stage and\n  // provide good type checking instead\n  // [key: string]: unknown;\n}\n\nexport type IronSession = IronSessionData & {\n  /**\n   * Destroys the session data and removes the cookie.\n   */\n  destroy: () => void;\n\n  /**\n   * Encrypts the session data and sets the cookie.\n   */\n  save: () => Promise<void>;\n};\n\ndeclare module \"http\" {\n  interface IncomingMessage {\n    session: IronSession;\n  }\n}\n\nexport async function getIronSession(\n  req: IncomingMessage,\n  res: ServerResponse,\n  userSessionOptions: IronSessionOptions,\n): Promise<IronSession> {\n  if (\n    !req ||\n    !res ||\n    !userSessionOptions ||\n    !userSessionOptions.cookieName ||\n    !userSessionOptions.password\n  ) {\n    throw new Error(\n      `iron-session: Bad usage. Minimum usage is const session = await getIronSession(req, res, { cookieName: \"...\", password: \"...\". Check the usage here: https://github.com/vvo/iron-session`,\n    );\n  }\n\n  const passwordsAsMap = normalizeStringPasswordToMap(\n    userSessionOptions.password,\n  );\n\n  Object.values(\n    normalizeStringPasswordToMap(userSessionOptions.password),\n  ).forEach((password) => {\n    if (password.length < 32) {\n      throw new Error(\n        `iron-session: Bad usage. Password must be at least 32 characters long.`,\n      );\n    }\n  });\n\n  const options: Required<IronSessionOptions> = {\n    ...defaultOptions,\n    ...userSessionOptions,\n    cookieOptions: {\n      ...defaultOptions.cookieOptions,\n      ...(userSessionOptions.cookieOptions || {}),\n    },\n  };\n\n  if (options.ttl === 0) {\n    // ttl = 0 means no expiration\n    // but in reality cookies have to expire (can't have no max-age)\n    // 2147483647 is the max value for max-age in cookies\n    // see https://stackoverflow.com/a/11685301/147079\n    options.ttl = 2147483647;\n  }\n\n  if (\n    userSessionOptions.cookieOptions &&\n    \"maxAge\" in userSessionOptions.cookieOptions\n  ) {\n    // session cookie, do not set maxAge, consider token as infinite\n    if (userSessionOptions.cookieOptions.maxAge === undefined) {\n      options.ttl = 0;\n    } else {\n      options.cookieOptions.maxAge = computeCookieMaxAge(\n        userSessionOptions.cookieOptions.maxAge,\n      );\n    }\n  } else {\n    options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);\n  }\n\n  const sealFromCookies = cookie.parse(req.headers.cookie || \"\")[\n    options.cookieName\n  ];\n\n  const session =\n    sealFromCookies === undefined\n      ? {}\n      : await unsealData<IronSessionData>(sealFromCookies, {\n          password: passwordsAsMap,\n          ttl: options.ttl,\n        });\n\n  Object.defineProperties(session, {\n    save: {\n      value: async function save() {\n        if (res.headersSent === true) {\n          throw new Error(\n            `iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()`,\n          );\n        }\n        const seal = await sealData(session, {\n          password: passwordsAsMap,\n          ttl: options.ttl,\n        });\n        const cookieValue = cookie.serialize(\n          options.cookieName,\n          seal,\n          options.cookieOptions,\n        );\n\n        if (cookieValue.length > 4096) {\n          throw new Error(\n            `iron-session: Cookie length is too big ${cookieValue.length}, browsers will refuse it. Try to remove some data.`,\n          );\n        }\n\n        addToCookies(cookieValue, res);\n      },\n    },\n    destroy: {\n      value: function destroy() {\n        Object.keys(session).forEach((key) => {\n          // @ts-ignore See comment on the IronSessionData interface\n          delete session[key];\n        });\n\n        const cookieValue = cookie.serialize(options.cookieName, \"\", {\n          ...options.cookieOptions,\n          maxAge: 0,\n        });\n        addToCookies(cookieValue, res);\n      },\n    },\n  });\n\n  return session as IronSession;\n}\n\nfunction addToCookies(cookieValue: string, res: ServerResponse) {\n  let existingSetCookie =\n    (res.getHeader(\"set-cookie\") as string[] | string) ?? [];\n  if (typeof existingSetCookie === \"string\") {\n    existingSetCookie = [existingSetCookie];\n  }\n  res.setHeader(\"set-cookie\", [...existingSetCookie, cookieValue]);\n}\n\nfunction computeCookieMaxAge(ttl: number) {\n  // The next line makes sure browser will expire cookies before seals are considered expired by the server.\n  // It also allows for clock difference of 60 seconds maximum between server and clients.\n  // It also makes sure to expire the cookie immediately when value is 0\n  return ttl - timestampSkewSec;\n}\n\nexport async function unsealData<T = Record<string, unknown>>(\n  seal: string,\n  {\n    password,\n    ttl = fourteenDaysInSeconds,\n  }: { password: password; ttl?: number },\n): Promise<T> {\n  const passwordsAsMap = normalizeStringPasswordToMap(password);\n  const { sealWithoutVersion, tokenVersion } = parseSeal(seal);\n\n  try {\n    const data = await Iron.unseal(sealWithoutVersion, passwordsAsMap, {\n      ...Iron.defaults,\n      ttl: ttl * 1000,\n    });\n\n    if (tokenVersion === 2) {\n      return data;\n    }\n\n    return {\n      ...data.persistent,\n    };\n  } catch (error) {\n    if (error instanceof Error) {\n      if (\n        error.message === \"Expired seal\" ||\n        error.message === \"Bad hmac value\" ||\n        error.message === \"Cannot find password: \" ||\n        error.message === \"Incorrect number of sealed components\"\n      ) {\n        // if seal expired or\n        // if seal is not valid (encrypted using a different password, when passwords are badly rotated) or\n        // if we can't find back the password in the seal\n        // then we just start a new session over\n        return {} as T;\n      }\n    }\n\n    throw error;\n  }\n}\n\nfunction parseSeal(seal: string): {\n  sealWithoutVersion: string;\n  tokenVersion: number | null;\n} {\n  if (seal[seal.length - 2] === versionDelimiter) {\n    const [sealWithoutVersion, tokenVersionAsString] =\n      seal.split(versionDelimiter);\n    return {\n      sealWithoutVersion,\n      tokenVersion: parseInt(tokenVersionAsString, 10),\n    };\n  }\n\n  return { sealWithoutVersion: seal, tokenVersion: null };\n}\n\nexport async function sealData(\n  data: unknown,\n  {\n    password,\n    ttl = fourteenDaysInSeconds,\n  }: { password: password; ttl?: number },\n) {\n  const passwordsAsMap = normalizeStringPasswordToMap(password);\n\n  const mostRecentPasswordId = Math.max(\n    ...Object.keys(passwordsAsMap).map((id) => parseInt(id, 10)),\n  );\n\n  const passwordForSeal = {\n    id: mostRecentPasswordId.toString(),\n    secret: passwordsAsMap[mostRecentPasswordId],\n  };\n\n  const seal = await Iron.seal(data, passwordForSeal, {\n    ...Iron.defaults,\n    ttl: ttl * 1000,\n  });\n\n  return `${seal}${versionDelimiter}${currentMajorVersion}`;\n}\n\nfunction normalizeStringPasswordToMap(password: password) {\n  return typeof password === \"string\" ? { 1: password } : password;\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kBAAiB;AAEjB,oBAAmB;AAKnB,IAAM,mBAAmB;AAKzB,IAAM,wBAAwB,KAAK,KAAK;AAIxC,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AAEzB,IAAM,iBAGF;AAAA,EACF,KAAK;AAAA,EACL,eAAe;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA;AAAA;AAiEV,8BACE,KACA,KACA,oBACsB;AACtB,MACE,CAAC,OACD,CAAC,OACD,CAAC,sBACD,CAAC,mBAAmB,cACpB,CAAC,mBAAmB,UACpB;AACA,UAAM,IAAI,MACR;AAAA;AAIJ,QAAM,iBAAiB,6BACrB,mBAAmB;AAGrB,SAAO,OACL,6BAA6B,mBAAmB,WAChD,QAAQ,CAAC,aAAa;AACtB,QAAI,SAAS,SAAS,IAAI;AACxB,YAAM,IAAI,MACR;AAAA;AAAA;AAKN,QAAM,UAAwC;AAAA,OACzC;AAAA,OACA;AAAA,IACH,eAAe;AAAA,SACV,eAAe;AAAA,SACd,mBAAmB,iBAAiB;AAAA;AAAA;AAI5C,MAAI,QAAQ,QAAQ,GAAG;AAKrB,YAAQ,MAAM;AAAA;AAGhB,MACE,mBAAmB,iBACnB,YAAY,mBAAmB,eAC/B;AAEA,QAAI,mBAAmB,cAAc,WAAW,QAAW;AACzD,cAAQ,MAAM;AAAA,WACT;AACL,cAAQ,cAAc,SAAS,oBAC7B,mBAAmB,cAAc;AAAA;AAAA,SAGhC;AACL,YAAQ,cAAc,SAAS,oBAAoB,QAAQ;AAAA;AAG7D,QAAM,kBAAkB,sBAAO,MAAM,IAAI,QAAQ,UAAU,IACzD,QAAQ;AAGV,QAAM,UACJ,oBAAoB,SAChB,KACA,MAAM,WAA4B,iBAAiB;AAAA,IACjD,UAAU;AAAA,IACV,KAAK,QAAQ;AAAA;AAGrB,SAAO,iBAAiB,SAAS;AAAA,IAC/B,MAAM;AAAA,MACJ,OAAO,sBAAsB;AAC3B,YAAI,IAAI,gBAAgB,MAAM;AAC5B,gBAAM,IAAI,MACR;AAAA;AAGJ,cAAM,OAAO,MAAM,SAAS,SAAS;AAAA,UACnC,UAAU;AAAA,UACV,KAAK,QAAQ;AAAA;AAEf,cAAM,cAAc,sBAAO,UACzB,QAAQ,YACR,MACA,QAAQ;AAGV,YAAI,YAAY,SAAS,MAAM;AAC7B,gBAAM,IAAI,MACR,0CAA0C,YAAY;AAAA;AAI1D,qBAAa,aAAa;AAAA;AAAA;AAAA,IAG9B,SAAS;AAAA,MACP,OAAO,mBAAmB;AACxB,eAAO,KAAK,SAAS,QAAQ,CAAC,QAAQ;AAEpC,iBAAO,QAAQ;AAAA;AAGjB,cAAM,cAAc,sBAAO,UAAU,QAAQ,YAAY,IAAI;AAAA,aACxD,QAAQ;AAAA,UACX,QAAQ;AAAA;AAEV,qBAAa,aAAa;AAAA;AAAA;AAAA;AAKhC,SAAO;AAAA;AAGT,sBAAsB,aAAqB,KAAqB;AAvNhE;AAwNE,MAAI,oBACD,UAAI,UAAU,kBAAd,YAAqD;AACxD,MAAI,OAAO,sBAAsB,UAAU;AACzC,wBAAoB,CAAC;AAAA;AAEvB,MAAI,UAAU,cAAc,CAAC,GAAG,mBAAmB;AAAA;AAGrD,6BAA6B,KAAa;AAIxC,SAAO,MAAM;AAAA;AAGf,0BACE,MACA;AAAA,EACE;AAAA,EACA,MAAM;AAAA,GAEI;AACZ,QAAM,iBAAiB,6BAA6B;AACpD,QAAM,EAAE,oBAAoB,iBAAiB,UAAU;AAEvD,MAAI;AACF,UAAM,OAAO,MAAM,oBAAK,OAAO,oBAAoB,gBAAgB;AAAA,SAC9D,oBAAK;AAAA,MACR,KAAK,MAAM;AAAA;AAGb,QAAI,iBAAiB,GAAG;AACtB,aAAO;AAAA;AAGT,WAAO;AAAA,SACF,KAAK;AAAA;AAAA,WAEH,OAAP;AACA,QAAI,iBAAiB,OAAO;AAC1B,UACE,MAAM,YAAY,kBAClB,MAAM,YAAY,oBAClB,MAAM,YAAY,4BAClB,MAAM,YAAY,yCAClB;AAKA,eAAO;AAAA;AAAA;AAIX,UAAM;AAAA;AAAA;AAIV,mBAAmB,MAGjB;AACA,MAAI,KAAK,KAAK,SAAS,OAAO,kBAAkB;AAC9C,UAAM,CAAC,oBAAoB,wBACzB,KAAK,MAAM;AACb,WAAO;AAAA,MACL;AAAA,MACA,cAAc,SAAS,sBAAsB;AAAA;AAAA;AAIjD,SAAO,EAAE,oBAAoB,MAAM,cAAc;AAAA;AAGnD,wBACE,MACA;AAAA,EACE;AAAA,EACA,MAAM;AAAA,GAER;AACA,QAAM,iBAAiB,6BAA6B;AAEpD,QAAM,uBAAuB,KAAK,IAChC,GAAG,OAAO,KAAK,gBAAgB,IAAI,CAAC,OAAO,SAAS,IAAI;AAG1D,QAAM,kBAAkB;AAAA,IACtB,IAAI,qBAAqB;AAAA,IACzB,QAAQ,eAAe;AAAA;AAGzB,QAAM,OAAO,MAAM,oBAAK,KAAK,MAAM,iBAAiB;AAAA,OAC/C,oBAAK;AAAA,IACR,KAAK,MAAM;AAAA;AAGb,SAAO,GAAG,OAAO,mBAAmB;AAAA;AAGtC,sCAAsC,UAAoB;AACxD,SAAO,OAAO,aAAa,WAAW,EAAE,GAAG,aAAa;AAAA;",
   "names": []
 }

package/dist/index.mjs

@@ -1,6 +1,6 @@
 // src/index.ts
 import Iron from "@hapi/iron";
-import { parse as parseCookie, serialize as serializeCookie } from "cookie";
+import cookie from "cookie";
 var timestampSkewSec = 60;
 var fourteenDaysInSeconds = 15 * 24 * 3600;
 var currentMajorVersion = 2;
@@ -44,7 +44,7 @@ async function getIronSession(req, res, userSessionOptions) {
   } else {
     options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);
   }
-  const sealFromCookies = parseCookie(req.headers.cookie || "")[options.cookieName];
+  const sealFromCookies = cookie.parse(req.headers.cookie || "")[options.cookieName];
   const session = sealFromCookies === void 0 ? {} : await unsealData(sealFromCookies, {
     password: passwordsAsMap,
     ttl: options.ttl
@@ -59,7 +59,7 @@ async function getIronSession(req, res, userSessionOptions) {
           password: passwordsAsMap,
           ttl: options.ttl
         });
-        const cookieValue = serializeCookie(options.cookieName, seal, options.cookieOptions);
+        const cookieValue = cookie.serialize(options.cookieName, seal, options.cookieOptions);
         if (cookieValue.length > 4096) {
           throw new Error(`iron-session: Cookie length is too big ${cookieValue.length}, browsers will refuse it. Try to remove some data.`);
         }
@@ -71,7 +71,7 @@ async function getIronSession(req, res, userSessionOptions) {
         Object.keys(session).forEach((key) => {
           delete session[key];
         });
-        const cookieValue = serializeCookie(options.cookieName, "", {
+        const cookieValue = cookie.serialize(options.cookieName, "", {
           ...options.cookieOptions,
           maxAge: 0
         });

package/dist/index.mjs.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/index.ts"],
-  "sourcesContent": ["import Iron from \"@hapi/iron\";\nimport type { CookieSerializeOptions } from \"cookie\";\nimport { parse as parseCookie, serialize as serializeCookie } from \"cookie\";\nimport type { IncomingMessage, ServerResponse } from \"http\";\n\n// default time allowed to check for iron seal validity when ttl passed\n// see https://hapi.dev/family/iron/api/?v=6.0.0#options\nconst timestampSkewSec = 60;\n\ntype passwordsMap = { [id: string]: string };\ntype password = string | passwordsMap;\n\nconst fourteenDaysInSeconds = 15 * 24 * 3600;\n\n// We store a token major version to handle data format changes when any. So that when you upgrade the cookies\n// can be kept alive between upgrades, no need to disconnect everyone.\nconst currentMajorVersion = 2;\nconst versionDelimiter = \"~\";\n\nconst defaultOptions: {\n  ttl: number;\n  cookieOptions: CookieSerializeOptions;\n} = {\n  ttl: fourteenDaysInSeconds,\n  cookieOptions: {\n    httpOnly: true,\n    secure: true,\n    sameSite: \"lax\",\n    path: \"/\",\n  },\n};\n\nexport interface IronSessionOptions {\n  /**\n   * This is the cookie name that will be used inside the browser. You should make sure it's unique given\n   * your application. Example: vercel-session\n   */\n  cookieName: string;\n\n  /**\n   * This is the password(s) that will be used to encrypt the cookie. It can be either a string or an object\n   * like {1: \"password\", 2: password}.\n   *\n   * When you provide multiple passwords then all of them will be used to decrypt the cookie and only the most\n   * recent (= highest key, 2 in this example) password will be used to encrypt the cookie. This allow you\n   * to use password rotation (security)\n   */\n  password: password;\n\n  /**\n   * This is the time in seconds that the session will be valid for. This also set the max-age attribute of\n   * the cookie automatically (minus 60 seconds so that the cookie always expire before the session).\n   */\n  ttl?: number;\n\n  /**\n   * This is the options that will be passed to the cookie library.\n   * You can see all of them here: https://github.com/jshttp/cookie#options-1.\n   *\n   * If you want to use \"session cookies\" (cookies that are deleted when the browser is closed) then you need\n   * to pass cookieOptions: { maxAge: undefined }.\n   */\n  cookieOptions?: CookieSerializeOptions;\n}\n\n// eslint-disable-next-line @typescript-eslint/no-empty-interface\nexport interface IronSessionData {\n  // If we allow for any keys, then there's no more type check on unknown properties\n  // which is not good\n  // If we allow for any keys, the later delete will work but I prefer to disable the\n  // check at this stage and\n  // provide good type checking instead\n  // [key: string]: unknown;\n}\n\nexport type IronSession = IronSessionData & {\n  /**\n   * Destroys the session data and removes the cookie.\n   */\n  destroy: () => void;\n\n  /**\n   * Encrypts the session data and sets the cookie.\n   */\n  save: () => Promise<void>;\n};\n\ndeclare module \"http\" {\n  interface IncomingMessage {\n    session: IronSession;\n  }\n}\n\nexport async function getIronSession(\n  req: IncomingMessage,\n  res: ServerResponse,\n  userSessionOptions: IronSessionOptions,\n): Promise<IronSession> {\n  if (\n    !req ||\n    !res ||\n    !userSessionOptions ||\n    !userSessionOptions.cookieName ||\n    !userSessionOptions.password\n  ) {\n    throw new Error(\n      `iron-session: Bad usage. Minimum usage is const session = await getIronSession(req, res, { cookieName: \"...\", password: \"...\". Check the usage here: https://github.com/vvo/iron-session`,\n    );\n  }\n\n  const passwordsAsMap = normalizeStringPasswordToMap(\n    userSessionOptions.password,\n  );\n\n  Object.values(\n    normalizeStringPasswordToMap(userSessionOptions.password),\n  ).forEach((password) => {\n    if (password.length < 32) {\n      throw new Error(\n        `iron-session: Bad usage. Password must be at least 32 characters long.`,\n      );\n    }\n  });\n\n  const options: Required<IronSessionOptions> = {\n    ...defaultOptions,\n    ...userSessionOptions,\n    cookieOptions: {\n      ...defaultOptions.cookieOptions,\n      ...(userSessionOptions.cookieOptions || {}),\n    },\n  };\n\n  if (options.ttl === 0) {\n    // ttl = 0 means no expiration\n    // but in reality cookies have to expire (can't have no max-age)\n    // 2147483647 is the max value for max-age in cookies\n    // see https://stackoverflow.com/a/11685301/147079\n    options.ttl = 2147483647;\n  }\n\n  if (\n    userSessionOptions.cookieOptions &&\n    \"maxAge\" in userSessionOptions.cookieOptions\n  ) {\n    // session cookie, do not set maxAge, consider token as infinite\n    if (userSessionOptions.cookieOptions.maxAge === undefined) {\n      options.ttl = 0;\n    } else {\n      options.cookieOptions.maxAge = computeCookieMaxAge(\n        userSessionOptions.cookieOptions.maxAge,\n      );\n    }\n  } else {\n    options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);\n  }\n\n  const sealFromCookies = parseCookie(req.headers.cookie || \"\")[\n    options.cookieName\n  ];\n\n  const session =\n    sealFromCookies === undefined\n      ? {}\n      : await unsealData<IronSessionData>(sealFromCookies, {\n          password: passwordsAsMap,\n          ttl: options.ttl,\n        });\n\n  Object.defineProperties(session, {\n    save: {\n      value: async function save() {\n        if (res.headersSent === true) {\n          throw new Error(\n            `iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()`,\n          );\n        }\n        const seal = await sealData(session, {\n          password: passwordsAsMap,\n          ttl: options.ttl,\n        });\n        const cookieValue = serializeCookie(\n          options.cookieName,\n          seal,\n          options.cookieOptions,\n        );\n\n        if (cookieValue.length > 4096) {\n          throw new Error(\n            `iron-session: Cookie length is too big ${cookieValue.length}, browsers will refuse it. Try to remove some data.`,\n          );\n        }\n\n        addToCookies(cookieValue, res);\n      },\n    },\n    destroy: {\n      value: function destroy() {\n        Object.keys(session).forEach((key) => {\n          // @ts-ignore See comment on the IronSessionData interface\n          delete session[key];\n        });\n\n        const cookieValue = serializeCookie(options.cookieName, \"\", {\n          ...options.cookieOptions,\n          maxAge: 0,\n        });\n        addToCookies(cookieValue, res);\n      },\n    },\n  });\n\n  return session as IronSession;\n}\n\nfunction addToCookies(cookieValue: string, res: ServerResponse) {\n  let existingSetCookie =\n    (res.getHeader(\"set-cookie\") as string[] | string) ?? [];\n  if (typeof existingSetCookie === \"string\") {\n    existingSetCookie = [existingSetCookie];\n  }\n  res.setHeader(\"set-cookie\", [...existingSetCookie, cookieValue]);\n}\n\nfunction computeCookieMaxAge(ttl: number) {\n  // The next line makes sure browser will expire cookies before seals are considered expired by the server.\n  // It also allows for clock difference of 60 seconds maximum between server and clients.\n  // It also makes sure to expire the cookie immediately when value is 0\n  return ttl - timestampSkewSec;\n}\n\nexport async function unsealData<T = Record<string, unknown>>(\n  seal: string,\n  {\n    password,\n    ttl = fourteenDaysInSeconds,\n  }: { password: password; ttl?: number },\n): Promise<T> {\n  const passwordsAsMap = normalizeStringPasswordToMap(password);\n  const { sealWithoutVersion, tokenVersion } = parseSeal(seal);\n\n  try {\n    const data = await Iron.unseal(sealWithoutVersion, passwordsAsMap, {\n      ...Iron.defaults,\n      ttl: ttl * 1000,\n    });\n\n    if (tokenVersion === 2) {\n      return data;\n    }\n\n    return {\n      ...data.persistent,\n    };\n  } catch (error) {\n    if (error instanceof Error) {\n      if (\n        error.message === \"Expired seal\" ||\n        error.message === \"Bad hmac value\" ||\n        error.message === \"Cannot find password: \" ||\n        error.message === \"Incorrect number of sealed components\"\n      ) {\n        // if seal expired or\n        // if seal is not valid (encrypted using a different password, when passwords are badly rotated) or\n        // if we can't find back the password in the seal\n        // then we just start a new session over\n        return {} as T;\n      }\n    }\n\n    throw error;\n  }\n}\n\nfunction parseSeal(seal: string): {\n  sealWithoutVersion: string;\n  tokenVersion: number | null;\n} {\n  if (seal[seal.length - 2] === versionDelimiter) {\n    const [sealWithoutVersion, tokenVersionAsString] =\n      seal.split(versionDelimiter);\n    return {\n      sealWithoutVersion,\n      tokenVersion: parseInt(tokenVersionAsString, 10),\n    };\n  }\n\n  return { sealWithoutVersion: seal, tokenVersion: null };\n}\n\nexport async function sealData(\n  data: unknown,\n  {\n    password,\n    ttl = fourteenDaysInSeconds,\n  }: { password: password; ttl?: number },\n) {\n  const passwordsAsMap = normalizeStringPasswordToMap(password);\n\n  const mostRecentPasswordId = Math.max(\n    ...Object.keys(passwordsAsMap).map((id) => parseInt(id, 10)),\n  );\n\n  const passwordForSeal = {\n    id: mostRecentPasswordId.toString(),\n    secret: passwordsAsMap[mostRecentPasswordId],\n  };\n\n  const seal = await Iron.seal(data, passwordForSeal, {\n    ...Iron.defaults,\n    ttl: ttl * 1000,\n  });\n\n  return `${seal}${versionDelimiter}${currentMajorVersion}`;\n}\n\nfunction normalizeStringPasswordToMap(password: password) {\n  return typeof password === \"string\" ? { 1: password } : password;\n}\n"],
-  "mappings": ";AAAA;AAEA;AAKA,IAAM,mBAAmB;AAKzB,IAAM,wBAAwB,KAAK,KAAK;AAIxC,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AAEzB,IAAM,iBAGF;AAAA,EACF,KAAK;AAAA,EACL,eAAe;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA;AAAA;AAiEV,8BACE,KACA,KACA,oBACsB;AACtB,MACE,CAAC,OACD,CAAC,OACD,CAAC,sBACD,CAAC,mBAAmB,cACpB,CAAC,mBAAmB,UACpB;AACA,UAAM,IAAI,MACR;AAAA;AAIJ,QAAM,iBAAiB,6BACrB,mBAAmB;AAGrB,SAAO,OACL,6BAA6B,mBAAmB,WAChD,QAAQ,CAAC,aAAa;AACtB,QAAI,SAAS,SAAS,IAAI;AACxB,YAAM,IAAI,MACR;AAAA;AAAA;AAKN,QAAM,UAAwC;AAAA,OACzC;AAAA,OACA;AAAA,IACH,eAAe;AAAA,SACV,eAAe;AAAA,SACd,mBAAmB,iBAAiB;AAAA;AAAA;AAI5C,MAAI,QAAQ,QAAQ,GAAG;AAKrB,YAAQ,MAAM;AAAA;AAGhB,MACE,mBAAmB,iBACnB,YAAY,mBAAmB,eAC/B;AAEA,QAAI,mBAAmB,cAAc,WAAW,QAAW;AACzD,cAAQ,MAAM;AAAA,WACT;AACL,cAAQ,cAAc,SAAS,oBAC7B,mBAAmB,cAAc;AAAA;AAAA,SAGhC;AACL,YAAQ,cAAc,SAAS,oBAAoB,QAAQ;AAAA;AAG7D,QAAM,kBAAkB,YAAY,IAAI,QAAQ,UAAU,IACxD,QAAQ;AAGV,QAAM,UACJ,oBAAoB,SAChB,KACA,MAAM,WAA4B,iBAAiB;AAAA,IACjD,UAAU;AAAA,IACV,KAAK,QAAQ;AAAA;AAGrB,SAAO,iBAAiB,SAAS;AAAA,IAC/B,MAAM;AAAA,MACJ,OAAO,sBAAsB;AAC3B,YAAI,IAAI,gBAAgB,MAAM;AAC5B,gBAAM,IAAI,MACR;AAAA;AAGJ,cAAM,OAAO,MAAM,SAAS,SAAS;AAAA,UACnC,UAAU;AAAA,UACV,KAAK,QAAQ;AAAA;AAEf,cAAM,cAAc,gBAClB,QAAQ,YACR,MACA,QAAQ;AAGV,YAAI,YAAY,SAAS,MAAM;AAC7B,gBAAM,IAAI,MACR,0CAA0C,YAAY;AAAA;AAI1D,qBAAa,aAAa;AAAA;AAAA;AAAA,IAG9B,SAAS;AAAA,MACP,OAAO,mBAAmB;AACxB,eAAO,KAAK,SAAS,QAAQ,CAAC,QAAQ;AAEpC,iBAAO,QAAQ;AAAA;AAGjB,cAAM,cAAc,gBAAgB,QAAQ,YAAY,IAAI;AAAA,aACvD,QAAQ;AAAA,UACX,QAAQ;AAAA;AAEV,qBAAa,aAAa;AAAA;AAAA;AAAA;AAKhC,SAAO;AAAA;AAGT,sBAAsB,aAAqB,KAAqB;AAvNhE;AAwNE,MAAI,oBACD,UAAI,UAAU,kBAAd,YAAqD;AACxD,MAAI,OAAO,sBAAsB,UAAU;AACzC,wBAAoB,CAAC;AAAA;AAEvB,MAAI,UAAU,cAAc,CAAC,GAAG,mBAAmB;AAAA;AAGrD,6BAA6B,KAAa;AAIxC,SAAO,MAAM;AAAA;AAGf,0BACE,MACA;AAAA,EACE;AAAA,EACA,MAAM;AAAA,GAEI;AACZ,QAAM,iBAAiB,6BAA6B;AACpD,QAAM,EAAE,oBAAoB,iBAAiB,UAAU;AAEvD,MAAI;AACF,UAAM,OAAO,MAAM,KAAK,OAAO,oBAAoB,gBAAgB;AAAA,SAC9D,KAAK;AAAA,MACR,KAAK,MAAM;AAAA;AAGb,QAAI,iBAAiB,GAAG;AACtB,aAAO;AAAA;AAGT,WAAO;AAAA,SACF,KAAK;AAAA;AAAA,WAEH,OAAP;AACA,QAAI,iBAAiB,OAAO;AAC1B,UACE,MAAM,YAAY,kBAClB,MAAM,YAAY,oBAClB,MAAM,YAAY,4BAClB,MAAM,YAAY,yCAClB;AAKA,eAAO;AAAA;AAAA;AAIX,UAAM;AAAA;AAAA;AAIV,mBAAmB,MAGjB;AACA,MAAI,KAAK,KAAK,SAAS,OAAO,kBAAkB;AAC9C,UAAM,CAAC,oBAAoB,wBACzB,KAAK,MAAM;AACb,WAAO;AAAA,MACL;AAAA,MACA,cAAc,SAAS,sBAAsB;AAAA;AAAA;AAIjD,SAAO,EAAE,oBAAoB,MAAM,cAAc;AAAA;AAGnD,wBACE,MACA;AAAA,EACE;AAAA,EACA,MAAM;AAAA,GAER;AACA,QAAM,iBAAiB,6BAA6B;AAEpD,QAAM,uBAAuB,KAAK,IAChC,GAAG,OAAO,KAAK,gBAAgB,IAAI,CAAC,OAAO,SAAS,IAAI;AAG1D,QAAM,kBAAkB;AAAA,IACtB,IAAI,qBAAqB;AAAA,IACzB,QAAQ,eAAe;AAAA;AAGzB,QAAM,OAAO,MAAM,KAAK,KAAK,MAAM,iBAAiB;AAAA,OAC/C,KAAK;AAAA,IACR,KAAK,MAAM;AAAA;AAGb,SAAO,GAAG,OAAO,mBAAmB;AAAA;AAGtC,sCAAsC,UAAoB;AACxD,SAAO,OAAO,aAAa,WAAW,EAAE,GAAG,aAAa;AAAA;",
+  "sourcesContent": ["import Iron from \"@hapi/iron\";\nimport type { CookieSerializeOptions } from \"cookie\";\nimport cookie from \"cookie\";\nimport type { IncomingMessage, ServerResponse } from \"http\";\n\n// default time allowed to check for iron seal validity when ttl passed\n// see https://hapi.dev/family/iron/api/?v=6.0.0#options\nconst timestampSkewSec = 60;\n\ntype passwordsMap = { [id: string]: string };\ntype password = string | passwordsMap;\n\nconst fourteenDaysInSeconds = 15 * 24 * 3600;\n\n// We store a token major version to handle data format changes when any. So that when you upgrade the cookies\n// can be kept alive between upgrades, no need to disconnect everyone.\nconst currentMajorVersion = 2;\nconst versionDelimiter = \"~\";\n\nconst defaultOptions: {\n  ttl: number;\n  cookieOptions: CookieSerializeOptions;\n} = {\n  ttl: fourteenDaysInSeconds,\n  cookieOptions: {\n    httpOnly: true,\n    secure: true,\n    sameSite: \"lax\",\n    path: \"/\",\n  },\n};\n\nexport interface IronSessionOptions {\n  /**\n   * This is the cookie name that will be used inside the browser. You should make sure it's unique given\n   * your application. Example: vercel-session\n   */\n  cookieName: string;\n\n  /**\n   * This is the password(s) that will be used to encrypt the cookie. It can be either a string or an object\n   * like {1: \"password\", 2: password}.\n   *\n   * When you provide multiple passwords then all of them will be used to decrypt the cookie and only the most\n   * recent (= highest key, 2 in this example) password will be used to encrypt the cookie. This allow you\n   * to use password rotation (security)\n   */\n  password: password;\n\n  /**\n   * This is the time in seconds that the session will be valid for. This also set the max-age attribute of\n   * the cookie automatically (minus 60 seconds so that the cookie always expire before the session).\n   */\n  ttl?: number;\n\n  /**\n   * This is the options that will be passed to the cookie library.\n   * You can see all of them here: https://github.com/jshttp/cookie#options-1.\n   *\n   * If you want to use \"session cookies\" (cookies that are deleted when the browser is closed) then you need\n   * to pass cookieOptions: { maxAge: undefined }.\n   */\n  cookieOptions?: CookieSerializeOptions;\n}\n\n// eslint-disable-next-line @typescript-eslint/no-empty-interface\nexport interface IronSessionData {\n  // If we allow for any keys, then there's no more type check on unknown properties\n  // which is not good\n  // If we allow for any keys, the later delete will work but I prefer to disable the\n  // check at this stage and\n  // provide good type checking instead\n  // [key: string]: unknown;\n}\n\nexport type IronSession = IronSessionData & {\n  /**\n   * Destroys the session data and removes the cookie.\n   */\n  destroy: () => void;\n\n  /**\n   * Encrypts the session data and sets the cookie.\n   */\n  save: () => Promise<void>;\n};\n\ndeclare module \"http\" {\n  interface IncomingMessage {\n    session: IronSession;\n  }\n}\n\nexport async function getIronSession(\n  req: IncomingMessage,\n  res: ServerResponse,\n  userSessionOptions: IronSessionOptions,\n): Promise<IronSession> {\n  if (\n    !req ||\n    !res ||\n    !userSessionOptions ||\n    !userSessionOptions.cookieName ||\n    !userSessionOptions.password\n  ) {\n    throw new Error(\n      `iron-session: Bad usage. Minimum usage is const session = await getIronSession(req, res, { cookieName: \"...\", password: \"...\". Check the usage here: https://github.com/vvo/iron-session`,\n    );\n  }\n\n  const passwordsAsMap = normalizeStringPasswordToMap(\n    userSessionOptions.password,\n  );\n\n  Object.values(\n    normalizeStringPasswordToMap(userSessionOptions.password),\n  ).forEach((password) => {\n    if (password.length < 32) {\n      throw new Error(\n        `iron-session: Bad usage. Password must be at least 32 characters long.`,\n      );\n    }\n  });\n\n  const options: Required<IronSessionOptions> = {\n    ...defaultOptions,\n    ...userSessionOptions,\n    cookieOptions: {\n      ...defaultOptions.cookieOptions,\n      ...(userSessionOptions.cookieOptions || {}),\n    },\n  };\n\n  if (options.ttl === 0) {\n    // ttl = 0 means no expiration\n    // but in reality cookies have to expire (can't have no max-age)\n    // 2147483647 is the max value for max-age in cookies\n    // see https://stackoverflow.com/a/11685301/147079\n    options.ttl = 2147483647;\n  }\n\n  if (\n    userSessionOptions.cookieOptions &&\n    \"maxAge\" in userSessionOptions.cookieOptions\n  ) {\n    // session cookie, do not set maxAge, consider token as infinite\n    if (userSessionOptions.cookieOptions.maxAge === undefined) {\n      options.ttl = 0;\n    } else {\n      options.cookieOptions.maxAge = computeCookieMaxAge(\n        userSessionOptions.cookieOptions.maxAge,\n      );\n    }\n  } else {\n    options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);\n  }\n\n  const sealFromCookies = cookie.parse(req.headers.cookie || \"\")[\n    options.cookieName\n  ];\n\n  const session =\n    sealFromCookies === undefined\n      ? {}\n      : await unsealData<IronSessionData>(sealFromCookies, {\n          password: passwordsAsMap,\n          ttl: options.ttl,\n        });\n\n  Object.defineProperties(session, {\n    save: {\n      value: async function save() {\n        if (res.headersSent === true) {\n          throw new Error(\n            `iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()`,\n          );\n        }\n        const seal = await sealData(session, {\n          password: passwordsAsMap,\n          ttl: options.ttl,\n        });\n        const cookieValue = cookie.serialize(\n          options.cookieName,\n          seal,\n          options.cookieOptions,\n        );\n\n        if (cookieValue.length > 4096) {\n          throw new Error(\n            `iron-session: Cookie length is too big ${cookieValue.length}, browsers will refuse it. Try to remove some data.`,\n          );\n        }\n\n        addToCookies(cookieValue, res);\n      },\n    },\n    destroy: {\n      value: function destroy() {\n        Object.keys(session).forEach((key) => {\n          // @ts-ignore See comment on the IronSessionData interface\n          delete session[key];\n        });\n\n        const cookieValue = cookie.serialize(options.cookieName, \"\", {\n          ...options.cookieOptions,\n          maxAge: 0,\n        });\n        addToCookies(cookieValue, res);\n      },\n    },\n  });\n\n  return session as IronSession;\n}\n\nfunction addToCookies(cookieValue: string, res: ServerResponse) {\n  let existingSetCookie =\n    (res.getHeader(\"set-cookie\") as string[] | string) ?? [];\n  if (typeof existingSetCookie === \"string\") {\n    existingSetCookie = [existingSetCookie];\n  }\n  res.setHeader(\"set-cookie\", [...existingSetCookie, cookieValue]);\n}\n\nfunction computeCookieMaxAge(ttl: number) {\n  // The next line makes sure browser will expire cookies before seals are considered expired by the server.\n  // It also allows for clock difference of 60 seconds maximum between server and clients.\n  // It also makes sure to expire the cookie immediately when value is 0\n  return ttl - timestampSkewSec;\n}\n\nexport async function unsealData<T = Record<string, unknown>>(\n  seal: string,\n  {\n    password,\n    ttl = fourteenDaysInSeconds,\n  }: { password: password; ttl?: number },\n): Promise<T> {\n  const passwordsAsMap = normalizeStringPasswordToMap(password);\n  const { sealWithoutVersion, tokenVersion } = parseSeal(seal);\n\n  try {\n    const data = await Iron.unseal(sealWithoutVersion, passwordsAsMap, {\n      ...Iron.defaults,\n      ttl: ttl * 1000,\n    });\n\n    if (tokenVersion === 2) {\n      return data;\n    }\n\n    return {\n      ...data.persistent,\n    };\n  } catch (error) {\n    if (error instanceof Error) {\n      if (\n        error.message === \"Expired seal\" ||\n        error.message === \"Bad hmac value\" ||\n        error.message === \"Cannot find password: \" ||\n        error.message === \"Incorrect number of sealed components\"\n      ) {\n        // if seal expired or\n        // if seal is not valid (encrypted using a different password, when passwords are badly rotated) or\n        // if we can't find back the password in the seal\n        // then we just start a new session over\n        return {} as T;\n      }\n    }\n\n    throw error;\n  }\n}\n\nfunction parseSeal(seal: string): {\n  sealWithoutVersion: string;\n  tokenVersion: number | null;\n} {\n  if (seal[seal.length - 2] === versionDelimiter) {\n    const [sealWithoutVersion, tokenVersionAsString] =\n      seal.split(versionDelimiter);\n    return {\n      sealWithoutVersion,\n      tokenVersion: parseInt(tokenVersionAsString, 10),\n    };\n  }\n\n  return { sealWithoutVersion: seal, tokenVersion: null };\n}\n\nexport async function sealData(\n  data: unknown,\n  {\n    password,\n    ttl = fourteenDaysInSeconds,\n  }: { password: password; ttl?: number },\n) {\n  const passwordsAsMap = normalizeStringPasswordToMap(password);\n\n  const mostRecentPasswordId = Math.max(\n    ...Object.keys(passwordsAsMap).map((id) => parseInt(id, 10)),\n  );\n\n  const passwordForSeal = {\n    id: mostRecentPasswordId.toString(),\n    secret: passwordsAsMap[mostRecentPasswordId],\n  };\n\n  const seal = await Iron.seal(data, passwordForSeal, {\n    ...Iron.defaults,\n    ttl: ttl * 1000,\n  });\n\n  return `${seal}${versionDelimiter}${currentMajorVersion}`;\n}\n\nfunction normalizeStringPasswordToMap(password: password) {\n  return typeof password === \"string\" ? { 1: password } : password;\n}\n"],
+  "mappings": ";AAAA;AAEA;AAKA,IAAM,mBAAmB;AAKzB,IAAM,wBAAwB,KAAK,KAAK;AAIxC,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AAEzB,IAAM,iBAGF;AAAA,EACF,KAAK;AAAA,EACL,eAAe;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA;AAAA;AAiEV,8BACE,KACA,KACA,oBACsB;AACtB,MACE,CAAC,OACD,CAAC,OACD,CAAC,sBACD,CAAC,mBAAmB,cACpB,CAAC,mBAAmB,UACpB;AACA,UAAM,IAAI,MACR;AAAA;AAIJ,QAAM,iBAAiB,6BACrB,mBAAmB;AAGrB,SAAO,OACL,6BAA6B,mBAAmB,WAChD,QAAQ,CAAC,aAAa;AACtB,QAAI,SAAS,SAAS,IAAI;AACxB,YAAM,IAAI,MACR;AAAA;AAAA;AAKN,QAAM,UAAwC;AAAA,OACzC;AAAA,OACA;AAAA,IACH,eAAe;AAAA,SACV,eAAe;AAAA,SACd,mBAAmB,iBAAiB;AAAA;AAAA;AAI5C,MAAI,QAAQ,QAAQ,GAAG;AAKrB,YAAQ,MAAM;AAAA;AAGhB,MACE,mBAAmB,iBACnB,YAAY,mBAAmB,eAC/B;AAEA,QAAI,mBAAmB,cAAc,WAAW,QAAW;AACzD,cAAQ,MAAM;AAAA,WACT;AACL,cAAQ,cAAc,SAAS,oBAC7B,mBAAmB,cAAc;AAAA;AAAA,SAGhC;AACL,YAAQ,cAAc,SAAS,oBAAoB,QAAQ;AAAA;AAG7D,QAAM,kBAAkB,OAAO,MAAM,IAAI,QAAQ,UAAU,IACzD,QAAQ;AAGV,QAAM,UACJ,oBAAoB,SAChB,KACA,MAAM,WAA4B,iBAAiB;AAAA,IACjD,UAAU;AAAA,IACV,KAAK,QAAQ;AAAA;AAGrB,SAAO,iBAAiB,SAAS;AAAA,IAC/B,MAAM;AAAA,MACJ,OAAO,sBAAsB;AAC3B,YAAI,IAAI,gBAAgB,MAAM;AAC5B,gBAAM,IAAI,MACR;AAAA;AAGJ,cAAM,OAAO,MAAM,SAAS,SAAS;AAAA,UACnC,UAAU;AAAA,UACV,KAAK,QAAQ;AAAA;AAEf,cAAM,cAAc,OAAO,UACzB,QAAQ,YACR,MACA,QAAQ;AAGV,YAAI,YAAY,SAAS,MAAM;AAC7B,gBAAM,IAAI,MACR,0CAA0C,YAAY;AAAA;AAI1D,qBAAa,aAAa;AAAA;AAAA;AAAA,IAG9B,SAAS;AAAA,MACP,OAAO,mBAAmB;AACxB,eAAO,KAAK,SAAS,QAAQ,CAAC,QAAQ;AAEpC,iBAAO,QAAQ;AAAA;AAGjB,cAAM,cAAc,OAAO,UAAU,QAAQ,YAAY,IAAI;AAAA,aACxD,QAAQ;AAAA,UACX,QAAQ;AAAA;AAEV,qBAAa,aAAa;AAAA;AAAA;AAAA;AAKhC,SAAO;AAAA;AAGT,sBAAsB,aAAqB,KAAqB;AAvNhE;AAwNE,MAAI,oBACD,UAAI,UAAU,kBAAd,YAAqD;AACxD,MAAI,OAAO,sBAAsB,UAAU;AACzC,wBAAoB,CAAC;AAAA;AAEvB,MAAI,UAAU,cAAc,CAAC,GAAG,mBAAmB;AAAA;AAGrD,6BAA6B,KAAa;AAIxC,SAAO,MAAM;AAAA;AAGf,0BACE,MACA;AAAA,EACE;AAAA,EACA,MAAM;AAAA,GAEI;AACZ,QAAM,iBAAiB,6BAA6B;AACpD,QAAM,EAAE,oBAAoB,iBAAiB,UAAU;AAEvD,MAAI;AACF,UAAM,OAAO,MAAM,KAAK,OAAO,oBAAoB,gBAAgB;AAAA,SAC9D,KAAK;AAAA,MACR,KAAK,MAAM;AAAA;AAGb,QAAI,iBAAiB,GAAG;AACtB,aAAO;AAAA;AAGT,WAAO;AAAA,SACF,KAAK;AAAA;AAAA,WAEH,OAAP;AACA,QAAI,iBAAiB,OAAO;AAC1B,UACE,MAAM,YAAY,kBAClB,MAAM,YAAY,oBAClB,MAAM,YAAY,4BAClB,MAAM,YAAY,yCAClB;AAKA,eAAO;AAAA;AAAA;AAIX,UAAM;AAAA;AAAA;AAIV,mBAAmB,MAGjB;AACA,MAAI,KAAK,KAAK,SAAS,OAAO,kBAAkB;AAC9C,UAAM,CAAC,oBAAoB,wBACzB,KAAK,MAAM;AACb,WAAO;AAAA,MACL;AAAA,MACA,cAAc,SAAS,sBAAsB;AAAA;AAAA;AAIjD,SAAO,EAAE,oBAAoB,MAAM,cAAc;AAAA;AAGnD,wBACE,MACA;AAAA,EACE;AAAA,EACA,MAAM;AAAA,GAER;AACA,QAAM,iBAAiB,6BAA6B;AAEpD,QAAM,uBAAuB,KAAK,IAChC,GAAG,OAAO,KAAK,gBAAgB,IAAI,CAAC,OAAO,SAAS,IAAI;AAG1D,QAAM,kBAAkB;AAAA,IACtB,IAAI,qBAAqB;AAAA,IACzB,QAAQ,eAAe;AAAA;AAGzB,QAAM,OAAO,MAAM,KAAK,KAAK,MAAM,iBAAiB;AAAA,OAC/C,KAAK;AAAA,IACR,KAAK,MAAM;AAAA;AAGb,SAAO,GAAG,OAAO,mBAAmB;AAAA;AAGtC,sCAAsC,UAAoB;AACxD,SAAO,OAAO,aAAa,WAAW,EAAE,GAAG,aAAa;AAAA;",
   "names": []
 }

package/next/dist/index.d.ts

@@ -1,11 +1,14 @@
-import { NextApiHandler, GetServerSidePropsContext, GetServerSidePropsResult } from 'next';
+import { NextApiHandler, GetServerSidePropsContext, GetServerSidePropsResult, NextApiRequest, NextApiResponse } from 'next';
 import { IronSessionOptions } from 'iron-session';
+import { IncomingMessage, ServerResponse } from 'http';
 
-declare function withIronSessionApiRoute(handler: NextApiHandler, options: IronSessionOptions): NextApiHandler;
+declare type GetIronSessionApiOptions = (request: NextApiRequest, response: NextApiResponse) => Promise<IronSessionOptions> | IronSessionOptions;
+declare function withIronSessionApiRoute(handler: NextApiHandler, options: IronSessionOptions | GetIronSessionApiOptions): NextApiHandler;
+declare type GetIronSessionSSROptions = (request: IncomingMessage, response: ServerResponse) => Promise<IronSessionOptions> | IronSessionOptions;
 declare function withIronSessionSsr<P extends {
     [key: string]: unknown;
 } = {
     [key: string]: unknown;
-}>(handler: (context: GetServerSidePropsContext) => GetServerSidePropsResult<P> | Promise<GetServerSidePropsResult<P>>, options: IronSessionOptions): (context: GetServerSidePropsContext) => Promise<GetServerSidePropsResult<P>>;
+}>(handler: (context: GetServerSidePropsContext) => GetServerSidePropsResult<P> | Promise<GetServerSidePropsResult<P>>, options: IronSessionOptions | GetIronSessionSSROptions): (context: GetServerSidePropsContext) => Promise<GetServerSidePropsResult<P>>;
 
 export { withIronSessionApiRoute, withIronSessionSsr };

package/next/dist/index.js

@@ -54,6 +54,9 @@ function getPropertyDescriptorForReqSession(session) {
 // next/index.ts
 function withIronSessionApiRoute(handler, options) {
   return async function nextApiHandlerWrappedWithIronSession(req, res) {
+    if (options instanceof Function) {
+      options = await options(req, res);
+    }
     const session = await (0, import_iron_session.getIronSession)(req, res, options);
     Object.defineProperty(req, "session", getPropertyDescriptorForReqSession(session));
     return handler(req, res);
@@ -61,6 +64,9 @@ function withIronSessionApiRoute(handler, options) {
 }
 function withIronSessionSsr(handler, options) {
   return async function nextGetServerSidePropsHandlerWrappedWithIronSession(context) {
+    if (options instanceof Function) {
+      options = await options(context.req, context.res);
+    }
     const session = await (0, import_iron_session.getIronSession)(context.req, context.res, options);
     Object.defineProperty(context.req, "session", getPropertyDescriptorForReqSession(session));
     return handler(context);

package/next/dist/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../index.ts", "../../src/getPropertyDescriptorForReqSession.ts"],
-  "sourcesContent": ["import type {\n  NextApiHandler,\n  GetServerSidePropsContext,\n  GetServerSidePropsResult,\n} from \"next\";\nimport type { IronSessionOptions } from \"iron-session\";\nimport { getIronSession } from \"iron-session\";\nimport getPropertyDescriptorForReqSession from \"../src/getPropertyDescriptorForReqSession\";\n\nexport function withIronSessionApiRoute(\n  handler: NextApiHandler,\n  options: IronSessionOptions,\n): NextApiHandler {\n  return async function nextApiHandlerWrappedWithIronSession(req, res) {\n    const session = await getIronSession(req, res, options);\n\n    // we define req.session as being enumerable (so console.log(req) shows it)\n    // and we also want to allow people to do:\n    // req.session = { admin: true }; or req.session = {...req.session, admin: true};\n    // req.session.save();\n    Object.defineProperty(\n      req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n    return handler(req, res);\n  };\n}\n\nexport function withIronSessionSsr<\n  P extends { [key: string]: unknown } = { [key: string]: unknown },\n>(\n  handler: (\n    context: GetServerSidePropsContext,\n  ) => GetServerSidePropsResult<P> | Promise<GetServerSidePropsResult<P>>,\n  options: IronSessionOptions,\n) {\n  return async function nextGetServerSidePropsHandlerWrappedWithIronSession(\n    context: GetServerSidePropsContext,\n  ) {\n    const session = await getIronSession(context.req, context.res, options);\n    Object.defineProperty(\n      context.req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n    return handler(context);\n  };\n}\n", "import type { IronSession } from \".\";\n\nexport default function getPropertyDescriptorForReqSession(\n  session: IronSession,\n): PropertyDescriptor {\n  return {\n    enumerable: true,\n    get() {\n      return session;\n    },\n    set(value) {\n      const keys = Object.keys(value);\n      const currentKeys = Object.keys(session);\n\n      currentKeys.forEach((key) => {\n        if (!keys.includes(key)) {\n          // @ts-ignore See comment in IronSessionData interface\n          delete session[key];\n        }\n      });\n\n      keys.forEach((key) => {\n        // @ts-ignore See comment in IronSessionData interface\n        session[key] = value[key];\n      });\n    },\n  };\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAMA,0BAA+B;;;ACJhB,4CACb,SACoB;AACpB,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AACJ,aAAO;AAAA;AAAA,IAET,IAAI,OAAO;AACT,YAAM,OAAO,OAAO,KAAK;AACzB,YAAM,cAAc,OAAO,KAAK;AAEhC,kBAAY,QAAQ,CAAC,QAAQ;AAC3B,YAAI,CAAC,KAAK,SAAS,MAAM;AAEvB,iBAAO,QAAQ;AAAA;AAAA;AAInB,WAAK,QAAQ,CAAC,QAAQ;AAEpB,gBAAQ,OAAO,MAAM;AAAA;AAAA;AAAA;AAAA;;;ADdtB,iCACL,SACA,SACgB;AAChB,SAAO,oDAAoD,KAAK,KAAK;AACnE,UAAM,UAAU,MAAM,wCAAe,KAAK,KAAK;AAM/C,WAAO,eACL,KACA,WACA,mCAAmC;AAErC,WAAO,QAAQ,KAAK;AAAA;AAAA;AAIjB,4BAGL,SAGA,SACA;AACA,SAAO,mEACL,SACA;AACA,UAAM,UAAU,MAAM,wCAAe,QAAQ,KAAK,QAAQ,KAAK;AAC/D,WAAO,eACL,QAAQ,KACR,WACA,mCAAmC;AAErC,WAAO,QAAQ;AAAA;AAAA;",
+  "sourcesContent": ["import type {\n  NextApiHandler,\n  GetServerSidePropsContext,\n  GetServerSidePropsResult,\n  NextApiRequest,\n  NextApiResponse,\n} from \"next\";\nimport type { IronSessionOptions } from \"iron-session\";\nimport { getIronSession } from \"iron-session\";\nimport getPropertyDescriptorForReqSession from \"../src/getPropertyDescriptorForReqSession\";\nimport { IncomingMessage, ServerResponse } from \"http\";\n\n// Argument types based on getIronSession function\ntype GetIronSessionApiOptions = (\n  request: NextApiRequest,\n  response: NextApiResponse,\n) => Promise<IronSessionOptions> | IronSessionOptions;\n\nexport function withIronSessionApiRoute(\n  handler: NextApiHandler,\n  options: IronSessionOptions | GetIronSessionApiOptions,\n): NextApiHandler {\n  return async function nextApiHandlerWrappedWithIronSession(req, res) {\n    // If options is a function, call it and assign the results back.\n    if (options instanceof Function) {\n      options = await options(req, res);\n    }\n    const session = await getIronSession(req, res, options);\n\n    // we define req.session as being enumerable (so console.log(req) shows it)\n    // and we also want to allow people to do:\n    // req.session = { admin: true }; or req.session = {...req.session, admin: true};\n    // req.session.save();\n    Object.defineProperty(\n      req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n    return handler(req, res);\n  };\n}\n\n// Argument type based on the SSR context\ntype GetIronSessionSSROptions = (\n  request: IncomingMessage,\n  response: ServerResponse,\n) => Promise<IronSessionOptions> | IronSessionOptions;\n\nexport function withIronSessionSsr<\n  P extends { [key: string]: unknown } = { [key: string]: unknown },\n>(\n  handler: (\n    context: GetServerSidePropsContext,\n  ) => GetServerSidePropsResult<P> | Promise<GetServerSidePropsResult<P>>,\n  options: IronSessionOptions | GetIronSessionSSROptions,\n) {\n  return async function nextGetServerSidePropsHandlerWrappedWithIronSession(\n    context: GetServerSidePropsContext,\n  ) {\n    // If options is a function, call it and assign the results back.\n    if (options instanceof Function) {\n      options = await options(context.req, context.res);\n    }\n    const session = await getIronSession(context.req, context.res, options);\n    Object.defineProperty(\n      context.req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n    return handler(context);\n  };\n}\n", "import type { IronSession } from \".\";\n\nexport default function getPropertyDescriptorForReqSession(\n  session: IronSession,\n): PropertyDescriptor {\n  return {\n    enumerable: true,\n    get() {\n      return session;\n    },\n    set(value) {\n      const keys = Object.keys(value);\n      const currentKeys = Object.keys(session);\n\n      currentKeys.forEach((key) => {\n        if (!keys.includes(key)) {\n          // @ts-ignore See comment in IronSessionData interface\n          delete session[key];\n        }\n      });\n\n      keys.forEach((key) => {\n        // @ts-ignore See comment in IronSessionData interface\n        session[key] = value[key];\n      });\n    },\n  };\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAQA,0BAA+B;;;ACNhB,4CACb,SACoB;AACpB,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AACJ,aAAO;AAAA;AAAA,IAET,IAAI,OAAO;AACT,YAAM,OAAO,OAAO,KAAK;AACzB,YAAM,cAAc,OAAO,KAAK;AAEhC,kBAAY,QAAQ,CAAC,QAAQ;AAC3B,YAAI,CAAC,KAAK,SAAS,MAAM;AAEvB,iBAAO,QAAQ;AAAA;AAAA;AAInB,WAAK,QAAQ,CAAC,QAAQ;AAEpB,gBAAQ,OAAO,MAAM;AAAA;AAAA;AAAA;AAAA;;;ADLtB,iCACL,SACA,SACgB;AAChB,SAAO,oDAAoD,KAAK,KAAK;AAEnE,QAAI,mBAAmB,UAAU;AAC/B,gBAAU,MAAM,QAAQ,KAAK;AAAA;AAE/B,UAAM,UAAU,MAAM,wCAAe,KAAK,KAAK;AAM/C,WAAO,eACL,KACA,WACA,mCAAmC;AAErC,WAAO,QAAQ,KAAK;AAAA;AAAA;AAUjB,4BAGL,SAGA,SACA;AACA,SAAO,mEACL,SACA;AAEA,QAAI,mBAAmB,UAAU;AAC/B,gBAAU,MAAM,QAAQ,QAAQ,KAAK,QAAQ;AAAA;AAE/C,UAAM,UAAU,MAAM,wCAAe,QAAQ,KAAK,QAAQ,KAAK;AAC/D,WAAO,eACL,QAAQ,KACR,WACA,mCAAmC;AAErC,WAAO,QAAQ;AAAA;AAAA;",
   "names": []
 }

package/next/dist/index.mjs

@@ -26,6 +26,9 @@ function getPropertyDescriptorForReqSession(session) {
 // next/index.ts
 function withIronSessionApiRoute(handler, options) {
   return async function nextApiHandlerWrappedWithIronSession(req, res) {
+    if (options instanceof Function) {
+      options = await options(req, res);
+    }
     const session = await getIronSession(req, res, options);
     Object.defineProperty(req, "session", getPropertyDescriptorForReqSession(session));
     return handler(req, res);
@@ -33,6 +36,9 @@ function withIronSessionApiRoute(handler, options) {
 }
 function withIronSessionSsr(handler, options) {
   return async function nextGetServerSidePropsHandlerWrappedWithIronSession(context) {
+    if (options instanceof Function) {
+      options = await options(context.req, context.res);
+    }
     const session = await getIronSession(context.req, context.res, options);
     Object.defineProperty(context.req, "session", getPropertyDescriptorForReqSession(session));
     return handler(context);

package/next/dist/index.mjs.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../index.ts", "../../src/getPropertyDescriptorForReqSession.ts"],
-  "sourcesContent": ["import type {\n  NextApiHandler,\n  GetServerSidePropsContext,\n  GetServerSidePropsResult,\n} from \"next\";\nimport type { IronSessionOptions } from \"iron-session\";\nimport { getIronSession } from \"iron-session\";\nimport getPropertyDescriptorForReqSession from \"../src/getPropertyDescriptorForReqSession\";\n\nexport function withIronSessionApiRoute(\n  handler: NextApiHandler,\n  options: IronSessionOptions,\n): NextApiHandler {\n  return async function nextApiHandlerWrappedWithIronSession(req, res) {\n    const session = await getIronSession(req, res, options);\n\n    // we define req.session as being enumerable (so console.log(req) shows it)\n    // and we also want to allow people to do:\n    // req.session = { admin: true }; or req.session = {...req.session, admin: true};\n    // req.session.save();\n    Object.defineProperty(\n      req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n    return handler(req, res);\n  };\n}\n\nexport function withIronSessionSsr<\n  P extends { [key: string]: unknown } = { [key: string]: unknown },\n>(\n  handler: (\n    context: GetServerSidePropsContext,\n  ) => GetServerSidePropsResult<P> | Promise<GetServerSidePropsResult<P>>,\n  options: IronSessionOptions,\n) {\n  return async function nextGetServerSidePropsHandlerWrappedWithIronSession(\n    context: GetServerSidePropsContext,\n  ) {\n    const session = await getIronSession(context.req, context.res, options);\n    Object.defineProperty(\n      context.req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n    return handler(context);\n  };\n}\n", "import type { IronSession } from \".\";\n\nexport default function getPropertyDescriptorForReqSession(\n  session: IronSession,\n): PropertyDescriptor {\n  return {\n    enumerable: true,\n    get() {\n      return session;\n    },\n    set(value) {\n      const keys = Object.keys(value);\n      const currentKeys = Object.keys(session);\n\n      currentKeys.forEach((key) => {\n        if (!keys.includes(key)) {\n          // @ts-ignore See comment in IronSessionData interface\n          delete session[key];\n        }\n      });\n\n      keys.forEach((key) => {\n        // @ts-ignore See comment in IronSessionData interface\n        session[key] = value[key];\n      });\n    },\n  };\n}\n"],
-  "mappings": ";AAMA;;;ACJe,4CACb,SACoB;AACpB,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AACJ,aAAO;AAAA;AAAA,IAET,IAAI,OAAO;AACT,YAAM,OAAO,OAAO,KAAK;AACzB,YAAM,cAAc,OAAO,KAAK;AAEhC,kBAAY,QAAQ,CAAC,QAAQ;AAC3B,YAAI,CAAC,KAAK,SAAS,MAAM;AAEvB,iBAAO,QAAQ;AAAA;AAAA;AAInB,WAAK,QAAQ,CAAC,QAAQ;AAEpB,gBAAQ,OAAO,MAAM;AAAA;AAAA;AAAA;AAAA;;;ADdtB,iCACL,SACA,SACgB;AAChB,SAAO,oDAAoD,KAAK,KAAK;AACnE,UAAM,UAAU,MAAM,eAAe,KAAK,KAAK;AAM/C,WAAO,eACL,KACA,WACA,mCAAmC;AAErC,WAAO,QAAQ,KAAK;AAAA;AAAA;AAIjB,4BAGL,SAGA,SACA;AACA,SAAO,mEACL,SACA;AACA,UAAM,UAAU,MAAM,eAAe,QAAQ,KAAK,QAAQ,KAAK;AAC/D,WAAO,eACL,QAAQ,KACR,WACA,mCAAmC;AAErC,WAAO,QAAQ;AAAA;AAAA;",
+  "sourcesContent": ["import type {\n  NextApiHandler,\n  GetServerSidePropsContext,\n  GetServerSidePropsResult,\n  NextApiRequest,\n  NextApiResponse,\n} from \"next\";\nimport type { IronSessionOptions } from \"iron-session\";\nimport { getIronSession } from \"iron-session\";\nimport getPropertyDescriptorForReqSession from \"../src/getPropertyDescriptorForReqSession\";\nimport { IncomingMessage, ServerResponse } from \"http\";\n\n// Argument types based on getIronSession function\ntype GetIronSessionApiOptions = (\n  request: NextApiRequest,\n  response: NextApiResponse,\n) => Promise<IronSessionOptions> | IronSessionOptions;\n\nexport function withIronSessionApiRoute(\n  handler: NextApiHandler,\n  options: IronSessionOptions | GetIronSessionApiOptions,\n): NextApiHandler {\n  return async function nextApiHandlerWrappedWithIronSession(req, res) {\n    // If options is a function, call it and assign the results back.\n    if (options instanceof Function) {\n      options = await options(req, res);\n    }\n    const session = await getIronSession(req, res, options);\n\n    // we define req.session as being enumerable (so console.log(req) shows it)\n    // and we also want to allow people to do:\n    // req.session = { admin: true }; or req.session = {...req.session, admin: true};\n    // req.session.save();\n    Object.defineProperty(\n      req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n    return handler(req, res);\n  };\n}\n\n// Argument type based on the SSR context\ntype GetIronSessionSSROptions = (\n  request: IncomingMessage,\n  response: ServerResponse,\n) => Promise<IronSessionOptions> | IronSessionOptions;\n\nexport function withIronSessionSsr<\n  P extends { [key: string]: unknown } = { [key: string]: unknown },\n>(\n  handler: (\n    context: GetServerSidePropsContext,\n  ) => GetServerSidePropsResult<P> | Promise<GetServerSidePropsResult<P>>,\n  options: IronSessionOptions | GetIronSessionSSROptions,\n) {\n  return async function nextGetServerSidePropsHandlerWrappedWithIronSession(\n    context: GetServerSidePropsContext,\n  ) {\n    // If options is a function, call it and assign the results back.\n    if (options instanceof Function) {\n      options = await options(context.req, context.res);\n    }\n    const session = await getIronSession(context.req, context.res, options);\n    Object.defineProperty(\n      context.req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n    return handler(context);\n  };\n}\n", "import type { IronSession } from \".\";\n\nexport default function getPropertyDescriptorForReqSession(\n  session: IronSession,\n): PropertyDescriptor {\n  return {\n    enumerable: true,\n    get() {\n      return session;\n    },\n    set(value) {\n      const keys = Object.keys(value);\n      const currentKeys = Object.keys(session);\n\n      currentKeys.forEach((key) => {\n        if (!keys.includes(key)) {\n          // @ts-ignore See comment in IronSessionData interface\n          delete session[key];\n        }\n      });\n\n      keys.forEach((key) => {\n        // @ts-ignore See comment in IronSessionData interface\n        session[key] = value[key];\n      });\n    },\n  };\n}\n"],
+  "mappings": ";AAQA;;;ACNe,4CACb,SACoB;AACpB,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AACJ,aAAO;AAAA;AAAA,IAET,IAAI,OAAO;AACT,YAAM,OAAO,OAAO,KAAK;AACzB,YAAM,cAAc,OAAO,KAAK;AAEhC,kBAAY,QAAQ,CAAC,QAAQ;AAC3B,YAAI,CAAC,KAAK,SAAS,MAAM;AAEvB,iBAAO,QAAQ;AAAA;AAAA;AAInB,WAAK,QAAQ,CAAC,QAAQ;AAEpB,gBAAQ,OAAO,MAAM;AAAA;AAAA;AAAA;AAAA;;;ADLtB,iCACL,SACA,SACgB;AAChB,SAAO,oDAAoD,KAAK,KAAK;AAEnE,QAAI,mBAAmB,UAAU;AAC/B,gBAAU,MAAM,QAAQ,KAAK;AAAA;AAE/B,UAAM,UAAU,MAAM,eAAe,KAAK,KAAK;AAM/C,WAAO,eACL,KACA,WACA,mCAAmC;AAErC,WAAO,QAAQ,KAAK;AAAA;AAAA;AAUjB,4BAGL,SAGA,SACA;AACA,SAAO,mEACL,SACA;AAEA,QAAI,mBAAmB,UAAU;AAC/B,gBAAU,MAAM,QAAQ,QAAQ,KAAK,QAAQ;AAAA;AAE/C,UAAM,UAAU,MAAM,eAAe,QAAQ,KAAK,QAAQ,KAAK;AAC/D,WAAO,eACL,QAAQ,KACR,WACA,mCAAmC;AAErC,WAAO,QAAQ;AAAA;AAAA;",
   "names": []
 }

package/next/index.d.ts

@@ -1,11 +1,14 @@
-import { NextApiHandler, GetServerSidePropsContext, GetServerSidePropsResult } from 'next';
+import { NextApiHandler, GetServerSidePropsContext, GetServerSidePropsResult, NextApiRequest, NextApiResponse } from 'next';
 import { IronSessionOptions } from 'iron-session';
+import { IncomingMessage, ServerResponse } from 'http';
 
-declare function withIronSessionApiRoute(handler: NextApiHandler, options: IronSessionOptions): NextApiHandler;
+declare type GetIronSessionApiOptions = (request: NextApiRequest, response: NextApiResponse) => Promise<IronSessionOptions> | IronSessionOptions;
+declare function withIronSessionApiRoute(handler: NextApiHandler, options: IronSessionOptions | GetIronSessionApiOptions): NextApiHandler;
+declare type GetIronSessionSSROptions = (request: IncomingMessage, response: ServerResponse) => Promise<IronSessionOptions> | IronSessionOptions;
 declare function withIronSessionSsr<P extends {
     [key: string]: unknown;
 } = {
     [key: string]: unknown;
-}>(handler: (context: GetServerSidePropsContext) => GetServerSidePropsResult<P> | Promise<GetServerSidePropsResult<P>>, options: IronSessionOptions): (context: GetServerSidePropsContext) => Promise<GetServerSidePropsResult<P>>;
+}>(handler: (context: GetServerSidePropsContext) => GetServerSidePropsResult<P> | Promise<GetServerSidePropsResult<P>>, options: IronSessionOptions | GetIronSessionSSROptions): (context: GetServerSidePropsContext) => Promise<GetServerSidePropsResult<P>>;
 
 export { withIronSessionApiRoute, withIronSessionSsr };

package/next/index.js

@@ -54,6 +54,9 @@ function getPropertyDescriptorForReqSession(session) {
 // next/index.ts
 function withIronSessionApiRoute(handler, options) {
   return async function nextApiHandlerWrappedWithIronSession(req, res) {
+    if (options instanceof Function) {
+      options = await options(req, res);
+    }
     const session = await (0, import_iron_session.getIronSession)(req, res, options);
     Object.defineProperty(req, "session", getPropertyDescriptorForReqSession(session));
     return handler(req, res);
@@ -61,6 +64,9 @@ function withIronSessionApiRoute(handler, options) {
 }
 function withIronSessionSsr(handler, options) {
   return async function nextGetServerSidePropsHandlerWrappedWithIronSession(context) {
+    if (options instanceof Function) {
+      options = await options(context.req, context.res);
+    }
     const session = await (0, import_iron_session.getIronSession)(context.req, context.res, options);
     Object.defineProperty(context.req, "session", getPropertyDescriptorForReqSession(session));
     return handler(context);

package/next/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../index.ts", "../../src/getPropertyDescriptorForReqSession.ts"],
-  "sourcesContent": ["import type {\n  NextApiHandler,\n  GetServerSidePropsContext,\n  GetServerSidePropsResult,\n} from \"next\";\nimport type { IronSessionOptions } from \"iron-session\";\nimport { getIronSession } from \"iron-session\";\nimport getPropertyDescriptorForReqSession from \"../src/getPropertyDescriptorForReqSession\";\n\nexport function withIronSessionApiRoute(\n  handler: NextApiHandler,\n  options: IronSessionOptions,\n): NextApiHandler {\n  return async function nextApiHandlerWrappedWithIronSession(req, res) {\n    const session = await getIronSession(req, res, options);\n\n    // we define req.session as being enumerable (so console.log(req) shows it)\n    // and we also want to allow people to do:\n    // req.session = { admin: true }; or req.session = {...req.session, admin: true};\n    // req.session.save();\n    Object.defineProperty(\n      req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n    return handler(req, res);\n  };\n}\n\nexport function withIronSessionSsr<\n  P extends { [key: string]: unknown } = { [key: string]: unknown },\n>(\n  handler: (\n    context: GetServerSidePropsContext,\n  ) => GetServerSidePropsResult<P> | Promise<GetServerSidePropsResult<P>>,\n  options: IronSessionOptions,\n) {\n  return async function nextGetServerSidePropsHandlerWrappedWithIronSession(\n    context: GetServerSidePropsContext,\n  ) {\n    const session = await getIronSession(context.req, context.res, options);\n    Object.defineProperty(\n      context.req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n    return handler(context);\n  };\n}\n", "import type { IronSession } from \".\";\n\nexport default function getPropertyDescriptorForReqSession(\n  session: IronSession,\n): PropertyDescriptor {\n  return {\n    enumerable: true,\n    get() {\n      return session;\n    },\n    set(value) {\n      const keys = Object.keys(value);\n      const currentKeys = Object.keys(session);\n\n      currentKeys.forEach((key) => {\n        if (!keys.includes(key)) {\n          // @ts-ignore See comment in IronSessionData interface\n          delete session[key];\n        }\n      });\n\n      keys.forEach((key) => {\n        // @ts-ignore See comment in IronSessionData interface\n        session[key] = value[key];\n      });\n    },\n  };\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAMA,0BAA+B;;;ACJhB,4CACb,SACoB;AACpB,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AACJ,aAAO;AAAA;AAAA,IAET,IAAI,OAAO;AACT,YAAM,OAAO,OAAO,KAAK;AACzB,YAAM,cAAc,OAAO,KAAK;AAEhC,kBAAY,QAAQ,CAAC,QAAQ;AAC3B,YAAI,CAAC,KAAK,SAAS,MAAM;AAEvB,iBAAO,QAAQ;AAAA;AAAA;AAInB,WAAK,QAAQ,CAAC,QAAQ;AAEpB,gBAAQ,OAAO,MAAM;AAAA;AAAA;AAAA;AAAA;;;ADdtB,iCACL,SACA,SACgB;AAChB,SAAO,oDAAoD,KAAK,KAAK;AACnE,UAAM,UAAU,MAAM,wCAAe,KAAK,KAAK;AAM/C,WAAO,eACL,KACA,WACA,mCAAmC;AAErC,WAAO,QAAQ,KAAK;AAAA;AAAA;AAIjB,4BAGL,SAGA,SACA;AACA,SAAO,mEACL,SACA;AACA,UAAM,UAAU,MAAM,wCAAe,QAAQ,KAAK,QAAQ,KAAK;AAC/D,WAAO,eACL,QAAQ,KACR,WACA,mCAAmC;AAErC,WAAO,QAAQ;AAAA;AAAA;",
+  "sourcesContent": ["import type {\n  NextApiHandler,\n  GetServerSidePropsContext,\n  GetServerSidePropsResult,\n  NextApiRequest,\n  NextApiResponse,\n} from \"next\";\nimport type { IronSessionOptions } from \"iron-session\";\nimport { getIronSession } from \"iron-session\";\nimport getPropertyDescriptorForReqSession from \"../src/getPropertyDescriptorForReqSession\";\nimport { IncomingMessage, ServerResponse } from \"http\";\n\n// Argument types based on getIronSession function\ntype GetIronSessionApiOptions = (\n  request: NextApiRequest,\n  response: NextApiResponse,\n) => Promise<IronSessionOptions> | IronSessionOptions;\n\nexport function withIronSessionApiRoute(\n  handler: NextApiHandler,\n  options: IronSessionOptions | GetIronSessionApiOptions,\n): NextApiHandler {\n  return async function nextApiHandlerWrappedWithIronSession(req, res) {\n    // If options is a function, call it and assign the results back.\n    if (options instanceof Function) {\n      options = await options(req, res);\n    }\n    const session = await getIronSession(req, res, options);\n\n    // we define req.session as being enumerable (so console.log(req) shows it)\n    // and we also want to allow people to do:\n    // req.session = { admin: true }; or req.session = {...req.session, admin: true};\n    // req.session.save();\n    Object.defineProperty(\n      req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n    return handler(req, res);\n  };\n}\n\n// Argument type based on the SSR context\ntype GetIronSessionSSROptions = (\n  request: IncomingMessage,\n  response: ServerResponse,\n) => Promise<IronSessionOptions> | IronSessionOptions;\n\nexport function withIronSessionSsr<\n  P extends { [key: string]: unknown } = { [key: string]: unknown },\n>(\n  handler: (\n    context: GetServerSidePropsContext,\n  ) => GetServerSidePropsResult<P> | Promise<GetServerSidePropsResult<P>>,\n  options: IronSessionOptions | GetIronSessionSSROptions,\n) {\n  return async function nextGetServerSidePropsHandlerWrappedWithIronSession(\n    context: GetServerSidePropsContext,\n  ) {\n    // If options is a function, call it and assign the results back.\n    if (options instanceof Function) {\n      options = await options(context.req, context.res);\n    }\n    const session = await getIronSession(context.req, context.res, options);\n    Object.defineProperty(\n      context.req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n    return handler(context);\n  };\n}\n", "import type { IronSession } from \".\";\n\nexport default function getPropertyDescriptorForReqSession(\n  session: IronSession,\n): PropertyDescriptor {\n  return {\n    enumerable: true,\n    get() {\n      return session;\n    },\n    set(value) {\n      const keys = Object.keys(value);\n      const currentKeys = Object.keys(session);\n\n      currentKeys.forEach((key) => {\n        if (!keys.includes(key)) {\n          // @ts-ignore See comment in IronSessionData interface\n          delete session[key];\n        }\n      });\n\n      keys.forEach((key) => {\n        // @ts-ignore See comment in IronSessionData interface\n        session[key] = value[key];\n      });\n    },\n  };\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAQA,0BAA+B;;;ACNhB,4CACb,SACoB;AACpB,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AACJ,aAAO;AAAA;AAAA,IAET,IAAI,OAAO;AACT,YAAM,OAAO,OAAO,KAAK;AACzB,YAAM,cAAc,OAAO,KAAK;AAEhC,kBAAY,QAAQ,CAAC,QAAQ;AAC3B,YAAI,CAAC,KAAK,SAAS,MAAM;AAEvB,iBAAO,QAAQ;AAAA;AAAA;AAInB,WAAK,QAAQ,CAAC,QAAQ;AAEpB,gBAAQ,OAAO,MAAM;AAAA;AAAA;AAAA;AAAA;;;ADLtB,iCACL,SACA,SACgB;AAChB,SAAO,oDAAoD,KAAK,KAAK;AAEnE,QAAI,mBAAmB,UAAU;AAC/B,gBAAU,MAAM,QAAQ,KAAK;AAAA;AAE/B,UAAM,UAAU,MAAM,wCAAe,KAAK,KAAK;AAM/C,WAAO,eACL,KACA,WACA,mCAAmC;AAErC,WAAO,QAAQ,KAAK;AAAA;AAAA;AAUjB,4BAGL,SAGA,SACA;AACA,SAAO,mEACL,SACA;AAEA,QAAI,mBAAmB,UAAU;AAC/B,gBAAU,MAAM,QAAQ,QAAQ,KAAK,QAAQ;AAAA;AAE/C,UAAM,UAAU,MAAM,wCAAe,QAAQ,KAAK,QAAQ,KAAK;AAC/D,WAAO,eACL,QAAQ,KACR,WACA,mCAAmC;AAErC,WAAO,QAAQ;AAAA;AAAA;",
   "names": []
 }

package/next/index.mjs

@@ -26,6 +26,9 @@ function getPropertyDescriptorForReqSession(session) {
 // next/index.ts
 function withIronSessionApiRoute(handler, options) {
   return async function nextApiHandlerWrappedWithIronSession(req, res) {
+    if (options instanceof Function) {
+      options = await options(req, res);
+    }
     const session = await getIronSession(req, res, options);
     Object.defineProperty(req, "session", getPropertyDescriptorForReqSession(session));
     return handler(req, res);
@@ -33,6 +36,9 @@ function withIronSessionApiRoute(handler, options) {
 }
 function withIronSessionSsr(handler, options) {
   return async function nextGetServerSidePropsHandlerWrappedWithIronSession(context) {
+    if (options instanceof Function) {
+      options = await options(context.req, context.res);
+    }
     const session = await getIronSession(context.req, context.res, options);
     Object.defineProperty(context.req, "session", getPropertyDescriptorForReqSession(session));
     return handler(context);

package/next/index.mjs.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../index.ts", "../../src/getPropertyDescriptorForReqSession.ts"],
-  "sourcesContent": ["import type {\n  NextApiHandler,\n  GetServerSidePropsContext,\n  GetServerSidePropsResult,\n} from \"next\";\nimport type { IronSessionOptions } from \"iron-session\";\nimport { getIronSession } from \"iron-session\";\nimport getPropertyDescriptorForReqSession from \"../src/getPropertyDescriptorForReqSession\";\n\nexport function withIronSessionApiRoute(\n  handler: NextApiHandler,\n  options: IronSessionOptions,\n): NextApiHandler {\n  return async function nextApiHandlerWrappedWithIronSession(req, res) {\n    const session = await getIronSession(req, res, options);\n\n    // we define req.session as being enumerable (so console.log(req) shows it)\n    // and we also want to allow people to do:\n    // req.session = { admin: true }; or req.session = {...req.session, admin: true};\n    // req.session.save();\n    Object.defineProperty(\n      req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n    return handler(req, res);\n  };\n}\n\nexport function withIronSessionSsr<\n  P extends { [key: string]: unknown } = { [key: string]: unknown },\n>(\n  handler: (\n    context: GetServerSidePropsContext,\n  ) => GetServerSidePropsResult<P> | Promise<GetServerSidePropsResult<P>>,\n  options: IronSessionOptions,\n) {\n  return async function nextGetServerSidePropsHandlerWrappedWithIronSession(\n    context: GetServerSidePropsContext,\n  ) {\n    const session = await getIronSession(context.req, context.res, options);\n    Object.defineProperty(\n      context.req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n    return handler(context);\n  };\n}\n", "import type { IronSession } from \".\";\n\nexport default function getPropertyDescriptorForReqSession(\n  session: IronSession,\n): PropertyDescriptor {\n  return {\n    enumerable: true,\n    get() {\n      return session;\n    },\n    set(value) {\n      const keys = Object.keys(value);\n      const currentKeys = Object.keys(session);\n\n      currentKeys.forEach((key) => {\n        if (!keys.includes(key)) {\n          // @ts-ignore See comment in IronSessionData interface\n          delete session[key];\n        }\n      });\n\n      keys.forEach((key) => {\n        // @ts-ignore See comment in IronSessionData interface\n        session[key] = value[key];\n      });\n    },\n  };\n}\n"],
-  "mappings": ";AAMA;;;ACJe,4CACb,SACoB;AACpB,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AACJ,aAAO;AAAA;AAAA,IAET,IAAI,OAAO;AACT,YAAM,OAAO,OAAO,KAAK;AACzB,YAAM,cAAc,OAAO,KAAK;AAEhC,kBAAY,QAAQ,CAAC,QAAQ;AAC3B,YAAI,CAAC,KAAK,SAAS,MAAM;AAEvB,iBAAO,QAAQ;AAAA;AAAA;AAInB,WAAK,QAAQ,CAAC,QAAQ;AAEpB,gBAAQ,OAAO,MAAM;AAAA;AAAA;AAAA;AAAA;;;ADdtB,iCACL,SACA,SACgB;AAChB,SAAO,oDAAoD,KAAK,KAAK;AACnE,UAAM,UAAU,MAAM,eAAe,KAAK,KAAK;AAM/C,WAAO,eACL,KACA,WACA,mCAAmC;AAErC,WAAO,QAAQ,KAAK;AAAA;AAAA;AAIjB,4BAGL,SAGA,SACA;AACA,SAAO,mEACL,SACA;AACA,UAAM,UAAU,MAAM,eAAe,QAAQ,KAAK,QAAQ,KAAK;AAC/D,WAAO,eACL,QAAQ,KACR,WACA,mCAAmC;AAErC,WAAO,QAAQ;AAAA;AAAA;",
+  "sourcesContent": ["import type {\n  NextApiHandler,\n  GetServerSidePropsContext,\n  GetServerSidePropsResult,\n  NextApiRequest,\n  NextApiResponse,\n} from \"next\";\nimport type { IronSessionOptions } from \"iron-session\";\nimport { getIronSession } from \"iron-session\";\nimport getPropertyDescriptorForReqSession from \"../src/getPropertyDescriptorForReqSession\";\nimport { IncomingMessage, ServerResponse } from \"http\";\n\n// Argument types based on getIronSession function\ntype GetIronSessionApiOptions = (\n  request: NextApiRequest,\n  response: NextApiResponse,\n) => Promise<IronSessionOptions> | IronSessionOptions;\n\nexport function withIronSessionApiRoute(\n  handler: NextApiHandler,\n  options: IronSessionOptions | GetIronSessionApiOptions,\n): NextApiHandler {\n  return async function nextApiHandlerWrappedWithIronSession(req, res) {\n    // If options is a function, call it and assign the results back.\n    if (options instanceof Function) {\n      options = await options(req, res);\n    }\n    const session = await getIronSession(req, res, options);\n\n    // we define req.session as being enumerable (so console.log(req) shows it)\n    // and we also want to allow people to do:\n    // req.session = { admin: true }; or req.session = {...req.session, admin: true};\n    // req.session.save();\n    Object.defineProperty(\n      req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n    return handler(req, res);\n  };\n}\n\n// Argument type based on the SSR context\ntype GetIronSessionSSROptions = (\n  request: IncomingMessage,\n  response: ServerResponse,\n) => Promise<IronSessionOptions> | IronSessionOptions;\n\nexport function withIronSessionSsr<\n  P extends { [key: string]: unknown } = { [key: string]: unknown },\n>(\n  handler: (\n    context: GetServerSidePropsContext,\n  ) => GetServerSidePropsResult<P> | Promise<GetServerSidePropsResult<P>>,\n  options: IronSessionOptions | GetIronSessionSSROptions,\n) {\n  return async function nextGetServerSidePropsHandlerWrappedWithIronSession(\n    context: GetServerSidePropsContext,\n  ) {\n    // If options is a function, call it and assign the results back.\n    if (options instanceof Function) {\n      options = await options(context.req, context.res);\n    }\n    const session = await getIronSession(context.req, context.res, options);\n    Object.defineProperty(\n      context.req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n    return handler(context);\n  };\n}\n", "import type { IronSession } from \".\";\n\nexport default function getPropertyDescriptorForReqSession(\n  session: IronSession,\n): PropertyDescriptor {\n  return {\n    enumerable: true,\n    get() {\n      return session;\n    },\n    set(value) {\n      const keys = Object.keys(value);\n      const currentKeys = Object.keys(session);\n\n      currentKeys.forEach((key) => {\n        if (!keys.includes(key)) {\n          // @ts-ignore See comment in IronSessionData interface\n          delete session[key];\n        }\n      });\n\n      keys.forEach((key) => {\n        // @ts-ignore See comment in IronSessionData interface\n        session[key] = value[key];\n      });\n    },\n  };\n}\n"],
+  "mappings": ";AAQA;;;ACNe,4CACb,SACoB;AACpB,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AACJ,aAAO;AAAA;AAAA,IAET,IAAI,OAAO;AACT,YAAM,OAAO,OAAO,KAAK;AACzB,YAAM,cAAc,OAAO,KAAK;AAEhC,kBAAY,QAAQ,CAAC,QAAQ;AAC3B,YAAI,CAAC,KAAK,SAAS,MAAM;AAEvB,iBAAO,QAAQ;AAAA;AAAA;AAInB,WAAK,QAAQ,CAAC,QAAQ;AAEpB,gBAAQ,OAAO,MAAM;AAAA;AAAA;AAAA;AAAA;;;ADLtB,iCACL,SACA,SACgB;AAChB,SAAO,oDAAoD,KAAK,KAAK;AAEnE,QAAI,mBAAmB,UAAU;AAC/B,gBAAU,MAAM,QAAQ,KAAK;AAAA;AAE/B,UAAM,UAAU,MAAM,eAAe,KAAK,KAAK;AAM/C,WAAO,eACL,KACA,WACA,mCAAmC;AAErC,WAAO,QAAQ,KAAK;AAAA;AAAA;AAUjB,4BAGL,SAGA,SACA;AACA,SAAO,mEACL,SACA;AAEA,QAAI,mBAAmB,UAAU;AAC/B,gBAAU,MAAM,QAAQ,QAAQ,KAAK,QAAQ;AAAA;AAE/C,UAAM,UAAU,MAAM,eAAe,QAAQ,KAAK,QAAQ,KAAK;AAC/D,WAAO,eACL,QAAQ,KACR,WACA,mCAAmC;AAErC,WAAO,QAAQ;AAAA;AAAA;",
   "names": []
 }

package/next/index.test.ts

@@ -60,6 +60,31 @@ test("withIronSessionApiRoute: req.session.save creates a cookie", async () => {
   await wrappedHandler(getDefaultReq(), getDefaultRes());
 });
 
+test("withIconSessionApiRoute: IronSessionOptions passed as a function works correctly", async () => {
+  const wrappedHandler = withIronSessionApiRoute(
+    async function handler(req, res) {
+      req.session.user = { id: 200 };
+      await req.session.save();
+      const headerValue = (res.setHeader as jest.Mock).mock.calls[0][1];
+      const cookie = headerValue[0];
+      const cookieParams = cookie.split(";").slice(1).join(";");
+      const cookieName = cookie.split("=")[0];
+
+      expect(cookieParams).toMatchInlineSnapshot(
+        `" Max-Age=60; Path=/; HttpOnly; Secure; SameSite=Lax"`,
+      );
+      expect(cookieName).toBe("dynamic-cookie-name");
+    },
+    () => ({
+      cookieName: "dynamic-cookie-name",
+      password,
+      ttl: 120,
+    }),
+  );
+
+  await wrappedHandler(getDefaultReq(), getDefaultRes());
+});
+
 test("withIronSessionApiRoute: req.session.destroy removes the cookie", async () => {
   const wrappedHandler = withIronSessionApiRoute(
     async function handler(req, res) {

package/next/index.ts

@@ -2,16 +2,29 @@ import type {
   NextApiHandler,
   GetServerSidePropsContext,
   GetServerSidePropsResult,
+  NextApiRequest,
+  NextApiResponse,
 } from "next";
 import type { IronSessionOptions } from "iron-session";
 import { getIronSession } from "iron-session";
 import getPropertyDescriptorForReqSession from "../src/getPropertyDescriptorForReqSession";
+import { IncomingMessage, ServerResponse } from "http";
+
+// Argument types based on getIronSession function
+type GetIronSessionApiOptions = (
+  request: NextApiRequest,
+  response: NextApiResponse,
+) => Promise<IronSessionOptions> | IronSessionOptions;
 
 export function withIronSessionApiRoute(
   handler: NextApiHandler,
-  options: IronSessionOptions,
+  options: IronSessionOptions | GetIronSessionApiOptions,
 ): NextApiHandler {
   return async function nextApiHandlerWrappedWithIronSession(req, res) {
+    // If options is a function, call it and assign the results back.
+    if (options instanceof Function) {
+      options = await options(req, res);
+    }
     const session = await getIronSession(req, res, options);
 
     // we define req.session as being enumerable (so console.log(req) shows it)
@@ -27,17 +40,27 @@ export function withIronSessionApiRoute(
   };
 }
 
+// Argument type based on the SSR context
+type GetIronSessionSSROptions = (
+  request: IncomingMessage,
+  response: ServerResponse,
+) => Promise<IronSessionOptions> | IronSessionOptions;
+
 export function withIronSessionSsr<
   P extends { [key: string]: unknown } = { [key: string]: unknown },
 >(
   handler: (
     context: GetServerSidePropsContext,
   ) => GetServerSidePropsResult<P> | Promise<GetServerSidePropsResult<P>>,
-  options: IronSessionOptions,
+  options: IronSessionOptions | GetIronSessionSSROptions,
 ) {
   return async function nextGetServerSidePropsHandlerWrappedWithIronSession(
     context: GetServerSidePropsContext,
   ) {
+    // If options is a function, call it and assign the results back.
+    if (options instanceof Function) {
+      options = await options(context.req, context.res);
+    }
     const session = await getIronSession(context.req, context.res, options);
     Object.defineProperty(
       context.req,

package/package.json

@@ -1,7 +1,20 @@
 {
   "name": "iron-session",
-  "version": "6.0.3",
+  "version": "6.1.0",
   "description": "Node.js stateless session utility using signed and encrypted cookies to store data. Works with Next.js, Express, NestJs, Fastify, and any Node.js HTTP framework.",
+  "keywords": [
+    "Next.js",
+    "session",
+    "cookies",
+    "login",
+    "auth",
+    "Express",
+    "NestJS"
+  ],
+  "bugs": {
+    "url": "https://github.com/vvo/iron-session/issues"
+  },
+  "repository": "https://github.com/vvo/iron-session.git",
   "license": "MIT",
   "author": "Vincent Voyer <vincent@codeagain.com>",
   "exports": {
@@ -112,23 +125,23 @@
     "@types/cookie": "^0.4.0",
     "@types/express": "^4.17.13",
     "@types/node": "^16.11.7",
-    "cookie": "^0.4.1"
+    "cookie": "^0.4.2"
   },
   "devDependencies": {
-    "@swc/core": "^1.2.107",
-    "@swc/jest": "0.2.5",
+    "@swc/core": "^1.2.156",
+    "@swc/jest": "^0.2.20",
     "@tsconfig/node12": "1.0.9",
-    "@types/jest": "27.0.2",
-    "@typescript-eslint/eslint-plugin": "5.3.0",
-    "@typescript-eslint/parser": "^5.3.1",
-    "concurrently": "6.3.0",
-    "eslint": "^8.2.0",
-    "jest": "27.3.1",
-    "prettier": "2.4.1",
-    "prettier-plugin-packagejson": "2.2.13",
+    "@types/jest": "^27.4.1",
+    "@typescript-eslint/eslint-plugin": "^5.15.0",
+    "@typescript-eslint/parser": "^5.15.0",
+    "concurrently": "^7.0.0",
+    "eslint": "^8.11.0",
+    "jest": "^27.5.1",
+    "prettier": "^2.6.0",
+    "prettier-plugin-packagejson": "^2.2.16",
     "rimraf": "3.0.2",
     "tsup": "5.6.0",
-    "typescript": "4.4.4"
+    "typescript": "^4.6.2"
   },
   "peerDependencies": {
     "express": ">=4",