iron-session 6.1.3 → 6.2.0-beta.2

package/README.md

@@ -2,8 +2,6 @@
 
 <p align="center"><b>⭐️ Featured in the <a href="https://nextjs.org/docs/authentication">Next.js documentation</a></b></p>
 
-**⚠️ Nov 2021 update**: The library was renamed to `iron-session` and fully rewritten in TypeScript, it includes lots of new features and fixes. Follow the migration guide here: https://github.com/vvo/iron-session/releases/tag/v6.0.0.
-
 _🛠 Node.js stateless session utility using signed and encrypted cookies to store data. Works with Next.js, Express, NestJs, Fastify, and any Node.js HTTP framework._
 
 The session data is stored in encrypted cookies ("seals"). And only your server can decode the session data. There are no session ids, making iron sessions "stateless" from the server point of view.
@@ -12,14 +10,15 @@ This strategy of storing session data is the same technique used by **frameworks
 
 The underlying cryptography library is [iron](https://hapi.dev/module/iron) which was [created by the lead developer of OAuth 2.0](https://hueniversedotcom.wordpress.com/2015/09/19/auth-to-see-the-wizard-or-i-wrote-an-oauth-replacement/).
 
-<p align="center"><b>Online demo at <a href="https://iron-session-example.vercel.app/">https://iron-session-example.vercel.app</a> 👀</b></p>
+<p align="center"><b>Online demo: <a href="https://iron-session-example.vercel.app/">https://iron-session-example.vercel.app</a> 👀</b></p>
 
 ---
 
 _Table of contents:_
 
 - [Installation](#installation)
-- [Usage (Next.js)](#usage-nextjs)
+- [Next.js usage](#nextjs-usage)
+- [Next.js middlewares usage](#nextjs-middlewares-usage)
 - [Advanced usage](#advanced-usage)
   - [Coding best practices](#coding-best-practices)
   - [Session wrappers](#session-wrappers)
@@ -32,8 +31,8 @@ _Table of contents:_
   - [Firebase usage](#firebase-usage)
 - [API](#api)
   - [ironOptions](#ironoptions)
-  - [Next.js: withIronSessionApiRoute(handler, ironOptions)](#nextjs-withironsessionapiroutehandler-ironoptions--req-nextapirequest-res-nextapiresponse--ironoptions--promiseironoptions)
-  - [Next.js: withIronSessionSsr(handler, ironOptions)](#nextjs-withironsessionapiroutehandler-ironoptions--req-nextapirequest-res-nextapiresponse--ironoptions--promiseironoptions)
+  - [Next.js: withIronSessionApiRoute(handler, ironOptions | (req: NextApiRequest, res: NextApiResponse) => IronOptions | Promise\<IronOptions\>)](#nextjs-withironsessionapiroutehandler-ironoptions--req-nextapirequest-res-nextapiresponse--ironoptions--promiseironoptions)
+  - [Next.js: withIronSessionSsr(handler, ironOptions | (req: IncomingMessage, res: ServerResponse) => IronOptions | Promise\<IronOptions\>)](#nextjs-withironsessionssrhandler-ironoptions--req-incomingmessage-res-serverresponse--ironoptions--promiseironoptions)
   - [Express: ironSession(ironOptions)](#express-ironsessionironoptions)
   - [session.save()](#sessionsave)
   - [session.destroy()](#sessiondestroy)
@@ -52,7 +51,7 @@ _Table of contents:_
 npm add iron-session
 ```
 
-## Usage (Next.js)
+## Next.js usage
 
 You can find full featured examples (Next.js, Express) in the [examples folder](examples).
 
@@ -171,6 +170,61 @@ export const getServerSideProps = withIronSessionSsr(
 
 Note: We encourage you to create a `withSession` utility so you do not have to repeat the password and cookie name in every route. You can see how to do that [in the example](./examples/next.js-typescript/lib/session.ts).
 
+## Next.js middlewares usage
+
+As of version 6.2.0, this library is compatible with [Next.js middlewares](https://nextjs.org/docs/advanced-features/middleware) locally and when deployed on Vercel.
+
+Since there's no pre-available `res` object in Next.js's middlewares, you need to use iron-session this way:
+
+```ts
+// pages/middleware.ts
+import { NextResponse } from "next/server";
+import type { NextRequest } from "next/server";
+import { getIronSession } from "iron-session/edge";
+
+export const middleware = async (req: NextRequest) => {
+  const res = NextResponse.next();
+  const session = await getIronSession(req, res, {
+    cookieName: "myapp_cookiename",
+    password: "complex_password_at_least_32_characters_long",
+    // secure: true should be used in production (HTTPS) but can't be used in development (HTTP)
+    cookieOptions: {
+      secure: process.env.NODE_ENV === "production",
+    },
+  });
+
+  // do anything with session here:
+  const { user } = session;
+
+  // like mutate user:
+  // user.something = someOtherThing;
+  // or:
+  // session.user = someoneElse;
+
+  // uncomment next line to commit changes:
+  // await session.save();
+  // or maybe you want to destroy session:
+  // await session.destroy();
+
+  console.log("from middleware", { user });
+
+  // demo:
+  if (user?.admin !== "true") {
+    return new NextResponse(null, { status: 403 }); // unauthorized to see pages inside admin/
+  }
+
+  return res;
+};
+
+export const config = {
+  matcher: "/admin",
+};
+```
+
+Note: There's a good probability that you can also use iron-session in the context of [Cloudflare Workers](https://workers.cloudflare.com/), try it and let us know.
+
+_Huge thanks to [Divyansh Singh](https://github.com/brc-dd) who ported [hapijs/iron](https://github.com/hapijs/iron) to the [Web Crypto API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API) and implemented the required changes in iron-session._
+
 ## Advanced usage
 
 ### Coding best practices
@@ -336,6 +390,16 @@ declare module "iron-session" {
     };
   }
 }
+
+// If you're also using the iron-session/edge endpoint, you need this too:
+// declare module "iron-session/edge" {
+//   interface IronSessionData {
+//     user?: {
+//       id: number;
+//       admin?: boolean;
+//     };
+//   }
+// }
 ```
 
 You can put this code anywhere in your project, as long as it is in a file that will be required at some point. For example it could be inside your `lib/withSession.ts` wrapper or inside an [`additional.d.ts`](https://nextjs.org/docs/basic-features/typescript) if you're using Next.js.
@@ -568,7 +632,7 @@ Only two options are required: `password` and `cookieName`. Everything else is a
 
 - `password`, **required**: Private key used to encrypt the cookie. It has to be at least 32 characters long. Use https://1password.com/password-generator/ to generate strong passwords. `password` can be either a `string` or an `array` of objects like this: `[{id: 2, password: "..."}, {id: 1, password: "..."}]` to allow for password rotation.
 - `cookieName`, **required**: Name of the cookie to be stored
-- `ttl`, _optional_: In seconds, default to 14 days
+- `ttl`, _optional_: In seconds. Default to the equivalent of 14 days. You can set this to `0` and iron-session will compute the maximum allowed value by cookies (~70 years).
 - [`cookieOptions`](https://github.com/jshttp/cookie#cookieserializename-value-options), _optional_: Any option available from [jshttp/cookie#serialize](https://github.com/jshttp/cookie#cookieserializename-value-options). Default to:
 
 ```js

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 import { CookieSerializeOptions } from 'cookie';
+import * as http from 'http';
 import { IncomingMessage, ServerResponse } from 'http';
 
 declare type passwordsMap = {
@@ -51,14 +52,30 @@ declare module "http" {
         session: IronSession;
     }
 }
-declare function getIronSession(req: IncomingMessage, res: ServerResponse, userSessionOptions: IronSessionOptions): Promise<IronSession>;
-declare function unsealData<T = Record<string, unknown>>(seal: string, { password, ttl, }: {
+declare type RequestType = IncomingMessage | Request;
+declare type ResponseType = ServerResponse | Response;
+declare function createGetIronSession(_crypto: Crypto, unsealData: ReturnType<typeof createUnsealData>, sealData: ReturnType<typeof createSealData>): (req: RequestType, res: ResponseType, userSessionOptions: IronSessionOptions) => Promise<IronSession>;
+declare function createUnsealData(_crypto: Crypto): <T = Record<string, unknown>>(seal: string, { password, ttl, }: {
     password: password;
-    ttl?: number;
-}): Promise<T>;
-declare function sealData(data: unknown, { password, ttl, }: {
+    ttl?: number | undefined;
+}) => Promise<T>;
+declare function createSealData(_crypto: Crypto): (data: unknown, { password, ttl, }: {
     password: password;
-    ttl?: number;
-}): Promise<string>;
+    ttl?: number | undefined;
+}) => Promise<string>;
+
+declare const unsealData: <T = Record<string, unknown>>(seal: string, { password, ttl, }: {
+    password: string | {
+        [id: string]: string;
+    };
+    ttl?: number | undefined;
+}) => Promise<T>;
+declare const sealData: (data: unknown, { password, ttl, }: {
+    password: string | {
+        [id: string]: string;
+    };
+    ttl?: number | undefined;
+}) => Promise<string>;
+declare const getIronSession: (req: http.IncomingMessage | Request, res: http.ServerResponse | Response, userSessionOptions: IronSessionOptions) => Promise<IronSession>;
 
-export { IronSession, IronSessionData, IronSessionOptions, getIronSession, sealData, unsealData };
+export { IronSession, IronSessionData, IronSessionOptions, createGetIronSession, createSealData, createUnsealData, getIronSession, sealData, unsealData };

package/dist/index.js

@@ -1,35 +1,43 @@
+"use strict";
 var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __markAsModule = (target) => __defProp(target, "__esModule", { value: true });
 var __export = (target, all) => {
-  __markAsModule(target);
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
 };
-var __reExport = (target, module2, desc) => {
-  if (module2 && typeof module2 === "object" || typeof module2 === "function") {
-    for (let key of __getOwnPropNames(module2))
-      if (!__hasOwnProp.call(target, key) && key !== "default")
-        __defProp(target, key, { get: () => module2[key], enumerable: !(desc = __getOwnPropDesc(module2, key)) || desc.enumerable });
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
   }
-  return target;
-};
-var __toModule = (module2) => {
-  return __reExport(__markAsModule(__defProp(module2 != null ? __create(__getProtoOf(module2)) : {}, "default", module2 && module2.__esModule && "default" in module2 ? { get: () => module2.default, enumerable: true } : { value: module2, enumerable: true })), module2);
+  return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/index.ts
-__export(exports, {
+var src_exports = {};
+__export(src_exports, {
+  createGetIronSession: () => createGetIronSession,
+  createSealData: () => createSealData,
+  createUnsealData: () => createUnsealData,
   getIronSession: () => getIronSession,
   sealData: () => sealData,
   unsealData: () => unsealData
 });
-var import_iron = __toModule(require("@hapi/iron"));
-var import_cookie = __toModule(require("cookie"));
+module.exports = __toCommonJS(src_exports);
+
+// src/core.ts
+var Iron = __toESM(require("iron-webcrypto"));
+var import_cookie = __toESM(require("cookie"));
 var timestampSkewSec = 60;
 var fourteenDaysInSeconds = 15 * 24 * 3600;
 var currentMajorVersion = 2;
@@ -43,75 +51,101 @@ var defaultOptions = {
     path: "/"
   }
 };
-async function getIronSession(req, res, userSessionOptions) {
-  if (!req || !res || !userSessionOptions || !userSessionOptions.cookieName || !userSessionOptions.password) {
-    throw new Error(`iron-session: Bad usage. Minimum usage is const session = await getIronSession(req, res, { cookieName: "...", password: "...". Check the usage here: https://github.com/vvo/iron-session`);
-  }
-  const passwordsAsMap = normalizeStringPasswordToMap(userSessionOptions.password);
-  Object.values(normalizeStringPasswordToMap(userSessionOptions.password)).forEach((password) => {
-    if (password.length < 32) {
-      throw new Error(`iron-session: Bad usage. Password must be at least 32 characters long.`);
+function createGetIronSession(_crypto2, unsealData2, sealData2) {
+  return async (req, res, userSessionOptions) => {
+    if (!req || !res || !userSessionOptions || !userSessionOptions.cookieName || !userSessionOptions.password) {
+      throw new Error(
+        `iron-session: Bad usage. Minimum usage is const session = await getIronSession(req, res, { cookieName: "...", password: "...". Check the usage here: https://github.com/vvo/iron-session`
+      );
     }
-  });
-  const options = {
-    ...defaultOptions,
-    ...userSessionOptions,
-    cookieOptions: {
-      ...defaultOptions.cookieOptions,
-      ...userSessionOptions.cookieOptions || {}
+    const passwordsAsMap = normalizeStringPasswordToMap(
+      userSessionOptions.password
+    );
+    Object.values(
+      normalizeStringPasswordToMap(userSessionOptions.password)
+    ).forEach((password) => {
+      if (password.length < 32) {
+        throw new Error(
+          `iron-session: Bad usage. Password must be at least 32 characters long.`
+        );
+      }
+    });
+    const options = {
+      ...defaultOptions,
+      ...userSessionOptions,
+      cookieOptions: {
+        ...defaultOptions.cookieOptions,
+        ...userSessionOptions.cookieOptions || {}
+      }
+    };
+    if (options.ttl === 0) {
+      options.ttl = 2147483647;
     }
-  };
-  if (options.ttl === 0) {
-    options.ttl = 2147483647;
-  }
-  if (userSessionOptions.cookieOptions && "maxAge" in userSessionOptions.cookieOptions) {
-    if (userSessionOptions.cookieOptions.maxAge === void 0) {
-      options.ttl = 0;
+    if (userSessionOptions.cookieOptions && "maxAge" in userSessionOptions.cookieOptions) {
+      if (userSessionOptions.cookieOptions.maxAge === void 0) {
+        options.ttl = 0;
+      } else {
+        options.cookieOptions.maxAge = computeCookieMaxAge(
+          userSessionOptions.cookieOptions.maxAge
+        );
+      }
     } else {
-      options.cookieOptions.maxAge = computeCookieMaxAge(userSessionOptions.cookieOptions.maxAge);
+      options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);
     }
-  } else {
-    options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);
-  }
-  const sealFromCookies = import_cookie.default.parse(req.headers.cookie || "")[options.cookieName];
-  const session = sealFromCookies === void 0 ? {} : await unsealData(sealFromCookies, {
-    password: passwordsAsMap,
-    ttl: options.ttl
-  });
-  Object.defineProperties(session, {
-    save: {
-      value: async function save() {
-        if (res.headersSent === true) {
-          throw new Error(`iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()`);
+    const sealFromCookies = import_cookie.default.parse(
+      "credentials" in req ? req.headers.get("cookie") || "" : req.headers.cookie || ""
+    )[options.cookieName];
+    const session = sealFromCookies === void 0 ? {} : await unsealData2(sealFromCookies, {
+      password: passwordsAsMap,
+      ttl: options.ttl
+    });
+    Object.defineProperties(session, {
+      save: {
+        value: async function save() {
+          if ("headersSent" in res && res.headersSent === true) {
+            throw new Error(
+              `iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()`
+            );
+          }
+          const seal2 = await sealData2(session, {
+            password: passwordsAsMap,
+            ttl: options.ttl
+          });
+          const cookieValue = import_cookie.default.serialize(
+            options.cookieName,
+            seal2,
+            options.cookieOptions
+          );
+          if (cookieValue.length > 4096) {
+            throw new Error(
+              `iron-session: Cookie length is too big ${cookieValue.length}, browsers will refuse it. Try to remove some data.`
+            );
+          }
+          addToCookies(cookieValue, res);
         }
-        const seal = await sealData(session, {
-          password: passwordsAsMap,
-          ttl: options.ttl
-        });
-        const cookieValue = import_cookie.default.serialize(options.cookieName, seal, options.cookieOptions);
-        if (cookieValue.length > 4096) {
-          throw new Error(`iron-session: Cookie length is too big ${cookieValue.length}, browsers will refuse it. Try to remove some data.`);
+      },
+      destroy: {
+        value: function destroy() {
+          Object.keys(session).forEach((key) => {
+            delete session[key];
+          });
+          const cookieValue = import_cookie.default.serialize(options.cookieName, "", {
+            ...options.cookieOptions,
+            maxAge: 0
+          });
+          addToCookies(cookieValue, res);
         }
-        addToCookies(cookieValue, res);
       }
-    },
-    destroy: {
-      value: function destroy() {
-        Object.keys(session).forEach((key) => {
-          delete session[key];
-        });
-        const cookieValue = import_cookie.default.serialize(options.cookieName, "", {
-          ...options.cookieOptions,
-          maxAge: 0
-        });
-        addToCookies(cookieValue, res);
-      }
-    }
-  });
-  return session;
+    });
+    return session;
+  };
 }
 function addToCookies(cookieValue, res) {
   var _a;
+  if ("headers" in res) {
+    res.headers.append("set-cookie", cookieValue);
+    return;
+  }
   let existingSetCookie = (_a = res.getHeader("set-cookie")) != null ? _a : [];
   if (typeof existingSetCookie === "string") {
     existingSetCookie = [existingSetCookie];
@@ -121,65 +155,87 @@ function addToCookies(cookieValue, res) {
 function computeCookieMaxAge(ttl) {
   return ttl - timestampSkewSec;
 }
-async function unsealData(seal, {
-  password,
-  ttl = fourteenDaysInSeconds
-}) {
-  const passwordsAsMap = normalizeStringPasswordToMap(password);
-  const { sealWithoutVersion, tokenVersion } = parseSeal(seal);
-  try {
-    const data = await import_iron.default.unseal(sealWithoutVersion, passwordsAsMap, {
-      ...import_iron.default.defaults,
-      ttl: ttl * 1e3
-    });
-    if (tokenVersion === 2) {
-      return data;
-    }
-    return {
-      ...data.persistent
-    };
-  } catch (error) {
-    if (error instanceof Error) {
-      if (error.message === "Expired seal" || error.message === "Bad hmac value" || error.message === "Cannot find password: " || error.message === "Incorrect number of sealed components") {
-        return {};
+function createUnsealData(_crypto2) {
+  return async (seal2, {
+    password,
+    ttl = fourteenDaysInSeconds
+  }) => {
+    const passwordsAsMap = normalizeStringPasswordToMap(password);
+    const { sealWithoutVersion, tokenVersion } = parseSeal(seal2);
+    try {
+      const data = await Iron.unseal(
+        _crypto2,
+        sealWithoutVersion,
+        passwordsAsMap,
+        { ...Iron.defaults, ttl: ttl * 1e3 }
+      );
+      if (tokenVersion === 2) {
+        return data;
+      }
+      return {
+        ...data.persistent
+      };
+    } catch (error) {
+      if (error instanceof Error) {
+        if (error.message === "Expired seal" || error.message === "Bad hmac value" || error.message === "Cannot find password: " || error.message === "Incorrect number of sealed components") {
+          return {};
+        }
       }
+      throw error;
     }
-    throw error;
-  }
+  };
 }
-function parseSeal(seal) {
-  if (seal[seal.length - 2] === versionDelimiter) {
-    const [sealWithoutVersion, tokenVersionAsString] = seal.split(versionDelimiter);
+function parseSeal(seal2) {
+  if (seal2[seal2.length - 2] === versionDelimiter) {
+    const [sealWithoutVersion, tokenVersionAsString] = seal2.split(versionDelimiter);
     return {
       sealWithoutVersion,
       tokenVersion: parseInt(tokenVersionAsString, 10)
     };
   }
-  return { sealWithoutVersion: seal, tokenVersion: null };
+  return { sealWithoutVersion: seal2, tokenVersion: null };
 }
-async function sealData(data, {
-  password,
-  ttl = fourteenDaysInSeconds
-}) {
-  const passwordsAsMap = normalizeStringPasswordToMap(password);
-  const mostRecentPasswordId = Math.max(...Object.keys(passwordsAsMap).map((id) => parseInt(id, 10)));
-  const passwordForSeal = {
-    id: mostRecentPasswordId.toString(),
-    secret: passwordsAsMap[mostRecentPasswordId]
+function createSealData(_crypto2) {
+  return async (data, {
+    password,
+    ttl = fourteenDaysInSeconds
+  }) => {
+    const passwordsAsMap = normalizeStringPasswordToMap(password);
+    const mostRecentPasswordId = Math.max(
+      ...Object.keys(passwordsAsMap).map((id) => parseInt(id, 10))
+    );
+    const passwordForSeal = {
+      id: mostRecentPasswordId.toString(),
+      secret: passwordsAsMap[mostRecentPasswordId]
+    };
+    const seal2 = await Iron.seal(_crypto2, data, passwordForSeal, {
+      ...Iron.defaults,
+      ttl: ttl * 1e3
+    });
+    return `${seal2}${versionDelimiter}${currentMajorVersion}`;
   };
-  const seal = await import_iron.default.seal(data, passwordForSeal, {
-    ...import_iron.default.defaults,
-    ttl: ttl * 1e3
-  });
-  return `${seal}${versionDelimiter}${currentMajorVersion}`;
 }
 function normalizeStringPasswordToMap(password) {
   return typeof password === "string" ? { 1: password } : password;
 }
+
+// src/index.ts
+var import_webcrypto = require("@peculiar/webcrypto");
+var _crypto = new import_webcrypto.Crypto();
+var unsealData = createUnsealData(_crypto);
+var sealData = createSealData(_crypto);
+var getIronSession = createGetIronSession(
+  _crypto,
+  unsealData,
+  sealData
+);
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  createGetIronSession,
+  createSealData,
+  createUnsealData,
   getIronSession,
   sealData,
   unsealData
 });
-//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1,7 +1 @@
-{
-  "version": 3,
-  "sources": ["../src/index.ts"],
-  "sourcesContent": ["import Iron from \"@hapi/iron\";\nimport type { CookieSerializeOptions } from \"cookie\";\nimport cookie from \"cookie\";\nimport type { IncomingMessage, ServerResponse } from \"http\";\n\n// default time allowed to check for iron seal validity when ttl passed\n// see https://hapi.dev/family/iron/api/?v=6.0.0#options\nconst timestampSkewSec = 60;\n\ntype passwordsMap = { [id: string]: string };\ntype password = string | passwordsMap;\n\nconst fourteenDaysInSeconds = 15 * 24 * 3600;\n\n// We store a token major version to handle data format changes when any. So that when you upgrade the cookies\n// can be kept alive between upgrades, no need to disconnect everyone.\nconst currentMajorVersion = 2;\nconst versionDelimiter = \"~\";\n\nconst defaultOptions: {\n  ttl: number;\n  cookieOptions: CookieSerializeOptions;\n} = {\n  ttl: fourteenDaysInSeconds,\n  cookieOptions: {\n    httpOnly: true,\n    secure: true,\n    sameSite: \"lax\",\n    path: \"/\",\n  },\n};\n\nexport interface IronSessionOptions {\n  /**\n   * This is the cookie name that will be used inside the browser. You should make sure it's unique given\n   * your application. Example: vercel-session\n   */\n  cookieName: string;\n\n  /**\n   * This is the password(s) that will be used to encrypt the cookie. It can be either a string or an object\n   * like {1: \"password\", 2: password}.\n   *\n   * When you provide multiple passwords then all of them will be used to decrypt the cookie and only the most\n   * recent (= highest key, 2 in this example) password will be used to encrypt the cookie. This allow you\n   * to use password rotation (security)\n   */\n  password: password;\n\n  /**\n   * This is the time in seconds that the session will be valid for. This also set the max-age attribute of\n   * the cookie automatically (minus 60 seconds so that the cookie always expire before the session).\n   */\n  ttl?: number;\n\n  /**\n   * This is the options that will be passed to the cookie library.\n   * You can see all of them here: https://github.com/jshttp/cookie#options-1.\n   *\n   * If you want to use \"session cookies\" (cookies that are deleted when the browser is closed) then you need\n   * to pass cookieOptions: { maxAge: undefined }.\n   */\n  cookieOptions?: CookieSerializeOptions;\n}\n\n// eslint-disable-next-line @typescript-eslint/no-empty-interface\nexport interface IronSessionData {\n  // If we allow for any keys, then there's no more type check on unknown properties\n  // which is not good\n  // If we allow for any keys, the later delete will work but I prefer to disable the\n  // check at this stage and\n  // provide good type checking instead\n  // [key: string]: unknown;\n}\n\nexport type IronSession = IronSessionData & {\n  /**\n   * Destroys the session data and removes the cookie.\n   */\n  destroy: () => void;\n\n  /**\n   * Encrypts the session data and sets the cookie.\n   */\n  save: () => Promise<void>;\n};\n\ndeclare module \"http\" {\n  interface IncomingMessage {\n    session: IronSession;\n  }\n}\n\nexport async function getIronSession(\n  req: IncomingMessage,\n  res: ServerResponse,\n  userSessionOptions: IronSessionOptions,\n): Promise<IronSession> {\n  if (\n    !req ||\n    !res ||\n    !userSessionOptions ||\n    !userSessionOptions.cookieName ||\n    !userSessionOptions.password\n  ) {\n    throw new Error(\n      `iron-session: Bad usage. Minimum usage is const session = await getIronSession(req, res, { cookieName: \"...\", password: \"...\". Check the usage here: https://github.com/vvo/iron-session`,\n    );\n  }\n\n  const passwordsAsMap = normalizeStringPasswordToMap(\n    userSessionOptions.password,\n  );\n\n  Object.values(\n    normalizeStringPasswordToMap(userSessionOptions.password),\n  ).forEach((password) => {\n    if (password.length < 32) {\n      throw new Error(\n        `iron-session: Bad usage. Password must be at least 32 characters long.`,\n      );\n    }\n  });\n\n  const options: Required<IronSessionOptions> = {\n    ...defaultOptions,\n    ...userSessionOptions,\n    cookieOptions: {\n      ...defaultOptions.cookieOptions,\n      ...(userSessionOptions.cookieOptions || {}),\n    },\n  };\n\n  if (options.ttl === 0) {\n    // ttl = 0 means no expiration\n    // but in reality cookies have to expire (can't have no max-age)\n    // 2147483647 is the max value for max-age in cookies\n    // see https://stackoverflow.com/a/11685301/147079\n    options.ttl = 2147483647;\n  }\n\n  if (\n    userSessionOptions.cookieOptions &&\n    \"maxAge\" in userSessionOptions.cookieOptions\n  ) {\n    // session cookie, do not set maxAge, consider token as infinite\n    if (userSessionOptions.cookieOptions.maxAge === undefined) {\n      options.ttl = 0;\n    } else {\n      options.cookieOptions.maxAge = computeCookieMaxAge(\n        userSessionOptions.cookieOptions.maxAge,\n      );\n    }\n  } else {\n    options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);\n  }\n\n  const sealFromCookies = cookie.parse(req.headers.cookie || \"\")[\n    options.cookieName\n  ];\n\n  const session =\n    sealFromCookies === undefined\n      ? {}\n      : await unsealData<IronSessionData>(sealFromCookies, {\n          password: passwordsAsMap,\n          ttl: options.ttl,\n        });\n\n  Object.defineProperties(session, {\n    save: {\n      value: async function save() {\n        if (res.headersSent === true) {\n          throw new Error(\n            `iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()`,\n          );\n        }\n        const seal = await sealData(session, {\n          password: passwordsAsMap,\n          ttl: options.ttl,\n        });\n        const cookieValue = cookie.serialize(\n          options.cookieName,\n          seal,\n          options.cookieOptions,\n        );\n\n        if (cookieValue.length > 4096) {\n          throw new Error(\n            `iron-session: Cookie length is too big ${cookieValue.length}, browsers will refuse it. Try to remove some data.`,\n          );\n        }\n\n        addToCookies(cookieValue, res);\n      },\n    },\n    destroy: {\n      value: function destroy() {\n        Object.keys(session).forEach((key) => {\n          // @ts-ignore See comment on the IronSessionData interface\n          delete session[key];\n        });\n\n        const cookieValue = cookie.serialize(options.cookieName, \"\", {\n          ...options.cookieOptions,\n          maxAge: 0,\n        });\n        addToCookies(cookieValue, res);\n      },\n    },\n  });\n\n  return session as IronSession;\n}\n\nfunction addToCookies(cookieValue: string, res: ServerResponse) {\n  let existingSetCookie =\n    (res.getHeader(\"set-cookie\") as string[] | string) ?? [];\n  if (typeof existingSetCookie === \"string\") {\n    existingSetCookie = [existingSetCookie];\n  }\n  res.setHeader(\"set-cookie\", [...existingSetCookie, cookieValue]);\n}\n\nfunction computeCookieMaxAge(ttl: number) {\n  // The next line makes sure browser will expire cookies before seals are considered expired by the server.\n  // It also allows for clock difference of 60 seconds maximum between server and clients.\n  // It also makes sure to expire the cookie immediately when value is 0\n  return ttl - timestampSkewSec;\n}\n\nexport async function unsealData<T = Record<string, unknown>>(\n  seal: string,\n  {\n    password,\n    ttl = fourteenDaysInSeconds,\n  }: { password: password; ttl?: number },\n): Promise<T> {\n  const passwordsAsMap = normalizeStringPasswordToMap(password);\n  const { sealWithoutVersion, tokenVersion } = parseSeal(seal);\n\n  try {\n    const data = await Iron.unseal(sealWithoutVersion, passwordsAsMap, {\n      ...Iron.defaults,\n      ttl: ttl * 1000,\n    });\n\n    if (tokenVersion === 2) {\n      return data;\n    }\n\n    return {\n      ...data.persistent,\n    };\n  } catch (error) {\n    if (error instanceof Error) {\n      if (\n        error.message === \"Expired seal\" ||\n        error.message === \"Bad hmac value\" ||\n        error.message === \"Cannot find password: \" ||\n        error.message === \"Incorrect number of sealed components\"\n      ) {\n        // if seal expired or\n        // if seal is not valid (encrypted using a different password, when passwords are badly rotated) or\n        // if we can't find back the password in the seal\n        // then we just start a new session over\n        return {} as T;\n      }\n    }\n\n    throw error;\n  }\n}\n\nfunction parseSeal(seal: string): {\n  sealWithoutVersion: string;\n  tokenVersion: number | null;\n} {\n  if (seal[seal.length - 2] === versionDelimiter) {\n    const [sealWithoutVersion, tokenVersionAsString] =\n      seal.split(versionDelimiter);\n    return {\n      sealWithoutVersion,\n      tokenVersion: parseInt(tokenVersionAsString, 10),\n    };\n  }\n\n  return { sealWithoutVersion: seal, tokenVersion: null };\n}\n\nexport async function sealData(\n  data: unknown,\n  {\n    password,\n    ttl = fourteenDaysInSeconds,\n  }: { password: password; ttl?: number },\n) {\n  const passwordsAsMap = normalizeStringPasswordToMap(password);\n\n  const mostRecentPasswordId = Math.max(\n    ...Object.keys(passwordsAsMap).map((id) => parseInt(id, 10)),\n  );\n\n  const passwordForSeal = {\n    id: mostRecentPasswordId.toString(),\n    secret: passwordsAsMap[mostRecentPasswordId],\n  };\n\n  const seal = await Iron.seal(data, passwordForSeal, {\n    ...Iron.defaults,\n    ttl: ttl * 1000,\n  });\n\n  return `${seal}${versionDelimiter}${currentMajorVersion}`;\n}\n\nfunction normalizeStringPasswordToMap(password: password) {\n  return typeof password === \"string\" ? { 1: password } : password;\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kBAAiB;AAEjB,oBAAmB;AAKnB,IAAM,mBAAmB;AAKzB,IAAM,wBAAwB,KAAK,KAAK;AAIxC,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AAEzB,IAAM,iBAGF;AAAA,EACF,KAAK;AAAA,EACL,eAAe;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA;AAAA;AAiEV,8BACE,KACA,KACA,oBACsB;AACtB,MACE,CAAC,OACD,CAAC,OACD,CAAC,sBACD,CAAC,mBAAmB,cACpB,CAAC,mBAAmB,UACpB;AACA,UAAM,IAAI,MACR;AAAA;AAIJ,QAAM,iBAAiB,6BACrB,mBAAmB;AAGrB,SAAO,OACL,6BAA6B,mBAAmB,WAChD,QAAQ,CAAC,aAAa;AACtB,QAAI,SAAS,SAAS,IAAI;AACxB,YAAM,IAAI,MACR;AAAA;AAAA;AAKN,QAAM,UAAwC;AAAA,OACzC;AAAA,OACA;AAAA,IACH,eAAe;AAAA,SACV,eAAe;AAAA,SACd,mBAAmB,iBAAiB;AAAA;AAAA;AAI5C,MAAI,QAAQ,QAAQ,GAAG;AAKrB,YAAQ,MAAM;AAAA;AAGhB,MACE,mBAAmB,iBACnB,YAAY,mBAAmB,eAC/B;AAEA,QAAI,mBAAmB,cAAc,WAAW,QAAW;AACzD,cAAQ,MAAM;AAAA,WACT;AACL,cAAQ,cAAc,SAAS,oBAC7B,mBAAmB,cAAc;AAAA;AAAA,SAGhC;AACL,YAAQ,cAAc,SAAS,oBAAoB,QAAQ;AAAA;AAG7D,QAAM,kBAAkB,sBAAO,MAAM,IAAI,QAAQ,UAAU,IACzD,QAAQ;AAGV,QAAM,UACJ,oBAAoB,SAChB,KACA,MAAM,WAA4B,iBAAiB;AAAA,IACjD,UAAU;AAAA,IACV,KAAK,QAAQ;AAAA;AAGrB,SAAO,iBAAiB,SAAS;AAAA,IAC/B,MAAM;AAAA,MACJ,OAAO,sBAAsB;AAC3B,YAAI,IAAI,gBAAgB,MAAM;AAC5B,gBAAM,IAAI,MACR;AAAA;AAGJ,cAAM,OAAO,MAAM,SAAS,SAAS;AAAA,UACnC,UAAU;AAAA,UACV,KAAK,QAAQ;AAAA;AAEf,cAAM,cAAc,sBAAO,UACzB,QAAQ,YACR,MACA,QAAQ;AAGV,YAAI,YAAY,SAAS,MAAM;AAC7B,gBAAM,IAAI,MACR,0CAA0C,YAAY;AAAA;AAI1D,qBAAa,aAAa;AAAA;AAAA;AAAA,IAG9B,SAAS;AAAA,MACP,OAAO,mBAAmB;AACxB,eAAO,KAAK,SAAS,QAAQ,CAAC,QAAQ;AAEpC,iBAAO,QAAQ;AAAA;AAGjB,cAAM,cAAc,sBAAO,UAAU,QAAQ,YAAY,IAAI;AAAA,aACxD,QAAQ;AAAA,UACX,QAAQ;AAAA;AAEV,qBAAa,aAAa;AAAA;AAAA;AAAA;AAKhC,SAAO;AAAA;AAGT,sBAAsB,aAAqB,KAAqB;AAvNhE;AAwNE,MAAI,oBACD,UAAI,UAAU,kBAAd,YAAqD;AACxD,MAAI,OAAO,sBAAsB,UAAU;AACzC,wBAAoB,CAAC;AAAA;AAEvB,MAAI,UAAU,cAAc,CAAC,GAAG,mBAAmB;AAAA;AAGrD,6BAA6B,KAAa;AAIxC,SAAO,MAAM;AAAA;AAGf,0BACE,MACA;AAAA,EACE;AAAA,EACA,MAAM;AAAA,GAEI;AACZ,QAAM,iBAAiB,6BAA6B;AACpD,QAAM,EAAE,oBAAoB,iBAAiB,UAAU;AAEvD,MAAI;AACF,UAAM,OAAO,MAAM,oBAAK,OAAO,oBAAoB,gBAAgB;AAAA,SAC9D,oBAAK;AAAA,MACR,KAAK,MAAM;AAAA;AAGb,QAAI,iBAAiB,GAAG;AACtB,aAAO;AAAA;AAGT,WAAO;AAAA,SACF,KAAK;AAAA;AAAA,WAEH,OAAP;AACA,QAAI,iBAAiB,OAAO;AAC1B,UACE,MAAM,YAAY,kBAClB,MAAM,YAAY,oBAClB,MAAM,YAAY,4BAClB,MAAM,YAAY,yCAClB;AAKA,eAAO;AAAA;AAAA;AAIX,UAAM;AAAA;AAAA;AAIV,mBAAmB,MAGjB;AACA,MAAI,KAAK,KAAK,SAAS,OAAO,kBAAkB;AAC9C,UAAM,CAAC,oBAAoB,wBACzB,KAAK,MAAM;AACb,WAAO;AAAA,MACL;AAAA,MACA,cAAc,SAAS,sBAAsB;AAAA;AAAA;AAIjD,SAAO,EAAE,oBAAoB,MAAM,cAAc;AAAA;AAGnD,wBACE,MACA;AAAA,EACE;AAAA,EACA,MAAM;AAAA,GAER;AACA,QAAM,iBAAiB,6BAA6B;AAEpD,QAAM,uBAAuB,KAAK,IAChC,GAAG,OAAO,KAAK,gBAAgB,IAAI,CAAC,OAAO,SAAS,IAAI;AAG1D,QAAM,kBAAkB;AAAA,IACtB,IAAI,qBAAqB;AAAA,IACzB,QAAQ,eAAe;AAAA;AAGzB,QAAM,OAAO,MAAM,oBAAK,KAAK,MAAM,iBAAiB;AAAA,OAC/C,oBAAK;AAAA,IACR,KAAK,MAAM;AAAA;AAGb,SAAO,GAAG,OAAO,mBAAmB;AAAA;AAGtC,sCAAsC,UAAoB;AACxD,SAAO,OAAO,aAAa,WAAW,EAAE,GAAG,aAAa;AAAA;",
-  "names": []
-}
+{"version":3,"sources":["../src/index.ts","../src/core.ts"],"sourcesContent":["import { createGetIronSession, createSealData, createUnsealData } from \"./core\";\nimport { Crypto } from \"@peculiar/webcrypto\";\n\nconst _crypto = new Crypto();\n\nexport * from \"./core\";\nexport const unsealData = createUnsealData(_crypto);\nexport const sealData = createSealData(_crypto);\nexport const getIronSession = createGetIronSession(\n  _crypto,\n  unsealData,\n  sealData,\n);\n","import * as Iron from \"iron-webcrypto\";\nimport type { CookieSerializeOptions } from \"cookie\";\nimport cookie from \"cookie\";\nimport type { IncomingMessage, ServerResponse } from \"http\";\n\n// default time allowed to check for iron seal validity when ttl passed\n// see https://hapi.dev/family/iron/api/?v=6.0.0#options\nconst timestampSkewSec = 60;\n\ntype passwordsMap = { [id: string]: string };\ntype password = string | passwordsMap;\n\nconst fourteenDaysInSeconds = 15 * 24 * 3600;\n\n// We store a token major version to handle data format changes when any. So that when you upgrade the cookies\n// can be kept alive between upgrades, no need to disconnect everyone.\nconst currentMajorVersion = 2;\nconst versionDelimiter = \"~\";\n\nconst defaultOptions: {\n  ttl: number;\n  cookieOptions: CookieSerializeOptions;\n} = {\n  ttl: fourteenDaysInSeconds,\n  cookieOptions: {\n    httpOnly: true,\n    secure: true,\n    sameSite: \"lax\",\n    path: \"/\",\n  },\n};\n\nexport interface IronSessionOptions {\n  /**\n   * This is the cookie name that will be used inside the browser. You should make sure it's unique given\n   * your application. Example: vercel-session\n   */\n  cookieName: string;\n\n  /**\n   * This is the password(s) that will be used to encrypt the cookie. It can be either a string or an object\n   * like {1: \"password\", 2: password}.\n   *\n   * When you provide multiple passwords then all of them will be used to decrypt the cookie and only the most\n   * recent (= highest key, 2 in this example) password will be used to encrypt the cookie. This allow you\n   * to use password rotation (security)\n   */\n  password: password;\n\n  /**\n   * This is the time in seconds that the session will be valid for. This also set the max-age attribute of\n   * the cookie automatically (minus 60 seconds so that the cookie always expire before the session).\n   */\n  ttl?: number;\n\n  /**\n   * This is the options that will be passed to the cookie library.\n   * You can see all of them here: https://github.com/jshttp/cookie#options-1.\n   *\n   * If you want to use \"session cookies\" (cookies that are deleted when the browser is closed) then you need\n   * to pass cookieOptions: { maxAge: undefined }.\n   */\n  cookieOptions?: CookieSerializeOptions;\n}\n\n// eslint-disable-next-line @typescript-eslint/no-empty-interface\nexport interface IronSessionData {\n  // If we allow for any keys, then there's no more type check on unknown properties\n  // which is not good\n  // If we allow for any keys, the later delete will work but I prefer to disable the\n  // check at this stage and\n  // provide good type checking instead\n  // [key: string]: unknown;\n}\n\nexport type IronSession = IronSessionData & {\n  /**\n   * Destroys the session data and removes the cookie.\n   */\n  destroy: () => void;\n\n  /**\n   * Encrypts the session data and sets the cookie.\n   */\n  save: () => Promise<void>;\n};\n\ndeclare module \"http\" {\n  interface IncomingMessage {\n    session: IronSession;\n  }\n}\n\ntype RequestType = IncomingMessage | Request;\ntype ResponseType = ServerResponse | Response;\n\nexport function createGetIronSession(\n  _crypto: Crypto,\n  unsealData: ReturnType<typeof createUnsealData>,\n  sealData: ReturnType<typeof createSealData>,\n) {\n  return async (\n    req: RequestType,\n    res: ResponseType,\n    userSessionOptions: IronSessionOptions,\n  ): Promise<IronSession> => {\n    if (\n      !req ||\n      !res ||\n      !userSessionOptions ||\n      !userSessionOptions.cookieName ||\n      !userSessionOptions.password\n    ) {\n      throw new Error(\n        `iron-session: Bad usage. Minimum usage is const session = await getIronSession(req, res, { cookieName: \"...\", password: \"...\". Check the usage here: https://github.com/vvo/iron-session`,\n      );\n    }\n\n    const passwordsAsMap = normalizeStringPasswordToMap(\n      userSessionOptions.password,\n    );\n\n    Object.values(\n      normalizeStringPasswordToMap(userSessionOptions.password),\n    ).forEach((password) => {\n      if (password.length < 32) {\n        throw new Error(\n          `iron-session: Bad usage. Password must be at least 32 characters long.`,\n        );\n      }\n    });\n\n    const options: Required<IronSessionOptions> = {\n      ...defaultOptions,\n      ...userSessionOptions,\n      cookieOptions: {\n        ...defaultOptions.cookieOptions,\n        ...(userSessionOptions.cookieOptions || {}),\n      },\n    };\n\n    if (options.ttl === 0) {\n      // ttl = 0 means no expiration\n      // but in reality cookies have to expire (can't have no max-age)\n      // 2147483647 is the max value for max-age in cookies\n      // see https://stackoverflow.com/a/11685301/147079\n      options.ttl = 2147483647;\n    }\n\n    if (\n      userSessionOptions.cookieOptions &&\n      \"maxAge\" in userSessionOptions.cookieOptions\n    ) {\n      // session cookie, do not set maxAge, consider token as infinite\n      if (userSessionOptions.cookieOptions.maxAge === undefined) {\n        options.ttl = 0;\n      } else {\n        options.cookieOptions.maxAge = computeCookieMaxAge(\n          userSessionOptions.cookieOptions.maxAge,\n        );\n      }\n    } else {\n      options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);\n    }\n\n    const sealFromCookies = cookie.parse(\n      \"credentials\" in req\n        ? req.headers.get(\"cookie\") || \"\"\n        : req.headers.cookie || \"\",\n    )[options.cookieName];\n\n    const session =\n      sealFromCookies === undefined\n        ? {}\n        : await unsealData<IronSessionData>(sealFromCookies, {\n            password: passwordsAsMap,\n            ttl: options.ttl,\n          });\n\n    Object.defineProperties(session, {\n      save: {\n        value: async function save() {\n          if (\"headersSent\" in res && res.headersSent === true) {\n            throw new Error(\n              `iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()`,\n            );\n          }\n          const seal = await sealData(session, {\n            password: passwordsAsMap,\n            ttl: options.ttl,\n          });\n          const cookieValue = cookie.serialize(\n            options.cookieName,\n            seal,\n            options.cookieOptions,\n          );\n\n          if (cookieValue.length > 4096) {\n            throw new Error(\n              `iron-session: Cookie length is too big ${cookieValue.length}, browsers will refuse it. Try to remove some data.`,\n            );\n          }\n\n          addToCookies(cookieValue, res);\n        },\n      },\n      destroy: {\n        value: function destroy() {\n          Object.keys(session).forEach((key) => {\n            // @ts-ignore See comment on the IronSessionData interface\n            delete session[key];\n          });\n\n          const cookieValue = cookie.serialize(options.cookieName, \"\", {\n            ...options.cookieOptions,\n            maxAge: 0,\n          });\n          addToCookies(cookieValue, res);\n        },\n      },\n    });\n\n    return session as IronSession;\n  };\n}\n\nfunction addToCookies(cookieValue: string, res: ResponseType) {\n  if (\"headers\" in res) {\n    res.headers.append(\"set-cookie\", cookieValue);\n    return;\n  }\n\n  let existingSetCookie =\n    (res.getHeader(\"set-cookie\") as string[] | string) ?? [];\n  if (typeof existingSetCookie === \"string\") {\n    existingSetCookie = [existingSetCookie];\n  }\n  res.setHeader(\"set-cookie\", [...existingSetCookie, cookieValue]);\n}\n\nfunction computeCookieMaxAge(ttl: number) {\n  // The next line makes sure browser will expire cookies before seals are considered expired by the server.\n  // It also allows for clock difference of 60 seconds maximum between server and clients.\n  // It also makes sure to expire the cookie immediately when value is 0\n  return ttl - timestampSkewSec;\n}\n\nexport function createUnsealData(_crypto: Crypto) {\n  return async <T = Record<string, unknown>>(\n    seal: string,\n    {\n      password,\n      ttl = fourteenDaysInSeconds,\n    }: { password: password; ttl?: number },\n  ): Promise<T> => {\n    const passwordsAsMap = normalizeStringPasswordToMap(password);\n    const { sealWithoutVersion, tokenVersion } = parseSeal(seal);\n\n    try {\n      const data = await Iron.unseal(\n        _crypto,\n        sealWithoutVersion,\n        passwordsAsMap,\n        { ...Iron.defaults, ttl: ttl * 1000 },\n      );\n\n      if (tokenVersion === 2) {\n        return data as T;\n      }\n\n      return {\n        // @ts-expect-error `persistent` does not exist on newer tokens\n        ...data.persistent,\n      };\n    } catch (error) {\n      if (error instanceof Error) {\n        if (\n          error.message === \"Expired seal\" ||\n          error.message === \"Bad hmac value\" ||\n          error.message === \"Cannot find password: \" ||\n          error.message === \"Incorrect number of sealed components\"\n        ) {\n          // if seal expired or\n          // if seal is not valid (encrypted using a different password, when passwords are badly rotated) or\n          // if we can't find back the password in the seal\n          // then we just start a new session over\n          return {} as T;\n        }\n      }\n\n      throw error;\n    }\n  };\n}\n\nfunction parseSeal(seal: string): {\n  sealWithoutVersion: string;\n  tokenVersion: number | null;\n} {\n  if (seal[seal.length - 2] === versionDelimiter) {\n    const [sealWithoutVersion, tokenVersionAsString] =\n      seal.split(versionDelimiter);\n    return {\n      sealWithoutVersion,\n      tokenVersion: parseInt(tokenVersionAsString, 10),\n    };\n  }\n\n  return { sealWithoutVersion: seal, tokenVersion: null };\n}\n\nexport function createSealData(_crypto: Crypto) {\n  return async (\n    data: unknown,\n    {\n      password,\n      ttl = fourteenDaysInSeconds,\n    }: { password: password; ttl?: number },\n  ) => {\n    const passwordsAsMap = normalizeStringPasswordToMap(password);\n\n    const mostRecentPasswordId = Math.max(\n      ...Object.keys(passwordsAsMap).map((id) => parseInt(id, 10)),\n    );\n\n    const passwordForSeal = {\n      id: mostRecentPasswordId.toString(),\n      secret: passwordsAsMap[mostRecentPasswordId],\n    };\n\n    const seal = await Iron.seal(_crypto, data, passwordForSeal, {\n      ...Iron.defaults,\n      ttl: ttl * 1000,\n    });\n\n    return `${seal}${versionDelimiter}${currentMajorVersion}`;\n  };\n}\n\nfunction normalizeStringPasswordToMap(password: password) {\n  return typeof password === \"string\" ? { 1: password } : password;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,WAAsB;AAEtB,oBAAmB;AAKnB,IAAM,mBAAmB;AAKzB,IAAM,wBAAwB,KAAK,KAAK;AAIxC,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AAEzB,IAAM,iBAGF;AAAA,EACF,KAAK;AAAA,EACL,eAAe;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,EACR;AACF;AAkEO,SAAS,qBACdA,UACAC,aACAC,WACA;AACA,SAAO,OACL,KACA,KACA,uBACyB;AACzB,QACE,CAAC,OACD,CAAC,OACD,CAAC,sBACD,CAAC,mBAAmB,cACpB,CAAC,mBAAmB,UACpB;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,iBAAiB;AAAA,MACrB,mBAAmB;AAAA,IACrB;AAEA,WAAO;AAAA,MACL,6BAA6B,mBAAmB,QAAQ;AAAA,IAC1D,EAAE,QAAQ,CAAC,aAAa;AACtB,UAAI,SAAS,SAAS,IAAI;AACxB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAED,UAAM,UAAwC;AAAA,MAC5C,GAAG;AAAA,MACH,GAAG;AAAA,MACH,eAAe;AAAA,QACb,GAAG,eAAe;AAAA,QAClB,GAAI,mBAAmB,iBAAiB,CAAC;AAAA,MAC3C;AAAA,IACF;AAEA,QAAI,QAAQ,QAAQ,GAAG;AAKrB,cAAQ,MAAM;AAAA,IAChB;AAEA,QACE,mBAAmB,iBACnB,YAAY,mBAAmB,eAC/B;AAEA,UAAI,mBAAmB,cAAc,WAAW,QAAW;AACzD,gBAAQ,MAAM;AAAA,MAChB,OAAO;AACL,gBAAQ,cAAc,SAAS;AAAA,UAC7B,mBAAmB,cAAc;AAAA,QACnC;AAAA,MACF;AAAA,IACF,OAAO;AACL,cAAQ,cAAc,SAAS,oBAAoB,QAAQ,GAAG;AAAA,IAChE;AAEA,UAAM,kBAAkB,cAAAC,QAAO;AAAA,MAC7B,iBAAiB,MACb,IAAI,QAAQ,IAAI,QAAQ,KAAK,KAC7B,IAAI,QAAQ,UAAU;AAAA,IAC5B,EAAE,QAAQ;AAEV,UAAM,UACJ,oBAAoB,SAChB,CAAC,IACD,MAAMF,YAA4B,iBAAiB;AAAA,MACjD,UAAU;AAAA,MACV,KAAK,QAAQ;AAAA,IACf,CAAC;AAEP,WAAO,iBAAiB,SAAS;AAAA,MAC/B,MAAM;AAAA,QACJ,OAAO,eAAe,OAAO;AAC3B,cAAI,iBAAiB,OAAO,IAAI,gBAAgB,MAAM;AACpD,kBAAM,IAAI;AAAA,cACR;AAAA,YACF;AAAA,UACF;AACA,gBAAMG,QAAO,MAAMF,UAAS,SAAS;AAAA,YACnC,UAAU;AAAA,YACV,KAAK,QAAQ;AAAA,UACf,CAAC;AACD,gBAAM,cAAc,cAAAC,QAAO;AAAA,YACzB,QAAQ;AAAA,YACRC;AAAA,YACA,QAAQ;AAAA,UACV;AAEA,cAAI,YAAY,SAAS,MAAM;AAC7B,kBAAM,IAAI;AAAA,cACR,0CAA0C,YAAY;AAAA,YACxD;AAAA,UACF;AAEA,uBAAa,aAAa,GAAG;AAAA,QAC/B;AAAA,MACF;AAAA,MACA,SAAS;AAAA,QACP,OAAO,SAAS,UAAU;AACxB,iBAAO,KAAK,OAAO,EAAE,QAAQ,CAAC,QAAQ;AAEpC,mBAAO,QAAQ;AAAA,UACjB,CAAC;AAED,gBAAM,cAAc,cAAAD,QAAO,UAAU,QAAQ,YAAY,IAAI;AAAA,YAC3D,GAAG,QAAQ;AAAA,YACX,QAAQ;AAAA,UACV,CAAC;AACD,uBAAa,aAAa,GAAG;AAAA,QAC/B;AAAA,MACF;AAAA,IACF,CAAC;AAED,WAAO;AAAA,EACT;AACF;AAEA,SAAS,aAAa,aAAqB,KAAmB;AAlO9D;AAmOE,MAAI,aAAa,KAAK;AACpB,QAAI,QAAQ,OAAO,cAAc,WAAW;AAC5C;AAAA,EACF;AAEA,MAAI,qBACD,SAAI,UAAU,YAAY,MAA1B,YAAqD,CAAC;AACzD,MAAI,OAAO,sBAAsB,UAAU;AACzC,wBAAoB,CAAC,iBAAiB;AAAA,EACxC;AACA,MAAI,UAAU,cAAc,CAAC,GAAG,mBAAmB,WAAW,CAAC;AACjE;AAEA,SAAS,oBAAoB,KAAa;AAIxC,SAAO,MAAM;AACf;AAEO,SAAS,iBAAiBH,UAAiB;AAChD,SAAO,OACLI,OACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,MACe;AACf,UAAM,iBAAiB,6BAA6B,QAAQ;AAC5D,UAAM,EAAE,oBAAoB,aAAa,IAAI,UAAUA,KAAI;AAE3D,QAAI;AACF,YAAM,OAAO,MAAW;AAAA,QACtBJ;AAAA,QACA;AAAA,QACA;AAAA,QACA,EAAE,GAAQ,eAAU,KAAK,MAAM,IAAK;AAAA,MACtC;AAEA,UAAI,iBAAiB,GAAG;AACtB,eAAO;AAAA,MACT;AAEA,aAAO;AAAA,QAEL,GAAG,KAAK;AAAA,MACV;AAAA,IACF,SAAS,OAAP;AACA,UAAI,iBAAiB,OAAO;AAC1B,YACE,MAAM,YAAY,kBAClB,MAAM,YAAY,oBAClB,MAAM,YAAY,4BAClB,MAAM,YAAY,yCAClB;AAKA,iBAAO,CAAC;AAAA,QACV;AAAA,MACF;AAEA,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,UAAUI,OAGjB;AACA,MAAIA,MAAKA,MAAK,SAAS,OAAO,kBAAkB;AAC9C,UAAM,CAAC,oBAAoB,oBAAoB,IAC7CA,MAAK,MAAM,gBAAgB;AAC7B,WAAO;AAAA,MACL;AAAA,MACA,cAAc,SAAS,sBAAsB,EAAE;AAAA,IACjD;AAAA,EACF;AAEA,SAAO,EAAE,oBAAoBA,OAAM,cAAc,KAAK;AACxD;AAEO,SAAS,eAAeJ,UAAiB;AAC9C,SAAO,OACL,MACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,MACG;AACH,UAAM,iBAAiB,6BAA6B,QAAQ;AAE5D,UAAM,uBAAuB,KAAK;AAAA,MAChC,GAAG,OAAO,KAAK,cAAc,EAAE,IAAI,CAAC,OAAO,SAAS,IAAI,EAAE,CAAC;AAAA,IAC7D;AAEA,UAAM,kBAAkB;AAAA,MACtB,IAAI,qBAAqB,SAAS;AAAA,MAClC,QAAQ,eAAe;AAAA,IACzB;AAEA,UAAMI,QAAO,MAAW,UAAKJ,UAAS,MAAM,iBAAiB;AAAA,MAC3D,GAAQ;AAAA,MACR,KAAK,MAAM;AAAA,IACb,CAAC;AAED,WAAO,GAAGI,QAAO,mBAAmB;AAAA,EACtC;AACF;AAEA,SAAS,6BAA6B,UAAoB;AACxD,SAAO,OAAO,aAAa,WAAW,EAAE,GAAG,SAAS,IAAI;AAC1D;;;ADpVA,uBAAuB;AAEvB,IAAM,UAAU,IAAI,wBAAO;AAGpB,IAAM,aAAa,iBAAiB,OAAO;AAC3C,IAAM,WAAW,eAAe,OAAO;AACvC,IAAM,iBAAiB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AACF;","names":["_crypto","unsealData","sealData","cookie","seal"]}