iron-session 6.2.0 → 6.3.0

package/README.md

@@ -2,7 +2,7 @@
 
 <p align="center"><b>⭐️ Featured in the <a href="https://nextjs.org/docs/authentication">Next.js documentation</a></b></p>
 
-_🛠 Node.js stateless session utility using signed and encrypted cookies to store data. Works with Next.js, Express, NestJs, Fastify, and any Node.js HTTP framework._
+_🛠 Node.js stateless session utility using signed and encrypted cookies to store data. Works with Next.js, Express, and Node.js HTTP servers._
 
 The session data is stored in encrypted cookies ("seals"). And only your server can decode the session data. There are no session ids, making iron sessions "stateless" from the server point of view.
 
@@ -24,6 +24,7 @@ _Table of contents:_
   - [Session wrappers](#session-wrappers)
   - [Typing session data with TypeScript](#typing-session-data-with-typescript)
   - [Express](#express)
+  - [Koa](#koa)
   - [Handle password rotation/update the password](#handle-password-rotationupdate-the-password)
   - [Magic links](#magic-links)
   - [Impersonation, login as someone else](#impersonation-login-as-someone-else)
@@ -48,7 +49,8 @@ _Table of contents:_
 ## Installation
 
 ```bash
-npm add iron-session
+npm install iron-session
+yarn add iron-session
 ```
 
 ## Next.js usage
@@ -210,7 +212,8 @@ export const middleware = async (req: NextRequest) => {
 
   // demo:
   if (user?.admin !== "true") {
-    return new NextResponse(null, { status: 403 }); // unauthorized to see pages inside admin/
+    // unauthorized to see pages inside admin/
+    return NextResponse.redirect(new URL('/unauthorized', req.url)) // redirect to /unauthorized page
   }
 
   return res;
@@ -382,6 +385,9 @@ export const getServerSideProps = withSessionSsr(
 But you might want to go further and type your session data also. So you can get autocompletion on `session.user` for example. To do so, use [module augmentation](https://www.typescriptlang.org/docs/handbook/declaration-merging.html#module-augmentation):
 
 ```ts
+// You may need the next line in some situations
+// import * as IronSession from "iron-session";
+
 declare module "iron-session" {
   interface IronSessionData {
     user?: {
@@ -400,6 +406,10 @@ We've taken this technique from [express-session types](https://github.com/Defin
 
 See [examples/express](examples/express) for an example of how to use this with Express.
 
+### Koa
+
+See [examples/koa](examples/koa) for an example of how to use this with Koa.
+
 ### Handle password rotation/update the password
 
 When you want to:
@@ -808,6 +818,7 @@ Thanks goes to these wonderful people ([emoji key](https://allcontributors.org/d
   <tr>
     <td align="center"><a href="http://www.afterecon.com/"><img src="https://avatars.githubusercontent.com/u/5559355?v=4?s=100" width="100px;" alt=""/><br /><sub><b>John Vandivier</b></sub></a><br /><a href="https://github.com/vvo/iron-session/commits?author=Vandivier" title="Code">💻</a> <a href="#ideas-Vandivier" title="Ideas, Planning, & Feedback">🤔</a> <a href="#example-Vandivier" title="Examples">💡</a></td>
     <td align="center"><a href="https://searchableguy.com"><img src="https://avatars.githubusercontent.com/u/73341821?v=4?s=100" width="100px;" alt=""/><br /><sub><b>searchableguy</b></sub></a><br /><a href="https://github.com/vvo/iron-session/commits?author=searchableguy" title="Tests">⚠️</a> <a href="https://github.com/vvo/iron-session/commits?author=searchableguy" title="Documentation">📖</a> <a href="https://github.com/vvo/iron-session/commits?author=searchableguy" title="Code">💻</a></td>
+    <td align="center"><a href="http://brc-dd.me"><img src="https://avatars.githubusercontent.com/u/40380293?v=4?s=100" width="100px;" alt=""/><br /><sub><b>Divyansh Singh</b></sub></a><br /><a href="https://github.com/vvo/iron-session/commits?author=brc-dd" title="Code">💻</a> <a href="https://github.com/vvo/iron-session/commits?author=brc-dd" title="Documentation">📖</a> <a href="#ideas-brc-dd" title="Ideas, Planning, & Feedback">🤔</a></td>
   </tr>
 </table>
 

package/dist/index.js

@@ -163,12 +163,10 @@ function createUnsealData(_crypto2) {
     const passwordsAsMap = normalizeStringPasswordToMap(password);
     const { sealWithoutVersion, tokenVersion } = parseSeal(seal2);
     try {
-      const data = await Iron.unseal(
-        _crypto2,
-        sealWithoutVersion,
-        passwordsAsMap,
-        { ...Iron.defaults, ttl: ttl * 1e3 }
-      );
+      const data = await Iron.unseal(_crypto2, sealWithoutVersion, passwordsAsMap, {
+        ...Iron.defaults,
+        ttl: ttl * 1e3
+      }) || {};
       if (tokenVersion === 2) {
         return data;
       }
@@ -177,7 +175,7 @@ function createUnsealData(_crypto2) {
       };
     } catch (error) {
       if (error instanceof Error) {
-        if (error.message === "Expired seal" || error.message === "Bad hmac value" || error.message === "Cannot find password: " || error.message === "Incorrect number of sealed components") {
+        if (error.message === "Expired seal" || error.message === "Bad hmac value" || error.message.startsWith("Cannot find password: ") || error.message === "Incorrect number of sealed components") {
           return {};
         }
       }

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/core.ts"],"sourcesContent":["import { createGetIronSession, createSealData, createUnsealData } from \"./core\";\nimport { Crypto } from \"@peculiar/webcrypto\";\n\nconst _crypto = new Crypto();\n\nexport * from \"./core\";\nexport const unsealData = createUnsealData(_crypto);\nexport const sealData = createSealData(_crypto);\nexport const getIronSession = createGetIronSession(\n  _crypto,\n  unsealData,\n  sealData,\n);\n","import * as Iron from \"iron-webcrypto\";\nimport type { CookieSerializeOptions } from \"cookie\";\nimport cookie from \"cookie\";\nimport type { IncomingMessage, ServerResponse } from \"http\";\n\n// default time allowed to check for iron seal validity when ttl passed\n// see https://hapi.dev/family/iron/api/?v=6.0.0#options\nconst timestampSkewSec = 60;\n\ntype passwordsMap = { [id: string]: string };\ntype password = string | passwordsMap;\n\nconst fourteenDaysInSeconds = 15 * 24 * 3600;\n\n// We store a token major version to handle data format changes when any. So that when you upgrade the cookies\n// can be kept alive between upgrades, no need to disconnect everyone.\nconst currentMajorVersion = 2;\nconst versionDelimiter = \"~\";\n\nconst defaultOptions: {\n  ttl: number;\n  cookieOptions: CookieSerializeOptions;\n} = {\n  ttl: fourteenDaysInSeconds,\n  cookieOptions: {\n    httpOnly: true,\n    secure: true,\n    sameSite: \"lax\",\n    path: \"/\",\n  },\n};\n\nexport interface IronSessionOptions {\n  /**\n   * This is the cookie name that will be used inside the browser. You should make sure it's unique given\n   * your application. Example: vercel-session\n   */\n  cookieName: string;\n\n  /**\n   * This is the password(s) that will be used to encrypt the cookie. It can be either a string or an object\n   * like {1: \"password\", 2: password}.\n   *\n   * When you provide multiple passwords then all of them will be used to decrypt the cookie and only the most\n   * recent (= highest key, 2 in this example) password will be used to encrypt the cookie. This allow you\n   * to use password rotation (security)\n   */\n  password: password;\n\n  /**\n   * This is the time in seconds that the session will be valid for. This also set the max-age attribute of\n   * the cookie automatically (minus 60 seconds so that the cookie always expire before the session).\n   */\n  ttl?: number;\n\n  /**\n   * This is the options that will be passed to the cookie library.\n   * You can see all of them here: https://github.com/jshttp/cookie#options-1.\n   *\n   * If you want to use \"session cookies\" (cookies that are deleted when the browser is closed) then you need\n   * to pass cookieOptions: { maxAge: undefined }.\n   */\n  cookieOptions?: CookieSerializeOptions;\n}\n\n// eslint-disable-next-line @typescript-eslint/no-empty-interface\nexport interface IronSessionData {\n  // If we allow for any keys, then there's no more type check on unknown properties\n  // which is not good\n  // If we allow for any keys, the later delete will work but I prefer to disable the\n  // check at this stage and\n  // provide good type checking instead\n  // [key: string]: unknown;\n}\n\nexport type IronSession = IronSessionData & {\n  /**\n   * Destroys the session data and removes the cookie.\n   */\n  destroy: () => void;\n\n  /**\n   * Encrypts the session data and sets the cookie.\n   */\n  save: () => Promise<void>;\n};\n\ndeclare module \"http\" {\n  interface IncomingMessage {\n    session: IronSession;\n  }\n}\n\ntype RequestType = IncomingMessage | Request;\ntype ResponseType = ServerResponse | Response;\n\nexport function createGetIronSession(\n  _crypto: Crypto,\n  unsealData: ReturnType<typeof createUnsealData>,\n  sealData: ReturnType<typeof createSealData>,\n) {\n  return async (\n    req: RequestType,\n    res: ResponseType,\n    userSessionOptions: IronSessionOptions,\n  ): Promise<IronSession> => {\n    if (\n      !req ||\n      !res ||\n      !userSessionOptions ||\n      !userSessionOptions.cookieName ||\n      !userSessionOptions.password\n    ) {\n      throw new Error(\n        `iron-session: Bad usage. Minimum usage is const session = await getIronSession(req, res, { cookieName: \"...\", password: \"...\". Check the usage here: https://github.com/vvo/iron-session`,\n      );\n    }\n\n    const passwordsAsMap = normalizeStringPasswordToMap(\n      userSessionOptions.password,\n    );\n\n    Object.values(\n      normalizeStringPasswordToMap(userSessionOptions.password),\n    ).forEach((password) => {\n      if (password.length < 32) {\n        throw new Error(\n          `iron-session: Bad usage. Password must be at least 32 characters long.`,\n        );\n      }\n    });\n\n    const options: Required<IronSessionOptions> = {\n      ...defaultOptions,\n      ...userSessionOptions,\n      cookieOptions: {\n        ...defaultOptions.cookieOptions,\n        ...(userSessionOptions.cookieOptions || {}),\n      },\n    };\n\n    if (options.ttl === 0) {\n      // ttl = 0 means no expiration\n      // but in reality cookies have to expire (can't have no max-age)\n      // 2147483647 is the max value for max-age in cookies\n      // see https://stackoverflow.com/a/11685301/147079\n      options.ttl = 2147483647;\n    }\n\n    if (\n      userSessionOptions.cookieOptions &&\n      \"maxAge\" in userSessionOptions.cookieOptions\n    ) {\n      // session cookie, do not set maxAge, consider token as infinite\n      if (userSessionOptions.cookieOptions.maxAge === undefined) {\n        options.ttl = 0;\n      } else {\n        options.cookieOptions.maxAge = computeCookieMaxAge(\n          userSessionOptions.cookieOptions.maxAge,\n        );\n      }\n    } else {\n      options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);\n    }\n\n    const sealFromCookies = cookie.parse(\n      \"credentials\" in req\n        ? req.headers.get(\"cookie\") || \"\"\n        : req.headers.cookie || \"\",\n    )[options.cookieName];\n\n    const session =\n      sealFromCookies === undefined\n        ? {}\n        : await unsealData<IronSessionData>(sealFromCookies, {\n            password: passwordsAsMap,\n            ttl: options.ttl,\n          });\n\n    Object.defineProperties(session, {\n      save: {\n        value: async function save() {\n          if (\"headersSent\" in res && res.headersSent === true) {\n            throw new Error(\n              `iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()`,\n            );\n          }\n          const seal = await sealData(session, {\n            password: passwordsAsMap,\n            ttl: options.ttl,\n          });\n          const cookieValue = cookie.serialize(\n            options.cookieName,\n            seal,\n            options.cookieOptions,\n          );\n\n          if (cookieValue.length > 4096) {\n            throw new Error(\n              `iron-session: Cookie length is too big ${cookieValue.length}, browsers will refuse it. Try to remove some data.`,\n            );\n          }\n\n          addToCookies(cookieValue, res);\n        },\n      },\n      destroy: {\n        value: function destroy() {\n          Object.keys(session).forEach((key) => {\n            // @ts-ignore See comment on the IronSessionData interface\n            delete session[key];\n          });\n\n          const cookieValue = cookie.serialize(options.cookieName, \"\", {\n            ...options.cookieOptions,\n            maxAge: 0,\n          });\n          addToCookies(cookieValue, res);\n        },\n      },\n    });\n\n    return session as IronSession;\n  };\n}\n\nfunction addToCookies(cookieValue: string, res: ResponseType) {\n  if (\"headers\" in res) {\n    res.headers.append(\"set-cookie\", cookieValue);\n    return;\n  }\n\n  let existingSetCookie =\n    (res.getHeader(\"set-cookie\") as string[] | string) ?? [];\n  if (typeof existingSetCookie === \"string\") {\n    existingSetCookie = [existingSetCookie];\n  }\n  res.setHeader(\"set-cookie\", [...existingSetCookie, cookieValue]);\n}\n\nfunction computeCookieMaxAge(ttl: number) {\n  // The next line makes sure browser will expire cookies before seals are considered expired by the server.\n  // It also allows for clock difference of 60 seconds maximum between server and clients.\n  // It also makes sure to expire the cookie immediately when value is 0\n  return ttl - timestampSkewSec;\n}\n\nexport function createUnsealData(_crypto: Crypto) {\n  return async <T = Record<string, unknown>>(\n    seal: string,\n    {\n      password,\n      ttl = fourteenDaysInSeconds,\n    }: { password: password; ttl?: number },\n  ): Promise<T> => {\n    const passwordsAsMap = normalizeStringPasswordToMap(password);\n    const { sealWithoutVersion, tokenVersion } = parseSeal(seal);\n\n    try {\n      const data = await Iron.unseal(\n        _crypto,\n        sealWithoutVersion,\n        passwordsAsMap,\n        { ...Iron.defaults, ttl: ttl * 1000 },\n      );\n\n      if (tokenVersion === 2) {\n        return data as T;\n      }\n\n      return {\n        // @ts-expect-error `persistent` does not exist on newer tokens\n        ...data.persistent,\n      };\n    } catch (error) {\n      if (error instanceof Error) {\n        if (\n          error.message === \"Expired seal\" ||\n          error.message === \"Bad hmac value\" ||\n          error.message === \"Cannot find password: \" ||\n          error.message === \"Incorrect number of sealed components\"\n        ) {\n          // if seal expired or\n          // if seal is not valid (encrypted using a different password, when passwords are badly rotated) or\n          // if we can't find back the password in the seal\n          // then we just start a new session over\n          return {} as T;\n        }\n      }\n\n      throw error;\n    }\n  };\n}\n\nfunction parseSeal(seal: string): {\n  sealWithoutVersion: string;\n  tokenVersion: number | null;\n} {\n  if (seal[seal.length - 2] === versionDelimiter) {\n    const [sealWithoutVersion, tokenVersionAsString] =\n      seal.split(versionDelimiter);\n    return {\n      sealWithoutVersion,\n      tokenVersion: parseInt(tokenVersionAsString, 10),\n    };\n  }\n\n  return { sealWithoutVersion: seal, tokenVersion: null };\n}\n\nexport function createSealData(_crypto: Crypto) {\n  return async (\n    data: unknown,\n    {\n      password,\n      ttl = fourteenDaysInSeconds,\n    }: { password: password; ttl?: number },\n  ) => {\n    const passwordsAsMap = normalizeStringPasswordToMap(password);\n\n    const mostRecentPasswordId = Math.max(\n      ...Object.keys(passwordsAsMap).map((id) => parseInt(id, 10)),\n    );\n\n    const passwordForSeal = {\n      id: mostRecentPasswordId.toString(),\n      secret: passwordsAsMap[mostRecentPasswordId],\n    };\n\n    const seal = await Iron.seal(_crypto, data, passwordForSeal, {\n      ...Iron.defaults,\n      ttl: ttl * 1000,\n    });\n\n    return `${seal}${versionDelimiter}${currentMajorVersion}`;\n  };\n}\n\nfunction normalizeStringPasswordToMap(password: password) {\n  return typeof password === \"string\" ? { 1: password } : password;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,WAAsB;AAEtB,oBAAmB;AAKnB,IAAM,mBAAmB;AAKzB,IAAM,wBAAwB,KAAK,KAAK;AAIxC,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AAEzB,IAAM,iBAGF;AAAA,EACF,KAAK;AAAA,EACL,eAAe;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,EACR;AACF;AAkEO,SAAS,qBACdA,UACAC,aACAC,WACA;AACA,SAAO,OACL,KACA,KACA,uBACyB;AACzB,QACE,CAAC,OACD,CAAC,OACD,CAAC,sBACD,CAAC,mBAAmB,cACpB,CAAC,mBAAmB,UACpB;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,iBAAiB;AAAA,MACrB,mBAAmB;AAAA,IACrB;AAEA,WAAO;AAAA,MACL,6BAA6B,mBAAmB,QAAQ;AAAA,IAC1D,EAAE,QAAQ,CAAC,aAAa;AACtB,UAAI,SAAS,SAAS,IAAI;AACxB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAED,UAAM,UAAwC;AAAA,MAC5C,GAAG;AAAA,MACH,GAAG;AAAA,MACH,eAAe;AAAA,QACb,GAAG,eAAe;AAAA,QAClB,GAAI,mBAAmB,iBAAiB,CAAC;AAAA,MAC3C;AAAA,IACF;AAEA,QAAI,QAAQ,QAAQ,GAAG;AAKrB,cAAQ,MAAM;AAAA,IAChB;AAEA,QACE,mBAAmB,iBACnB,YAAY,mBAAmB,eAC/B;AAEA,UAAI,mBAAmB,cAAc,WAAW,QAAW;AACzD,gBAAQ,MAAM;AAAA,MAChB,OAAO;AACL,gBAAQ,cAAc,SAAS;AAAA,UAC7B,mBAAmB,cAAc;AAAA,QACnC;AAAA,MACF;AAAA,IACF,OAAO;AACL,cAAQ,cAAc,SAAS,oBAAoB,QAAQ,GAAG;AAAA,IAChE;AAEA,UAAM,kBAAkB,cAAAC,QAAO;AAAA,MAC7B,iBAAiB,MACb,IAAI,QAAQ,IAAI,QAAQ,KAAK,KAC7B,IAAI,QAAQ,UAAU;AAAA,IAC5B,EAAE,QAAQ;AAEV,UAAM,UACJ,oBAAoB,SAChB,CAAC,IACD,MAAMF,YAA4B,iBAAiB;AAAA,MACjD,UAAU;AAAA,MACV,KAAK,QAAQ;AAAA,IACf,CAAC;AAEP,WAAO,iBAAiB,SAAS;AAAA,MAC/B,MAAM;AAAA,QACJ,OAAO,eAAe,OAAO;AAC3B,cAAI,iBAAiB,OAAO,IAAI,gBAAgB,MAAM;AACpD,kBAAM,IAAI;AAAA,cACR;AAAA,YACF;AAAA,UACF;AACA,gBAAMG,QAAO,MAAMF,UAAS,SAAS;AAAA,YACnC,UAAU;AAAA,YACV,KAAK,QAAQ;AAAA,UACf,CAAC;AACD,gBAAM,cAAc,cAAAC,QAAO;AAAA,YACzB,QAAQ;AAAA,YACRC;AAAA,YACA,QAAQ;AAAA,UACV;AAEA,cAAI,YAAY,SAAS,MAAM;AAC7B,kBAAM,IAAI;AAAA,cACR,0CAA0C,YAAY;AAAA,YACxD;AAAA,UACF;AAEA,uBAAa,aAAa,GAAG;AAAA,QAC/B;AAAA,MACF;AAAA,MACA,SAAS;AAAA,QACP,OAAO,SAAS,UAAU;AACxB,iBAAO,KAAK,OAAO,EAAE,QAAQ,CAAC,QAAQ;AAEpC,mBAAO,QAAQ;AAAA,UACjB,CAAC;AAED,gBAAM,cAAc,cAAAD,QAAO,UAAU,QAAQ,YAAY,IAAI;AAAA,YAC3D,GAAG,QAAQ;AAAA,YACX,QAAQ;AAAA,UACV,CAAC;AACD,uBAAa,aAAa,GAAG;AAAA,QAC/B;AAAA,MACF;AAAA,IACF,CAAC;AAED,WAAO;AAAA,EACT;AACF;AAEA,SAAS,aAAa,aAAqB,KAAmB;AAlO9D;AAmOE,MAAI,aAAa,KAAK;AACpB,QAAI,QAAQ,OAAO,cAAc,WAAW;AAC5C;AAAA,EACF;AAEA,MAAI,qBACD,SAAI,UAAU,YAAY,MAA1B,YAAqD,CAAC;AACzD,MAAI,OAAO,sBAAsB,UAAU;AACzC,wBAAoB,CAAC,iBAAiB;AAAA,EACxC;AACA,MAAI,UAAU,cAAc,CAAC,GAAG,mBAAmB,WAAW,CAAC;AACjE;AAEA,SAAS,oBAAoB,KAAa;AAIxC,SAAO,MAAM;AACf;AAEO,SAAS,iBAAiBH,UAAiB;AAChD,SAAO,OACLI,OACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,MACe;AACf,UAAM,iBAAiB,6BAA6B,QAAQ;AAC5D,UAAM,EAAE,oBAAoB,aAAa,IAAI,UAAUA,KAAI;AAE3D,QAAI;AACF,YAAM,OAAO,MAAW;AAAA,QACtBJ;AAAA,QACA;AAAA,QACA;AAAA,QACA,EAAE,GAAQ,eAAU,KAAK,MAAM,IAAK;AAAA,MACtC;AAEA,UAAI,iBAAiB,GAAG;AACtB,eAAO;AAAA,MACT;AAEA,aAAO;AAAA,QAEL,GAAG,KAAK;AAAA,MACV;AAAA,IACF,SAAS,OAAP;AACA,UAAI,iBAAiB,OAAO;AAC1B,YACE,MAAM,YAAY,kBAClB,MAAM,YAAY,oBAClB,MAAM,YAAY,4BAClB,MAAM,YAAY,yCAClB;AAKA,iBAAO,CAAC;AAAA,QACV;AAAA,MACF;AAEA,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,UAAUI,OAGjB;AACA,MAAIA,MAAKA,MAAK,SAAS,OAAO,kBAAkB;AAC9C,UAAM,CAAC,oBAAoB,oBAAoB,IAC7CA,MAAK,MAAM,gBAAgB;AAC7B,WAAO;AAAA,MACL;AAAA,MACA,cAAc,SAAS,sBAAsB,EAAE;AAAA,IACjD;AAAA,EACF;AAEA,SAAO,EAAE,oBAAoBA,OAAM,cAAc,KAAK;AACxD;AAEO,SAAS,eAAeJ,UAAiB;AAC9C,SAAO,OACL,MACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,MACG;AACH,UAAM,iBAAiB,6BAA6B,QAAQ;AAE5D,UAAM,uBAAuB,KAAK;AAAA,MAChC,GAAG,OAAO,KAAK,cAAc,EAAE,IAAI,CAAC,OAAO,SAAS,IAAI,EAAE,CAAC;AAAA,IAC7D;AAEA,UAAM,kBAAkB;AAAA,MACtB,IAAI,qBAAqB,SAAS;AAAA,MAClC,QAAQ,eAAe;AAAA,IACzB;AAEA,UAAMI,QAAO,MAAW,UAAKJ,UAAS,MAAM,iBAAiB;AAAA,MAC3D,GAAQ;AAAA,MACR,KAAK,MAAM;AAAA,IACb,CAAC;AAED,WAAO,GAAGI,QAAO,mBAAmB;AAAA,EACtC;AACF;AAEA,SAAS,6BAA6B,UAAoB;AACxD,SAAO,OAAO,aAAa,WAAW,EAAE,GAAG,SAAS,IAAI;AAC1D;;;ADpVA,uBAAuB;AAEvB,IAAM,UAAU,IAAI,wBAAO;AAGpB,IAAM,aAAa,iBAAiB,OAAO;AAC3C,IAAM,WAAW,eAAe,OAAO;AACvC,IAAM,iBAAiB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AACF;","names":["_crypto","unsealData","sealData","cookie","seal"]}
+{"version":3,"sources":["../src/index.ts","../src/core.ts"],"sourcesContent":["import { createGetIronSession, createSealData, createUnsealData } from \"./core\";\nimport { Crypto } from \"@peculiar/webcrypto\";\n\nconst _crypto = new Crypto();\n\nexport * from \"./core\";\nexport const unsealData = createUnsealData(_crypto);\nexport const sealData = createSealData(_crypto);\nexport const getIronSession = createGetIronSession(\n  _crypto,\n  unsealData,\n  sealData,\n);\n","import * as Iron from \"iron-webcrypto\";\nimport type { CookieSerializeOptions } from \"cookie\";\nimport cookie from \"cookie\";\nimport type { IncomingMessage, ServerResponse } from \"http\";\n\n// default time allowed to check for iron seal validity when ttl passed\n// see https://hapi.dev/family/iron/api/?v=6.0.0#options\nconst timestampSkewSec = 60;\n\ntype passwordsMap = { [id: string]: string };\ntype password = string | passwordsMap;\n\nconst fourteenDaysInSeconds = 15 * 24 * 3600;\n\n// We store a token major version to handle data format changes when any. So that when you upgrade the cookies\n// can be kept alive between upgrades, no need to disconnect everyone.\nconst currentMajorVersion = 2;\nconst versionDelimiter = \"~\";\n\nconst defaultOptions: {\n  ttl: number;\n  cookieOptions: CookieSerializeOptions;\n} = {\n  ttl: fourteenDaysInSeconds,\n  cookieOptions: {\n    httpOnly: true,\n    secure: true,\n    sameSite: \"lax\",\n    path: \"/\",\n  },\n};\n\nexport interface IronSessionOptions {\n  /**\n   * This is the cookie name that will be used inside the browser. You should make sure it's unique given\n   * your application. Example: vercel-session\n   */\n  cookieName: string;\n\n  /**\n   * This is the password(s) that will be used to encrypt the cookie. It can be either a string or an object\n   * like {1: \"password\", 2: password}.\n   *\n   * When you provide multiple passwords then all of them will be used to decrypt the cookie and only the most\n   * recent (= highest key, 2 in this example) password will be used to encrypt the cookie. This allow you\n   * to use password rotation (security)\n   */\n  password: password;\n\n  /**\n   * This is the time in seconds that the session will be valid for. This also set the max-age attribute of\n   * the cookie automatically (minus 60 seconds so that the cookie always expire before the session).\n   */\n  ttl?: number;\n\n  /**\n   * This is the options that will be passed to the cookie library.\n   * You can see all of them here: https://github.com/jshttp/cookie#options-1.\n   *\n   * If you want to use \"session cookies\" (cookies that are deleted when the browser is closed) then you need\n   * to pass cookieOptions: { maxAge: undefined }.\n   */\n  cookieOptions?: CookieSerializeOptions;\n}\n\n// eslint-disable-next-line @typescript-eslint/no-empty-interface\nexport interface IronSessionData {\n  // If we allow for any keys, then there's no more type check on unknown properties\n  // which is not good\n  // If we allow for any keys, the later delete will work but I prefer to disable the\n  // check at this stage and\n  // provide good type checking instead\n  // [key: string]: unknown;\n}\n\nexport type IronSession = IronSessionData & {\n  /**\n   * Destroys the session data and removes the cookie.\n   */\n  destroy: () => void;\n\n  /**\n   * Encrypts the session data and sets the cookie.\n   */\n  save: () => Promise<void>;\n};\n\ndeclare module \"http\" {\n  interface IncomingMessage {\n    session: IronSession;\n  }\n}\n\ntype RequestType = IncomingMessage | Request;\ntype ResponseType = ServerResponse | Response;\n\nexport function createGetIronSession(\n  _crypto: Crypto,\n  unsealData: ReturnType<typeof createUnsealData>,\n  sealData: ReturnType<typeof createSealData>,\n) {\n  return async (\n    req: RequestType,\n    res: ResponseType,\n    userSessionOptions: IronSessionOptions,\n  ): Promise<IronSession> => {\n    if (\n      !req ||\n      !res ||\n      !userSessionOptions ||\n      !userSessionOptions.cookieName ||\n      !userSessionOptions.password\n    ) {\n      throw new Error(\n        `iron-session: Bad usage. Minimum usage is const session = await getIronSession(req, res, { cookieName: \"...\", password: \"...\". Check the usage here: https://github.com/vvo/iron-session`,\n      );\n    }\n\n    const passwordsAsMap = normalizeStringPasswordToMap(\n      userSessionOptions.password,\n    );\n\n    Object.values(\n      normalizeStringPasswordToMap(userSessionOptions.password),\n    ).forEach((password) => {\n      if (password.length < 32) {\n        throw new Error(\n          `iron-session: Bad usage. Password must be at least 32 characters long.`,\n        );\n      }\n    });\n\n    const options: Required<IronSessionOptions> = {\n      ...defaultOptions,\n      ...userSessionOptions,\n      cookieOptions: {\n        ...defaultOptions.cookieOptions,\n        ...(userSessionOptions.cookieOptions || {}),\n      },\n    };\n\n    if (options.ttl === 0) {\n      // ttl = 0 means no expiration\n      // but in reality cookies have to expire (can't have no max-age)\n      // 2147483647 is the max value for max-age in cookies\n      // see https://stackoverflow.com/a/11685301/147079\n      options.ttl = 2147483647;\n    }\n\n    if (\n      userSessionOptions.cookieOptions &&\n      \"maxAge\" in userSessionOptions.cookieOptions\n    ) {\n      // session cookie, do not set maxAge, consider token as infinite\n      if (userSessionOptions.cookieOptions.maxAge === undefined) {\n        options.ttl = 0;\n      } else {\n        options.cookieOptions.maxAge = computeCookieMaxAge(\n          userSessionOptions.cookieOptions.maxAge,\n        );\n      }\n    } else {\n      options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);\n    }\n\n    const sealFromCookies = cookie.parse(\n      \"credentials\" in req\n        ? req.headers.get(\"cookie\") || \"\"\n        : req.headers.cookie || \"\",\n    )[options.cookieName];\n\n    const session =\n      sealFromCookies === undefined\n        ? {}\n        : await unsealData<IronSessionData>(sealFromCookies, {\n            password: passwordsAsMap,\n            ttl: options.ttl,\n          });\n\n    Object.defineProperties(session, {\n      save: {\n        value: async function save() {\n          if (\"headersSent\" in res && res.headersSent === true) {\n            throw new Error(\n              `iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()`,\n            );\n          }\n          const seal = await sealData(session, {\n            password: passwordsAsMap,\n            ttl: options.ttl,\n          });\n          const cookieValue = cookie.serialize(\n            options.cookieName,\n            seal,\n            options.cookieOptions,\n          );\n\n          if (cookieValue.length > 4096) {\n            throw new Error(\n              `iron-session: Cookie length is too big ${cookieValue.length}, browsers will refuse it. Try to remove some data.`,\n            );\n          }\n\n          addToCookies(cookieValue, res);\n        },\n      },\n      destroy: {\n        value: function destroy() {\n          Object.keys(session).forEach((key) => {\n            // @ts-ignore See comment on the IronSessionData interface\n            delete session[key];\n          });\n\n          const cookieValue = cookie.serialize(options.cookieName, \"\", {\n            ...options.cookieOptions,\n            maxAge: 0,\n          });\n          addToCookies(cookieValue, res);\n        },\n      },\n    });\n\n    return session as IronSession;\n  };\n}\n\nfunction addToCookies(cookieValue: string, res: ResponseType) {\n  if (\"headers\" in res) {\n    res.headers.append(\"set-cookie\", cookieValue);\n    return;\n  }\n\n  let existingSetCookie =\n    (res.getHeader(\"set-cookie\") as string[] | string) ?? [];\n  if (typeof existingSetCookie === \"string\") {\n    existingSetCookie = [existingSetCookie];\n  }\n  res.setHeader(\"set-cookie\", [...existingSetCookie, cookieValue]);\n}\n\nfunction computeCookieMaxAge(ttl: number) {\n  // The next line makes sure browser will expire cookies before seals are considered expired by the server.\n  // It also allows for clock difference of 60 seconds maximum between server and clients.\n  // It also makes sure to expire the cookie immediately when value is 0\n  return ttl - timestampSkewSec;\n}\n\nexport function createUnsealData(_crypto: Crypto) {\n  return async <T = Record<string, unknown>>(\n    seal: string,\n    {\n      password,\n      ttl = fourteenDaysInSeconds,\n    }: { password: password; ttl?: number },\n  ): Promise<T> => {\n    const passwordsAsMap = normalizeStringPasswordToMap(password);\n    const { sealWithoutVersion, tokenVersion } = parseSeal(seal);\n\n    try {\n      const data =\n        (await Iron.unseal(_crypto, sealWithoutVersion, passwordsAsMap, {\n          ...Iron.defaults,\n          ttl: ttl * 1000,\n        })) || {};\n\n      if (tokenVersion === 2) {\n        return data as T;\n      }\n\n      return {\n        // @ts-expect-error `persistent` does not exist on newer tokens\n        ...data.persistent,\n      };\n    } catch (error) {\n      if (error instanceof Error) {\n        if (\n          error.message === \"Expired seal\" ||\n          error.message === \"Bad hmac value\" ||\n          error.message.startsWith(\"Cannot find password: \") ||\n          error.message === \"Incorrect number of sealed components\"\n        ) {\n          // if seal expired or\n          // if seal is not valid (encrypted using a different password, when passwords are badly rotated) or\n          // if we can't find back the password in the seal\n          // then we just start a new session over\n          return {} as T;\n        }\n      }\n\n      throw error;\n    }\n  };\n}\n\nfunction parseSeal(seal: string): {\n  sealWithoutVersion: string;\n  tokenVersion: number | null;\n} {\n  if (seal[seal.length - 2] === versionDelimiter) {\n    const [sealWithoutVersion, tokenVersionAsString] =\n      seal.split(versionDelimiter);\n    return {\n      sealWithoutVersion,\n      tokenVersion: parseInt(tokenVersionAsString, 10),\n    };\n  }\n\n  return { sealWithoutVersion: seal, tokenVersion: null };\n}\n\nexport function createSealData(_crypto: Crypto) {\n  return async (\n    data: unknown,\n    {\n      password,\n      ttl = fourteenDaysInSeconds,\n    }: { password: password; ttl?: number },\n  ) => {\n    const passwordsAsMap = normalizeStringPasswordToMap(password);\n\n    const mostRecentPasswordId = Math.max(\n      ...Object.keys(passwordsAsMap).map((id) => parseInt(id, 10)),\n    );\n\n    const passwordForSeal = {\n      id: mostRecentPasswordId.toString(),\n      secret: passwordsAsMap[mostRecentPasswordId],\n    };\n\n    const seal = await Iron.seal(_crypto, data, passwordForSeal, {\n      ...Iron.defaults,\n      ttl: ttl * 1000,\n    });\n\n    return `${seal}${versionDelimiter}${currentMajorVersion}`;\n  };\n}\n\nfunction normalizeStringPasswordToMap(password: password) {\n  return typeof password === \"string\" ? { 1: password } : password;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,WAAsB;AAEtB,oBAAmB;AAKnB,IAAM,mBAAmB;AAKzB,IAAM,wBAAwB,KAAK,KAAK;AAIxC,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AAEzB,IAAM,iBAGF;AAAA,EACF,KAAK;AAAA,EACL,eAAe;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,EACR;AACF;AAkEO,SAAS,qBACdA,UACAC,aACAC,WACA;AACA,SAAO,OACL,KACA,KACA,uBACyB;AACzB,QACE,CAAC,OACD,CAAC,OACD,CAAC,sBACD,CAAC,mBAAmB,cACpB,CAAC,mBAAmB,UACpB;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,iBAAiB;AAAA,MACrB,mBAAmB;AAAA,IACrB;AAEA,WAAO;AAAA,MACL,6BAA6B,mBAAmB,QAAQ;AAAA,IAC1D,EAAE,QAAQ,CAAC,aAAa;AACtB,UAAI,SAAS,SAAS,IAAI;AACxB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAED,UAAM,UAAwC;AAAA,MAC5C,GAAG;AAAA,MACH,GAAG;AAAA,MACH,eAAe;AAAA,QACb,GAAG,eAAe;AAAA,QAClB,GAAI,mBAAmB,iBAAiB,CAAC;AAAA,MAC3C;AAAA,IACF;AAEA,QAAI,QAAQ,QAAQ,GAAG;AAKrB,cAAQ,MAAM;AAAA,IAChB;AAEA,QACE,mBAAmB,iBACnB,YAAY,mBAAmB,eAC/B;AAEA,UAAI,mBAAmB,cAAc,WAAW,QAAW;AACzD,gBAAQ,MAAM;AAAA,MAChB,OAAO;AACL,gBAAQ,cAAc,SAAS;AAAA,UAC7B,mBAAmB,cAAc;AAAA,QACnC;AAAA,MACF;AAAA,IACF,OAAO;AACL,cAAQ,cAAc,SAAS,oBAAoB,QAAQ,GAAG;AAAA,IAChE;AAEA,UAAM,kBAAkB,cAAAC,QAAO;AAAA,MAC7B,iBAAiB,MACb,IAAI,QAAQ,IAAI,QAAQ,KAAK,KAC7B,IAAI,QAAQ,UAAU;AAAA,IAC5B,EAAE,QAAQ;AAEV,UAAM,UACJ,oBAAoB,SAChB,CAAC,IACD,MAAMF,YAA4B,iBAAiB;AAAA,MACjD,UAAU;AAAA,MACV,KAAK,QAAQ;AAAA,IACf,CAAC;AAEP,WAAO,iBAAiB,SAAS;AAAA,MAC/B,MAAM;AAAA,QACJ,OAAO,eAAe,OAAO;AAC3B,cAAI,iBAAiB,OAAO,IAAI,gBAAgB,MAAM;AACpD,kBAAM,IAAI;AAAA,cACR;AAAA,YACF;AAAA,UACF;AACA,gBAAMG,QAAO,MAAMF,UAAS,SAAS;AAAA,YACnC,UAAU;AAAA,YACV,KAAK,QAAQ;AAAA,UACf,CAAC;AACD,gBAAM,cAAc,cAAAC,QAAO;AAAA,YACzB,QAAQ;AAAA,YACRC;AAAA,YACA,QAAQ;AAAA,UACV;AAEA,cAAI,YAAY,SAAS,MAAM;AAC7B,kBAAM,IAAI;AAAA,cACR,0CAA0C,YAAY;AAAA,YACxD;AAAA,UACF;AAEA,uBAAa,aAAa,GAAG;AAAA,QAC/B;AAAA,MACF;AAAA,MACA,SAAS;AAAA,QACP,OAAO,SAAS,UAAU;AACxB,iBAAO,KAAK,OAAO,EAAE,QAAQ,CAAC,QAAQ;AAEpC,mBAAO,QAAQ;AAAA,UACjB,CAAC;AAED,gBAAM,cAAc,cAAAD,QAAO,UAAU,QAAQ,YAAY,IAAI;AAAA,YAC3D,GAAG,QAAQ;AAAA,YACX,QAAQ;AAAA,UACV,CAAC;AACD,uBAAa,aAAa,GAAG;AAAA,QAC/B;AAAA,MACF;AAAA,IACF,CAAC;AAED,WAAO;AAAA,EACT;AACF;AAEA,SAAS,aAAa,aAAqB,KAAmB;AAlO9D;AAmOE,MAAI,aAAa,KAAK;AACpB,QAAI,QAAQ,OAAO,cAAc,WAAW;AAC5C;AAAA,EACF;AAEA,MAAI,qBACD,SAAI,UAAU,YAAY,MAA1B,YAAqD,CAAC;AACzD,MAAI,OAAO,sBAAsB,UAAU;AACzC,wBAAoB,CAAC,iBAAiB;AAAA,EACxC;AACA,MAAI,UAAU,cAAc,CAAC,GAAG,mBAAmB,WAAW,CAAC;AACjE;AAEA,SAAS,oBAAoB,KAAa;AAIxC,SAAO,MAAM;AACf;AAEO,SAAS,iBAAiBH,UAAiB;AAChD,SAAO,OACLI,OACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,MACe;AACf,UAAM,iBAAiB,6BAA6B,QAAQ;AAC5D,UAAM,EAAE,oBAAoB,aAAa,IAAI,UAAUA,KAAI;AAE3D,QAAI;AACF,YAAM,OACH,MAAW,YAAOJ,UAAS,oBAAoB,gBAAgB;AAAA,QAC9D,GAAQ;AAAA,QACR,KAAK,MAAM;AAAA,MACb,CAAC,KAAM,CAAC;AAEV,UAAI,iBAAiB,GAAG;AACtB,eAAO;AAAA,MACT;AAEA,aAAO;AAAA,QAEL,GAAG,KAAK;AAAA,MACV;AAAA,IACF,SAAS,OAAP;AACA,UAAI,iBAAiB,OAAO;AAC1B,YACE,MAAM,YAAY,kBAClB,MAAM,YAAY,oBAClB,MAAM,QAAQ,WAAW,wBAAwB,KACjD,MAAM,YAAY,yCAClB;AAKA,iBAAO,CAAC;AAAA,QACV;AAAA,MACF;AAEA,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,UAAUI,OAGjB;AACA,MAAIA,MAAKA,MAAK,SAAS,OAAO,kBAAkB;AAC9C,UAAM,CAAC,oBAAoB,oBAAoB,IAC7CA,MAAK,MAAM,gBAAgB;AAC7B,WAAO;AAAA,MACL;AAAA,MACA,cAAc,SAAS,sBAAsB,EAAE;AAAA,IACjD;AAAA,EACF;AAEA,SAAO,EAAE,oBAAoBA,OAAM,cAAc,KAAK;AACxD;AAEO,SAAS,eAAeJ,UAAiB;AAC9C,SAAO,OACL,MACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,MACG;AACH,UAAM,iBAAiB,6BAA6B,QAAQ;AAE5D,UAAM,uBAAuB,KAAK;AAAA,MAChC,GAAG,OAAO,KAAK,cAAc,EAAE,IAAI,CAAC,OAAO,SAAS,IAAI,EAAE,CAAC;AAAA,IAC7D;AAEA,UAAM,kBAAkB;AAAA,MACtB,IAAI,qBAAqB,SAAS;AAAA,MAClC,QAAQ,eAAe;AAAA,IACzB;AAEA,UAAMI,QAAO,MAAW,UAAKJ,UAAS,MAAM,iBAAiB;AAAA,MAC3D,GAAQ;AAAA,MACR,KAAK,MAAM;AAAA,IACb,CAAC;AAED,WAAO,GAAGI,QAAO,mBAAmB;AAAA,EACtC;AACF;AAEA,SAAS,6BAA6B,UAAoB;AACxD,SAAO,OAAO,aAAa,WAAW,EAAE,GAAG,SAAS,IAAI;AAC1D;;;ADnVA,uBAAuB;AAEvB,IAAM,UAAU,IAAI,wBAAO;AAGpB,IAAM,aAAa,iBAAiB,OAAO;AAC3C,IAAM,WAAW,eAAe,OAAO;AACvC,IAAM,iBAAiB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AACF;","names":["_crypto","unsealData","sealData","cookie","seal"]}

package/dist/index.mjs

@@ -126,12 +126,10 @@ function createUnsealData(_crypto2) {
     const passwordsAsMap = normalizeStringPasswordToMap(password);
     const { sealWithoutVersion, tokenVersion } = parseSeal(seal2);
     try {
-      const data = await Iron.unseal(
-        _crypto2,
-        sealWithoutVersion,
-        passwordsAsMap,
-        { ...Iron.defaults, ttl: ttl * 1e3 }
-      );
+      const data = await Iron.unseal(_crypto2, sealWithoutVersion, passwordsAsMap, {
+        ...Iron.defaults,
+        ttl: ttl * 1e3
+      }) || {};
       if (tokenVersion === 2) {
         return data;
       }
@@ -140,7 +138,7 @@ function createUnsealData(_crypto2) {
       };
     } catch (error) {
       if (error instanceof Error) {
-        if (error.message === "Expired seal" || error.message === "Bad hmac value" || error.message === "Cannot find password: " || error.message === "Incorrect number of sealed components") {
+        if (error.message === "Expired seal" || error.message === "Bad hmac value" || error.message.startsWith("Cannot find password: ") || error.message === "Incorrect number of sealed components") {
           return {};
         }
       }

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/core.ts","../src/index.ts"],"sourcesContent":["import * as Iron from \"iron-webcrypto\";\nimport type { CookieSerializeOptions } from \"cookie\";\nimport cookie from \"cookie\";\nimport type { IncomingMessage, ServerResponse } from \"http\";\n\n// default time allowed to check for iron seal validity when ttl passed\n// see https://hapi.dev/family/iron/api/?v=6.0.0#options\nconst timestampSkewSec = 60;\n\ntype passwordsMap = { [id: string]: string };\ntype password = string | passwordsMap;\n\nconst fourteenDaysInSeconds = 15 * 24 * 3600;\n\n// We store a token major version to handle data format changes when any. So that when you upgrade the cookies\n// can be kept alive between upgrades, no need to disconnect everyone.\nconst currentMajorVersion = 2;\nconst versionDelimiter = \"~\";\n\nconst defaultOptions: {\n  ttl: number;\n  cookieOptions: CookieSerializeOptions;\n} = {\n  ttl: fourteenDaysInSeconds,\n  cookieOptions: {\n    httpOnly: true,\n    secure: true,\n    sameSite: \"lax\",\n    path: \"/\",\n  },\n};\n\nexport interface IronSessionOptions {\n  /**\n   * This is the cookie name that will be used inside the browser. You should make sure it's unique given\n   * your application. Example: vercel-session\n   */\n  cookieName: string;\n\n  /**\n   * This is the password(s) that will be used to encrypt the cookie. It can be either a string or an object\n   * like {1: \"password\", 2: password}.\n   *\n   * When you provide multiple passwords then all of them will be used to decrypt the cookie and only the most\n   * recent (= highest key, 2 in this example) password will be used to encrypt the cookie. This allow you\n   * to use password rotation (security)\n   */\n  password: password;\n\n  /**\n   * This is the time in seconds that the session will be valid for. This also set the max-age attribute of\n   * the cookie automatically (minus 60 seconds so that the cookie always expire before the session).\n   */\n  ttl?: number;\n\n  /**\n   * This is the options that will be passed to the cookie library.\n   * You can see all of them here: https://github.com/jshttp/cookie#options-1.\n   *\n   * If you want to use \"session cookies\" (cookies that are deleted when the browser is closed) then you need\n   * to pass cookieOptions: { maxAge: undefined }.\n   */\n  cookieOptions?: CookieSerializeOptions;\n}\n\n// eslint-disable-next-line @typescript-eslint/no-empty-interface\nexport interface IronSessionData {\n  // If we allow for any keys, then there's no more type check on unknown properties\n  // which is not good\n  // If we allow for any keys, the later delete will work but I prefer to disable the\n  // check at this stage and\n  // provide good type checking instead\n  // [key: string]: unknown;\n}\n\nexport type IronSession = IronSessionData & {\n  /**\n   * Destroys the session data and removes the cookie.\n   */\n  destroy: () => void;\n\n  /**\n   * Encrypts the session data and sets the cookie.\n   */\n  save: () => Promise<void>;\n};\n\ndeclare module \"http\" {\n  interface IncomingMessage {\n    session: IronSession;\n  }\n}\n\ntype RequestType = IncomingMessage | Request;\ntype ResponseType = ServerResponse | Response;\n\nexport function createGetIronSession(\n  _crypto: Crypto,\n  unsealData: ReturnType<typeof createUnsealData>,\n  sealData: ReturnType<typeof createSealData>,\n) {\n  return async (\n    req: RequestType,\n    res: ResponseType,\n    userSessionOptions: IronSessionOptions,\n  ): Promise<IronSession> => {\n    if (\n      !req ||\n      !res ||\n      !userSessionOptions ||\n      !userSessionOptions.cookieName ||\n      !userSessionOptions.password\n    ) {\n      throw new Error(\n        `iron-session: Bad usage. Minimum usage is const session = await getIronSession(req, res, { cookieName: \"...\", password: \"...\". Check the usage here: https://github.com/vvo/iron-session`,\n      );\n    }\n\n    const passwordsAsMap = normalizeStringPasswordToMap(\n      userSessionOptions.password,\n    );\n\n    Object.values(\n      normalizeStringPasswordToMap(userSessionOptions.password),\n    ).forEach((password) => {\n      if (password.length < 32) {\n        throw new Error(\n          `iron-session: Bad usage. Password must be at least 32 characters long.`,\n        );\n      }\n    });\n\n    const options: Required<IronSessionOptions> = {\n      ...defaultOptions,\n      ...userSessionOptions,\n      cookieOptions: {\n        ...defaultOptions.cookieOptions,\n        ...(userSessionOptions.cookieOptions || {}),\n      },\n    };\n\n    if (options.ttl === 0) {\n      // ttl = 0 means no expiration\n      // but in reality cookies have to expire (can't have no max-age)\n      // 2147483647 is the max value for max-age in cookies\n      // see https://stackoverflow.com/a/11685301/147079\n      options.ttl = 2147483647;\n    }\n\n    if (\n      userSessionOptions.cookieOptions &&\n      \"maxAge\" in userSessionOptions.cookieOptions\n    ) {\n      // session cookie, do not set maxAge, consider token as infinite\n      if (userSessionOptions.cookieOptions.maxAge === undefined) {\n        options.ttl = 0;\n      } else {\n        options.cookieOptions.maxAge = computeCookieMaxAge(\n          userSessionOptions.cookieOptions.maxAge,\n        );\n      }\n    } else {\n      options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);\n    }\n\n    const sealFromCookies = cookie.parse(\n      \"credentials\" in req\n        ? req.headers.get(\"cookie\") || \"\"\n        : req.headers.cookie || \"\",\n    )[options.cookieName];\n\n    const session =\n      sealFromCookies === undefined\n        ? {}\n        : await unsealData<IronSessionData>(sealFromCookies, {\n            password: passwordsAsMap,\n            ttl: options.ttl,\n          });\n\n    Object.defineProperties(session, {\n      save: {\n        value: async function save() {\n          if (\"headersSent\" in res && res.headersSent === true) {\n            throw new Error(\n              `iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()`,\n            );\n          }\n          const seal = await sealData(session, {\n            password: passwordsAsMap,\n            ttl: options.ttl,\n          });\n          const cookieValue = cookie.serialize(\n            options.cookieName,\n            seal,\n            options.cookieOptions,\n          );\n\n          if (cookieValue.length > 4096) {\n            throw new Error(\n              `iron-session: Cookie length is too big ${cookieValue.length}, browsers will refuse it. Try to remove some data.`,\n            );\n          }\n\n          addToCookies(cookieValue, res);\n        },\n      },\n      destroy: {\n        value: function destroy() {\n          Object.keys(session).forEach((key) => {\n            // @ts-ignore See comment on the IronSessionData interface\n            delete session[key];\n          });\n\n          const cookieValue = cookie.serialize(options.cookieName, \"\", {\n            ...options.cookieOptions,\n            maxAge: 0,\n          });\n          addToCookies(cookieValue, res);\n        },\n      },\n    });\n\n    return session as IronSession;\n  };\n}\n\nfunction addToCookies(cookieValue: string, res: ResponseType) {\n  if (\"headers\" in res) {\n    res.headers.append(\"set-cookie\", cookieValue);\n    return;\n  }\n\n  let existingSetCookie =\n    (res.getHeader(\"set-cookie\") as string[] | string) ?? [];\n  if (typeof existingSetCookie === \"string\") {\n    existingSetCookie = [existingSetCookie];\n  }\n  res.setHeader(\"set-cookie\", [...existingSetCookie, cookieValue]);\n}\n\nfunction computeCookieMaxAge(ttl: number) {\n  // The next line makes sure browser will expire cookies before seals are considered expired by the server.\n  // It also allows for clock difference of 60 seconds maximum between server and clients.\n  // It also makes sure to expire the cookie immediately when value is 0\n  return ttl - timestampSkewSec;\n}\n\nexport function createUnsealData(_crypto: Crypto) {\n  return async <T = Record<string, unknown>>(\n    seal: string,\n    {\n      password,\n      ttl = fourteenDaysInSeconds,\n    }: { password: password; ttl?: number },\n  ): Promise<T> => {\n    const passwordsAsMap = normalizeStringPasswordToMap(password);\n    const { sealWithoutVersion, tokenVersion } = parseSeal(seal);\n\n    try {\n      const data = await Iron.unseal(\n        _crypto,\n        sealWithoutVersion,\n        passwordsAsMap,\n        { ...Iron.defaults, ttl: ttl * 1000 },\n      );\n\n      if (tokenVersion === 2) {\n        return data as T;\n      }\n\n      return {\n        // @ts-expect-error `persistent` does not exist on newer tokens\n        ...data.persistent,\n      };\n    } catch (error) {\n      if (error instanceof Error) {\n        if (\n          error.message === \"Expired seal\" ||\n          error.message === \"Bad hmac value\" ||\n          error.message === \"Cannot find password: \" ||\n          error.message === \"Incorrect number of sealed components\"\n        ) {\n          // if seal expired or\n          // if seal is not valid (encrypted using a different password, when passwords are badly rotated) or\n          // if we can't find back the password in the seal\n          // then we just start a new session over\n          return {} as T;\n        }\n      }\n\n      throw error;\n    }\n  };\n}\n\nfunction parseSeal(seal: string): {\n  sealWithoutVersion: string;\n  tokenVersion: number | null;\n} {\n  if (seal[seal.length - 2] === versionDelimiter) {\n    const [sealWithoutVersion, tokenVersionAsString] =\n      seal.split(versionDelimiter);\n    return {\n      sealWithoutVersion,\n      tokenVersion: parseInt(tokenVersionAsString, 10),\n    };\n  }\n\n  return { sealWithoutVersion: seal, tokenVersion: null };\n}\n\nexport function createSealData(_crypto: Crypto) {\n  return async (\n    data: unknown,\n    {\n      password,\n      ttl = fourteenDaysInSeconds,\n    }: { password: password; ttl?: number },\n  ) => {\n    const passwordsAsMap = normalizeStringPasswordToMap(password);\n\n    const mostRecentPasswordId = Math.max(\n      ...Object.keys(passwordsAsMap).map((id) => parseInt(id, 10)),\n    );\n\n    const passwordForSeal = {\n      id: mostRecentPasswordId.toString(),\n      secret: passwordsAsMap[mostRecentPasswordId],\n    };\n\n    const seal = await Iron.seal(_crypto, data, passwordForSeal, {\n      ...Iron.defaults,\n      ttl: ttl * 1000,\n    });\n\n    return `${seal}${versionDelimiter}${currentMajorVersion}`;\n  };\n}\n\nfunction normalizeStringPasswordToMap(password: password) {\n  return typeof password === \"string\" ? { 1: password } : password;\n}\n","import { createGetIronSession, createSealData, createUnsealData } from \"./core\";\nimport { Crypto } from \"@peculiar/webcrypto\";\n\nconst _crypto = new Crypto();\n\nexport * from \"./core\";\nexport const unsealData = createUnsealData(_crypto);\nexport const sealData = createSealData(_crypto);\nexport const getIronSession = createGetIronSession(\n  _crypto,\n  unsealData,\n  sealData,\n);\n"],"mappings":";AAAA,YAAY,UAAU;AAEtB,OAAO,YAAY;AAKnB,IAAM,mBAAmB;AAKzB,IAAM,wBAAwB,KAAK,KAAK;AAIxC,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AAEzB,IAAM,iBAGF;AAAA,EACF,KAAK;AAAA,EACL,eAAe;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,EACR;AACF;AAkEO,SAAS,qBACdA,UACAC,aACAC,WACA;AACA,SAAO,OACL,KACA,KACA,uBACyB;AACzB,QACE,CAAC,OACD,CAAC,OACD,CAAC,sBACD,CAAC,mBAAmB,cACpB,CAAC,mBAAmB,UACpB;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,iBAAiB;AAAA,MACrB,mBAAmB;AAAA,IACrB;AAEA,WAAO;AAAA,MACL,6BAA6B,mBAAmB,QAAQ;AAAA,IAC1D,EAAE,QAAQ,CAAC,aAAa;AACtB,UAAI,SAAS,SAAS,IAAI;AACxB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAED,UAAM,UAAwC;AAAA,MAC5C,GAAG;AAAA,MACH,GAAG;AAAA,MACH,eAAe;AAAA,QACb,GAAG,eAAe;AAAA,QAClB,GAAI,mBAAmB,iBAAiB,CAAC;AAAA,MAC3C;AAAA,IACF;AAEA,QAAI,QAAQ,QAAQ,GAAG;AAKrB,cAAQ,MAAM;AAAA,IAChB;AAEA,QACE,mBAAmB,iBACnB,YAAY,mBAAmB,eAC/B;AAEA,UAAI,mBAAmB,cAAc,WAAW,QAAW;AACzD,gBAAQ,MAAM;AAAA,MAChB,OAAO;AACL,gBAAQ,cAAc,SAAS;AAAA,UAC7B,mBAAmB,cAAc;AAAA,QACnC;AAAA,MACF;AAAA,IACF,OAAO;AACL,cAAQ,cAAc,SAAS,oBAAoB,QAAQ,GAAG;AAAA,IAChE;AAEA,UAAM,kBAAkB,OAAO;AAAA,MAC7B,iBAAiB,MACb,IAAI,QAAQ,IAAI,QAAQ,KAAK,KAC7B,IAAI,QAAQ,UAAU;AAAA,IAC5B,EAAE,QAAQ;AAEV,UAAM,UACJ,oBAAoB,SAChB,CAAC,IACD,MAAMD,YAA4B,iBAAiB;AAAA,MACjD,UAAU;AAAA,MACV,KAAK,QAAQ;AAAA,IACf,CAAC;AAEP,WAAO,iBAAiB,SAAS;AAAA,MAC/B,MAAM;AAAA,QACJ,OAAO,eAAe,OAAO;AAC3B,cAAI,iBAAiB,OAAO,IAAI,gBAAgB,MAAM;AACpD,kBAAM,IAAI;AAAA,cACR;AAAA,YACF;AAAA,UACF;AACA,gBAAME,QAAO,MAAMD,UAAS,SAAS;AAAA,YACnC,UAAU;AAAA,YACV,KAAK,QAAQ;AAAA,UACf,CAAC;AACD,gBAAM,cAAc,OAAO;AAAA,YACzB,QAAQ;AAAA,YACRC;AAAA,YACA,QAAQ;AAAA,UACV;AAEA,cAAI,YAAY,SAAS,MAAM;AAC7B,kBAAM,IAAI;AAAA,cACR,0CAA0C,YAAY;AAAA,YACxD;AAAA,UACF;AAEA,uBAAa,aAAa,GAAG;AAAA,QAC/B;AAAA,MACF;AAAA,MACA,SAAS;AAAA,QACP,OAAO,SAAS,UAAU;AACxB,iBAAO,KAAK,OAAO,EAAE,QAAQ,CAAC,QAAQ;AAEpC,mBAAO,QAAQ;AAAA,UACjB,CAAC;AAED,gBAAM,cAAc,OAAO,UAAU,QAAQ,YAAY,IAAI;AAAA,YAC3D,GAAG,QAAQ;AAAA,YACX,QAAQ;AAAA,UACV,CAAC;AACD,uBAAa,aAAa,GAAG;AAAA,QAC/B;AAAA,MACF;AAAA,IACF,CAAC;AAED,WAAO;AAAA,EACT;AACF;AAEA,SAAS,aAAa,aAAqB,KAAmB;AAlO9D;AAmOE,MAAI,aAAa,KAAK;AACpB,QAAI,QAAQ,OAAO,cAAc,WAAW;AAC5C;AAAA,EACF;AAEA,MAAI,qBACD,SAAI,UAAU,YAAY,MAA1B,YAAqD,CAAC;AACzD,MAAI,OAAO,sBAAsB,UAAU;AACzC,wBAAoB,CAAC,iBAAiB;AAAA,EACxC;AACA,MAAI,UAAU,cAAc,CAAC,GAAG,mBAAmB,WAAW,CAAC;AACjE;AAEA,SAAS,oBAAoB,KAAa;AAIxC,SAAO,MAAM;AACf;AAEO,SAAS,iBAAiBH,UAAiB;AAChD,SAAO,OACLG,OACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,MACe;AACf,UAAM,iBAAiB,6BAA6B,QAAQ;AAC5D,UAAM,EAAE,oBAAoB,aAAa,IAAI,UAAUA,KAAI;AAE3D,QAAI;AACF,YAAM,OAAO,MAAW;AAAA,QACtBH;AAAA,QACA;AAAA,QACA;AAAA,QACA,EAAE,GAAQ,eAAU,KAAK,MAAM,IAAK;AAAA,MACtC;AAEA,UAAI,iBAAiB,GAAG;AACtB,eAAO;AAAA,MACT;AAEA,aAAO;AAAA,QAEL,GAAG,KAAK;AAAA,MACV;AAAA,IACF,SAAS,OAAP;AACA,UAAI,iBAAiB,OAAO;AAC1B,YACE,MAAM,YAAY,kBAClB,MAAM,YAAY,oBAClB,MAAM,YAAY,4BAClB,MAAM,YAAY,yCAClB;AAKA,iBAAO,CAAC;AAAA,QACV;AAAA,MACF;AAEA,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,UAAUG,OAGjB;AACA,MAAIA,MAAKA,MAAK,SAAS,OAAO,kBAAkB;AAC9C,UAAM,CAAC,oBAAoB,oBAAoB,IAC7CA,MAAK,MAAM,gBAAgB;AAC7B,WAAO;AAAA,MACL;AAAA,MACA,cAAc,SAAS,sBAAsB,EAAE;AAAA,IACjD;AAAA,EACF;AAEA,SAAO,EAAE,oBAAoBA,OAAM,cAAc,KAAK;AACxD;AAEO,SAAS,eAAeH,UAAiB;AAC9C,SAAO,OACL,MACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,MACG;AACH,UAAM,iBAAiB,6BAA6B,QAAQ;AAE5D,UAAM,uBAAuB,KAAK;AAAA,MAChC,GAAG,OAAO,KAAK,cAAc,EAAE,IAAI,CAAC,OAAO,SAAS,IAAI,EAAE,CAAC;AAAA,IAC7D;AAEA,UAAM,kBAAkB;AAAA,MACtB,IAAI,qBAAqB,SAAS;AAAA,MAClC,QAAQ,eAAe;AAAA,IACzB;AAEA,UAAMG,QAAO,MAAW,UAAKH,UAAS,MAAM,iBAAiB;AAAA,MAC3D,GAAQ;AAAA,MACR,KAAK,MAAM;AAAA,IACb,CAAC;AAED,WAAO,GAAGG,QAAO,mBAAmB;AAAA,EACtC;AACF;AAEA,SAAS,6BAA6B,UAAoB;AACxD,SAAO,OAAO,aAAa,WAAW,EAAE,GAAG,SAAS,IAAI;AAC1D;;;ACpVA,SAAS,cAAc;AAEvB,IAAM,UAAU,IAAI,OAAO;AAGpB,IAAM,aAAa,iBAAiB,OAAO;AAC3C,IAAM,WAAW,eAAe,OAAO;AACvC,IAAM,iBAAiB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AACF;","names":["_crypto","unsealData","sealData","seal"]}
+{"version":3,"sources":["../src/core.ts","../src/index.ts"],"sourcesContent":["import * as Iron from \"iron-webcrypto\";\nimport type { CookieSerializeOptions } from \"cookie\";\nimport cookie from \"cookie\";\nimport type { IncomingMessage, ServerResponse } from \"http\";\n\n// default time allowed to check for iron seal validity when ttl passed\n// see https://hapi.dev/family/iron/api/?v=6.0.0#options\nconst timestampSkewSec = 60;\n\ntype passwordsMap = { [id: string]: string };\ntype password = string | passwordsMap;\n\nconst fourteenDaysInSeconds = 15 * 24 * 3600;\n\n// We store a token major version to handle data format changes when any. So that when you upgrade the cookies\n// can be kept alive between upgrades, no need to disconnect everyone.\nconst currentMajorVersion = 2;\nconst versionDelimiter = \"~\";\n\nconst defaultOptions: {\n  ttl: number;\n  cookieOptions: CookieSerializeOptions;\n} = {\n  ttl: fourteenDaysInSeconds,\n  cookieOptions: {\n    httpOnly: true,\n    secure: true,\n    sameSite: \"lax\",\n    path: \"/\",\n  },\n};\n\nexport interface IronSessionOptions {\n  /**\n   * This is the cookie name that will be used inside the browser. You should make sure it's unique given\n   * your application. Example: vercel-session\n   */\n  cookieName: string;\n\n  /**\n   * This is the password(s) that will be used to encrypt the cookie. It can be either a string or an object\n   * like {1: \"password\", 2: password}.\n   *\n   * When you provide multiple passwords then all of them will be used to decrypt the cookie and only the most\n   * recent (= highest key, 2 in this example) password will be used to encrypt the cookie. This allow you\n   * to use password rotation (security)\n   */\n  password: password;\n\n  /**\n   * This is the time in seconds that the session will be valid for. This also set the max-age attribute of\n   * the cookie automatically (minus 60 seconds so that the cookie always expire before the session).\n   */\n  ttl?: number;\n\n  /**\n   * This is the options that will be passed to the cookie library.\n   * You can see all of them here: https://github.com/jshttp/cookie#options-1.\n   *\n   * If you want to use \"session cookies\" (cookies that are deleted when the browser is closed) then you need\n   * to pass cookieOptions: { maxAge: undefined }.\n   */\n  cookieOptions?: CookieSerializeOptions;\n}\n\n// eslint-disable-next-line @typescript-eslint/no-empty-interface\nexport interface IronSessionData {\n  // If we allow for any keys, then there's no more type check on unknown properties\n  // which is not good\n  // If we allow for any keys, the later delete will work but I prefer to disable the\n  // check at this stage and\n  // provide good type checking instead\n  // [key: string]: unknown;\n}\n\nexport type IronSession = IronSessionData & {\n  /**\n   * Destroys the session data and removes the cookie.\n   */\n  destroy: () => void;\n\n  /**\n   * Encrypts the session data and sets the cookie.\n   */\n  save: () => Promise<void>;\n};\n\ndeclare module \"http\" {\n  interface IncomingMessage {\n    session: IronSession;\n  }\n}\n\ntype RequestType = IncomingMessage | Request;\ntype ResponseType = ServerResponse | Response;\n\nexport function createGetIronSession(\n  _crypto: Crypto,\n  unsealData: ReturnType<typeof createUnsealData>,\n  sealData: ReturnType<typeof createSealData>,\n) {\n  return async (\n    req: RequestType,\n    res: ResponseType,\n    userSessionOptions: IronSessionOptions,\n  ): Promise<IronSession> => {\n    if (\n      !req ||\n      !res ||\n      !userSessionOptions ||\n      !userSessionOptions.cookieName ||\n      !userSessionOptions.password\n    ) {\n      throw new Error(\n        `iron-session: Bad usage. Minimum usage is const session = await getIronSession(req, res, { cookieName: \"...\", password: \"...\". Check the usage here: https://github.com/vvo/iron-session`,\n      );\n    }\n\n    const passwordsAsMap = normalizeStringPasswordToMap(\n      userSessionOptions.password,\n    );\n\n    Object.values(\n      normalizeStringPasswordToMap(userSessionOptions.password),\n    ).forEach((password) => {\n      if (password.length < 32) {\n        throw new Error(\n          `iron-session: Bad usage. Password must be at least 32 characters long.`,\n        );\n      }\n    });\n\n    const options: Required<IronSessionOptions> = {\n      ...defaultOptions,\n      ...userSessionOptions,\n      cookieOptions: {\n        ...defaultOptions.cookieOptions,\n        ...(userSessionOptions.cookieOptions || {}),\n      },\n    };\n\n    if (options.ttl === 0) {\n      // ttl = 0 means no expiration\n      // but in reality cookies have to expire (can't have no max-age)\n      // 2147483647 is the max value for max-age in cookies\n      // see https://stackoverflow.com/a/11685301/147079\n      options.ttl = 2147483647;\n    }\n\n    if (\n      userSessionOptions.cookieOptions &&\n      \"maxAge\" in userSessionOptions.cookieOptions\n    ) {\n      // session cookie, do not set maxAge, consider token as infinite\n      if (userSessionOptions.cookieOptions.maxAge === undefined) {\n        options.ttl = 0;\n      } else {\n        options.cookieOptions.maxAge = computeCookieMaxAge(\n          userSessionOptions.cookieOptions.maxAge,\n        );\n      }\n    } else {\n      options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);\n    }\n\n    const sealFromCookies = cookie.parse(\n      \"credentials\" in req\n        ? req.headers.get(\"cookie\") || \"\"\n        : req.headers.cookie || \"\",\n    )[options.cookieName];\n\n    const session =\n      sealFromCookies === undefined\n        ? {}\n        : await unsealData<IronSessionData>(sealFromCookies, {\n            password: passwordsAsMap,\n            ttl: options.ttl,\n          });\n\n    Object.defineProperties(session, {\n      save: {\n        value: async function save() {\n          if (\"headersSent\" in res && res.headersSent === true) {\n            throw new Error(\n              `iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()`,\n            );\n          }\n          const seal = await sealData(session, {\n            password: passwordsAsMap,\n            ttl: options.ttl,\n          });\n          const cookieValue = cookie.serialize(\n            options.cookieName,\n            seal,\n            options.cookieOptions,\n          );\n\n          if (cookieValue.length > 4096) {\n            throw new Error(\n              `iron-session: Cookie length is too big ${cookieValue.length}, browsers will refuse it. Try to remove some data.`,\n            );\n          }\n\n          addToCookies(cookieValue, res);\n        },\n      },\n      destroy: {\n        value: function destroy() {\n          Object.keys(session).forEach((key) => {\n            // @ts-ignore See comment on the IronSessionData interface\n            delete session[key];\n          });\n\n          const cookieValue = cookie.serialize(options.cookieName, \"\", {\n            ...options.cookieOptions,\n            maxAge: 0,\n          });\n          addToCookies(cookieValue, res);\n        },\n      },\n    });\n\n    return session as IronSession;\n  };\n}\n\nfunction addToCookies(cookieValue: string, res: ResponseType) {\n  if (\"headers\" in res) {\n    res.headers.append(\"set-cookie\", cookieValue);\n    return;\n  }\n\n  let existingSetCookie =\n    (res.getHeader(\"set-cookie\") as string[] | string) ?? [];\n  if (typeof existingSetCookie === \"string\") {\n    existingSetCookie = [existingSetCookie];\n  }\n  res.setHeader(\"set-cookie\", [...existingSetCookie, cookieValue]);\n}\n\nfunction computeCookieMaxAge(ttl: number) {\n  // The next line makes sure browser will expire cookies before seals are considered expired by the server.\n  // It also allows for clock difference of 60 seconds maximum between server and clients.\n  // It also makes sure to expire the cookie immediately when value is 0\n  return ttl - timestampSkewSec;\n}\n\nexport function createUnsealData(_crypto: Crypto) {\n  return async <T = Record<string, unknown>>(\n    seal: string,\n    {\n      password,\n      ttl = fourteenDaysInSeconds,\n    }: { password: password; ttl?: number },\n  ): Promise<T> => {\n    const passwordsAsMap = normalizeStringPasswordToMap(password);\n    const { sealWithoutVersion, tokenVersion } = parseSeal(seal);\n\n    try {\n      const data =\n        (await Iron.unseal(_crypto, sealWithoutVersion, passwordsAsMap, {\n          ...Iron.defaults,\n          ttl: ttl * 1000,\n        })) || {};\n\n      if (tokenVersion === 2) {\n        return data as T;\n      }\n\n      return {\n        // @ts-expect-error `persistent` does not exist on newer tokens\n        ...data.persistent,\n      };\n    } catch (error) {\n      if (error instanceof Error) {\n        if (\n          error.message === \"Expired seal\" ||\n          error.message === \"Bad hmac value\" ||\n          error.message.startsWith(\"Cannot find password: \") ||\n          error.message === \"Incorrect number of sealed components\"\n        ) {\n          // if seal expired or\n          // if seal is not valid (encrypted using a different password, when passwords are badly rotated) or\n          // if we can't find back the password in the seal\n          // then we just start a new session over\n          return {} as T;\n        }\n      }\n\n      throw error;\n    }\n  };\n}\n\nfunction parseSeal(seal: string): {\n  sealWithoutVersion: string;\n  tokenVersion: number | null;\n} {\n  if (seal[seal.length - 2] === versionDelimiter) {\n    const [sealWithoutVersion, tokenVersionAsString] =\n      seal.split(versionDelimiter);\n    return {\n      sealWithoutVersion,\n      tokenVersion: parseInt(tokenVersionAsString, 10),\n    };\n  }\n\n  return { sealWithoutVersion: seal, tokenVersion: null };\n}\n\nexport function createSealData(_crypto: Crypto) {\n  return async (\n    data: unknown,\n    {\n      password,\n      ttl = fourteenDaysInSeconds,\n    }: { password: password; ttl?: number },\n  ) => {\n    const passwordsAsMap = normalizeStringPasswordToMap(password);\n\n    const mostRecentPasswordId = Math.max(\n      ...Object.keys(passwordsAsMap).map((id) => parseInt(id, 10)),\n    );\n\n    const passwordForSeal = {\n      id: mostRecentPasswordId.toString(),\n      secret: passwordsAsMap[mostRecentPasswordId],\n    };\n\n    const seal = await Iron.seal(_crypto, data, passwordForSeal, {\n      ...Iron.defaults,\n      ttl: ttl * 1000,\n    });\n\n    return `${seal}${versionDelimiter}${currentMajorVersion}`;\n  };\n}\n\nfunction normalizeStringPasswordToMap(password: password) {\n  return typeof password === \"string\" ? { 1: password } : password;\n}\n","import { createGetIronSession, createSealData, createUnsealData } from \"./core\";\nimport { Crypto } from \"@peculiar/webcrypto\";\n\nconst _crypto = new Crypto();\n\nexport * from \"./core\";\nexport const unsealData = createUnsealData(_crypto);\nexport const sealData = createSealData(_crypto);\nexport const getIronSession = createGetIronSession(\n  _crypto,\n  unsealData,\n  sealData,\n);\n"],"mappings":";AAAA,YAAY,UAAU;AAEtB,OAAO,YAAY;AAKnB,IAAM,mBAAmB;AAKzB,IAAM,wBAAwB,KAAK,KAAK;AAIxC,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AAEzB,IAAM,iBAGF;AAAA,EACF,KAAK;AAAA,EACL,eAAe;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,EACR;AACF;AAkEO,SAAS,qBACdA,UACAC,aACAC,WACA;AACA,SAAO,OACL,KACA,KACA,uBACyB;AACzB,QACE,CAAC,OACD,CAAC,OACD,CAAC,sBACD,CAAC,mBAAmB,cACpB,CAAC,mBAAmB,UACpB;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,iBAAiB;AAAA,MACrB,mBAAmB;AAAA,IACrB;AAEA,WAAO;AAAA,MACL,6BAA6B,mBAAmB,QAAQ;AAAA,IAC1D,EAAE,QAAQ,CAAC,aAAa;AACtB,UAAI,SAAS,SAAS,IAAI;AACxB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAED,UAAM,UAAwC;AAAA,MAC5C,GAAG;AAAA,MACH,GAAG;AAAA,MACH,eAAe;AAAA,QACb,GAAG,eAAe;AAAA,QAClB,GAAI,mBAAmB,iBAAiB,CAAC;AAAA,MAC3C;AAAA,IACF;AAEA,QAAI,QAAQ,QAAQ,GAAG;AAKrB,cAAQ,MAAM;AAAA,IAChB;AAEA,QACE,mBAAmB,iBACnB,YAAY,mBAAmB,eAC/B;AAEA,UAAI,mBAAmB,cAAc,WAAW,QAAW;AACzD,gBAAQ,MAAM;AAAA,MAChB,OAAO;AACL,gBAAQ,cAAc,SAAS;AAAA,UAC7B,mBAAmB,cAAc;AAAA,QACnC;AAAA,MACF;AAAA,IACF,OAAO;AACL,cAAQ,cAAc,SAAS,oBAAoB,QAAQ,GAAG;AAAA,IAChE;AAEA,UAAM,kBAAkB,OAAO;AAAA,MAC7B,iBAAiB,MACb,IAAI,QAAQ,IAAI,QAAQ,KAAK,KAC7B,IAAI,QAAQ,UAAU;AAAA,IAC5B,EAAE,QAAQ;AAEV,UAAM,UACJ,oBAAoB,SAChB,CAAC,IACD,MAAMD,YAA4B,iBAAiB;AAAA,MACjD,UAAU;AAAA,MACV,KAAK,QAAQ;AAAA,IACf,CAAC;AAEP,WAAO,iBAAiB,SAAS;AAAA,MAC/B,MAAM;AAAA,QACJ,OAAO,eAAe,OAAO;AAC3B,cAAI,iBAAiB,OAAO,IAAI,gBAAgB,MAAM;AACpD,kBAAM,IAAI;AAAA,cACR;AAAA,YACF;AAAA,UACF;AACA,gBAAME,QAAO,MAAMD,UAAS,SAAS;AAAA,YACnC,UAAU;AAAA,YACV,KAAK,QAAQ;AAAA,UACf,CAAC;AACD,gBAAM,cAAc,OAAO;AAAA,YACzB,QAAQ;AAAA,YACRC;AAAA,YACA,QAAQ;AAAA,UACV;AAEA,cAAI,YAAY,SAAS,MAAM;AAC7B,kBAAM,IAAI;AAAA,cACR,0CAA0C,YAAY;AAAA,YACxD;AAAA,UACF;AAEA,uBAAa,aAAa,GAAG;AAAA,QAC/B;AAAA,MACF;AAAA,MACA,SAAS;AAAA,QACP,OAAO,SAAS,UAAU;AACxB,iBAAO,KAAK,OAAO,EAAE,QAAQ,CAAC,QAAQ;AAEpC,mBAAO,QAAQ;AAAA,UACjB,CAAC;AAED,gBAAM,cAAc,OAAO,UAAU,QAAQ,YAAY,IAAI;AAAA,YAC3D,GAAG,QAAQ;AAAA,YACX,QAAQ;AAAA,UACV,CAAC;AACD,uBAAa,aAAa,GAAG;AAAA,QAC/B;AAAA,MACF;AAAA,IACF,CAAC;AAED,WAAO;AAAA,EACT;AACF;AAEA,SAAS,aAAa,aAAqB,KAAmB;AAlO9D;AAmOE,MAAI,aAAa,KAAK;AACpB,QAAI,QAAQ,OAAO,cAAc,WAAW;AAC5C;AAAA,EACF;AAEA,MAAI,qBACD,SAAI,UAAU,YAAY,MAA1B,YAAqD,CAAC;AACzD,MAAI,OAAO,sBAAsB,UAAU;AACzC,wBAAoB,CAAC,iBAAiB;AAAA,EACxC;AACA,MAAI,UAAU,cAAc,CAAC,GAAG,mBAAmB,WAAW,CAAC;AACjE;AAEA,SAAS,oBAAoB,KAAa;AAIxC,SAAO,MAAM;AACf;AAEO,SAAS,iBAAiBH,UAAiB;AAChD,SAAO,OACLG,OACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,MACe;AACf,UAAM,iBAAiB,6BAA6B,QAAQ;AAC5D,UAAM,EAAE,oBAAoB,aAAa,IAAI,UAAUA,KAAI;AAE3D,QAAI;AACF,YAAM,OACH,MAAW,YAAOH,UAAS,oBAAoB,gBAAgB;AAAA,QAC9D,GAAQ;AAAA,QACR,KAAK,MAAM;AAAA,MACb,CAAC,KAAM,CAAC;AAEV,UAAI,iBAAiB,GAAG;AACtB,eAAO;AAAA,MACT;AAEA,aAAO;AAAA,QAEL,GAAG,KAAK;AAAA,MACV;AAAA,IACF,SAAS,OAAP;AACA,UAAI,iBAAiB,OAAO;AAC1B,YACE,MAAM,YAAY,kBAClB,MAAM,YAAY,oBAClB,MAAM,QAAQ,WAAW,wBAAwB,KACjD,MAAM,YAAY,yCAClB;AAKA,iBAAO,CAAC;AAAA,QACV;AAAA,MACF;AAEA,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,UAAUG,OAGjB;AACA,MAAIA,MAAKA,MAAK,SAAS,OAAO,kBAAkB;AAC9C,UAAM,CAAC,oBAAoB,oBAAoB,IAC7CA,MAAK,MAAM,gBAAgB;AAC7B,WAAO;AAAA,MACL;AAAA,MACA,cAAc,SAAS,sBAAsB,EAAE;AAAA,IACjD;AAAA,EACF;AAEA,SAAO,EAAE,oBAAoBA,OAAM,cAAc,KAAK;AACxD;AAEO,SAAS,eAAeH,UAAiB;AAC9C,SAAO,OACL,MACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,MACG;AACH,UAAM,iBAAiB,6BAA6B,QAAQ;AAE5D,UAAM,uBAAuB,KAAK;AAAA,MAChC,GAAG,OAAO,KAAK,cAAc,EAAE,IAAI,CAAC,OAAO,SAAS,IAAI,EAAE,CAAC;AAAA,IAC7D;AAEA,UAAM,kBAAkB;AAAA,MACtB,IAAI,qBAAqB,SAAS;AAAA,MAClC,QAAQ,eAAe;AAAA,IACzB;AAEA,UAAMG,QAAO,MAAW,UAAKH,UAAS,MAAM,iBAAiB;AAAA,MAC3D,GAAQ;AAAA,MACR,KAAK,MAAM;AAAA,IACb,CAAC;AAED,WAAO,GAAGG,QAAO,mBAAmB;AAAA,EACtC;AACF;AAEA,SAAS,6BAA6B,UAAoB;AACxD,SAAO,OAAO,aAAa,WAAW,EAAE,GAAG,SAAS,IAAI;AAC1D;;;ACnVA,SAAS,cAAc;AAEvB,IAAM,UAAU,IAAI,OAAO;AAGpB,IAAM,aAAa,iBAAiB,OAAO;AAC3C,IAAM,WAAW,eAAe,OAAO;AACvC,IAAM,iBAAiB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AACF;","names":["_crypto","unsealData","sealData","seal"]}

package/edge/dist/index.js

@@ -160,12 +160,10 @@ function createUnsealData(_crypto2) {
     const passwordsAsMap = normalizeStringPasswordToMap(password);
     const { sealWithoutVersion, tokenVersion } = parseSeal(seal2);
     try {
-      const data = await Iron.unseal(
-        _crypto2,
-        sealWithoutVersion,
-        passwordsAsMap,
-        { ...Iron.defaults, ttl: ttl * 1e3 }
-      );
+      const data = await Iron.unseal(_crypto2, sealWithoutVersion, passwordsAsMap, {
+        ...Iron.defaults,
+        ttl: ttl * 1e3
+      }) || {};
       if (tokenVersion === 2) {
         return data;
       }
@@ -174,7 +172,7 @@ function createUnsealData(_crypto2) {
       };
     } catch (error) {
       if (error instanceof Error) {
-        if (error.message === "Expired seal" || error.message === "Bad hmac value" || error.message === "Cannot find password: " || error.message === "Incorrect number of sealed components") {
+        if (error.message === "Expired seal" || error.message === "Bad hmac value" || error.message.startsWith("Cannot find password: ") || error.message === "Incorrect number of sealed components") {
           return {};
         }
       }

package/edge/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../index.ts","../../src/core.ts"],"sourcesContent":["// This allows the types to be linked from the main module instead of duplicated\nexport type { IronSessionOptions, IronSessionData } from \"iron-session\";\n\nimport {\n  createGetIronSession,\n  createSealData,\n  createUnsealData,\n} from \"../src/core\";\n\nconst getCrypto = (): Crypto => {\n  if (typeof globalThis.crypto?.subtle === \"object\") return globalThis.crypto;\n  // @ts-ignore crypto.webcrypto is not available in dom, but is there in newer node versions\n  if (typeof globalThis.crypto?.webcrypto?.subtle === \"object\")\n    // @ts-ignore same as above\n    return globalThis.crypto.webcrypto;\n  throw new Error(\n    \"no native implementation of WebCrypto is available in current context\",\n  );\n};\n\nconst _crypto = getCrypto();\n\nexport const unsealData = createUnsealData(_crypto);\nexport const sealData = createSealData(_crypto);\nexport const getIronSession = createGetIronSession(\n  _crypto,\n  unsealData,\n  sealData,\n);\n","import * as Iron from \"iron-webcrypto\";\nimport type { CookieSerializeOptions } from \"cookie\";\nimport cookie from \"cookie\";\nimport type { IncomingMessage, ServerResponse } from \"http\";\n\n// default time allowed to check for iron seal validity when ttl passed\n// see https://hapi.dev/family/iron/api/?v=6.0.0#options\nconst timestampSkewSec = 60;\n\ntype passwordsMap = { [id: string]: string };\ntype password = string | passwordsMap;\n\nconst fourteenDaysInSeconds = 15 * 24 * 3600;\n\n// We store a token major version to handle data format changes when any. So that when you upgrade the cookies\n// can be kept alive between upgrades, no need to disconnect everyone.\nconst currentMajorVersion = 2;\nconst versionDelimiter = \"~\";\n\nconst defaultOptions: {\n  ttl: number;\n  cookieOptions: CookieSerializeOptions;\n} = {\n  ttl: fourteenDaysInSeconds,\n  cookieOptions: {\n    httpOnly: true,\n    secure: true,\n    sameSite: \"lax\",\n    path: \"/\",\n  },\n};\n\nexport interface IronSessionOptions {\n  /**\n   * This is the cookie name that will be used inside the browser. You should make sure it's unique given\n   * your application. Example: vercel-session\n   */\n  cookieName: string;\n\n  /**\n   * This is the password(s) that will be used to encrypt the cookie. It can be either a string or an object\n   * like {1: \"password\", 2: password}.\n   *\n   * When you provide multiple passwords then all of them will be used to decrypt the cookie and only the most\n   * recent (= highest key, 2 in this example) password will be used to encrypt the cookie. This allow you\n   * to use password rotation (security)\n   */\n  password: password;\n\n  /**\n   * This is the time in seconds that the session will be valid for. This also set the max-age attribute of\n   * the cookie automatically (minus 60 seconds so that the cookie always expire before the session).\n   */\n  ttl?: number;\n\n  /**\n   * This is the options that will be passed to the cookie library.\n   * You can see all of them here: https://github.com/jshttp/cookie#options-1.\n   *\n   * If you want to use \"session cookies\" (cookies that are deleted when the browser is closed) then you need\n   * to pass cookieOptions: { maxAge: undefined }.\n   */\n  cookieOptions?: CookieSerializeOptions;\n}\n\n// eslint-disable-next-line @typescript-eslint/no-empty-interface\nexport interface IronSessionData {\n  // If we allow for any keys, then there's no more type check on unknown properties\n  // which is not good\n  // If we allow for any keys, the later delete will work but I prefer to disable the\n  // check at this stage and\n  // provide good type checking instead\n  // [key: string]: unknown;\n}\n\nexport type IronSession = IronSessionData & {\n  /**\n   * Destroys the session data and removes the cookie.\n   */\n  destroy: () => void;\n\n  /**\n   * Encrypts the session data and sets the cookie.\n   */\n  save: () => Promise<void>;\n};\n\ndeclare module \"http\" {\n  interface IncomingMessage {\n    session: IronSession;\n  }\n}\n\ntype RequestType = IncomingMessage | Request;\ntype ResponseType = ServerResponse | Response;\n\nexport function createGetIronSession(\n  _crypto: Crypto,\n  unsealData: ReturnType<typeof createUnsealData>,\n  sealData: ReturnType<typeof createSealData>,\n) {\n  return async (\n    req: RequestType,\n    res: ResponseType,\n    userSessionOptions: IronSessionOptions,\n  ): Promise<IronSession> => {\n    if (\n      !req ||\n      !res ||\n      !userSessionOptions ||\n      !userSessionOptions.cookieName ||\n      !userSessionOptions.password\n    ) {\n      throw new Error(\n        `iron-session: Bad usage. Minimum usage is const session = await getIronSession(req, res, { cookieName: \"...\", password: \"...\". Check the usage here: https://github.com/vvo/iron-session`,\n      );\n    }\n\n    const passwordsAsMap = normalizeStringPasswordToMap(\n      userSessionOptions.password,\n    );\n\n    Object.values(\n      normalizeStringPasswordToMap(userSessionOptions.password),\n    ).forEach((password) => {\n      if (password.length < 32) {\n        throw new Error(\n          `iron-session: Bad usage. Password must be at least 32 characters long.`,\n        );\n      }\n    });\n\n    const options: Required<IronSessionOptions> = {\n      ...defaultOptions,\n      ...userSessionOptions,\n      cookieOptions: {\n        ...defaultOptions.cookieOptions,\n        ...(userSessionOptions.cookieOptions || {}),\n      },\n    };\n\n    if (options.ttl === 0) {\n      // ttl = 0 means no expiration\n      // but in reality cookies have to expire (can't have no max-age)\n      // 2147483647 is the max value for max-age in cookies\n      // see https://stackoverflow.com/a/11685301/147079\n      options.ttl = 2147483647;\n    }\n\n    if (\n      userSessionOptions.cookieOptions &&\n      \"maxAge\" in userSessionOptions.cookieOptions\n    ) {\n      // session cookie, do not set maxAge, consider token as infinite\n      if (userSessionOptions.cookieOptions.maxAge === undefined) {\n        options.ttl = 0;\n      } else {\n        options.cookieOptions.maxAge = computeCookieMaxAge(\n          userSessionOptions.cookieOptions.maxAge,\n        );\n      }\n    } else {\n      options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);\n    }\n\n    const sealFromCookies = cookie.parse(\n      \"credentials\" in req\n        ? req.headers.get(\"cookie\") || \"\"\n        : req.headers.cookie || \"\",\n    )[options.cookieName];\n\n    const session =\n      sealFromCookies === undefined\n        ? {}\n        : await unsealData<IronSessionData>(sealFromCookies, {\n            password: passwordsAsMap,\n            ttl: options.ttl,\n          });\n\n    Object.defineProperties(session, {\n      save: {\n        value: async function save() {\n          if (\"headersSent\" in res && res.headersSent === true) {\n            throw new Error(\n              `iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()`,\n            );\n          }\n          const seal = await sealData(session, {\n            password: passwordsAsMap,\n            ttl: options.ttl,\n          });\n          const cookieValue = cookie.serialize(\n            options.cookieName,\n            seal,\n            options.cookieOptions,\n          );\n\n          if (cookieValue.length > 4096) {\n            throw new Error(\n              `iron-session: Cookie length is too big ${cookieValue.length}, browsers will refuse it. Try to remove some data.`,\n            );\n          }\n\n          addToCookies(cookieValue, res);\n        },\n      },\n      destroy: {\n        value: function destroy() {\n          Object.keys(session).forEach((key) => {\n            // @ts-ignore See comment on the IronSessionData interface\n            delete session[key];\n          });\n\n          const cookieValue = cookie.serialize(options.cookieName, \"\", {\n            ...options.cookieOptions,\n            maxAge: 0,\n          });\n          addToCookies(cookieValue, res);\n        },\n      },\n    });\n\n    return session as IronSession;\n  };\n}\n\nfunction addToCookies(cookieValue: string, res: ResponseType) {\n  if (\"headers\" in res) {\n    res.headers.append(\"set-cookie\", cookieValue);\n    return;\n  }\n\n  let existingSetCookie =\n    (res.getHeader(\"set-cookie\") as string[] | string) ?? [];\n  if (typeof existingSetCookie === \"string\") {\n    existingSetCookie = [existingSetCookie];\n  }\n  res.setHeader(\"set-cookie\", [...existingSetCookie, cookieValue]);\n}\n\nfunction computeCookieMaxAge(ttl: number) {\n  // The next line makes sure browser will expire cookies before seals are considered expired by the server.\n  // It also allows for clock difference of 60 seconds maximum between server and clients.\n  // It also makes sure to expire the cookie immediately when value is 0\n  return ttl - timestampSkewSec;\n}\n\nexport function createUnsealData(_crypto: Crypto) {\n  return async <T = Record<string, unknown>>(\n    seal: string,\n    {\n      password,\n      ttl = fourteenDaysInSeconds,\n    }: { password: password; ttl?: number },\n  ): Promise<T> => {\n    const passwordsAsMap = normalizeStringPasswordToMap(password);\n    const { sealWithoutVersion, tokenVersion } = parseSeal(seal);\n\n    try {\n      const data = await Iron.unseal(\n        _crypto,\n        sealWithoutVersion,\n        passwordsAsMap,\n        { ...Iron.defaults, ttl: ttl * 1000 },\n      );\n\n      if (tokenVersion === 2) {\n        return data as T;\n      }\n\n      return {\n        // @ts-expect-error `persistent` does not exist on newer tokens\n        ...data.persistent,\n      };\n    } catch (error) {\n      if (error instanceof Error) {\n        if (\n          error.message === \"Expired seal\" ||\n          error.message === \"Bad hmac value\" ||\n          error.message === \"Cannot find password: \" ||\n          error.message === \"Incorrect number of sealed components\"\n        ) {\n          // if seal expired or\n          // if seal is not valid (encrypted using a different password, when passwords are badly rotated) or\n          // if we can't find back the password in the seal\n          // then we just start a new session over\n          return {} as T;\n        }\n      }\n\n      throw error;\n    }\n  };\n}\n\nfunction parseSeal(seal: string): {\n  sealWithoutVersion: string;\n  tokenVersion: number | null;\n} {\n  if (seal[seal.length - 2] === versionDelimiter) {\n    const [sealWithoutVersion, tokenVersionAsString] =\n      seal.split(versionDelimiter);\n    return {\n      sealWithoutVersion,\n      tokenVersion: parseInt(tokenVersionAsString, 10),\n    };\n  }\n\n  return { sealWithoutVersion: seal, tokenVersion: null };\n}\n\nexport function createSealData(_crypto: Crypto) {\n  return async (\n    data: unknown,\n    {\n      password,\n      ttl = fourteenDaysInSeconds,\n    }: { password: password; ttl?: number },\n  ) => {\n    const passwordsAsMap = normalizeStringPasswordToMap(password);\n\n    const mostRecentPasswordId = Math.max(\n      ...Object.keys(passwordsAsMap).map((id) => parseInt(id, 10)),\n    );\n\n    const passwordForSeal = {\n      id: mostRecentPasswordId.toString(),\n      secret: passwordsAsMap[mostRecentPasswordId],\n    };\n\n    const seal = await Iron.seal(_crypto, data, passwordForSeal, {\n      ...Iron.defaults,\n      ttl: ttl * 1000,\n    });\n\n    return `${seal}${versionDelimiter}${currentMajorVersion}`;\n  };\n}\n\nfunction normalizeStringPasswordToMap(password: password) {\n  return typeof password === \"string\" ? { 1: password } : password;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,WAAsB;AAEtB,oBAAmB;AAKnB,IAAM,mBAAmB;AAKzB,IAAM,wBAAwB,KAAK,KAAK;AAIxC,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AAEzB,IAAM,iBAGF;AAAA,EACF,KAAK;AAAA,EACL,eAAe;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,EACR;AACF;AAkEO,SAAS,qBACdA,UACAC,aACAC,WACA;AACA,SAAO,OACL,KACA,KACA,uBACyB;AACzB,QACE,CAAC,OACD,CAAC,OACD,CAAC,sBACD,CAAC,mBAAmB,cACpB,CAAC,mBAAmB,UACpB;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,iBAAiB;AAAA,MACrB,mBAAmB;AAAA,IACrB;AAEA,WAAO;AAAA,MACL,6BAA6B,mBAAmB,QAAQ;AAAA,IAC1D,EAAE,QAAQ,CAAC,aAAa;AACtB,UAAI,SAAS,SAAS,IAAI;AACxB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAED,UAAM,UAAwC;AAAA,MAC5C,GAAG;AAAA,MACH,GAAG;AAAA,MACH,eAAe;AAAA,QACb,GAAG,eAAe;AAAA,QAClB,GAAI,mBAAmB,iBAAiB,CAAC;AAAA,MAC3C;AAAA,IACF;AAEA,QAAI,QAAQ,QAAQ,GAAG;AAKrB,cAAQ,MAAM;AAAA,IAChB;AAEA,QACE,mBAAmB,iBACnB,YAAY,mBAAmB,eAC/B;AAEA,UAAI,mBAAmB,cAAc,WAAW,QAAW;AACzD,gBAAQ,MAAM;AAAA,MAChB,OAAO;AACL,gBAAQ,cAAc,SAAS;AAAA,UAC7B,mBAAmB,cAAc;AAAA,QACnC;AAAA,MACF;AAAA,IACF,OAAO;AACL,cAAQ,cAAc,SAAS,oBAAoB,QAAQ,GAAG;AAAA,IAChE;AAEA,UAAM,kBAAkB,cAAAC,QAAO;AAAA,MAC7B,iBAAiB,MACb,IAAI,QAAQ,IAAI,QAAQ,KAAK,KAC7B,IAAI,QAAQ,UAAU;AAAA,IAC5B,EAAE,QAAQ;AAEV,UAAM,UACJ,oBAAoB,SAChB,CAAC,IACD,MAAMF,YAA4B,iBAAiB;AAAA,MACjD,UAAU;AAAA,MACV,KAAK,QAAQ;AAAA,IACf,CAAC;AAEP,WAAO,iBAAiB,SAAS;AAAA,MAC/B,MAAM;AAAA,QACJ,OAAO,eAAe,OAAO;AAC3B,cAAI,iBAAiB,OAAO,IAAI,gBAAgB,MAAM;AACpD,kBAAM,IAAI;AAAA,cACR;AAAA,YACF;AAAA,UACF;AACA,gBAAMG,QAAO,MAAMF,UAAS,SAAS;AAAA,YACnC,UAAU;AAAA,YACV,KAAK,QAAQ;AAAA,UACf,CAAC;AACD,gBAAM,cAAc,cAAAC,QAAO;AAAA,YACzB,QAAQ;AAAA,YACRC;AAAA,YACA,QAAQ;AAAA,UACV;AAEA,cAAI,YAAY,SAAS,MAAM;AAC7B,kBAAM,IAAI;AAAA,cACR,0CAA0C,YAAY;AAAA,YACxD;AAAA,UACF;AAEA,uBAAa,aAAa,GAAG;AAAA,QAC/B;AAAA,MACF;AAAA,MACA,SAAS;AAAA,QACP,OAAO,SAAS,UAAU;AACxB,iBAAO,KAAK,OAAO,EAAE,QAAQ,CAAC,QAAQ;AAEpC,mBAAO,QAAQ;AAAA,UACjB,CAAC;AAED,gBAAM,cAAc,cAAAD,QAAO,UAAU,QAAQ,YAAY,IAAI;AAAA,YAC3D,GAAG,QAAQ;AAAA,YACX,QAAQ;AAAA,UACV,CAAC;AACD,uBAAa,aAAa,GAAG;AAAA,QAC/B;AAAA,MACF;AAAA,IACF,CAAC;AAED,WAAO;AAAA,EACT;AACF;AAEA,SAAS,aAAa,aAAqB,KAAmB;AAlO9D;AAmOE,MAAI,aAAa,KAAK;AACpB,QAAI,QAAQ,OAAO,cAAc,WAAW;AAC5C;AAAA,EACF;AAEA,MAAI,qBACD,SAAI,UAAU,YAAY,MAA1B,YAAqD,CAAC;AACzD,MAAI,OAAO,sBAAsB,UAAU;AACzC,wBAAoB,CAAC,iBAAiB;AAAA,EACxC;AACA,MAAI,UAAU,cAAc,CAAC,GAAG,mBAAmB,WAAW,CAAC;AACjE;AAEA,SAAS,oBAAoB,KAAa;AAIxC,SAAO,MAAM;AACf;AAEO,SAAS,iBAAiBH,UAAiB;AAChD,SAAO,OACLI,OACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,MACe;AACf,UAAM,iBAAiB,6BAA6B,QAAQ;AAC5D,UAAM,EAAE,oBAAoB,aAAa,IAAI,UAAUA,KAAI;AAE3D,QAAI;AACF,YAAM,OAAO,MAAW;AAAA,QACtBJ;AAAA,QACA;AAAA,QACA;AAAA,QACA,EAAE,GAAQ,eAAU,KAAK,MAAM,IAAK;AAAA,MACtC;AAEA,UAAI,iBAAiB,GAAG;AACtB,eAAO;AAAA,MACT;AAEA,aAAO;AAAA,QAEL,GAAG,KAAK;AAAA,MACV;AAAA,IACF,SAAS,OAAP;AACA,UAAI,iBAAiB,OAAO;AAC1B,YACE,MAAM,YAAY,kBAClB,MAAM,YAAY,oBAClB,MAAM,YAAY,4BAClB,MAAM,YAAY,yCAClB;AAKA,iBAAO,CAAC;AAAA,QACV;AAAA,MACF;AAEA,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,UAAUI,OAGjB;AACA,MAAIA,MAAKA,MAAK,SAAS,OAAO,kBAAkB;AAC9C,UAAM,CAAC,oBAAoB,oBAAoB,IAC7CA,MAAK,MAAM,gBAAgB;AAC7B,WAAO;AAAA,MACL;AAAA,MACA,cAAc,SAAS,sBAAsB,EAAE;AAAA,IACjD;AAAA,EACF;AAEA,SAAO,EAAE,oBAAoBA,OAAM,cAAc,KAAK;AACxD;AAEO,SAAS,eAAeJ,UAAiB;AAC9C,SAAO,OACL,MACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,MACG;AACH,UAAM,iBAAiB,6BAA6B,QAAQ;AAE5D,UAAM,uBAAuB,KAAK;AAAA,MAChC,GAAG,OAAO,KAAK,cAAc,EAAE,IAAI,CAAC,OAAO,SAAS,IAAI,EAAE,CAAC;AAAA,IAC7D;AAEA,UAAM,kBAAkB;AAAA,MACtB,IAAI,qBAAqB,SAAS;AAAA,MAClC,QAAQ,eAAe;AAAA,IACzB;AAEA,UAAMI,QAAO,MAAW,UAAKJ,UAAS,MAAM,iBAAiB;AAAA,MAC3D,GAAQ;AAAA,MACR,KAAK,MAAM;AAAA,IACb,CAAC;AAED,WAAO,GAAGI,QAAO,mBAAmB;AAAA,EACtC;AACF;AAEA,SAAS,6BAA6B,UAAoB;AACxD,SAAO,OAAO,aAAa,WAAW,EAAE,GAAG,SAAS,IAAI;AAC1D;;;AD5UA,IAAM,YAAY,MAAc;AAThC;AAUE,MAAI,SAAO,gBAAW,WAAX,mBAAmB,YAAW;AAAU,WAAO,WAAW;AAErE,MAAI,SAAO,sBAAW,WAAX,mBAAmB,cAAnB,mBAA8B,YAAW;AAElD,WAAO,WAAW,OAAO;AAC3B,QAAM,IAAI;AAAA,IACR;AAAA,EACF;AACF;AAEA,IAAM,UAAU,UAAU;AAEnB,IAAM,aAAa,iBAAiB,OAAO;AAC3C,IAAM,WAAW,eAAe,OAAO;AACvC,IAAM,iBAAiB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AACF;","names":["_crypto","unsealData","sealData","cookie","seal"]}
+{"version":3,"sources":["../index.ts","../../src/core.ts"],"sourcesContent":["// This allows the types to be linked from the main module instead of duplicated\nexport type { IronSessionOptions, IronSessionData } from \"iron-session\";\n\nimport {\n  createGetIronSession,\n  createSealData,\n  createUnsealData,\n} from \"../src/core\";\n\nconst getCrypto = (): Crypto => {\n  if (typeof globalThis.crypto?.subtle === \"object\") return globalThis.crypto;\n  // @ts-ignore crypto.webcrypto is not available in dom, but is there in newer node versions\n  if (typeof globalThis.crypto?.webcrypto?.subtle === \"object\")\n    // @ts-ignore same as above\n    return globalThis.crypto.webcrypto;\n  throw new Error(\n    \"no native implementation of WebCrypto is available in current context\",\n  );\n};\n\nconst _crypto = getCrypto();\n\nexport const unsealData = createUnsealData(_crypto);\nexport const sealData = createSealData(_crypto);\nexport const getIronSession = createGetIronSession(\n  _crypto,\n  unsealData,\n  sealData,\n);\n","import * as Iron from \"iron-webcrypto\";\nimport type { CookieSerializeOptions } from \"cookie\";\nimport cookie from \"cookie\";\nimport type { IncomingMessage, ServerResponse } from \"http\";\n\n// default time allowed to check for iron seal validity when ttl passed\n// see https://hapi.dev/family/iron/api/?v=6.0.0#options\nconst timestampSkewSec = 60;\n\ntype passwordsMap = { [id: string]: string };\ntype password = string | passwordsMap;\n\nconst fourteenDaysInSeconds = 15 * 24 * 3600;\n\n// We store a token major version to handle data format changes when any. So that when you upgrade the cookies\n// can be kept alive between upgrades, no need to disconnect everyone.\nconst currentMajorVersion = 2;\nconst versionDelimiter = \"~\";\n\nconst defaultOptions: {\n  ttl: number;\n  cookieOptions: CookieSerializeOptions;\n} = {\n  ttl: fourteenDaysInSeconds,\n  cookieOptions: {\n    httpOnly: true,\n    secure: true,\n    sameSite: \"lax\",\n    path: \"/\",\n  },\n};\n\nexport interface IronSessionOptions {\n  /**\n   * This is the cookie name that will be used inside the browser. You should make sure it's unique given\n   * your application. Example: vercel-session\n   */\n  cookieName: string;\n\n  /**\n   * This is the password(s) that will be used to encrypt the cookie. It can be either a string or an object\n   * like {1: \"password\", 2: password}.\n   *\n   * When you provide multiple passwords then all of them will be used to decrypt the cookie and only the most\n   * recent (= highest key, 2 in this example) password will be used to encrypt the cookie. This allow you\n   * to use password rotation (security)\n   */\n  password: password;\n\n  /**\n   * This is the time in seconds that the session will be valid for. This also set the max-age attribute of\n   * the cookie automatically (minus 60 seconds so that the cookie always expire before the session).\n   */\n  ttl?: number;\n\n  /**\n   * This is the options that will be passed to the cookie library.\n   * You can see all of them here: https://github.com/jshttp/cookie#options-1.\n   *\n   * If you want to use \"session cookies\" (cookies that are deleted when the browser is closed) then you need\n   * to pass cookieOptions: { maxAge: undefined }.\n   */\n  cookieOptions?: CookieSerializeOptions;\n}\n\n// eslint-disable-next-line @typescript-eslint/no-empty-interface\nexport interface IronSessionData {\n  // If we allow for any keys, then there's no more type check on unknown properties\n  // which is not good\n  // If we allow for any keys, the later delete will work but I prefer to disable the\n  // check at this stage and\n  // provide good type checking instead\n  // [key: string]: unknown;\n}\n\nexport type IronSession = IronSessionData & {\n  /**\n   * Destroys the session data and removes the cookie.\n   */\n  destroy: () => void;\n\n  /**\n   * Encrypts the session data and sets the cookie.\n   */\n  save: () => Promise<void>;\n};\n\ndeclare module \"http\" {\n  interface IncomingMessage {\n    session: IronSession;\n  }\n}\n\ntype RequestType = IncomingMessage | Request;\ntype ResponseType = ServerResponse | Response;\n\nexport function createGetIronSession(\n  _crypto: Crypto,\n  unsealData: ReturnType<typeof createUnsealData>,\n  sealData: ReturnType<typeof createSealData>,\n) {\n  return async (\n    req: RequestType,\n    res: ResponseType,\n    userSessionOptions: IronSessionOptions,\n  ): Promise<IronSession> => {\n    if (\n      !req ||\n      !res ||\n      !userSessionOptions ||\n      !userSessionOptions.cookieName ||\n      !userSessionOptions.password\n    ) {\n      throw new Error(\n        `iron-session: Bad usage. Minimum usage is const session = await getIronSession(req, res, { cookieName: \"...\", password: \"...\". Check the usage here: https://github.com/vvo/iron-session`,\n      );\n    }\n\n    const passwordsAsMap = normalizeStringPasswordToMap(\n      userSessionOptions.password,\n    );\n\n    Object.values(\n      normalizeStringPasswordToMap(userSessionOptions.password),\n    ).forEach((password) => {\n      if (password.length < 32) {\n        throw new Error(\n          `iron-session: Bad usage. Password must be at least 32 characters long.`,\n        );\n      }\n    });\n\n    const options: Required<IronSessionOptions> = {\n      ...defaultOptions,\n      ...userSessionOptions,\n      cookieOptions: {\n        ...defaultOptions.cookieOptions,\n        ...(userSessionOptions.cookieOptions || {}),\n      },\n    };\n\n    if (options.ttl === 0) {\n      // ttl = 0 means no expiration\n      // but in reality cookies have to expire (can't have no max-age)\n      // 2147483647 is the max value for max-age in cookies\n      // see https://stackoverflow.com/a/11685301/147079\n      options.ttl = 2147483647;\n    }\n\n    if (\n      userSessionOptions.cookieOptions &&\n      \"maxAge\" in userSessionOptions.cookieOptions\n    ) {\n      // session cookie, do not set maxAge, consider token as infinite\n      if (userSessionOptions.cookieOptions.maxAge === undefined) {\n        options.ttl = 0;\n      } else {\n        options.cookieOptions.maxAge = computeCookieMaxAge(\n          userSessionOptions.cookieOptions.maxAge,\n        );\n      }\n    } else {\n      options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);\n    }\n\n    const sealFromCookies = cookie.parse(\n      \"credentials\" in req\n        ? req.headers.get(\"cookie\") || \"\"\n        : req.headers.cookie || \"\",\n    )[options.cookieName];\n\n    const session =\n      sealFromCookies === undefined\n        ? {}\n        : await unsealData<IronSessionData>(sealFromCookies, {\n            password: passwordsAsMap,\n            ttl: options.ttl,\n          });\n\n    Object.defineProperties(session, {\n      save: {\n        value: async function save() {\n          if (\"headersSent\" in res && res.headersSent === true) {\n            throw new Error(\n              `iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()`,\n            );\n          }\n          const seal = await sealData(session, {\n            password: passwordsAsMap,\n            ttl: options.ttl,\n          });\n          const cookieValue = cookie.serialize(\n            options.cookieName,\n            seal,\n            options.cookieOptions,\n          );\n\n          if (cookieValue.length > 4096) {\n            throw new Error(\n              `iron-session: Cookie length is too big ${cookieValue.length}, browsers will refuse it. Try to remove some data.`,\n            );\n          }\n\n          addToCookies(cookieValue, res);\n        },\n      },\n      destroy: {\n        value: function destroy() {\n          Object.keys(session).forEach((key) => {\n            // @ts-ignore See comment on the IronSessionData interface\n            delete session[key];\n          });\n\n          const cookieValue = cookie.serialize(options.cookieName, \"\", {\n            ...options.cookieOptions,\n            maxAge: 0,\n          });\n          addToCookies(cookieValue, res);\n        },\n      },\n    });\n\n    return session as IronSession;\n  };\n}\n\nfunction addToCookies(cookieValue: string, res: ResponseType) {\n  if (\"headers\" in res) {\n    res.headers.append(\"set-cookie\", cookieValue);\n    return;\n  }\n\n  let existingSetCookie =\n    (res.getHeader(\"set-cookie\") as string[] | string) ?? [];\n  if (typeof existingSetCookie === \"string\") {\n    existingSetCookie = [existingSetCookie];\n  }\n  res.setHeader(\"set-cookie\", [...existingSetCookie, cookieValue]);\n}\n\nfunction computeCookieMaxAge(ttl: number) {\n  // The next line makes sure browser will expire cookies before seals are considered expired by the server.\n  // It also allows for clock difference of 60 seconds maximum between server and clients.\n  // It also makes sure to expire the cookie immediately when value is 0\n  return ttl - timestampSkewSec;\n}\n\nexport function createUnsealData(_crypto: Crypto) {\n  return async <T = Record<string, unknown>>(\n    seal: string,\n    {\n      password,\n      ttl = fourteenDaysInSeconds,\n    }: { password: password; ttl?: number },\n  ): Promise<T> => {\n    const passwordsAsMap = normalizeStringPasswordToMap(password);\n    const { sealWithoutVersion, tokenVersion } = parseSeal(seal);\n\n    try {\n      const data =\n        (await Iron.unseal(_crypto, sealWithoutVersion, passwordsAsMap, {\n          ...Iron.defaults,\n          ttl: ttl * 1000,\n        })) || {};\n\n      if (tokenVersion === 2) {\n        return data as T;\n      }\n\n      return {\n        // @ts-expect-error `persistent` does not exist on newer tokens\n        ...data.persistent,\n      };\n    } catch (error) {\n      if (error instanceof Error) {\n        if (\n          error.message === \"Expired seal\" ||\n          error.message === \"Bad hmac value\" ||\n          error.message.startsWith(\"Cannot find password: \") ||\n          error.message === \"Incorrect number of sealed components\"\n        ) {\n          // if seal expired or\n          // if seal is not valid (encrypted using a different password, when passwords are badly rotated) or\n          // if we can't find back the password in the seal\n          // then we just start a new session over\n          return {} as T;\n        }\n      }\n\n      throw error;\n    }\n  };\n}\n\nfunction parseSeal(seal: string): {\n  sealWithoutVersion: string;\n  tokenVersion: number | null;\n} {\n  if (seal[seal.length - 2] === versionDelimiter) {\n    const [sealWithoutVersion, tokenVersionAsString] =\n      seal.split(versionDelimiter);\n    return {\n      sealWithoutVersion,\n      tokenVersion: parseInt(tokenVersionAsString, 10),\n    };\n  }\n\n  return { sealWithoutVersion: seal, tokenVersion: null };\n}\n\nexport function createSealData(_crypto: Crypto) {\n  return async (\n    data: unknown,\n    {\n      password,\n      ttl = fourteenDaysInSeconds,\n    }: { password: password; ttl?: number },\n  ) => {\n    const passwordsAsMap = normalizeStringPasswordToMap(password);\n\n    const mostRecentPasswordId = Math.max(\n      ...Object.keys(passwordsAsMap).map((id) => parseInt(id, 10)),\n    );\n\n    const passwordForSeal = {\n      id: mostRecentPasswordId.toString(),\n      secret: passwordsAsMap[mostRecentPasswordId],\n    };\n\n    const seal = await Iron.seal(_crypto, data, passwordForSeal, {\n      ...Iron.defaults,\n      ttl: ttl * 1000,\n    });\n\n    return `${seal}${versionDelimiter}${currentMajorVersion}`;\n  };\n}\n\nfunction normalizeStringPasswordToMap(password: password) {\n  return typeof password === \"string\" ? { 1: password } : password;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,WAAsB;AAEtB,oBAAmB;AAKnB,IAAM,mBAAmB;AAKzB,IAAM,wBAAwB,KAAK,KAAK;AAIxC,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AAEzB,IAAM,iBAGF;AAAA,EACF,KAAK;AAAA,EACL,eAAe;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,EACR;AACF;AAkEO,SAAS,qBACdA,UACAC,aACAC,WACA;AACA,SAAO,OACL,KACA,KACA,uBACyB;AACzB,QACE,CAAC,OACD,CAAC,OACD,CAAC,sBACD,CAAC,mBAAmB,cACpB,CAAC,mBAAmB,UACpB;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,iBAAiB;AAAA,MACrB,mBAAmB;AAAA,IACrB;AAEA,WAAO;AAAA,MACL,6BAA6B,mBAAmB,QAAQ;AAAA,IAC1D,EAAE,QAAQ,CAAC,aAAa;AACtB,UAAI,SAAS,SAAS,IAAI;AACxB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAED,UAAM,UAAwC;AAAA,MAC5C,GAAG;AAAA,MACH,GAAG;AAAA,MACH,eAAe;AAAA,QACb,GAAG,eAAe;AAAA,QAClB,GAAI,mBAAmB,iBAAiB,CAAC;AAAA,MAC3C;AAAA,IACF;AAEA,QAAI,QAAQ,QAAQ,GAAG;AAKrB,cAAQ,MAAM;AAAA,IAChB;AAEA,QACE,mBAAmB,iBACnB,YAAY,mBAAmB,eAC/B;AAEA,UAAI,mBAAmB,cAAc,WAAW,QAAW;AACzD,gBAAQ,MAAM;AAAA,MAChB,OAAO;AACL,gBAAQ,cAAc,SAAS;AAAA,UAC7B,mBAAmB,cAAc;AAAA,QACnC;AAAA,MACF;AAAA,IACF,OAAO;AACL,cAAQ,cAAc,SAAS,oBAAoB,QAAQ,GAAG;AAAA,IAChE;AAEA,UAAM,kBAAkB,cAAAC,QAAO;AAAA,MAC7B,iBAAiB,MACb,IAAI,QAAQ,IAAI,QAAQ,KAAK,KAC7B,IAAI,QAAQ,UAAU;AAAA,IAC5B,EAAE,QAAQ;AAEV,UAAM,UACJ,oBAAoB,SAChB,CAAC,IACD,MAAMF,YAA4B,iBAAiB;AAAA,MACjD,UAAU;AAAA,MACV,KAAK,QAAQ;AAAA,IACf,CAAC;AAEP,WAAO,iBAAiB,SAAS;AAAA,MAC/B,MAAM;AAAA,QACJ,OAAO,eAAe,OAAO;AAC3B,cAAI,iBAAiB,OAAO,IAAI,gBAAgB,MAAM;AACpD,kBAAM,IAAI;AAAA,cACR;AAAA,YACF;AAAA,UACF;AACA,gBAAMG,QAAO,MAAMF,UAAS,SAAS;AAAA,YACnC,UAAU;AAAA,YACV,KAAK,QAAQ;AAAA,UACf,CAAC;AACD,gBAAM,cAAc,cAAAC,QAAO;AAAA,YACzB,QAAQ;AAAA,YACRC;AAAA,YACA,QAAQ;AAAA,UACV;AAEA,cAAI,YAAY,SAAS,MAAM;AAC7B,kBAAM,IAAI;AAAA,cACR,0CAA0C,YAAY;AAAA,YACxD;AAAA,UACF;AAEA,uBAAa,aAAa,GAAG;AAAA,QAC/B;AAAA,MACF;AAAA,MACA,SAAS;AAAA,QACP,OAAO,SAAS,UAAU;AACxB,iBAAO,KAAK,OAAO,EAAE,QAAQ,CAAC,QAAQ;AAEpC,mBAAO,QAAQ;AAAA,UACjB,CAAC;AAED,gBAAM,cAAc,cAAAD,QAAO,UAAU,QAAQ,YAAY,IAAI;AAAA,YAC3D,GAAG,QAAQ;AAAA,YACX,QAAQ;AAAA,UACV,CAAC;AACD,uBAAa,aAAa,GAAG;AAAA,QAC/B;AAAA,MACF;AAAA,IACF,CAAC;AAED,WAAO;AAAA,EACT;AACF;AAEA,SAAS,aAAa,aAAqB,KAAmB;AAlO9D;AAmOE,MAAI,aAAa,KAAK;AACpB,QAAI,QAAQ,OAAO,cAAc,WAAW;AAC5C;AAAA,EACF;AAEA,MAAI,qBACD,SAAI,UAAU,YAAY,MAA1B,YAAqD,CAAC;AACzD,MAAI,OAAO,sBAAsB,UAAU;AACzC,wBAAoB,CAAC,iBAAiB;AAAA,EACxC;AACA,MAAI,UAAU,cAAc,CAAC,GAAG,mBAAmB,WAAW,CAAC;AACjE;AAEA,SAAS,oBAAoB,KAAa;AAIxC,SAAO,MAAM;AACf;AAEO,SAAS,iBAAiBH,UAAiB;AAChD,SAAO,OACLI,OACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,MACe;AACf,UAAM,iBAAiB,6BAA6B,QAAQ;AAC5D,UAAM,EAAE,oBAAoB,aAAa,IAAI,UAAUA,KAAI;AAE3D,QAAI;AACF,YAAM,OACH,MAAW,YAAOJ,UAAS,oBAAoB,gBAAgB;AAAA,QAC9D,GAAQ;AAAA,QACR,KAAK,MAAM;AAAA,MACb,CAAC,KAAM,CAAC;AAEV,UAAI,iBAAiB,GAAG;AACtB,eAAO;AAAA,MACT;AAEA,aAAO;AAAA,QAEL,GAAG,KAAK;AAAA,MACV;AAAA,IACF,SAAS,OAAP;AACA,UAAI,iBAAiB,OAAO;AAC1B,YACE,MAAM,YAAY,kBAClB,MAAM,YAAY,oBAClB,MAAM,QAAQ,WAAW,wBAAwB,KACjD,MAAM,YAAY,yCAClB;AAKA,iBAAO,CAAC;AAAA,QACV;AAAA,MACF;AAEA,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,UAAUI,OAGjB;AACA,MAAIA,MAAKA,MAAK,SAAS,OAAO,kBAAkB;AAC9C,UAAM,CAAC,oBAAoB,oBAAoB,IAC7CA,MAAK,MAAM,gBAAgB;AAC7B,WAAO;AAAA,MACL;AAAA,MACA,cAAc,SAAS,sBAAsB,EAAE;AAAA,IACjD;AAAA,EACF;AAEA,SAAO,EAAE,oBAAoBA,OAAM,cAAc,KAAK;AACxD;AAEO,SAAS,eAAeJ,UAAiB;AAC9C,SAAO,OACL,MACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,MACG;AACH,UAAM,iBAAiB,6BAA6B,QAAQ;AAE5D,UAAM,uBAAuB,KAAK;AAAA,MAChC,GAAG,OAAO,KAAK,cAAc,EAAE,IAAI,CAAC,OAAO,SAAS,IAAI,EAAE,CAAC;AAAA,IAC7D;AAEA,UAAM,kBAAkB;AAAA,MACtB,IAAI,qBAAqB,SAAS;AAAA,MAClC,QAAQ,eAAe;AAAA,IACzB;AAEA,UAAMI,QAAO,MAAW,UAAKJ,UAAS,MAAM,iBAAiB;AAAA,MAC3D,GAAQ;AAAA,MACR,KAAK,MAAM;AAAA,IACb,CAAC;AAED,WAAO,GAAGI,QAAO,mBAAmB;AAAA,EACtC;AACF;AAEA,SAAS,6BAA6B,UAAoB;AACxD,SAAO,OAAO,aAAa,WAAW,EAAE,GAAG,SAAS,IAAI;AAC1D;;;AD3UA,IAAM,YAAY,MAAc;AAThC;AAUE,MAAI,SAAO,gBAAW,WAAX,mBAAmB,YAAW;AAAU,WAAO,WAAW;AAErE,MAAI,SAAO,sBAAW,WAAX,mBAAmB,cAAnB,mBAA8B,YAAW;AAElD,WAAO,WAAW,OAAO;AAC3B,QAAM,IAAI;AAAA,IACR;AAAA,EACF;AACF;AAEA,IAAM,UAAU,UAAU;AAEnB,IAAM,aAAa,iBAAiB,OAAO;AAC3C,IAAM,WAAW,eAAe,OAAO;AACvC,IAAM,iBAAiB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AACF;","names":["_crypto","unsealData","sealData","cookie","seal"]}

package/edge/dist/index.mjs

@@ -126,12 +126,10 @@ function createUnsealData(_crypto2) {
     const passwordsAsMap = normalizeStringPasswordToMap(password);
     const { sealWithoutVersion, tokenVersion } = parseSeal(seal2);
     try {
-      const data = await Iron.unseal(
-        _crypto2,
-        sealWithoutVersion,
-        passwordsAsMap,
-        { ...Iron.defaults, ttl: ttl * 1e3 }
-      );
+      const data = await Iron.unseal(_crypto2, sealWithoutVersion, passwordsAsMap, {
+        ...Iron.defaults,
+        ttl: ttl * 1e3
+      }) || {};
       if (tokenVersion === 2) {
         return data;
       }
@@ -140,7 +138,7 @@ function createUnsealData(_crypto2) {
       };
     } catch (error) {
       if (error instanceof Error) {
-        if (error.message === "Expired seal" || error.message === "Bad hmac value" || error.message === "Cannot find password: " || error.message === "Incorrect number of sealed components") {
+        if (error.message === "Expired seal" || error.message === "Bad hmac value" || error.message.startsWith("Cannot find password: ") || error.message === "Incorrect number of sealed components") {
           return {};
         }
       }

package/edge/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core.ts","../index.ts"],"sourcesContent":["import * as Iron from \"iron-webcrypto\";\nimport type { CookieSerializeOptions } from \"cookie\";\nimport cookie from \"cookie\";\nimport type { IncomingMessage, ServerResponse } from \"http\";\n\n// default time allowed to check for iron seal validity when ttl passed\n// see https://hapi.dev/family/iron/api/?v=6.0.0#options\nconst timestampSkewSec = 60;\n\ntype passwordsMap = { [id: string]: string };\ntype password = string | passwordsMap;\n\nconst fourteenDaysInSeconds = 15 * 24 * 3600;\n\n// We store a token major version to handle data format changes when any. So that when you upgrade the cookies\n// can be kept alive between upgrades, no need to disconnect everyone.\nconst currentMajorVersion = 2;\nconst versionDelimiter = \"~\";\n\nconst defaultOptions: {\n  ttl: number;\n  cookieOptions: CookieSerializeOptions;\n} = {\n  ttl: fourteenDaysInSeconds,\n  cookieOptions: {\n    httpOnly: true,\n    secure: true,\n    sameSite: \"lax\",\n    path: \"/\",\n  },\n};\n\nexport interface IronSessionOptions {\n  /**\n   * This is the cookie name that will be used inside the browser. You should make sure it's unique given\n   * your application. Example: vercel-session\n   */\n  cookieName: string;\n\n  /**\n   * This is the password(s) that will be used to encrypt the cookie. It can be either a string or an object\n   * like {1: \"password\", 2: password}.\n   *\n   * When you provide multiple passwords then all of them will be used to decrypt the cookie and only the most\n   * recent (= highest key, 2 in this example) password will be used to encrypt the cookie. This allow you\n   * to use password rotation (security)\n   */\n  password: password;\n\n  /**\n   * This is the time in seconds that the session will be valid for. This also set the max-age attribute of\n   * the cookie automatically (minus 60 seconds so that the cookie always expire before the session).\n   */\n  ttl?: number;\n\n  /**\n   * This is the options that will be passed to the cookie library.\n   * You can see all of them here: https://github.com/jshttp/cookie#options-1.\n   *\n   * If you want to use \"session cookies\" (cookies that are deleted when the browser is closed) then you need\n   * to pass cookieOptions: { maxAge: undefined }.\n   */\n  cookieOptions?: CookieSerializeOptions;\n}\n\n// eslint-disable-next-line @typescript-eslint/no-empty-interface\nexport interface IronSessionData {\n  // If we allow for any keys, then there's no more type check on unknown properties\n  // which is not good\n  // If we allow for any keys, the later delete will work but I prefer to disable the\n  // check at this stage and\n  // provide good type checking instead\n  // [key: string]: unknown;\n}\n\nexport type IronSession = IronSessionData & {\n  /**\n   * Destroys the session data and removes the cookie.\n   */\n  destroy: () => void;\n\n  /**\n   * Encrypts the session data and sets the cookie.\n   */\n  save: () => Promise<void>;\n};\n\ndeclare module \"http\" {\n  interface IncomingMessage {\n    session: IronSession;\n  }\n}\n\ntype RequestType = IncomingMessage | Request;\ntype ResponseType = ServerResponse | Response;\n\nexport function createGetIronSession(\n  _crypto: Crypto,\n  unsealData: ReturnType<typeof createUnsealData>,\n  sealData: ReturnType<typeof createSealData>,\n) {\n  return async (\n    req: RequestType,\n    res: ResponseType,\n    userSessionOptions: IronSessionOptions,\n  ): Promise<IronSession> => {\n    if (\n      !req ||\n      !res ||\n      !userSessionOptions ||\n      !userSessionOptions.cookieName ||\n      !userSessionOptions.password\n    ) {\n      throw new Error(\n        `iron-session: Bad usage. Minimum usage is const session = await getIronSession(req, res, { cookieName: \"...\", password: \"...\". Check the usage here: https://github.com/vvo/iron-session`,\n      );\n    }\n\n    const passwordsAsMap = normalizeStringPasswordToMap(\n      userSessionOptions.password,\n    );\n\n    Object.values(\n      normalizeStringPasswordToMap(userSessionOptions.password),\n    ).forEach((password) => {\n      if (password.length < 32) {\n        throw new Error(\n          `iron-session: Bad usage. Password must be at least 32 characters long.`,\n        );\n      }\n    });\n\n    const options: Required<IronSessionOptions> = {\n      ...defaultOptions,\n      ...userSessionOptions,\n      cookieOptions: {\n        ...defaultOptions.cookieOptions,\n        ...(userSessionOptions.cookieOptions || {}),\n      },\n    };\n\n    if (options.ttl === 0) {\n      // ttl = 0 means no expiration\n      // but in reality cookies have to expire (can't have no max-age)\n      // 2147483647 is the max value for max-age in cookies\n      // see https://stackoverflow.com/a/11685301/147079\n      options.ttl = 2147483647;\n    }\n\n    if (\n      userSessionOptions.cookieOptions &&\n      \"maxAge\" in userSessionOptions.cookieOptions\n    ) {\n      // session cookie, do not set maxAge, consider token as infinite\n      if (userSessionOptions.cookieOptions.maxAge === undefined) {\n        options.ttl = 0;\n      } else {\n        options.cookieOptions.maxAge = computeCookieMaxAge(\n          userSessionOptions.cookieOptions.maxAge,\n        );\n      }\n    } else {\n      options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);\n    }\n\n    const sealFromCookies = cookie.parse(\n      \"credentials\" in req\n        ? req.headers.get(\"cookie\") || \"\"\n        : req.headers.cookie || \"\",\n    )[options.cookieName];\n\n    const session =\n      sealFromCookies === undefined\n        ? {}\n        : await unsealData<IronSessionData>(sealFromCookies, {\n            password: passwordsAsMap,\n            ttl: options.ttl,\n          });\n\n    Object.defineProperties(session, {\n      save: {\n        value: async function save() {\n          if (\"headersSent\" in res && res.headersSent === true) {\n            throw new Error(\n              `iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()`,\n            );\n          }\n          const seal = await sealData(session, {\n            password: passwordsAsMap,\n            ttl: options.ttl,\n          });\n          const cookieValue = cookie.serialize(\n            options.cookieName,\n            seal,\n            options.cookieOptions,\n          );\n\n          if (cookieValue.length > 4096) {\n            throw new Error(\n              `iron-session: Cookie length is too big ${cookieValue.length}, browsers will refuse it. Try to remove some data.`,\n            );\n          }\n\n          addToCookies(cookieValue, res);\n        },\n      },\n      destroy: {\n        value: function destroy() {\n          Object.keys(session).forEach((key) => {\n            // @ts-ignore See comment on the IronSessionData interface\n            delete session[key];\n          });\n\n          const cookieValue = cookie.serialize(options.cookieName, \"\", {\n            ...options.cookieOptions,\n            maxAge: 0,\n          });\n          addToCookies(cookieValue, res);\n        },\n      },\n    });\n\n    return session as IronSession;\n  };\n}\n\nfunction addToCookies(cookieValue: string, res: ResponseType) {\n  if (\"headers\" in res) {\n    res.headers.append(\"set-cookie\", cookieValue);\n    return;\n  }\n\n  let existingSetCookie =\n    (res.getHeader(\"set-cookie\") as string[] | string) ?? [];\n  if (typeof existingSetCookie === \"string\") {\n    existingSetCookie = [existingSetCookie];\n  }\n  res.setHeader(\"set-cookie\", [...existingSetCookie, cookieValue]);\n}\n\nfunction computeCookieMaxAge(ttl: number) {\n  // The next line makes sure browser will expire cookies before seals are considered expired by the server.\n  // It also allows for clock difference of 60 seconds maximum between server and clients.\n  // It also makes sure to expire the cookie immediately when value is 0\n  return ttl - timestampSkewSec;\n}\n\nexport function createUnsealData(_crypto: Crypto) {\n  return async <T = Record<string, unknown>>(\n    seal: string,\n    {\n      password,\n      ttl = fourteenDaysInSeconds,\n    }: { password: password; ttl?: number },\n  ): Promise<T> => {\n    const passwordsAsMap = normalizeStringPasswordToMap(password);\n    const { sealWithoutVersion, tokenVersion } = parseSeal(seal);\n\n    try {\n      const data = await Iron.unseal(\n        _crypto,\n        sealWithoutVersion,\n        passwordsAsMap,\n        { ...Iron.defaults, ttl: ttl * 1000 },\n      );\n\n      if (tokenVersion === 2) {\n        return data as T;\n      }\n\n      return {\n        // @ts-expect-error `persistent` does not exist on newer tokens\n        ...data.persistent,\n      };\n    } catch (error) {\n      if (error instanceof Error) {\n        if (\n          error.message === \"Expired seal\" ||\n          error.message === \"Bad hmac value\" ||\n          error.message === \"Cannot find password: \" ||\n          error.message === \"Incorrect number of sealed components\"\n        ) {\n          // if seal expired or\n          // if seal is not valid (encrypted using a different password, when passwords are badly rotated) or\n          // if we can't find back the password in the seal\n          // then we just start a new session over\n          return {} as T;\n        }\n      }\n\n      throw error;\n    }\n  };\n}\n\nfunction parseSeal(seal: string): {\n  sealWithoutVersion: string;\n  tokenVersion: number | null;\n} {\n  if (seal[seal.length - 2] === versionDelimiter) {\n    const [sealWithoutVersion, tokenVersionAsString] =\n      seal.split(versionDelimiter);\n    return {\n      sealWithoutVersion,\n      tokenVersion: parseInt(tokenVersionAsString, 10),\n    };\n  }\n\n  return { sealWithoutVersion: seal, tokenVersion: null };\n}\n\nexport function createSealData(_crypto: Crypto) {\n  return async (\n    data: unknown,\n    {\n      password,\n      ttl = fourteenDaysInSeconds,\n    }: { password: password; ttl?: number },\n  ) => {\n    const passwordsAsMap = normalizeStringPasswordToMap(password);\n\n    const mostRecentPasswordId = Math.max(\n      ...Object.keys(passwordsAsMap).map((id) => parseInt(id, 10)),\n    );\n\n    const passwordForSeal = {\n      id: mostRecentPasswordId.toString(),\n      secret: passwordsAsMap[mostRecentPasswordId],\n    };\n\n    const seal = await Iron.seal(_crypto, data, passwordForSeal, {\n      ...Iron.defaults,\n      ttl: ttl * 1000,\n    });\n\n    return `${seal}${versionDelimiter}${currentMajorVersion}`;\n  };\n}\n\nfunction normalizeStringPasswordToMap(password: password) {\n  return typeof password === \"string\" ? { 1: password } : password;\n}\n","// This allows the types to be linked from the main module instead of duplicated\nexport type { IronSessionOptions, IronSessionData } from \"iron-session\";\n\nimport {\n  createGetIronSession,\n  createSealData,\n  createUnsealData,\n} from \"../src/core\";\n\nconst getCrypto = (): Crypto => {\n  if (typeof globalThis.crypto?.subtle === \"object\") return globalThis.crypto;\n  // @ts-ignore crypto.webcrypto is not available in dom, but is there in newer node versions\n  if (typeof globalThis.crypto?.webcrypto?.subtle === \"object\")\n    // @ts-ignore same as above\n    return globalThis.crypto.webcrypto;\n  throw new Error(\n    \"no native implementation of WebCrypto is available in current context\",\n  );\n};\n\nconst _crypto = getCrypto();\n\nexport const unsealData = createUnsealData(_crypto);\nexport const sealData = createSealData(_crypto);\nexport const getIronSession = createGetIronSession(\n  _crypto,\n  unsealData,\n  sealData,\n);\n"],"mappings":";AAAA,YAAY,UAAU;AAEtB,OAAO,YAAY;AAKnB,IAAM,mBAAmB;AAKzB,IAAM,wBAAwB,KAAK,KAAK;AAIxC,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AAEzB,IAAM,iBAGF;AAAA,EACF,KAAK;AAAA,EACL,eAAe;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,EACR;AACF;AAkEO,SAAS,qBACdA,UACAC,aACAC,WACA;AACA,SAAO,OACL,KACA,KACA,uBACyB;AACzB,QACE,CAAC,OACD,CAAC,OACD,CAAC,sBACD,CAAC,mBAAmB,cACpB,CAAC,mBAAmB,UACpB;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,iBAAiB;AAAA,MACrB,mBAAmB;AAAA,IACrB;AAEA,WAAO;AAAA,MACL,6BAA6B,mBAAmB,QAAQ;AAAA,IAC1D,EAAE,QAAQ,CAAC,aAAa;AACtB,UAAI,SAAS,SAAS,IAAI;AACxB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAED,UAAM,UAAwC;AAAA,MAC5C,GAAG;AAAA,MACH,GAAG;AAAA,MACH,eAAe;AAAA,QACb,GAAG,eAAe;AAAA,QAClB,GAAI,mBAAmB,iBAAiB,CAAC;AAAA,MAC3C;AAAA,IACF;AAEA,QAAI,QAAQ,QAAQ,GAAG;AAKrB,cAAQ,MAAM;AAAA,IAChB;AAEA,QACE,mBAAmB,iBACnB,YAAY,mBAAmB,eAC/B;AAEA,UAAI,mBAAmB,cAAc,WAAW,QAAW;AACzD,gBAAQ,MAAM;AAAA,MAChB,OAAO;AACL,gBAAQ,cAAc,SAAS;AAAA,UAC7B,mBAAmB,cAAc;AAAA,QACnC;AAAA,MACF;AAAA,IACF,OAAO;AACL,cAAQ,cAAc,SAAS,oBAAoB,QAAQ,GAAG;AAAA,IAChE;AAEA,UAAM,kBAAkB,OAAO;AAAA,MAC7B,iBAAiB,MACb,IAAI,QAAQ,IAAI,QAAQ,KAAK,KAC7B,IAAI,QAAQ,UAAU;AAAA,IAC5B,EAAE,QAAQ;AAEV,UAAM,UACJ,oBAAoB,SAChB,CAAC,IACD,MAAMD,YAA4B,iBAAiB;AAAA,MACjD,UAAU;AAAA,MACV,KAAK,QAAQ;AAAA,IACf,CAAC;AAEP,WAAO,iBAAiB,SAAS;AAAA,MAC/B,MAAM;AAAA,QACJ,OAAO,eAAe,OAAO;AAC3B,cAAI,iBAAiB,OAAO,IAAI,gBAAgB,MAAM;AACpD,kBAAM,IAAI;AAAA,cACR;AAAA,YACF;AAAA,UACF;AACA,gBAAME,QAAO,MAAMD,UAAS,SAAS;AAAA,YACnC,UAAU;AAAA,YACV,KAAK,QAAQ;AAAA,UACf,CAAC;AACD,gBAAM,cAAc,OAAO;AAAA,YACzB,QAAQ;AAAA,YACRC;AAAA,YACA,QAAQ;AAAA,UACV;AAEA,cAAI,YAAY,SAAS,MAAM;AAC7B,kBAAM,IAAI;AAAA,cACR,0CAA0C,YAAY;AAAA,YACxD;AAAA,UACF;AAEA,uBAAa,aAAa,GAAG;AAAA,QAC/B;AAAA,MACF;AAAA,MACA,SAAS;AAAA,QACP,OAAO,SAAS,UAAU;AACxB,iBAAO,KAAK,OAAO,EAAE,QAAQ,CAAC,QAAQ;AAEpC,mBAAO,QAAQ;AAAA,UACjB,CAAC;AAED,gBAAM,cAAc,OAAO,UAAU,QAAQ,YAAY,IAAI;AAAA,YAC3D,GAAG,QAAQ;AAAA,YACX,QAAQ;AAAA,UACV,CAAC;AACD,uBAAa,aAAa,GAAG;AAAA,QAC/B;AAAA,MACF;AAAA,IACF,CAAC;AAED,WAAO;AAAA,EACT;AACF;AAEA,SAAS,aAAa,aAAqB,KAAmB;AAlO9D;AAmOE,MAAI,aAAa,KAAK;AACpB,QAAI,QAAQ,OAAO,cAAc,WAAW;AAC5C;AAAA,EACF;AAEA,MAAI,qBACD,SAAI,UAAU,YAAY,MAA1B,YAAqD,CAAC;AACzD,MAAI,OAAO,sBAAsB,UAAU;AACzC,wBAAoB,CAAC,iBAAiB;AAAA,EACxC;AACA,MAAI,UAAU,cAAc,CAAC,GAAG,mBAAmB,WAAW,CAAC;AACjE;AAEA,SAAS,oBAAoB,KAAa;AAIxC,SAAO,MAAM;AACf;AAEO,SAAS,iBAAiBH,UAAiB;AAChD,SAAO,OACLG,OACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,MACe;AACf,UAAM,iBAAiB,6BAA6B,QAAQ;AAC5D,UAAM,EAAE,oBAAoB,aAAa,IAAI,UAAUA,KAAI;AAE3D,QAAI;AACF,YAAM,OAAO,MAAW;AAAA,QACtBH;AAAA,QACA;AAAA,QACA;AAAA,QACA,EAAE,GAAQ,eAAU,KAAK,MAAM,IAAK;AAAA,MACtC;AAEA,UAAI,iBAAiB,GAAG;AACtB,eAAO;AAAA,MACT;AAEA,aAAO;AAAA,QAEL,GAAG,KAAK;AAAA,MACV;AAAA,IACF,SAAS,OAAP;AACA,UAAI,iBAAiB,OAAO;AAC1B,YACE,MAAM,YAAY,kBAClB,MAAM,YAAY,oBAClB,MAAM,YAAY,4BAClB,MAAM,YAAY,yCAClB;AAKA,iBAAO,CAAC;AAAA,QACV;AAAA,MACF;AAEA,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,UAAUG,OAGjB;AACA,MAAIA,MAAKA,MAAK,SAAS,OAAO,kBAAkB;AAC9C,UAAM,CAAC,oBAAoB,oBAAoB,IAC7CA,MAAK,MAAM,gBAAgB;AAC7B,WAAO;AAAA,MACL;AAAA,MACA,cAAc,SAAS,sBAAsB,EAAE;AAAA,IACjD;AAAA,EACF;AAEA,SAAO,EAAE,oBAAoBA,OAAM,cAAc,KAAK;AACxD;AAEO,SAAS,eAAeH,UAAiB;AAC9C,SAAO,OACL,MACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,MACG;AACH,UAAM,iBAAiB,6BAA6B,QAAQ;AAE5D,UAAM,uBAAuB,KAAK;AAAA,MAChC,GAAG,OAAO,KAAK,cAAc,EAAE,IAAI,CAAC,OAAO,SAAS,IAAI,EAAE,CAAC;AAAA,IAC7D;AAEA,UAAM,kBAAkB;AAAA,MACtB,IAAI,qBAAqB,SAAS;AAAA,MAClC,QAAQ,eAAe;AAAA,IACzB;AAEA,UAAMG,QAAO,MAAW,UAAKH,UAAS,MAAM,iBAAiB;AAAA,MAC3D,GAAQ;AAAA,MACR,KAAK,MAAM;AAAA,IACb,CAAC;AAED,WAAO,GAAGG,QAAO,mBAAmB;AAAA,EACtC;AACF;AAEA,SAAS,6BAA6B,UAAoB;AACxD,SAAO,OAAO,aAAa,WAAW,EAAE,GAAG,SAAS,IAAI;AAC1D;;;AC5UA,IAAM,YAAY,MAAc;AAThC;AAUE,MAAI,SAAO,gBAAW,WAAX,mBAAmB,YAAW;AAAU,WAAO,WAAW;AAErE,MAAI,SAAO,sBAAW,WAAX,mBAAmB,cAAnB,mBAA8B,YAAW;AAElD,WAAO,WAAW,OAAO;AAC3B,QAAM,IAAI;AAAA,IACR;AAAA,EACF;AACF;AAEA,IAAM,UAAU,UAAU;AAEnB,IAAM,aAAa,iBAAiB,OAAO;AAC3C,IAAM,WAAW,eAAe,OAAO;AACvC,IAAM,iBAAiB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AACF;","names":["_crypto","unsealData","sealData","seal"]}
+{"version":3,"sources":["../../src/core.ts","../index.ts"],"sourcesContent":["import * as Iron from \"iron-webcrypto\";\nimport type { CookieSerializeOptions } from \"cookie\";\nimport cookie from \"cookie\";\nimport type { IncomingMessage, ServerResponse } from \"http\";\n\n// default time allowed to check for iron seal validity when ttl passed\n// see https://hapi.dev/family/iron/api/?v=6.0.0#options\nconst timestampSkewSec = 60;\n\ntype passwordsMap = { [id: string]: string };\ntype password = string | passwordsMap;\n\nconst fourteenDaysInSeconds = 15 * 24 * 3600;\n\n// We store a token major version to handle data format changes when any. So that when you upgrade the cookies\n// can be kept alive between upgrades, no need to disconnect everyone.\nconst currentMajorVersion = 2;\nconst versionDelimiter = \"~\";\n\nconst defaultOptions: {\n  ttl: number;\n  cookieOptions: CookieSerializeOptions;\n} = {\n  ttl: fourteenDaysInSeconds,\n  cookieOptions: {\n    httpOnly: true,\n    secure: true,\n    sameSite: \"lax\",\n    path: \"/\",\n  },\n};\n\nexport interface IronSessionOptions {\n  /**\n   * This is the cookie name that will be used inside the browser. You should make sure it's unique given\n   * your application. Example: vercel-session\n   */\n  cookieName: string;\n\n  /**\n   * This is the password(s) that will be used to encrypt the cookie. It can be either a string or an object\n   * like {1: \"password\", 2: password}.\n   *\n   * When you provide multiple passwords then all of them will be used to decrypt the cookie and only the most\n   * recent (= highest key, 2 in this example) password will be used to encrypt the cookie. This allow you\n   * to use password rotation (security)\n   */\n  password: password;\n\n  /**\n   * This is the time in seconds that the session will be valid for. This also set the max-age attribute of\n   * the cookie automatically (minus 60 seconds so that the cookie always expire before the session).\n   */\n  ttl?: number;\n\n  /**\n   * This is the options that will be passed to the cookie library.\n   * You can see all of them here: https://github.com/jshttp/cookie#options-1.\n   *\n   * If you want to use \"session cookies\" (cookies that are deleted when the browser is closed) then you need\n   * to pass cookieOptions: { maxAge: undefined }.\n   */\n  cookieOptions?: CookieSerializeOptions;\n}\n\n// eslint-disable-next-line @typescript-eslint/no-empty-interface\nexport interface IronSessionData {\n  // If we allow for any keys, then there's no more type check on unknown properties\n  // which is not good\n  // If we allow for any keys, the later delete will work but I prefer to disable the\n  // check at this stage and\n  // provide good type checking instead\n  // [key: string]: unknown;\n}\n\nexport type IronSession = IronSessionData & {\n  /**\n   * Destroys the session data and removes the cookie.\n   */\n  destroy: () => void;\n\n  /**\n   * Encrypts the session data and sets the cookie.\n   */\n  save: () => Promise<void>;\n};\n\ndeclare module \"http\" {\n  interface IncomingMessage {\n    session: IronSession;\n  }\n}\n\ntype RequestType = IncomingMessage | Request;\ntype ResponseType = ServerResponse | Response;\n\nexport function createGetIronSession(\n  _crypto: Crypto,\n  unsealData: ReturnType<typeof createUnsealData>,\n  sealData: ReturnType<typeof createSealData>,\n) {\n  return async (\n    req: RequestType,\n    res: ResponseType,\n    userSessionOptions: IronSessionOptions,\n  ): Promise<IronSession> => {\n    if (\n      !req ||\n      !res ||\n      !userSessionOptions ||\n      !userSessionOptions.cookieName ||\n      !userSessionOptions.password\n    ) {\n      throw new Error(\n        `iron-session: Bad usage. Minimum usage is const session = await getIronSession(req, res, { cookieName: \"...\", password: \"...\". Check the usage here: https://github.com/vvo/iron-session`,\n      );\n    }\n\n    const passwordsAsMap = normalizeStringPasswordToMap(\n      userSessionOptions.password,\n    );\n\n    Object.values(\n      normalizeStringPasswordToMap(userSessionOptions.password),\n    ).forEach((password) => {\n      if (password.length < 32) {\n        throw new Error(\n          `iron-session: Bad usage. Password must be at least 32 characters long.`,\n        );\n      }\n    });\n\n    const options: Required<IronSessionOptions> = {\n      ...defaultOptions,\n      ...userSessionOptions,\n      cookieOptions: {\n        ...defaultOptions.cookieOptions,\n        ...(userSessionOptions.cookieOptions || {}),\n      },\n    };\n\n    if (options.ttl === 0) {\n      // ttl = 0 means no expiration\n      // but in reality cookies have to expire (can't have no max-age)\n      // 2147483647 is the max value for max-age in cookies\n      // see https://stackoverflow.com/a/11685301/147079\n      options.ttl = 2147483647;\n    }\n\n    if (\n      userSessionOptions.cookieOptions &&\n      \"maxAge\" in userSessionOptions.cookieOptions\n    ) {\n      // session cookie, do not set maxAge, consider token as infinite\n      if (userSessionOptions.cookieOptions.maxAge === undefined) {\n        options.ttl = 0;\n      } else {\n        options.cookieOptions.maxAge = computeCookieMaxAge(\n          userSessionOptions.cookieOptions.maxAge,\n        );\n      }\n    } else {\n      options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);\n    }\n\n    const sealFromCookies = cookie.parse(\n      \"credentials\" in req\n        ? req.headers.get(\"cookie\") || \"\"\n        : req.headers.cookie || \"\",\n    )[options.cookieName];\n\n    const session =\n      sealFromCookies === undefined\n        ? {}\n        : await unsealData<IronSessionData>(sealFromCookies, {\n            password: passwordsAsMap,\n            ttl: options.ttl,\n          });\n\n    Object.defineProperties(session, {\n      save: {\n        value: async function save() {\n          if (\"headersSent\" in res && res.headersSent === true) {\n            throw new Error(\n              `iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()`,\n            );\n          }\n          const seal = await sealData(session, {\n            password: passwordsAsMap,\n            ttl: options.ttl,\n          });\n          const cookieValue = cookie.serialize(\n            options.cookieName,\n            seal,\n            options.cookieOptions,\n          );\n\n          if (cookieValue.length > 4096) {\n            throw new Error(\n              `iron-session: Cookie length is too big ${cookieValue.length}, browsers will refuse it. Try to remove some data.`,\n            );\n          }\n\n          addToCookies(cookieValue, res);\n        },\n      },\n      destroy: {\n        value: function destroy() {\n          Object.keys(session).forEach((key) => {\n            // @ts-ignore See comment on the IronSessionData interface\n            delete session[key];\n          });\n\n          const cookieValue = cookie.serialize(options.cookieName, \"\", {\n            ...options.cookieOptions,\n            maxAge: 0,\n          });\n          addToCookies(cookieValue, res);\n        },\n      },\n    });\n\n    return session as IronSession;\n  };\n}\n\nfunction addToCookies(cookieValue: string, res: ResponseType) {\n  if (\"headers\" in res) {\n    res.headers.append(\"set-cookie\", cookieValue);\n    return;\n  }\n\n  let existingSetCookie =\n    (res.getHeader(\"set-cookie\") as string[] | string) ?? [];\n  if (typeof existingSetCookie === \"string\") {\n    existingSetCookie = [existingSetCookie];\n  }\n  res.setHeader(\"set-cookie\", [...existingSetCookie, cookieValue]);\n}\n\nfunction computeCookieMaxAge(ttl: number) {\n  // The next line makes sure browser will expire cookies before seals are considered expired by the server.\n  // It also allows for clock difference of 60 seconds maximum between server and clients.\n  // It also makes sure to expire the cookie immediately when value is 0\n  return ttl - timestampSkewSec;\n}\n\nexport function createUnsealData(_crypto: Crypto) {\n  return async <T = Record<string, unknown>>(\n    seal: string,\n    {\n      password,\n      ttl = fourteenDaysInSeconds,\n    }: { password: password; ttl?: number },\n  ): Promise<T> => {\n    const passwordsAsMap = normalizeStringPasswordToMap(password);\n    const { sealWithoutVersion, tokenVersion } = parseSeal(seal);\n\n    try {\n      const data =\n        (await Iron.unseal(_crypto, sealWithoutVersion, passwordsAsMap, {\n          ...Iron.defaults,\n          ttl: ttl * 1000,\n        })) || {};\n\n      if (tokenVersion === 2) {\n        return data as T;\n      }\n\n      return {\n        // @ts-expect-error `persistent` does not exist on newer tokens\n        ...data.persistent,\n      };\n    } catch (error) {\n      if (error instanceof Error) {\n        if (\n          error.message === \"Expired seal\" ||\n          error.message === \"Bad hmac value\" ||\n          error.message.startsWith(\"Cannot find password: \") ||\n          error.message === \"Incorrect number of sealed components\"\n        ) {\n          // if seal expired or\n          // if seal is not valid (encrypted using a different password, when passwords are badly rotated) or\n          // if we can't find back the password in the seal\n          // then we just start a new session over\n          return {} as T;\n        }\n      }\n\n      throw error;\n    }\n  };\n}\n\nfunction parseSeal(seal: string): {\n  sealWithoutVersion: string;\n  tokenVersion: number | null;\n} {\n  if (seal[seal.length - 2] === versionDelimiter) {\n    const [sealWithoutVersion, tokenVersionAsString] =\n      seal.split(versionDelimiter);\n    return {\n      sealWithoutVersion,\n      tokenVersion: parseInt(tokenVersionAsString, 10),\n    };\n  }\n\n  return { sealWithoutVersion: seal, tokenVersion: null };\n}\n\nexport function createSealData(_crypto: Crypto) {\n  return async (\n    data: unknown,\n    {\n      password,\n      ttl = fourteenDaysInSeconds,\n    }: { password: password; ttl?: number },\n  ) => {\n    const passwordsAsMap = normalizeStringPasswordToMap(password);\n\n    const mostRecentPasswordId = Math.max(\n      ...Object.keys(passwordsAsMap).map((id) => parseInt(id, 10)),\n    );\n\n    const passwordForSeal = {\n      id: mostRecentPasswordId.toString(),\n      secret: passwordsAsMap[mostRecentPasswordId],\n    };\n\n    const seal = await Iron.seal(_crypto, data, passwordForSeal, {\n      ...Iron.defaults,\n      ttl: ttl * 1000,\n    });\n\n    return `${seal}${versionDelimiter}${currentMajorVersion}`;\n  };\n}\n\nfunction normalizeStringPasswordToMap(password: password) {\n  return typeof password === \"string\" ? { 1: password } : password;\n}\n","// This allows the types to be linked from the main module instead of duplicated\nexport type { IronSessionOptions, IronSessionData } from \"iron-session\";\n\nimport {\n  createGetIronSession,\n  createSealData,\n  createUnsealData,\n} from \"../src/core\";\n\nconst getCrypto = (): Crypto => {\n  if (typeof globalThis.crypto?.subtle === \"object\") return globalThis.crypto;\n  // @ts-ignore crypto.webcrypto is not available in dom, but is there in newer node versions\n  if (typeof globalThis.crypto?.webcrypto?.subtle === \"object\")\n    // @ts-ignore same as above\n    return globalThis.crypto.webcrypto;\n  throw new Error(\n    \"no native implementation of WebCrypto is available in current context\",\n  );\n};\n\nconst _crypto = getCrypto();\n\nexport const unsealData = createUnsealData(_crypto);\nexport const sealData = createSealData(_crypto);\nexport const getIronSession = createGetIronSession(\n  _crypto,\n  unsealData,\n  sealData,\n);\n"],"mappings":";AAAA,YAAY,UAAU;AAEtB,OAAO,YAAY;AAKnB,IAAM,mBAAmB;AAKzB,IAAM,wBAAwB,KAAK,KAAK;AAIxC,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AAEzB,IAAM,iBAGF;AAAA,EACF,KAAK;AAAA,EACL,eAAe;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,EACR;AACF;AAkEO,SAAS,qBACdA,UACAC,aACAC,WACA;AACA,SAAO,OACL,KACA,KACA,uBACyB;AACzB,QACE,CAAC,OACD,CAAC,OACD,CAAC,sBACD,CAAC,mBAAmB,cACpB,CAAC,mBAAmB,UACpB;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,iBAAiB;AAAA,MACrB,mBAAmB;AAAA,IACrB;AAEA,WAAO;AAAA,MACL,6BAA6B,mBAAmB,QAAQ;AAAA,IAC1D,EAAE,QAAQ,CAAC,aAAa;AACtB,UAAI,SAAS,SAAS,IAAI;AACxB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAED,UAAM,UAAwC;AAAA,MAC5C,GAAG;AAAA,MACH,GAAG;AAAA,MACH,eAAe;AAAA,QACb,GAAG,eAAe;AAAA,QAClB,GAAI,mBAAmB,iBAAiB,CAAC;AAAA,MAC3C;AAAA,IACF;AAEA,QAAI,QAAQ,QAAQ,GAAG;AAKrB,cAAQ,MAAM;AAAA,IAChB;AAEA,QACE,mBAAmB,iBACnB,YAAY,mBAAmB,eAC/B;AAEA,UAAI,mBAAmB,cAAc,WAAW,QAAW;AACzD,gBAAQ,MAAM;AAAA,MAChB,OAAO;AACL,gBAAQ,cAAc,SAAS;AAAA,UAC7B,mBAAmB,cAAc;AAAA,QACnC;AAAA,MACF;AAAA,IACF,OAAO;AACL,cAAQ,cAAc,SAAS,oBAAoB,QAAQ,GAAG;AAAA,IAChE;AAEA,UAAM,kBAAkB,OAAO;AAAA,MAC7B,iBAAiB,MACb,IAAI,QAAQ,IAAI,QAAQ,KAAK,KAC7B,IAAI,QAAQ,UAAU;AAAA,IAC5B,EAAE,QAAQ;AAEV,UAAM,UACJ,oBAAoB,SAChB,CAAC,IACD,MAAMD,YAA4B,iBAAiB;AAAA,MACjD,UAAU;AAAA,MACV,KAAK,QAAQ;AAAA,IACf,CAAC;AAEP,WAAO,iBAAiB,SAAS;AAAA,MAC/B,MAAM;AAAA,QACJ,OAAO,eAAe,OAAO;AAC3B,cAAI,iBAAiB,OAAO,IAAI,gBAAgB,MAAM;AACpD,kBAAM,IAAI;AAAA,cACR;AAAA,YACF;AAAA,UACF;AACA,gBAAME,QAAO,MAAMD,UAAS,SAAS;AAAA,YACnC,UAAU;AAAA,YACV,KAAK,QAAQ;AAAA,UACf,CAAC;AACD,gBAAM,cAAc,OAAO;AAAA,YACzB,QAAQ;AAAA,YACRC;AAAA,YACA,QAAQ;AAAA,UACV;AAEA,cAAI,YAAY,SAAS,MAAM;AAC7B,kBAAM,IAAI;AAAA,cACR,0CAA0C,YAAY;AAAA,YACxD;AAAA,UACF;AAEA,uBAAa,aAAa,GAAG;AAAA,QAC/B;AAAA,MACF;AAAA,MACA,SAAS;AAAA,QACP,OAAO,SAAS,UAAU;AACxB,iBAAO,KAAK,OAAO,EAAE,QAAQ,CAAC,QAAQ;AAEpC,mBAAO,QAAQ;AAAA,UACjB,CAAC;AAED,gBAAM,cAAc,OAAO,UAAU,QAAQ,YAAY,IAAI;AAAA,YAC3D,GAAG,QAAQ;AAAA,YACX,QAAQ;AAAA,UACV,CAAC;AACD,uBAAa,aAAa,GAAG;AAAA,QAC/B;AAAA,MACF;AAAA,IACF,CAAC;AAED,WAAO;AAAA,EACT;AACF;AAEA,SAAS,aAAa,aAAqB,KAAmB;AAlO9D;AAmOE,MAAI,aAAa,KAAK;AACpB,QAAI,QAAQ,OAAO,cAAc,WAAW;AAC5C;AAAA,EACF;AAEA,MAAI,qBACD,SAAI,UAAU,YAAY,MAA1B,YAAqD,CAAC;AACzD,MAAI,OAAO,sBAAsB,UAAU;AACzC,wBAAoB,CAAC,iBAAiB;AAAA,EACxC;AACA,MAAI,UAAU,cAAc,CAAC,GAAG,mBAAmB,WAAW,CAAC;AACjE;AAEA,SAAS,oBAAoB,KAAa;AAIxC,SAAO,MAAM;AACf;AAEO,SAAS,iBAAiBH,UAAiB;AAChD,SAAO,OACLG,OACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,MACe;AACf,UAAM,iBAAiB,6BAA6B,QAAQ;AAC5D,UAAM,EAAE,oBAAoB,aAAa,IAAI,UAAUA,KAAI;AAE3D,QAAI;AACF,YAAM,OACH,MAAW,YAAOH,UAAS,oBAAoB,gBAAgB;AAAA,QAC9D,GAAQ;AAAA,QACR,KAAK,MAAM;AAAA,MACb,CAAC,KAAM,CAAC;AAEV,UAAI,iBAAiB,GAAG;AACtB,eAAO;AAAA,MACT;AAEA,aAAO;AAAA,QAEL,GAAG,KAAK;AAAA,MACV;AAAA,IACF,SAAS,OAAP;AACA,UAAI,iBAAiB,OAAO;AAC1B,YACE,MAAM,YAAY,kBAClB,MAAM,YAAY,oBAClB,MAAM,QAAQ,WAAW,wBAAwB,KACjD,MAAM,YAAY,yCAClB;AAKA,iBAAO,CAAC;AAAA,QACV;AAAA,MACF;AAEA,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,UAAUG,OAGjB;AACA,MAAIA,MAAKA,MAAK,SAAS,OAAO,kBAAkB;AAC9C,UAAM,CAAC,oBAAoB,oBAAoB,IAC7CA,MAAK,MAAM,gBAAgB;AAC7B,WAAO;AAAA,MACL;AAAA,MACA,cAAc,SAAS,sBAAsB,EAAE;AAAA,IACjD;AAAA,EACF;AAEA,SAAO,EAAE,oBAAoBA,OAAM,cAAc,KAAK;AACxD;AAEO,SAAS,eAAeH,UAAiB;AAC9C,SAAO,OACL,MACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,MACG;AACH,UAAM,iBAAiB,6BAA6B,QAAQ;AAE5D,UAAM,uBAAuB,KAAK;AAAA,MAChC,GAAG,OAAO,KAAK,cAAc,EAAE,IAAI,CAAC,OAAO,SAAS,IAAI,EAAE,CAAC;AAAA,IAC7D;AAEA,UAAM,kBAAkB;AAAA,MACtB,IAAI,qBAAqB,SAAS;AAAA,MAClC,QAAQ,eAAe;AAAA,IACzB;AAEA,UAAMG,QAAO,MAAW,UAAKH,UAAS,MAAM,iBAAiB;AAAA,MAC3D,GAAQ;AAAA,MACR,KAAK,MAAM;AAAA,IACb,CAAC;AAED,WAAO,GAAGG,QAAO,mBAAmB;AAAA,EACtC;AACF;AAEA,SAAS,6BAA6B,UAAoB;AACxD,SAAO,OAAO,aAAa,WAAW,EAAE,GAAG,SAAS,IAAI;AAC1D;;;AC3UA,IAAM,YAAY,MAAc;AAThC;AAUE,MAAI,SAAO,gBAAW,WAAX,mBAAmB,YAAW;AAAU,WAAO,WAAW;AAErE,MAAI,SAAO,sBAAW,WAAX,mBAAmB,cAAnB,mBAA8B,YAAW;AAElD,WAAO,WAAW,OAAO;AAC3B,QAAM,IAAI;AAAA,IACR;AAAA,EACF;AACF;AAEA,IAAM,UAAU,UAAU;AAEnB,IAAM,aAAa,iBAAiB,OAAO;AAC3C,IAAM,WAAW,eAAe,OAAO;AACvC,IAAM,iBAAiB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AACF;","names":["_crypto","unsealData","sealData","seal"]}

package/edge/index.js

@@ -160,12 +160,10 @@ function createUnsealData(_crypto2) {
     const passwordsAsMap = normalizeStringPasswordToMap(password);
     const { sealWithoutVersion, tokenVersion } = parseSeal(seal2);
     try {
-      const data = await Iron.unseal(
-        _crypto2,
-        sealWithoutVersion,
-        passwordsAsMap,
-        { ...Iron.defaults, ttl: ttl * 1e3 }
-      );
+      const data = await Iron.unseal(_crypto2, sealWithoutVersion, passwordsAsMap, {
+        ...Iron.defaults,
+        ttl: ttl * 1e3
+      }) || {};
       if (tokenVersion === 2) {
         return data;
       }
@@ -174,7 +172,7 @@ function createUnsealData(_crypto2) {
       };
     } catch (error) {
       if (error instanceof Error) {
-        if (error.message === "Expired seal" || error.message === "Bad hmac value" || error.message === "Cannot find password: " || error.message === "Incorrect number of sealed components") {
+        if (error.message === "Expired seal" || error.message === "Bad hmac value" || error.message.startsWith("Cannot find password: ") || error.message === "Incorrect number of sealed components") {
           return {};
         }
       }

package/edge/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../index.ts","../../src/core.ts"],"sourcesContent":["// This allows the types to be linked from the main module instead of duplicated\nexport type { IronSessionOptions, IronSessionData } from \"iron-session\";\n\nimport {\n  createGetIronSession,\n  createSealData,\n  createUnsealData,\n} from \"../src/core\";\n\nconst getCrypto = (): Crypto => {\n  if (typeof globalThis.crypto?.subtle === \"object\") return globalThis.crypto;\n  // @ts-ignore crypto.webcrypto is not available in dom, but is there in newer node versions\n  if (typeof globalThis.crypto?.webcrypto?.subtle === \"object\")\n    // @ts-ignore same as above\n    return globalThis.crypto.webcrypto;\n  throw new Error(\n    \"no native implementation of WebCrypto is available in current context\",\n  );\n};\n\nconst _crypto = getCrypto();\n\nexport const unsealData = createUnsealData(_crypto);\nexport const sealData = createSealData(_crypto);\nexport const getIronSession = createGetIronSession(\n  _crypto,\n  unsealData,\n  sealData,\n);\n","import * as Iron from \"iron-webcrypto\";\nimport type { CookieSerializeOptions } from \"cookie\";\nimport cookie from \"cookie\";\nimport type { IncomingMessage, ServerResponse } from \"http\";\n\n// default time allowed to check for iron seal validity when ttl passed\n// see https://hapi.dev/family/iron/api/?v=6.0.0#options\nconst timestampSkewSec = 60;\n\ntype passwordsMap = { [id: string]: string };\ntype password = string | passwordsMap;\n\nconst fourteenDaysInSeconds = 15 * 24 * 3600;\n\n// We store a token major version to handle data format changes when any. So that when you upgrade the cookies\n// can be kept alive between upgrades, no need to disconnect everyone.\nconst currentMajorVersion = 2;\nconst versionDelimiter = \"~\";\n\nconst defaultOptions: {\n  ttl: number;\n  cookieOptions: CookieSerializeOptions;\n} = {\n  ttl: fourteenDaysInSeconds,\n  cookieOptions: {\n    httpOnly: true,\n    secure: true,\n    sameSite: \"lax\",\n    path: \"/\",\n  },\n};\n\nexport interface IronSessionOptions {\n  /**\n   * This is the cookie name that will be used inside the browser. You should make sure it's unique given\n   * your application. Example: vercel-session\n   */\n  cookieName: string;\n\n  /**\n   * This is the password(s) that will be used to encrypt the cookie. It can be either a string or an object\n   * like {1: \"password\", 2: password}.\n   *\n   * When you provide multiple passwords then all of them will be used to decrypt the cookie and only the most\n   * recent (= highest key, 2 in this example) password will be used to encrypt the cookie. This allow you\n   * to use password rotation (security)\n   */\n  password: password;\n\n  /**\n   * This is the time in seconds that the session will be valid for. This also set the max-age attribute of\n   * the cookie automatically (minus 60 seconds so that the cookie always expire before the session).\n   */\n  ttl?: number;\n\n  /**\n   * This is the options that will be passed to the cookie library.\n   * You can see all of them here: https://github.com/jshttp/cookie#options-1.\n   *\n   * If you want to use \"session cookies\" (cookies that are deleted when the browser is closed) then you need\n   * to pass cookieOptions: { maxAge: undefined }.\n   */\n  cookieOptions?: CookieSerializeOptions;\n}\n\n// eslint-disable-next-line @typescript-eslint/no-empty-interface\nexport interface IronSessionData {\n  // If we allow for any keys, then there's no more type check on unknown properties\n  // which is not good\n  // If we allow for any keys, the later delete will work but I prefer to disable the\n  // check at this stage and\n  // provide good type checking instead\n  // [key: string]: unknown;\n}\n\nexport type IronSession = IronSessionData & {\n  /**\n   * Destroys the session data and removes the cookie.\n   */\n  destroy: () => void;\n\n  /**\n   * Encrypts the session data and sets the cookie.\n   */\n  save: () => Promise<void>;\n};\n\ndeclare module \"http\" {\n  interface IncomingMessage {\n    session: IronSession;\n  }\n}\n\ntype RequestType = IncomingMessage | Request;\ntype ResponseType = ServerResponse | Response;\n\nexport function createGetIronSession(\n  _crypto: Crypto,\n  unsealData: ReturnType<typeof createUnsealData>,\n  sealData: ReturnType<typeof createSealData>,\n) {\n  return async (\n    req: RequestType,\n    res: ResponseType,\n    userSessionOptions: IronSessionOptions,\n  ): Promise<IronSession> => {\n    if (\n      !req ||\n      !res ||\n      !userSessionOptions ||\n      !userSessionOptions.cookieName ||\n      !userSessionOptions.password\n    ) {\n      throw new Error(\n        `iron-session: Bad usage. Minimum usage is const session = await getIronSession(req, res, { cookieName: \"...\", password: \"...\". Check the usage here: https://github.com/vvo/iron-session`,\n      );\n    }\n\n    const passwordsAsMap = normalizeStringPasswordToMap(\n      userSessionOptions.password,\n    );\n\n    Object.values(\n      normalizeStringPasswordToMap(userSessionOptions.password),\n    ).forEach((password) => {\n      if (password.length < 32) {\n        throw new Error(\n          `iron-session: Bad usage. Password must be at least 32 characters long.`,\n        );\n      }\n    });\n\n    const options: Required<IronSessionOptions> = {\n      ...defaultOptions,\n      ...userSessionOptions,\n      cookieOptions: {\n        ...defaultOptions.cookieOptions,\n        ...(userSessionOptions.cookieOptions || {}),\n      },\n    };\n\n    if (options.ttl === 0) {\n      // ttl = 0 means no expiration\n      // but in reality cookies have to expire (can't have no max-age)\n      // 2147483647 is the max value for max-age in cookies\n      // see https://stackoverflow.com/a/11685301/147079\n      options.ttl = 2147483647;\n    }\n\n    if (\n      userSessionOptions.cookieOptions &&\n      \"maxAge\" in userSessionOptions.cookieOptions\n    ) {\n      // session cookie, do not set maxAge, consider token as infinite\n      if (userSessionOptions.cookieOptions.maxAge === undefined) {\n        options.ttl = 0;\n      } else {\n        options.cookieOptions.maxAge = computeCookieMaxAge(\n          userSessionOptions.cookieOptions.maxAge,\n        );\n      }\n    } else {\n      options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);\n    }\n\n    const sealFromCookies = cookie.parse(\n      \"credentials\" in req\n        ? req.headers.get(\"cookie\") || \"\"\n        : req.headers.cookie || \"\",\n    )[options.cookieName];\n\n    const session =\n      sealFromCookies === undefined\n        ? {}\n        : await unsealData<IronSessionData>(sealFromCookies, {\n            password: passwordsAsMap,\n            ttl: options.ttl,\n          });\n\n    Object.defineProperties(session, {\n      save: {\n        value: async function save() {\n          if (\"headersSent\" in res && res.headersSent === true) {\n            throw new Error(\n              `iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()`,\n            );\n          }\n          const seal = await sealData(session, {\n            password: passwordsAsMap,\n            ttl: options.ttl,\n          });\n          const cookieValue = cookie.serialize(\n            options.cookieName,\n            seal,\n            options.cookieOptions,\n          );\n\n          if (cookieValue.length > 4096) {\n            throw new Error(\n              `iron-session: Cookie length is too big ${cookieValue.length}, browsers will refuse it. Try to remove some data.`,\n            );\n          }\n\n          addToCookies(cookieValue, res);\n        },\n      },\n      destroy: {\n        value: function destroy() {\n          Object.keys(session).forEach((key) => {\n            // @ts-ignore See comment on the IronSessionData interface\n            delete session[key];\n          });\n\n          const cookieValue = cookie.serialize(options.cookieName, \"\", {\n            ...options.cookieOptions,\n            maxAge: 0,\n          });\n          addToCookies(cookieValue, res);\n        },\n      },\n    });\n\n    return session as IronSession;\n  };\n}\n\nfunction addToCookies(cookieValue: string, res: ResponseType) {\n  if (\"headers\" in res) {\n    res.headers.append(\"set-cookie\", cookieValue);\n    return;\n  }\n\n  let existingSetCookie =\n    (res.getHeader(\"set-cookie\") as string[] | string) ?? [];\n  if (typeof existingSetCookie === \"string\") {\n    existingSetCookie = [existingSetCookie];\n  }\n  res.setHeader(\"set-cookie\", [...existingSetCookie, cookieValue]);\n}\n\nfunction computeCookieMaxAge(ttl: number) {\n  // The next line makes sure browser will expire cookies before seals are considered expired by the server.\n  // It also allows for clock difference of 60 seconds maximum between server and clients.\n  // It also makes sure to expire the cookie immediately when value is 0\n  return ttl - timestampSkewSec;\n}\n\nexport function createUnsealData(_crypto: Crypto) {\n  return async <T = Record<string, unknown>>(\n    seal: string,\n    {\n      password,\n      ttl = fourteenDaysInSeconds,\n    }: { password: password; ttl?: number },\n  ): Promise<T> => {\n    const passwordsAsMap = normalizeStringPasswordToMap(password);\n    const { sealWithoutVersion, tokenVersion } = parseSeal(seal);\n\n    try {\n      const data = await Iron.unseal(\n        _crypto,\n        sealWithoutVersion,\n        passwordsAsMap,\n        { ...Iron.defaults, ttl: ttl * 1000 },\n      );\n\n      if (tokenVersion === 2) {\n        return data as T;\n      }\n\n      return {\n        // @ts-expect-error `persistent` does not exist on newer tokens\n        ...data.persistent,\n      };\n    } catch (error) {\n      if (error instanceof Error) {\n        if (\n          error.message === \"Expired seal\" ||\n          error.message === \"Bad hmac value\" ||\n          error.message === \"Cannot find password: \" ||\n          error.message === \"Incorrect number of sealed components\"\n        ) {\n          // if seal expired or\n          // if seal is not valid (encrypted using a different password, when passwords are badly rotated) or\n          // if we can't find back the password in the seal\n          // then we just start a new session over\n          return {} as T;\n        }\n      }\n\n      throw error;\n    }\n  };\n}\n\nfunction parseSeal(seal: string): {\n  sealWithoutVersion: string;\n  tokenVersion: number | null;\n} {\n  if (seal[seal.length - 2] === versionDelimiter) {\n    const [sealWithoutVersion, tokenVersionAsString] =\n      seal.split(versionDelimiter);\n    return {\n      sealWithoutVersion,\n      tokenVersion: parseInt(tokenVersionAsString, 10),\n    };\n  }\n\n  return { sealWithoutVersion: seal, tokenVersion: null };\n}\n\nexport function createSealData(_crypto: Crypto) {\n  return async (\n    data: unknown,\n    {\n      password,\n      ttl = fourteenDaysInSeconds,\n    }: { password: password; ttl?: number },\n  ) => {\n    const passwordsAsMap = normalizeStringPasswordToMap(password);\n\n    const mostRecentPasswordId = Math.max(\n      ...Object.keys(passwordsAsMap).map((id) => parseInt(id, 10)),\n    );\n\n    const passwordForSeal = {\n      id: mostRecentPasswordId.toString(),\n      secret: passwordsAsMap[mostRecentPasswordId],\n    };\n\n    const seal = await Iron.seal(_crypto, data, passwordForSeal, {\n      ...Iron.defaults,\n      ttl: ttl * 1000,\n    });\n\n    return `${seal}${versionDelimiter}${currentMajorVersion}`;\n  };\n}\n\nfunction normalizeStringPasswordToMap(password: password) {\n  return typeof password === \"string\" ? { 1: password } : password;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,WAAsB;AAEtB,oBAAmB;AAKnB,IAAM,mBAAmB;AAKzB,IAAM,wBAAwB,KAAK,KAAK;AAIxC,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AAEzB,IAAM,iBAGF;AAAA,EACF,KAAK;AAAA,EACL,eAAe;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,EACR;AACF;AAkEO,SAAS,qBACdA,UACAC,aACAC,WACA;AACA,SAAO,OACL,KACA,KACA,uBACyB;AACzB,QACE,CAAC,OACD,CAAC,OACD,CAAC,sBACD,CAAC,mBAAmB,cACpB,CAAC,mBAAmB,UACpB;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,iBAAiB;AAAA,MACrB,mBAAmB;AAAA,IACrB;AAEA,WAAO;AAAA,MACL,6BAA6B,mBAAmB,QAAQ;AAAA,IAC1D,EAAE,QAAQ,CAAC,aAAa;AACtB,UAAI,SAAS,SAAS,IAAI;AACxB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAED,UAAM,UAAwC;AAAA,MAC5C,GAAG;AAAA,MACH,GAAG;AAAA,MACH,eAAe;AAAA,QACb,GAAG,eAAe;AAAA,QAClB,GAAI,mBAAmB,iBAAiB,CAAC;AAAA,MAC3C;AAAA,IACF;AAEA,QAAI,QAAQ,QAAQ,GAAG;AAKrB,cAAQ,MAAM;AAAA,IAChB;AAEA,QACE,mBAAmB,iBACnB,YAAY,mBAAmB,eAC/B;AAEA,UAAI,mBAAmB,cAAc,WAAW,QAAW;AACzD,gBAAQ,MAAM;AAAA,MAChB,OAAO;AACL,gBAAQ,cAAc,SAAS;AAAA,UAC7B,mBAAmB,cAAc;AAAA,QACnC;AAAA,MACF;AAAA,IACF,OAAO;AACL,cAAQ,cAAc,SAAS,oBAAoB,QAAQ,GAAG;AAAA,IAChE;AAEA,UAAM,kBAAkB,cAAAC,QAAO;AAAA,MAC7B,iBAAiB,MACb,IAAI,QAAQ,IAAI,QAAQ,KAAK,KAC7B,IAAI,QAAQ,UAAU;AAAA,IAC5B,EAAE,QAAQ;AAEV,UAAM,UACJ,oBAAoB,SAChB,CAAC,IACD,MAAMF,YAA4B,iBAAiB;AAAA,MACjD,UAAU;AAAA,MACV,KAAK,QAAQ;AAAA,IACf,CAAC;AAEP,WAAO,iBAAiB,SAAS;AAAA,MAC/B,MAAM;AAAA,QACJ,OAAO,eAAe,OAAO;AAC3B,cAAI,iBAAiB,OAAO,IAAI,gBAAgB,MAAM;AACpD,kBAAM,IAAI;AAAA,cACR;AAAA,YACF;AAAA,UACF;AACA,gBAAMG,QAAO,MAAMF,UAAS,SAAS;AAAA,YACnC,UAAU;AAAA,YACV,KAAK,QAAQ;AAAA,UACf,CAAC;AACD,gBAAM,cAAc,cAAAC,QAAO;AAAA,YACzB,QAAQ;AAAA,YACRC;AAAA,YACA,QAAQ;AAAA,UACV;AAEA,cAAI,YAAY,SAAS,MAAM;AAC7B,kBAAM,IAAI;AAAA,cACR,0CAA0C,YAAY;AAAA,YACxD;AAAA,UACF;AAEA,uBAAa,aAAa,GAAG;AAAA,QAC/B;AAAA,MACF;AAAA,MACA,SAAS;AAAA,QACP,OAAO,SAAS,UAAU;AACxB,iBAAO,KAAK,OAAO,EAAE,QAAQ,CAAC,QAAQ;AAEpC,mBAAO,QAAQ;AAAA,UACjB,CAAC;AAED,gBAAM,cAAc,cAAAD,QAAO,UAAU,QAAQ,YAAY,IAAI;AAAA,YAC3D,GAAG,QAAQ;AAAA,YACX,QAAQ;AAAA,UACV,CAAC;AACD,uBAAa,aAAa,GAAG;AAAA,QAC/B;AAAA,MACF;AAAA,IACF,CAAC;AAED,WAAO;AAAA,EACT;AACF;AAEA,SAAS,aAAa,aAAqB,KAAmB;AAlO9D;AAmOE,MAAI,aAAa,KAAK;AACpB,QAAI,QAAQ,OAAO,cAAc,WAAW;AAC5C;AAAA,EACF;AAEA,MAAI,qBACD,SAAI,UAAU,YAAY,MAA1B,YAAqD,CAAC;AACzD,MAAI,OAAO,sBAAsB,UAAU;AACzC,wBAAoB,CAAC,iBAAiB;AAAA,EACxC;AACA,MAAI,UAAU,cAAc,CAAC,GAAG,mBAAmB,WAAW,CAAC;AACjE;AAEA,SAAS,oBAAoB,KAAa;AAIxC,SAAO,MAAM;AACf;AAEO,SAAS,iBAAiBH,UAAiB;AAChD,SAAO,OACLI,OACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,MACe;AACf,UAAM,iBAAiB,6BAA6B,QAAQ;AAC5D,UAAM,EAAE,oBAAoB,aAAa,IAAI,UAAUA,KAAI;AAE3D,QAAI;AACF,YAAM,OAAO,MAAW;AAAA,QACtBJ;AAAA,QACA;AAAA,QACA;AAAA,QACA,EAAE,GAAQ,eAAU,KAAK,MAAM,IAAK;AAAA,MACtC;AAEA,UAAI,iBAAiB,GAAG;AACtB,eAAO;AAAA,MACT;AAEA,aAAO;AAAA,QAEL,GAAG,KAAK;AAAA,MACV;AAAA,IACF,SAAS,OAAP;AACA,UAAI,iBAAiB,OAAO;AAC1B,YACE,MAAM,YAAY,kBAClB,MAAM,YAAY,oBAClB,MAAM,YAAY,4BAClB,MAAM,YAAY,yCAClB;AAKA,iBAAO,CAAC;AAAA,QACV;AAAA,MACF;AAEA,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,UAAUI,OAGjB;AACA,MAAIA,MAAKA,MAAK,SAAS,OAAO,kBAAkB;AAC9C,UAAM,CAAC,oBAAoB,oBAAoB,IAC7CA,MAAK,MAAM,gBAAgB;AAC7B,WAAO;AAAA,MACL;AAAA,MACA,cAAc,SAAS,sBAAsB,EAAE;AAAA,IACjD;AAAA,EACF;AAEA,SAAO,EAAE,oBAAoBA,OAAM,cAAc,KAAK;AACxD;AAEO,SAAS,eAAeJ,UAAiB;AAC9C,SAAO,OACL,MACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,MACG;AACH,UAAM,iBAAiB,6BAA6B,QAAQ;AAE5D,UAAM,uBAAuB,KAAK;AAAA,MAChC,GAAG,OAAO,KAAK,cAAc,EAAE,IAAI,CAAC,OAAO,SAAS,IAAI,EAAE,CAAC;AAAA,IAC7D;AAEA,UAAM,kBAAkB;AAAA,MACtB,IAAI,qBAAqB,SAAS;AAAA,MAClC,QAAQ,eAAe;AAAA,IACzB;AAEA,UAAMI,QAAO,MAAW,UAAKJ,UAAS,MAAM,iBAAiB;AAAA,MAC3D,GAAQ;AAAA,MACR,KAAK,MAAM;AAAA,IACb,CAAC;AAED,WAAO,GAAGI,QAAO,mBAAmB;AAAA,EACtC;AACF;AAEA,SAAS,6BAA6B,UAAoB;AACxD,SAAO,OAAO,aAAa,WAAW,EAAE,GAAG,SAAS,IAAI;AAC1D;;;AD5UA,IAAM,YAAY,MAAc;AAThC;AAUE,MAAI,SAAO,gBAAW,WAAX,mBAAmB,YAAW;AAAU,WAAO,WAAW;AAErE,MAAI,SAAO,sBAAW,WAAX,mBAAmB,cAAnB,mBAA8B,YAAW;AAElD,WAAO,WAAW,OAAO;AAC3B,QAAM,IAAI;AAAA,IACR;AAAA,EACF;AACF;AAEA,IAAM,UAAU,UAAU;AAEnB,IAAM,aAAa,iBAAiB,OAAO;AAC3C,IAAM,WAAW,eAAe,OAAO;AACvC,IAAM,iBAAiB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AACF;","names":["_crypto","unsealData","sealData","cookie","seal"]}
+{"version":3,"sources":["../index.ts","../../src/core.ts"],"sourcesContent":["// This allows the types to be linked from the main module instead of duplicated\nexport type { IronSessionOptions, IronSessionData } from \"iron-session\";\n\nimport {\n  createGetIronSession,\n  createSealData,\n  createUnsealData,\n} from \"../src/core\";\n\nconst getCrypto = (): Crypto => {\n  if (typeof globalThis.crypto?.subtle === \"object\") return globalThis.crypto;\n  // @ts-ignore crypto.webcrypto is not available in dom, but is there in newer node versions\n  if (typeof globalThis.crypto?.webcrypto?.subtle === \"object\")\n    // @ts-ignore same as above\n    return globalThis.crypto.webcrypto;\n  throw new Error(\n    \"no native implementation of WebCrypto is available in current context\",\n  );\n};\n\nconst _crypto = getCrypto();\n\nexport const unsealData = createUnsealData(_crypto);\nexport const sealData = createSealData(_crypto);\nexport const getIronSession = createGetIronSession(\n  _crypto,\n  unsealData,\n  sealData,\n);\n","import * as Iron from \"iron-webcrypto\";\nimport type { CookieSerializeOptions } from \"cookie\";\nimport cookie from \"cookie\";\nimport type { IncomingMessage, ServerResponse } from \"http\";\n\n// default time allowed to check for iron seal validity when ttl passed\n// see https://hapi.dev/family/iron/api/?v=6.0.0#options\nconst timestampSkewSec = 60;\n\ntype passwordsMap = { [id: string]: string };\ntype password = string | passwordsMap;\n\nconst fourteenDaysInSeconds = 15 * 24 * 3600;\n\n// We store a token major version to handle data format changes when any. So that when you upgrade the cookies\n// can be kept alive between upgrades, no need to disconnect everyone.\nconst currentMajorVersion = 2;\nconst versionDelimiter = \"~\";\n\nconst defaultOptions: {\n  ttl: number;\n  cookieOptions: CookieSerializeOptions;\n} = {\n  ttl: fourteenDaysInSeconds,\n  cookieOptions: {\n    httpOnly: true,\n    secure: true,\n    sameSite: \"lax\",\n    path: \"/\",\n  },\n};\n\nexport interface IronSessionOptions {\n  /**\n   * This is the cookie name that will be used inside the browser. You should make sure it's unique given\n   * your application. Example: vercel-session\n   */\n  cookieName: string;\n\n  /**\n   * This is the password(s) that will be used to encrypt the cookie. It can be either a string or an object\n   * like {1: \"password\", 2: password}.\n   *\n   * When you provide multiple passwords then all of them will be used to decrypt the cookie and only the most\n   * recent (= highest key, 2 in this example) password will be used to encrypt the cookie. This allow you\n   * to use password rotation (security)\n   */\n  password: password;\n\n  /**\n   * This is the time in seconds that the session will be valid for. This also set the max-age attribute of\n   * the cookie automatically (minus 60 seconds so that the cookie always expire before the session).\n   */\n  ttl?: number;\n\n  /**\n   * This is the options that will be passed to the cookie library.\n   * You can see all of them here: https://github.com/jshttp/cookie#options-1.\n   *\n   * If you want to use \"session cookies\" (cookies that are deleted when the browser is closed) then you need\n   * to pass cookieOptions: { maxAge: undefined }.\n   */\n  cookieOptions?: CookieSerializeOptions;\n}\n\n// eslint-disable-next-line @typescript-eslint/no-empty-interface\nexport interface IronSessionData {\n  // If we allow for any keys, then there's no more type check on unknown properties\n  // which is not good\n  // If we allow for any keys, the later delete will work but I prefer to disable the\n  // check at this stage and\n  // provide good type checking instead\n  // [key: string]: unknown;\n}\n\nexport type IronSession = IronSessionData & {\n  /**\n   * Destroys the session data and removes the cookie.\n   */\n  destroy: () => void;\n\n  /**\n   * Encrypts the session data and sets the cookie.\n   */\n  save: () => Promise<void>;\n};\n\ndeclare module \"http\" {\n  interface IncomingMessage {\n    session: IronSession;\n  }\n}\n\ntype RequestType = IncomingMessage | Request;\ntype ResponseType = ServerResponse | Response;\n\nexport function createGetIronSession(\n  _crypto: Crypto,\n  unsealData: ReturnType<typeof createUnsealData>,\n  sealData: ReturnType<typeof createSealData>,\n) {\n  return async (\n    req: RequestType,\n    res: ResponseType,\n    userSessionOptions: IronSessionOptions,\n  ): Promise<IronSession> => {\n    if (\n      !req ||\n      !res ||\n      !userSessionOptions ||\n      !userSessionOptions.cookieName ||\n      !userSessionOptions.password\n    ) {\n      throw new Error(\n        `iron-session: Bad usage. Minimum usage is const session = await getIronSession(req, res, { cookieName: \"...\", password: \"...\". Check the usage here: https://github.com/vvo/iron-session`,\n      );\n    }\n\n    const passwordsAsMap = normalizeStringPasswordToMap(\n      userSessionOptions.password,\n    );\n\n    Object.values(\n      normalizeStringPasswordToMap(userSessionOptions.password),\n    ).forEach((password) => {\n      if (password.length < 32) {\n        throw new Error(\n          `iron-session: Bad usage. Password must be at least 32 characters long.`,\n        );\n      }\n    });\n\n    const options: Required<IronSessionOptions> = {\n      ...defaultOptions,\n      ...userSessionOptions,\n      cookieOptions: {\n        ...defaultOptions.cookieOptions,\n        ...(userSessionOptions.cookieOptions || {}),\n      },\n    };\n\n    if (options.ttl === 0) {\n      // ttl = 0 means no expiration\n      // but in reality cookies have to expire (can't have no max-age)\n      // 2147483647 is the max value for max-age in cookies\n      // see https://stackoverflow.com/a/11685301/147079\n      options.ttl = 2147483647;\n    }\n\n    if (\n      userSessionOptions.cookieOptions &&\n      \"maxAge\" in userSessionOptions.cookieOptions\n    ) {\n      // session cookie, do not set maxAge, consider token as infinite\n      if (userSessionOptions.cookieOptions.maxAge === undefined) {\n        options.ttl = 0;\n      } else {\n        options.cookieOptions.maxAge = computeCookieMaxAge(\n          userSessionOptions.cookieOptions.maxAge,\n        );\n      }\n    } else {\n      options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);\n    }\n\n    const sealFromCookies = cookie.parse(\n      \"credentials\" in req\n        ? req.headers.get(\"cookie\") || \"\"\n        : req.headers.cookie || \"\",\n    )[options.cookieName];\n\n    const session =\n      sealFromCookies === undefined\n        ? {}\n        : await unsealData<IronSessionData>(sealFromCookies, {\n            password: passwordsAsMap,\n            ttl: options.ttl,\n          });\n\n    Object.defineProperties(session, {\n      save: {\n        value: async function save() {\n          if (\"headersSent\" in res && res.headersSent === true) {\n            throw new Error(\n              `iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()`,\n            );\n          }\n          const seal = await sealData(session, {\n            password: passwordsAsMap,\n            ttl: options.ttl,\n          });\n          const cookieValue = cookie.serialize(\n            options.cookieName,\n            seal,\n            options.cookieOptions,\n          );\n\n          if (cookieValue.length > 4096) {\n            throw new Error(\n              `iron-session: Cookie length is too big ${cookieValue.length}, browsers will refuse it. Try to remove some data.`,\n            );\n          }\n\n          addToCookies(cookieValue, res);\n        },\n      },\n      destroy: {\n        value: function destroy() {\n          Object.keys(session).forEach((key) => {\n            // @ts-ignore See comment on the IronSessionData interface\n            delete session[key];\n          });\n\n          const cookieValue = cookie.serialize(options.cookieName, \"\", {\n            ...options.cookieOptions,\n            maxAge: 0,\n          });\n          addToCookies(cookieValue, res);\n        },\n      },\n    });\n\n    return session as IronSession;\n  };\n}\n\nfunction addToCookies(cookieValue: string, res: ResponseType) {\n  if (\"headers\" in res) {\n    res.headers.append(\"set-cookie\", cookieValue);\n    return;\n  }\n\n  let existingSetCookie =\n    (res.getHeader(\"set-cookie\") as string[] | string) ?? [];\n  if (typeof existingSetCookie === \"string\") {\n    existingSetCookie = [existingSetCookie];\n  }\n  res.setHeader(\"set-cookie\", [...existingSetCookie, cookieValue]);\n}\n\nfunction computeCookieMaxAge(ttl: number) {\n  // The next line makes sure browser will expire cookies before seals are considered expired by the server.\n  // It also allows for clock difference of 60 seconds maximum between server and clients.\n  // It also makes sure to expire the cookie immediately when value is 0\n  return ttl - timestampSkewSec;\n}\n\nexport function createUnsealData(_crypto: Crypto) {\n  return async <T = Record<string, unknown>>(\n    seal: string,\n    {\n      password,\n      ttl = fourteenDaysInSeconds,\n    }: { password: password; ttl?: number },\n  ): Promise<T> => {\n    const passwordsAsMap = normalizeStringPasswordToMap(password);\n    const { sealWithoutVersion, tokenVersion } = parseSeal(seal);\n\n    try {\n      const data =\n        (await Iron.unseal(_crypto, sealWithoutVersion, passwordsAsMap, {\n          ...Iron.defaults,\n          ttl: ttl * 1000,\n        })) || {};\n\n      if (tokenVersion === 2) {\n        return data as T;\n      }\n\n      return {\n        // @ts-expect-error `persistent` does not exist on newer tokens\n        ...data.persistent,\n      };\n    } catch (error) {\n      if (error instanceof Error) {\n        if (\n          error.message === \"Expired seal\" ||\n          error.message === \"Bad hmac value\" ||\n          error.message.startsWith(\"Cannot find password: \") ||\n          error.message === \"Incorrect number of sealed components\"\n        ) {\n          // if seal expired or\n          // if seal is not valid (encrypted using a different password, when passwords are badly rotated) or\n          // if we can't find back the password in the seal\n          // then we just start a new session over\n          return {} as T;\n        }\n      }\n\n      throw error;\n    }\n  };\n}\n\nfunction parseSeal(seal: string): {\n  sealWithoutVersion: string;\n  tokenVersion: number | null;\n} {\n  if (seal[seal.length - 2] === versionDelimiter) {\n    const [sealWithoutVersion, tokenVersionAsString] =\n      seal.split(versionDelimiter);\n    return {\n      sealWithoutVersion,\n      tokenVersion: parseInt(tokenVersionAsString, 10),\n    };\n  }\n\n  return { sealWithoutVersion: seal, tokenVersion: null };\n}\n\nexport function createSealData(_crypto: Crypto) {\n  return async (\n    data: unknown,\n    {\n      password,\n      ttl = fourteenDaysInSeconds,\n    }: { password: password; ttl?: number },\n  ) => {\n    const passwordsAsMap = normalizeStringPasswordToMap(password);\n\n    const mostRecentPasswordId = Math.max(\n      ...Object.keys(passwordsAsMap).map((id) => parseInt(id, 10)),\n    );\n\n    const passwordForSeal = {\n      id: mostRecentPasswordId.toString(),\n      secret: passwordsAsMap[mostRecentPasswordId],\n    };\n\n    const seal = await Iron.seal(_crypto, data, passwordForSeal, {\n      ...Iron.defaults,\n      ttl: ttl * 1000,\n    });\n\n    return `${seal}${versionDelimiter}${currentMajorVersion}`;\n  };\n}\n\nfunction normalizeStringPasswordToMap(password: password) {\n  return typeof password === \"string\" ? { 1: password } : password;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA,WAAsB;AAEtB,oBAAmB;AAKnB,IAAM,mBAAmB;AAKzB,IAAM,wBAAwB,KAAK,KAAK;AAIxC,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AAEzB,IAAM,iBAGF;AAAA,EACF,KAAK;AAAA,EACL,eAAe;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,EACR;AACF;AAkEO,SAAS,qBACdA,UACAC,aACAC,WACA;AACA,SAAO,OACL,KACA,KACA,uBACyB;AACzB,QACE,CAAC,OACD,CAAC,OACD,CAAC,sBACD,CAAC,mBAAmB,cACpB,CAAC,mBAAmB,UACpB;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,iBAAiB;AAAA,MACrB,mBAAmB;AAAA,IACrB;AAEA,WAAO;AAAA,MACL,6BAA6B,mBAAmB,QAAQ;AAAA,IAC1D,EAAE,QAAQ,CAAC,aAAa;AACtB,UAAI,SAAS,SAAS,IAAI;AACxB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAED,UAAM,UAAwC;AAAA,MAC5C,GAAG;AAAA,MACH,GAAG;AAAA,MACH,eAAe;AAAA,QACb,GAAG,eAAe;AAAA,QAClB,GAAI,mBAAmB,iBAAiB,CAAC;AAAA,MAC3C;AAAA,IACF;AAEA,QAAI,QAAQ,QAAQ,GAAG;AAKrB,cAAQ,MAAM;AAAA,IAChB;AAEA,QACE,mBAAmB,iBACnB,YAAY,mBAAmB,eAC/B;AAEA,UAAI,mBAAmB,cAAc,WAAW,QAAW;AACzD,gBAAQ,MAAM;AAAA,MAChB,OAAO;AACL,gBAAQ,cAAc,SAAS;AAAA,UAC7B,mBAAmB,cAAc;AAAA,QACnC;AAAA,MACF;AAAA,IACF,OAAO;AACL,cAAQ,cAAc,SAAS,oBAAoB,QAAQ,GAAG;AAAA,IAChE;AAEA,UAAM,kBAAkB,cAAAC,QAAO;AAAA,MAC7B,iBAAiB,MACb,IAAI,QAAQ,IAAI,QAAQ,KAAK,KAC7B,IAAI,QAAQ,UAAU;AAAA,IAC5B,EAAE,QAAQ;AAEV,UAAM,UACJ,oBAAoB,SAChB,CAAC,IACD,MAAMF,YAA4B,iBAAiB;AAAA,MACjD,UAAU;AAAA,MACV,KAAK,QAAQ;AAAA,IACf,CAAC;AAEP,WAAO,iBAAiB,SAAS;AAAA,MAC/B,MAAM;AAAA,QACJ,OAAO,eAAe,OAAO;AAC3B,cAAI,iBAAiB,OAAO,IAAI,gBAAgB,MAAM;AACpD,kBAAM,IAAI;AAAA,cACR;AAAA,YACF;AAAA,UACF;AACA,gBAAMG,QAAO,MAAMF,UAAS,SAAS;AAAA,YACnC,UAAU;AAAA,YACV,KAAK,QAAQ;AAAA,UACf,CAAC;AACD,gBAAM,cAAc,cAAAC,QAAO;AAAA,YACzB,QAAQ;AAAA,YACRC;AAAA,YACA,QAAQ;AAAA,UACV;AAEA,cAAI,YAAY,SAAS,MAAM;AAC7B,kBAAM,IAAI;AAAA,cACR,0CAA0C,YAAY;AAAA,YACxD;AAAA,UACF;AAEA,uBAAa,aAAa,GAAG;AAAA,QAC/B;AAAA,MACF;AAAA,MACA,SAAS;AAAA,QACP,OAAO,SAAS,UAAU;AACxB,iBAAO,KAAK,OAAO,EAAE,QAAQ,CAAC,QAAQ;AAEpC,mBAAO,QAAQ;AAAA,UACjB,CAAC;AAED,gBAAM,cAAc,cAAAD,QAAO,UAAU,QAAQ,YAAY,IAAI;AAAA,YAC3D,GAAG,QAAQ;AAAA,YACX,QAAQ;AAAA,UACV,CAAC;AACD,uBAAa,aAAa,GAAG;AAAA,QAC/B;AAAA,MACF;AAAA,IACF,CAAC;AAED,WAAO;AAAA,EACT;AACF;AAEA,SAAS,aAAa,aAAqB,KAAmB;AAlO9D;AAmOE,MAAI,aAAa,KAAK;AACpB,QAAI,QAAQ,OAAO,cAAc,WAAW;AAC5C;AAAA,EACF;AAEA,MAAI,qBACD,SAAI,UAAU,YAAY,MAA1B,YAAqD,CAAC;AACzD,MAAI,OAAO,sBAAsB,UAAU;AACzC,wBAAoB,CAAC,iBAAiB;AAAA,EACxC;AACA,MAAI,UAAU,cAAc,CAAC,GAAG,mBAAmB,WAAW,CAAC;AACjE;AAEA,SAAS,oBAAoB,KAAa;AAIxC,SAAO,MAAM;AACf;AAEO,SAAS,iBAAiBH,UAAiB;AAChD,SAAO,OACLI,OACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,MACe;AACf,UAAM,iBAAiB,6BAA6B,QAAQ;AAC5D,UAAM,EAAE,oBAAoB,aAAa,IAAI,UAAUA,KAAI;AAE3D,QAAI;AACF,YAAM,OACH,MAAW,YAAOJ,UAAS,oBAAoB,gBAAgB;AAAA,QAC9D,GAAQ;AAAA,QACR,KAAK,MAAM;AAAA,MACb,CAAC,KAAM,CAAC;AAEV,UAAI,iBAAiB,GAAG;AACtB,eAAO;AAAA,MACT;AAEA,aAAO;AAAA,QAEL,GAAG,KAAK;AAAA,MACV;AAAA,IACF,SAAS,OAAP;AACA,UAAI,iBAAiB,OAAO;AAC1B,YACE,MAAM,YAAY,kBAClB,MAAM,YAAY,oBAClB,MAAM,QAAQ,WAAW,wBAAwB,KACjD,MAAM,YAAY,yCAClB;AAKA,iBAAO,CAAC;AAAA,QACV;AAAA,MACF;AAEA,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,UAAUI,OAGjB;AACA,MAAIA,MAAKA,MAAK,SAAS,OAAO,kBAAkB;AAC9C,UAAM,CAAC,oBAAoB,oBAAoB,IAC7CA,MAAK,MAAM,gBAAgB;AAC7B,WAAO;AAAA,MACL;AAAA,MACA,cAAc,SAAS,sBAAsB,EAAE;AAAA,IACjD;AAAA,EACF;AAEA,SAAO,EAAE,oBAAoBA,OAAM,cAAc,KAAK;AACxD;AAEO,SAAS,eAAeJ,UAAiB;AAC9C,SAAO,OACL,MACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,MACG;AACH,UAAM,iBAAiB,6BAA6B,QAAQ;AAE5D,UAAM,uBAAuB,KAAK;AAAA,MAChC,GAAG,OAAO,KAAK,cAAc,EAAE,IAAI,CAAC,OAAO,SAAS,IAAI,EAAE,CAAC;AAAA,IAC7D;AAEA,UAAM,kBAAkB;AAAA,MACtB,IAAI,qBAAqB,SAAS;AAAA,MAClC,QAAQ,eAAe;AAAA,IACzB;AAEA,UAAMI,QAAO,MAAW,UAAKJ,UAAS,MAAM,iBAAiB;AAAA,MAC3D,GAAQ;AAAA,MACR,KAAK,MAAM;AAAA,IACb,CAAC;AAED,WAAO,GAAGI,QAAO,mBAAmB;AAAA,EACtC;AACF;AAEA,SAAS,6BAA6B,UAAoB;AACxD,SAAO,OAAO,aAAa,WAAW,EAAE,GAAG,SAAS,IAAI;AAC1D;;;AD3UA,IAAM,YAAY,MAAc;AAThC;AAUE,MAAI,SAAO,gBAAW,WAAX,mBAAmB,YAAW;AAAU,WAAO,WAAW;AAErE,MAAI,SAAO,sBAAW,WAAX,mBAAmB,cAAnB,mBAA8B,YAAW;AAElD,WAAO,WAAW,OAAO;AAC3B,QAAM,IAAI;AAAA,IACR;AAAA,EACF;AACF;AAEA,IAAM,UAAU,UAAU;AAEnB,IAAM,aAAa,iBAAiB,OAAO;AAC3C,IAAM,WAAW,eAAe,OAAO;AACvC,IAAM,iBAAiB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AACF;","names":["_crypto","unsealData","sealData","cookie","seal"]}

package/edge/index.mjs

@@ -126,12 +126,10 @@ function createUnsealData(_crypto2) {
     const passwordsAsMap = normalizeStringPasswordToMap(password);
     const { sealWithoutVersion, tokenVersion } = parseSeal(seal2);
     try {
-      const data = await Iron.unseal(
-        _crypto2,
-        sealWithoutVersion,
-        passwordsAsMap,
-        { ...Iron.defaults, ttl: ttl * 1e3 }
-      );
+      const data = await Iron.unseal(_crypto2, sealWithoutVersion, passwordsAsMap, {
+        ...Iron.defaults,
+        ttl: ttl * 1e3
+      }) || {};
       if (tokenVersion === 2) {
         return data;
       }
@@ -140,7 +138,7 @@ function createUnsealData(_crypto2) {
       };
     } catch (error) {
       if (error instanceof Error) {
-        if (error.message === "Expired seal" || error.message === "Bad hmac value" || error.message === "Cannot find password: " || error.message === "Incorrect number of sealed components") {
+        if (error.message === "Expired seal" || error.message === "Bad hmac value" || error.message.startsWith("Cannot find password: ") || error.message === "Incorrect number of sealed components") {
           return {};
         }
       }

package/edge/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core.ts","../index.ts"],"sourcesContent":["import * as Iron from \"iron-webcrypto\";\nimport type { CookieSerializeOptions } from \"cookie\";\nimport cookie from \"cookie\";\nimport type { IncomingMessage, ServerResponse } from \"http\";\n\n// default time allowed to check for iron seal validity when ttl passed\n// see https://hapi.dev/family/iron/api/?v=6.0.0#options\nconst timestampSkewSec = 60;\n\ntype passwordsMap = { [id: string]: string };\ntype password = string | passwordsMap;\n\nconst fourteenDaysInSeconds = 15 * 24 * 3600;\n\n// We store a token major version to handle data format changes when any. So that when you upgrade the cookies\n// can be kept alive between upgrades, no need to disconnect everyone.\nconst currentMajorVersion = 2;\nconst versionDelimiter = \"~\";\n\nconst defaultOptions: {\n  ttl: number;\n  cookieOptions: CookieSerializeOptions;\n} = {\n  ttl: fourteenDaysInSeconds,\n  cookieOptions: {\n    httpOnly: true,\n    secure: true,\n    sameSite: \"lax\",\n    path: \"/\",\n  },\n};\n\nexport interface IronSessionOptions {\n  /**\n   * This is the cookie name that will be used inside the browser. You should make sure it's unique given\n   * your application. Example: vercel-session\n   */\n  cookieName: string;\n\n  /**\n   * This is the password(s) that will be used to encrypt the cookie. It can be either a string or an object\n   * like {1: \"password\", 2: password}.\n   *\n   * When you provide multiple passwords then all of them will be used to decrypt the cookie and only the most\n   * recent (= highest key, 2 in this example) password will be used to encrypt the cookie. This allow you\n   * to use password rotation (security)\n   */\n  password: password;\n\n  /**\n   * This is the time in seconds that the session will be valid for. This also set the max-age attribute of\n   * the cookie automatically (minus 60 seconds so that the cookie always expire before the session).\n   */\n  ttl?: number;\n\n  /**\n   * This is the options that will be passed to the cookie library.\n   * You can see all of them here: https://github.com/jshttp/cookie#options-1.\n   *\n   * If you want to use \"session cookies\" (cookies that are deleted when the browser is closed) then you need\n   * to pass cookieOptions: { maxAge: undefined }.\n   */\n  cookieOptions?: CookieSerializeOptions;\n}\n\n// eslint-disable-next-line @typescript-eslint/no-empty-interface\nexport interface IronSessionData {\n  // If we allow for any keys, then there's no more type check on unknown properties\n  // which is not good\n  // If we allow for any keys, the later delete will work but I prefer to disable the\n  // check at this stage and\n  // provide good type checking instead\n  // [key: string]: unknown;\n}\n\nexport type IronSession = IronSessionData & {\n  /**\n   * Destroys the session data and removes the cookie.\n   */\n  destroy: () => void;\n\n  /**\n   * Encrypts the session data and sets the cookie.\n   */\n  save: () => Promise<void>;\n};\n\ndeclare module \"http\" {\n  interface IncomingMessage {\n    session: IronSession;\n  }\n}\n\ntype RequestType = IncomingMessage | Request;\ntype ResponseType = ServerResponse | Response;\n\nexport function createGetIronSession(\n  _crypto: Crypto,\n  unsealData: ReturnType<typeof createUnsealData>,\n  sealData: ReturnType<typeof createSealData>,\n) {\n  return async (\n    req: RequestType,\n    res: ResponseType,\n    userSessionOptions: IronSessionOptions,\n  ): Promise<IronSession> => {\n    if (\n      !req ||\n      !res ||\n      !userSessionOptions ||\n      !userSessionOptions.cookieName ||\n      !userSessionOptions.password\n    ) {\n      throw new Error(\n        `iron-session: Bad usage. Minimum usage is const session = await getIronSession(req, res, { cookieName: \"...\", password: \"...\". Check the usage here: https://github.com/vvo/iron-session`,\n      );\n    }\n\n    const passwordsAsMap = normalizeStringPasswordToMap(\n      userSessionOptions.password,\n    );\n\n    Object.values(\n      normalizeStringPasswordToMap(userSessionOptions.password),\n    ).forEach((password) => {\n      if (password.length < 32) {\n        throw new Error(\n          `iron-session: Bad usage. Password must be at least 32 characters long.`,\n        );\n      }\n    });\n\n    const options: Required<IronSessionOptions> = {\n      ...defaultOptions,\n      ...userSessionOptions,\n      cookieOptions: {\n        ...defaultOptions.cookieOptions,\n        ...(userSessionOptions.cookieOptions || {}),\n      },\n    };\n\n    if (options.ttl === 0) {\n      // ttl = 0 means no expiration\n      // but in reality cookies have to expire (can't have no max-age)\n      // 2147483647 is the max value for max-age in cookies\n      // see https://stackoverflow.com/a/11685301/147079\n      options.ttl = 2147483647;\n    }\n\n    if (\n      userSessionOptions.cookieOptions &&\n      \"maxAge\" in userSessionOptions.cookieOptions\n    ) {\n      // session cookie, do not set maxAge, consider token as infinite\n      if (userSessionOptions.cookieOptions.maxAge === undefined) {\n        options.ttl = 0;\n      } else {\n        options.cookieOptions.maxAge = computeCookieMaxAge(\n          userSessionOptions.cookieOptions.maxAge,\n        );\n      }\n    } else {\n      options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);\n    }\n\n    const sealFromCookies = cookie.parse(\n      \"credentials\" in req\n        ? req.headers.get(\"cookie\") || \"\"\n        : req.headers.cookie || \"\",\n    )[options.cookieName];\n\n    const session =\n      sealFromCookies === undefined\n        ? {}\n        : await unsealData<IronSessionData>(sealFromCookies, {\n            password: passwordsAsMap,\n            ttl: options.ttl,\n          });\n\n    Object.defineProperties(session, {\n      save: {\n        value: async function save() {\n          if (\"headersSent\" in res && res.headersSent === true) {\n            throw new Error(\n              `iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()`,\n            );\n          }\n          const seal = await sealData(session, {\n            password: passwordsAsMap,\n            ttl: options.ttl,\n          });\n          const cookieValue = cookie.serialize(\n            options.cookieName,\n            seal,\n            options.cookieOptions,\n          );\n\n          if (cookieValue.length > 4096) {\n            throw new Error(\n              `iron-session: Cookie length is too big ${cookieValue.length}, browsers will refuse it. Try to remove some data.`,\n            );\n          }\n\n          addToCookies(cookieValue, res);\n        },\n      },\n      destroy: {\n        value: function destroy() {\n          Object.keys(session).forEach((key) => {\n            // @ts-ignore See comment on the IronSessionData interface\n            delete session[key];\n          });\n\n          const cookieValue = cookie.serialize(options.cookieName, \"\", {\n            ...options.cookieOptions,\n            maxAge: 0,\n          });\n          addToCookies(cookieValue, res);\n        },\n      },\n    });\n\n    return session as IronSession;\n  };\n}\n\nfunction addToCookies(cookieValue: string, res: ResponseType) {\n  if (\"headers\" in res) {\n    res.headers.append(\"set-cookie\", cookieValue);\n    return;\n  }\n\n  let existingSetCookie =\n    (res.getHeader(\"set-cookie\") as string[] | string) ?? [];\n  if (typeof existingSetCookie === \"string\") {\n    existingSetCookie = [existingSetCookie];\n  }\n  res.setHeader(\"set-cookie\", [...existingSetCookie, cookieValue]);\n}\n\nfunction computeCookieMaxAge(ttl: number) {\n  // The next line makes sure browser will expire cookies before seals are considered expired by the server.\n  // It also allows for clock difference of 60 seconds maximum between server and clients.\n  // It also makes sure to expire the cookie immediately when value is 0\n  return ttl - timestampSkewSec;\n}\n\nexport function createUnsealData(_crypto: Crypto) {\n  return async <T = Record<string, unknown>>(\n    seal: string,\n    {\n      password,\n      ttl = fourteenDaysInSeconds,\n    }: { password: password; ttl?: number },\n  ): Promise<T> => {\n    const passwordsAsMap = normalizeStringPasswordToMap(password);\n    const { sealWithoutVersion, tokenVersion } = parseSeal(seal);\n\n    try {\n      const data = await Iron.unseal(\n        _crypto,\n        sealWithoutVersion,\n        passwordsAsMap,\n        { ...Iron.defaults, ttl: ttl * 1000 },\n      );\n\n      if (tokenVersion === 2) {\n        return data as T;\n      }\n\n      return {\n        // @ts-expect-error `persistent` does not exist on newer tokens\n        ...data.persistent,\n      };\n    } catch (error) {\n      if (error instanceof Error) {\n        if (\n          error.message === \"Expired seal\" ||\n          error.message === \"Bad hmac value\" ||\n          error.message === \"Cannot find password: \" ||\n          error.message === \"Incorrect number of sealed components\"\n        ) {\n          // if seal expired or\n          // if seal is not valid (encrypted using a different password, when passwords are badly rotated) or\n          // if we can't find back the password in the seal\n          // then we just start a new session over\n          return {} as T;\n        }\n      }\n\n      throw error;\n    }\n  };\n}\n\nfunction parseSeal(seal: string): {\n  sealWithoutVersion: string;\n  tokenVersion: number | null;\n} {\n  if (seal[seal.length - 2] === versionDelimiter) {\n    const [sealWithoutVersion, tokenVersionAsString] =\n      seal.split(versionDelimiter);\n    return {\n      sealWithoutVersion,\n      tokenVersion: parseInt(tokenVersionAsString, 10),\n    };\n  }\n\n  return { sealWithoutVersion: seal, tokenVersion: null };\n}\n\nexport function createSealData(_crypto: Crypto) {\n  return async (\n    data: unknown,\n    {\n      password,\n      ttl = fourteenDaysInSeconds,\n    }: { password: password; ttl?: number },\n  ) => {\n    const passwordsAsMap = normalizeStringPasswordToMap(password);\n\n    const mostRecentPasswordId = Math.max(\n      ...Object.keys(passwordsAsMap).map((id) => parseInt(id, 10)),\n    );\n\n    const passwordForSeal = {\n      id: mostRecentPasswordId.toString(),\n      secret: passwordsAsMap[mostRecentPasswordId],\n    };\n\n    const seal = await Iron.seal(_crypto, data, passwordForSeal, {\n      ...Iron.defaults,\n      ttl: ttl * 1000,\n    });\n\n    return `${seal}${versionDelimiter}${currentMajorVersion}`;\n  };\n}\n\nfunction normalizeStringPasswordToMap(password: password) {\n  return typeof password === \"string\" ? { 1: password } : password;\n}\n","// This allows the types to be linked from the main module instead of duplicated\nexport type { IronSessionOptions, IronSessionData } from \"iron-session\";\n\nimport {\n  createGetIronSession,\n  createSealData,\n  createUnsealData,\n} from \"../src/core\";\n\nconst getCrypto = (): Crypto => {\n  if (typeof globalThis.crypto?.subtle === \"object\") return globalThis.crypto;\n  // @ts-ignore crypto.webcrypto is not available in dom, but is there in newer node versions\n  if (typeof globalThis.crypto?.webcrypto?.subtle === \"object\")\n    // @ts-ignore same as above\n    return globalThis.crypto.webcrypto;\n  throw new Error(\n    \"no native implementation of WebCrypto is available in current context\",\n  );\n};\n\nconst _crypto = getCrypto();\n\nexport const unsealData = createUnsealData(_crypto);\nexport const sealData = createSealData(_crypto);\nexport const getIronSession = createGetIronSession(\n  _crypto,\n  unsealData,\n  sealData,\n);\n"],"mappings":";AAAA,YAAY,UAAU;AAEtB,OAAO,YAAY;AAKnB,IAAM,mBAAmB;AAKzB,IAAM,wBAAwB,KAAK,KAAK;AAIxC,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AAEzB,IAAM,iBAGF;AAAA,EACF,KAAK;AAAA,EACL,eAAe;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,EACR;AACF;AAkEO,SAAS,qBACdA,UACAC,aACAC,WACA;AACA,SAAO,OACL,KACA,KACA,uBACyB;AACzB,QACE,CAAC,OACD,CAAC,OACD,CAAC,sBACD,CAAC,mBAAmB,cACpB,CAAC,mBAAmB,UACpB;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,iBAAiB;AAAA,MACrB,mBAAmB;AAAA,IACrB;AAEA,WAAO;AAAA,MACL,6BAA6B,mBAAmB,QAAQ;AAAA,IAC1D,EAAE,QAAQ,CAAC,aAAa;AACtB,UAAI,SAAS,SAAS,IAAI;AACxB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAED,UAAM,UAAwC;AAAA,MAC5C,GAAG;AAAA,MACH,GAAG;AAAA,MACH,eAAe;AAAA,QACb,GAAG,eAAe;AAAA,QAClB,GAAI,mBAAmB,iBAAiB,CAAC;AAAA,MAC3C;AAAA,IACF;AAEA,QAAI,QAAQ,QAAQ,GAAG;AAKrB,cAAQ,MAAM;AAAA,IAChB;AAEA,QACE,mBAAmB,iBACnB,YAAY,mBAAmB,eAC/B;AAEA,UAAI,mBAAmB,cAAc,WAAW,QAAW;AACzD,gBAAQ,MAAM;AAAA,MAChB,OAAO;AACL,gBAAQ,cAAc,SAAS;AAAA,UAC7B,mBAAmB,cAAc;AAAA,QACnC;AAAA,MACF;AAAA,IACF,OAAO;AACL,cAAQ,cAAc,SAAS,oBAAoB,QAAQ,GAAG;AAAA,IAChE;AAEA,UAAM,kBAAkB,OAAO;AAAA,MAC7B,iBAAiB,MACb,IAAI,QAAQ,IAAI,QAAQ,KAAK,KAC7B,IAAI,QAAQ,UAAU;AAAA,IAC5B,EAAE,QAAQ;AAEV,UAAM,UACJ,oBAAoB,SAChB,CAAC,IACD,MAAMD,YAA4B,iBAAiB;AAAA,MACjD,UAAU;AAAA,MACV,KAAK,QAAQ;AAAA,IACf,CAAC;AAEP,WAAO,iBAAiB,SAAS;AAAA,MAC/B,MAAM;AAAA,QACJ,OAAO,eAAe,OAAO;AAC3B,cAAI,iBAAiB,OAAO,IAAI,gBAAgB,MAAM;AACpD,kBAAM,IAAI;AAAA,cACR;AAAA,YACF;AAAA,UACF;AACA,gBAAME,QAAO,MAAMD,UAAS,SAAS;AAAA,YACnC,UAAU;AAAA,YACV,KAAK,QAAQ;AAAA,UACf,CAAC;AACD,gBAAM,cAAc,OAAO;AAAA,YACzB,QAAQ;AAAA,YACRC;AAAA,YACA,QAAQ;AAAA,UACV;AAEA,cAAI,YAAY,SAAS,MAAM;AAC7B,kBAAM,IAAI;AAAA,cACR,0CAA0C,YAAY;AAAA,YACxD;AAAA,UACF;AAEA,uBAAa,aAAa,GAAG;AAAA,QAC/B;AAAA,MACF;AAAA,MACA,SAAS;AAAA,QACP,OAAO,SAAS,UAAU;AACxB,iBAAO,KAAK,OAAO,EAAE,QAAQ,CAAC,QAAQ;AAEpC,mBAAO,QAAQ;AAAA,UACjB,CAAC;AAED,gBAAM,cAAc,OAAO,UAAU,QAAQ,YAAY,IAAI;AAAA,YAC3D,GAAG,QAAQ;AAAA,YACX,QAAQ;AAAA,UACV,CAAC;AACD,uBAAa,aAAa,GAAG;AAAA,QAC/B;AAAA,MACF;AAAA,IACF,CAAC;AAED,WAAO;AAAA,EACT;AACF;AAEA,SAAS,aAAa,aAAqB,KAAmB;AAlO9D;AAmOE,MAAI,aAAa,KAAK;AACpB,QAAI,QAAQ,OAAO,cAAc,WAAW;AAC5C;AAAA,EACF;AAEA,MAAI,qBACD,SAAI,UAAU,YAAY,MAA1B,YAAqD,CAAC;AACzD,MAAI,OAAO,sBAAsB,UAAU;AACzC,wBAAoB,CAAC,iBAAiB;AAAA,EACxC;AACA,MAAI,UAAU,cAAc,CAAC,GAAG,mBAAmB,WAAW,CAAC;AACjE;AAEA,SAAS,oBAAoB,KAAa;AAIxC,SAAO,MAAM;AACf;AAEO,SAAS,iBAAiBH,UAAiB;AAChD,SAAO,OACLG,OACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,MACe;AACf,UAAM,iBAAiB,6BAA6B,QAAQ;AAC5D,UAAM,EAAE,oBAAoB,aAAa,IAAI,UAAUA,KAAI;AAE3D,QAAI;AACF,YAAM,OAAO,MAAW;AAAA,QACtBH;AAAA,QACA;AAAA,QACA;AAAA,QACA,EAAE,GAAQ,eAAU,KAAK,MAAM,IAAK;AAAA,MACtC;AAEA,UAAI,iBAAiB,GAAG;AACtB,eAAO;AAAA,MACT;AAEA,aAAO;AAAA,QAEL,GAAG,KAAK;AAAA,MACV;AAAA,IACF,SAAS,OAAP;AACA,UAAI,iBAAiB,OAAO;AAC1B,YACE,MAAM,YAAY,kBAClB,MAAM,YAAY,oBAClB,MAAM,YAAY,4BAClB,MAAM,YAAY,yCAClB;AAKA,iBAAO,CAAC;AAAA,QACV;AAAA,MACF;AAEA,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,UAAUG,OAGjB;AACA,MAAIA,MAAKA,MAAK,SAAS,OAAO,kBAAkB;AAC9C,UAAM,CAAC,oBAAoB,oBAAoB,IAC7CA,MAAK,MAAM,gBAAgB;AAC7B,WAAO;AAAA,MACL;AAAA,MACA,cAAc,SAAS,sBAAsB,EAAE;AAAA,IACjD;AAAA,EACF;AAEA,SAAO,EAAE,oBAAoBA,OAAM,cAAc,KAAK;AACxD;AAEO,SAAS,eAAeH,UAAiB;AAC9C,SAAO,OACL,MACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,MACG;AACH,UAAM,iBAAiB,6BAA6B,QAAQ;AAE5D,UAAM,uBAAuB,KAAK;AAAA,MAChC,GAAG,OAAO,KAAK,cAAc,EAAE,IAAI,CAAC,OAAO,SAAS,IAAI,EAAE,CAAC;AAAA,IAC7D;AAEA,UAAM,kBAAkB;AAAA,MACtB,IAAI,qBAAqB,SAAS;AAAA,MAClC,QAAQ,eAAe;AAAA,IACzB;AAEA,UAAMG,QAAO,MAAW,UAAKH,UAAS,MAAM,iBAAiB;AAAA,MAC3D,GAAQ;AAAA,MACR,KAAK,MAAM;AAAA,IACb,CAAC;AAED,WAAO,GAAGG,QAAO,mBAAmB;AAAA,EACtC;AACF;AAEA,SAAS,6BAA6B,UAAoB;AACxD,SAAO,OAAO,aAAa,WAAW,EAAE,GAAG,SAAS,IAAI;AAC1D;;;AC5UA,IAAM,YAAY,MAAc;AAThC;AAUE,MAAI,SAAO,gBAAW,WAAX,mBAAmB,YAAW;AAAU,WAAO,WAAW;AAErE,MAAI,SAAO,sBAAW,WAAX,mBAAmB,cAAnB,mBAA8B,YAAW;AAElD,WAAO,WAAW,OAAO;AAC3B,QAAM,IAAI;AAAA,IACR;AAAA,EACF;AACF;AAEA,IAAM,UAAU,UAAU;AAEnB,IAAM,aAAa,iBAAiB,OAAO;AAC3C,IAAM,WAAW,eAAe,OAAO;AACvC,IAAM,iBAAiB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AACF;","names":["_crypto","unsealData","sealData","seal"]}
+{"version":3,"sources":["../../src/core.ts","../index.ts"],"sourcesContent":["import * as Iron from \"iron-webcrypto\";\nimport type { CookieSerializeOptions } from \"cookie\";\nimport cookie from \"cookie\";\nimport type { IncomingMessage, ServerResponse } from \"http\";\n\n// default time allowed to check for iron seal validity when ttl passed\n// see https://hapi.dev/family/iron/api/?v=6.0.0#options\nconst timestampSkewSec = 60;\n\ntype passwordsMap = { [id: string]: string };\ntype password = string | passwordsMap;\n\nconst fourteenDaysInSeconds = 15 * 24 * 3600;\n\n// We store a token major version to handle data format changes when any. So that when you upgrade the cookies\n// can be kept alive between upgrades, no need to disconnect everyone.\nconst currentMajorVersion = 2;\nconst versionDelimiter = \"~\";\n\nconst defaultOptions: {\n  ttl: number;\n  cookieOptions: CookieSerializeOptions;\n} = {\n  ttl: fourteenDaysInSeconds,\n  cookieOptions: {\n    httpOnly: true,\n    secure: true,\n    sameSite: \"lax\",\n    path: \"/\",\n  },\n};\n\nexport interface IronSessionOptions {\n  /**\n   * This is the cookie name that will be used inside the browser. You should make sure it's unique given\n   * your application. Example: vercel-session\n   */\n  cookieName: string;\n\n  /**\n   * This is the password(s) that will be used to encrypt the cookie. It can be either a string or an object\n   * like {1: \"password\", 2: password}.\n   *\n   * When you provide multiple passwords then all of them will be used to decrypt the cookie and only the most\n   * recent (= highest key, 2 in this example) password will be used to encrypt the cookie. This allow you\n   * to use password rotation (security)\n   */\n  password: password;\n\n  /**\n   * This is the time in seconds that the session will be valid for. This also set the max-age attribute of\n   * the cookie automatically (minus 60 seconds so that the cookie always expire before the session).\n   */\n  ttl?: number;\n\n  /**\n   * This is the options that will be passed to the cookie library.\n   * You can see all of them here: https://github.com/jshttp/cookie#options-1.\n   *\n   * If you want to use \"session cookies\" (cookies that are deleted when the browser is closed) then you need\n   * to pass cookieOptions: { maxAge: undefined }.\n   */\n  cookieOptions?: CookieSerializeOptions;\n}\n\n// eslint-disable-next-line @typescript-eslint/no-empty-interface\nexport interface IronSessionData {\n  // If we allow for any keys, then there's no more type check on unknown properties\n  // which is not good\n  // If we allow for any keys, the later delete will work but I prefer to disable the\n  // check at this stage and\n  // provide good type checking instead\n  // [key: string]: unknown;\n}\n\nexport type IronSession = IronSessionData & {\n  /**\n   * Destroys the session data and removes the cookie.\n   */\n  destroy: () => void;\n\n  /**\n   * Encrypts the session data and sets the cookie.\n   */\n  save: () => Promise<void>;\n};\n\ndeclare module \"http\" {\n  interface IncomingMessage {\n    session: IronSession;\n  }\n}\n\ntype RequestType = IncomingMessage | Request;\ntype ResponseType = ServerResponse | Response;\n\nexport function createGetIronSession(\n  _crypto: Crypto,\n  unsealData: ReturnType<typeof createUnsealData>,\n  sealData: ReturnType<typeof createSealData>,\n) {\n  return async (\n    req: RequestType,\n    res: ResponseType,\n    userSessionOptions: IronSessionOptions,\n  ): Promise<IronSession> => {\n    if (\n      !req ||\n      !res ||\n      !userSessionOptions ||\n      !userSessionOptions.cookieName ||\n      !userSessionOptions.password\n    ) {\n      throw new Error(\n        `iron-session: Bad usage. Minimum usage is const session = await getIronSession(req, res, { cookieName: \"...\", password: \"...\". Check the usage here: https://github.com/vvo/iron-session`,\n      );\n    }\n\n    const passwordsAsMap = normalizeStringPasswordToMap(\n      userSessionOptions.password,\n    );\n\n    Object.values(\n      normalizeStringPasswordToMap(userSessionOptions.password),\n    ).forEach((password) => {\n      if (password.length < 32) {\n        throw new Error(\n          `iron-session: Bad usage. Password must be at least 32 characters long.`,\n        );\n      }\n    });\n\n    const options: Required<IronSessionOptions> = {\n      ...defaultOptions,\n      ...userSessionOptions,\n      cookieOptions: {\n        ...defaultOptions.cookieOptions,\n        ...(userSessionOptions.cookieOptions || {}),\n      },\n    };\n\n    if (options.ttl === 0) {\n      // ttl = 0 means no expiration\n      // but in reality cookies have to expire (can't have no max-age)\n      // 2147483647 is the max value for max-age in cookies\n      // see https://stackoverflow.com/a/11685301/147079\n      options.ttl = 2147483647;\n    }\n\n    if (\n      userSessionOptions.cookieOptions &&\n      \"maxAge\" in userSessionOptions.cookieOptions\n    ) {\n      // session cookie, do not set maxAge, consider token as infinite\n      if (userSessionOptions.cookieOptions.maxAge === undefined) {\n        options.ttl = 0;\n      } else {\n        options.cookieOptions.maxAge = computeCookieMaxAge(\n          userSessionOptions.cookieOptions.maxAge,\n        );\n      }\n    } else {\n      options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);\n    }\n\n    const sealFromCookies = cookie.parse(\n      \"credentials\" in req\n        ? req.headers.get(\"cookie\") || \"\"\n        : req.headers.cookie || \"\",\n    )[options.cookieName];\n\n    const session =\n      sealFromCookies === undefined\n        ? {}\n        : await unsealData<IronSessionData>(sealFromCookies, {\n            password: passwordsAsMap,\n            ttl: options.ttl,\n          });\n\n    Object.defineProperties(session, {\n      save: {\n        value: async function save() {\n          if (\"headersSent\" in res && res.headersSent === true) {\n            throw new Error(\n              `iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()`,\n            );\n          }\n          const seal = await sealData(session, {\n            password: passwordsAsMap,\n            ttl: options.ttl,\n          });\n          const cookieValue = cookie.serialize(\n            options.cookieName,\n            seal,\n            options.cookieOptions,\n          );\n\n          if (cookieValue.length > 4096) {\n            throw new Error(\n              `iron-session: Cookie length is too big ${cookieValue.length}, browsers will refuse it. Try to remove some data.`,\n            );\n          }\n\n          addToCookies(cookieValue, res);\n        },\n      },\n      destroy: {\n        value: function destroy() {\n          Object.keys(session).forEach((key) => {\n            // @ts-ignore See comment on the IronSessionData interface\n            delete session[key];\n          });\n\n          const cookieValue = cookie.serialize(options.cookieName, \"\", {\n            ...options.cookieOptions,\n            maxAge: 0,\n          });\n          addToCookies(cookieValue, res);\n        },\n      },\n    });\n\n    return session as IronSession;\n  };\n}\n\nfunction addToCookies(cookieValue: string, res: ResponseType) {\n  if (\"headers\" in res) {\n    res.headers.append(\"set-cookie\", cookieValue);\n    return;\n  }\n\n  let existingSetCookie =\n    (res.getHeader(\"set-cookie\") as string[] | string) ?? [];\n  if (typeof existingSetCookie === \"string\") {\n    existingSetCookie = [existingSetCookie];\n  }\n  res.setHeader(\"set-cookie\", [...existingSetCookie, cookieValue]);\n}\n\nfunction computeCookieMaxAge(ttl: number) {\n  // The next line makes sure browser will expire cookies before seals are considered expired by the server.\n  // It also allows for clock difference of 60 seconds maximum between server and clients.\n  // It also makes sure to expire the cookie immediately when value is 0\n  return ttl - timestampSkewSec;\n}\n\nexport function createUnsealData(_crypto: Crypto) {\n  return async <T = Record<string, unknown>>(\n    seal: string,\n    {\n      password,\n      ttl = fourteenDaysInSeconds,\n    }: { password: password; ttl?: number },\n  ): Promise<T> => {\n    const passwordsAsMap = normalizeStringPasswordToMap(password);\n    const { sealWithoutVersion, tokenVersion } = parseSeal(seal);\n\n    try {\n      const data =\n        (await Iron.unseal(_crypto, sealWithoutVersion, passwordsAsMap, {\n          ...Iron.defaults,\n          ttl: ttl * 1000,\n        })) || {};\n\n      if (tokenVersion === 2) {\n        return data as T;\n      }\n\n      return {\n        // @ts-expect-error `persistent` does not exist on newer tokens\n        ...data.persistent,\n      };\n    } catch (error) {\n      if (error instanceof Error) {\n        if (\n          error.message === \"Expired seal\" ||\n          error.message === \"Bad hmac value\" ||\n          error.message.startsWith(\"Cannot find password: \") ||\n          error.message === \"Incorrect number of sealed components\"\n        ) {\n          // if seal expired or\n          // if seal is not valid (encrypted using a different password, when passwords are badly rotated) or\n          // if we can't find back the password in the seal\n          // then we just start a new session over\n          return {} as T;\n        }\n      }\n\n      throw error;\n    }\n  };\n}\n\nfunction parseSeal(seal: string): {\n  sealWithoutVersion: string;\n  tokenVersion: number | null;\n} {\n  if (seal[seal.length - 2] === versionDelimiter) {\n    const [sealWithoutVersion, tokenVersionAsString] =\n      seal.split(versionDelimiter);\n    return {\n      sealWithoutVersion,\n      tokenVersion: parseInt(tokenVersionAsString, 10),\n    };\n  }\n\n  return { sealWithoutVersion: seal, tokenVersion: null };\n}\n\nexport function createSealData(_crypto: Crypto) {\n  return async (\n    data: unknown,\n    {\n      password,\n      ttl = fourteenDaysInSeconds,\n    }: { password: password; ttl?: number },\n  ) => {\n    const passwordsAsMap = normalizeStringPasswordToMap(password);\n\n    const mostRecentPasswordId = Math.max(\n      ...Object.keys(passwordsAsMap).map((id) => parseInt(id, 10)),\n    );\n\n    const passwordForSeal = {\n      id: mostRecentPasswordId.toString(),\n      secret: passwordsAsMap[mostRecentPasswordId],\n    };\n\n    const seal = await Iron.seal(_crypto, data, passwordForSeal, {\n      ...Iron.defaults,\n      ttl: ttl * 1000,\n    });\n\n    return `${seal}${versionDelimiter}${currentMajorVersion}`;\n  };\n}\n\nfunction normalizeStringPasswordToMap(password: password) {\n  return typeof password === \"string\" ? { 1: password } : password;\n}\n","// This allows the types to be linked from the main module instead of duplicated\nexport type { IronSessionOptions, IronSessionData } from \"iron-session\";\n\nimport {\n  createGetIronSession,\n  createSealData,\n  createUnsealData,\n} from \"../src/core\";\n\nconst getCrypto = (): Crypto => {\n  if (typeof globalThis.crypto?.subtle === \"object\") return globalThis.crypto;\n  // @ts-ignore crypto.webcrypto is not available in dom, but is there in newer node versions\n  if (typeof globalThis.crypto?.webcrypto?.subtle === \"object\")\n    // @ts-ignore same as above\n    return globalThis.crypto.webcrypto;\n  throw new Error(\n    \"no native implementation of WebCrypto is available in current context\",\n  );\n};\n\nconst _crypto = getCrypto();\n\nexport const unsealData = createUnsealData(_crypto);\nexport const sealData = createSealData(_crypto);\nexport const getIronSession = createGetIronSession(\n  _crypto,\n  unsealData,\n  sealData,\n);\n"],"mappings":";AAAA,YAAY,UAAU;AAEtB,OAAO,YAAY;AAKnB,IAAM,mBAAmB;AAKzB,IAAM,wBAAwB,KAAK,KAAK;AAIxC,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AAEzB,IAAM,iBAGF;AAAA,EACF,KAAK;AAAA,EACL,eAAe;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,EACR;AACF;AAkEO,SAAS,qBACdA,UACAC,aACAC,WACA;AACA,SAAO,OACL,KACA,KACA,uBACyB;AACzB,QACE,CAAC,OACD,CAAC,OACD,CAAC,sBACD,CAAC,mBAAmB,cACpB,CAAC,mBAAmB,UACpB;AACA,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,iBAAiB;AAAA,MACrB,mBAAmB;AAAA,IACrB;AAEA,WAAO;AAAA,MACL,6BAA6B,mBAAmB,QAAQ;AAAA,IAC1D,EAAE,QAAQ,CAAC,aAAa;AACtB,UAAI,SAAS,SAAS,IAAI;AACxB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAC;AAED,UAAM,UAAwC;AAAA,MAC5C,GAAG;AAAA,MACH,GAAG;AAAA,MACH,eAAe;AAAA,QACb,GAAG,eAAe;AAAA,QAClB,GAAI,mBAAmB,iBAAiB,CAAC;AAAA,MAC3C;AAAA,IACF;AAEA,QAAI,QAAQ,QAAQ,GAAG;AAKrB,cAAQ,MAAM;AAAA,IAChB;AAEA,QACE,mBAAmB,iBACnB,YAAY,mBAAmB,eAC/B;AAEA,UAAI,mBAAmB,cAAc,WAAW,QAAW;AACzD,gBAAQ,MAAM;AAAA,MAChB,OAAO;AACL,gBAAQ,cAAc,SAAS;AAAA,UAC7B,mBAAmB,cAAc;AAAA,QACnC;AAAA,MACF;AAAA,IACF,OAAO;AACL,cAAQ,cAAc,SAAS,oBAAoB,QAAQ,GAAG;AAAA,IAChE;AAEA,UAAM,kBAAkB,OAAO;AAAA,MAC7B,iBAAiB,MACb,IAAI,QAAQ,IAAI,QAAQ,KAAK,KAC7B,IAAI,QAAQ,UAAU;AAAA,IAC5B,EAAE,QAAQ;AAEV,UAAM,UACJ,oBAAoB,SAChB,CAAC,IACD,MAAMD,YAA4B,iBAAiB;AAAA,MACjD,UAAU;AAAA,MACV,KAAK,QAAQ;AAAA,IACf,CAAC;AAEP,WAAO,iBAAiB,SAAS;AAAA,MAC/B,MAAM;AAAA,QACJ,OAAO,eAAe,OAAO;AAC3B,cAAI,iBAAiB,OAAO,IAAI,gBAAgB,MAAM;AACpD,kBAAM,IAAI;AAAA,cACR;AAAA,YACF;AAAA,UACF;AACA,gBAAME,QAAO,MAAMD,UAAS,SAAS;AAAA,YACnC,UAAU;AAAA,YACV,KAAK,QAAQ;AAAA,UACf,CAAC;AACD,gBAAM,cAAc,OAAO;AAAA,YACzB,QAAQ;AAAA,YACRC;AAAA,YACA,QAAQ;AAAA,UACV;AAEA,cAAI,YAAY,SAAS,MAAM;AAC7B,kBAAM,IAAI;AAAA,cACR,0CAA0C,YAAY;AAAA,YACxD;AAAA,UACF;AAEA,uBAAa,aAAa,GAAG;AAAA,QAC/B;AAAA,MACF;AAAA,MACA,SAAS;AAAA,QACP,OAAO,SAAS,UAAU;AACxB,iBAAO,KAAK,OAAO,EAAE,QAAQ,CAAC,QAAQ;AAEpC,mBAAO,QAAQ;AAAA,UACjB,CAAC;AAED,gBAAM,cAAc,OAAO,UAAU,QAAQ,YAAY,IAAI;AAAA,YAC3D,GAAG,QAAQ;AAAA,YACX,QAAQ;AAAA,UACV,CAAC;AACD,uBAAa,aAAa,GAAG;AAAA,QAC/B;AAAA,MACF;AAAA,IACF,CAAC;AAED,WAAO;AAAA,EACT;AACF;AAEA,SAAS,aAAa,aAAqB,KAAmB;AAlO9D;AAmOE,MAAI,aAAa,KAAK;AACpB,QAAI,QAAQ,OAAO,cAAc,WAAW;AAC5C;AAAA,EACF;AAEA,MAAI,qBACD,SAAI,UAAU,YAAY,MAA1B,YAAqD,CAAC;AACzD,MAAI,OAAO,sBAAsB,UAAU;AACzC,wBAAoB,CAAC,iBAAiB;AAAA,EACxC;AACA,MAAI,UAAU,cAAc,CAAC,GAAG,mBAAmB,WAAW,CAAC;AACjE;AAEA,SAAS,oBAAoB,KAAa;AAIxC,SAAO,MAAM;AACf;AAEO,SAAS,iBAAiBH,UAAiB;AAChD,SAAO,OACLG,OACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,MACe;AACf,UAAM,iBAAiB,6BAA6B,QAAQ;AAC5D,UAAM,EAAE,oBAAoB,aAAa,IAAI,UAAUA,KAAI;AAE3D,QAAI;AACF,YAAM,OACH,MAAW,YAAOH,UAAS,oBAAoB,gBAAgB;AAAA,QAC9D,GAAQ;AAAA,QACR,KAAK,MAAM;AAAA,MACb,CAAC,KAAM,CAAC;AAEV,UAAI,iBAAiB,GAAG;AACtB,eAAO;AAAA,MACT;AAEA,aAAO;AAAA,QAEL,GAAG,KAAK;AAAA,MACV;AAAA,IACF,SAAS,OAAP;AACA,UAAI,iBAAiB,OAAO;AAC1B,YACE,MAAM,YAAY,kBAClB,MAAM,YAAY,oBAClB,MAAM,QAAQ,WAAW,wBAAwB,KACjD,MAAM,YAAY,yCAClB;AAKA,iBAAO,CAAC;AAAA,QACV;AAAA,MACF;AAEA,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,UAAUG,OAGjB;AACA,MAAIA,MAAKA,MAAK,SAAS,OAAO,kBAAkB;AAC9C,UAAM,CAAC,oBAAoB,oBAAoB,IAC7CA,MAAK,MAAM,gBAAgB;AAC7B,WAAO;AAAA,MACL;AAAA,MACA,cAAc,SAAS,sBAAsB,EAAE;AAAA,IACjD;AAAA,EACF;AAEA,SAAO,EAAE,oBAAoBA,OAAM,cAAc,KAAK;AACxD;AAEO,SAAS,eAAeH,UAAiB;AAC9C,SAAO,OACL,MACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,MACG;AACH,UAAM,iBAAiB,6BAA6B,QAAQ;AAE5D,UAAM,uBAAuB,KAAK;AAAA,MAChC,GAAG,OAAO,KAAK,cAAc,EAAE,IAAI,CAAC,OAAO,SAAS,IAAI,EAAE,CAAC;AAAA,IAC7D;AAEA,UAAM,kBAAkB;AAAA,MACtB,IAAI,qBAAqB,SAAS;AAAA,MAClC,QAAQ,eAAe;AAAA,IACzB;AAEA,UAAMG,QAAO,MAAW,UAAKH,UAAS,MAAM,iBAAiB;AAAA,MAC3D,GAAQ;AAAA,MACR,KAAK,MAAM;AAAA,IACb,CAAC;AAED,WAAO,GAAGG,QAAO,mBAAmB;AAAA,EACtC;AACF;AAEA,SAAS,6BAA6B,UAAoB;AACxD,SAAO,OAAO,aAAa,WAAW,EAAE,GAAG,SAAS,IAAI;AAC1D;;;AC3UA,IAAM,YAAY,MAAc;AAThC;AAUE,MAAI,SAAO,gBAAW,WAAX,mBAAmB,YAAW;AAAU,WAAO,WAAW;AAErE,MAAI,SAAO,sBAAW,WAAX,mBAAmB,cAAnB,mBAA8B,YAAW;AAElD,WAAO,WAAW,OAAO;AAC3B,QAAM,IAAI;AAAA,IACR;AAAA,EACF;AACF;AAEA,IAAM,UAAU,UAAU;AAEnB,IAAM,aAAa,iBAAiB,OAAO;AAC3C,IAAM,WAAW,eAAe,OAAO;AACvC,IAAM,iBAAiB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AACF;","names":["_crypto","unsealData","sealData","seal"]}

package/koa/dist/index.d.ts

@@ -0,0 +1,6 @@
+import { IronSessionOptions } from 'iron-session';
+import * as Koa from 'koa';
+
+declare function ironSession(sessionOptions: IronSessionOptions): (ctx: Koa.Context, next: Koa.Next) => Promise<void>;
+
+export { ironSession };

package/koa/dist/index.js

@@ -0,0 +1,66 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// koa/index.ts
+var koa_exports = {};
+__export(koa_exports, {
+  ironSession: () => ironSession
+});
+module.exports = __toCommonJS(koa_exports);
+var import_iron_session = require("iron-session");
+
+// src/getPropertyDescriptorForReqSession.ts
+function getPropertyDescriptorForReqSession(session) {
+  return {
+    enumerable: true,
+    get() {
+      return session;
+    },
+    set(value) {
+      const keys = Object.keys(value);
+      const currentKeys = Object.keys(session);
+      currentKeys.forEach((key) => {
+        if (!keys.includes(key)) {
+          delete session[key];
+        }
+      });
+      keys.forEach((key) => {
+        session[key] = value[key];
+      });
+    }
+  };
+}
+
+// koa/index.ts
+function ironSession(sessionOptions) {
+  return async function ironSessionMiddleWare(ctx, next) {
+    const session = await (0, import_iron_session.getIronSession)(ctx.req, ctx.res, sessionOptions);
+    Object.defineProperty(
+      ctx,
+      "session",
+      getPropertyDescriptorForReqSession(session)
+    );
+    await next();
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ironSession
+});
+//# sourceMappingURL=index.js.map

package/koa/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../index.ts","../../src/getPropertyDescriptorForReqSession.ts"],"sourcesContent":["import type { IronSessionOptions } from \"iron-session\";\nimport { getIronSession } from \"iron-session\";\nimport * as Koa from \"koa\";\nimport getPropertyDescriptorForReqSession from \"../src/getPropertyDescriptorForReqSession\";\n\nexport function ironSession(\n  sessionOptions: IronSessionOptions,\n): (ctx: Koa.Context, next: Koa.Next) => Promise<void> {\n  return async function ironSessionMiddleWare(ctx, next) {\n    const session = await getIronSession(ctx.req, ctx.res, sessionOptions);\n    Object.defineProperty(\n      ctx,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n\n    await next();\n  }\n}\n","import type { IronSession } from \".\";\n\nexport default function getPropertyDescriptorForReqSession(\n  session: IronSession,\n): PropertyDescriptor {\n  return {\n    enumerable: true,\n    get() {\n      return session;\n    },\n    set(value) {\n      const keys = Object.keys(value);\n      const currentKeys = Object.keys(session);\n\n      currentKeys.forEach((key) => {\n        if (!keys.includes(key)) {\n          // @ts-ignore See comment in IronSessionData interface\n          delete session[key];\n        }\n      });\n\n      keys.forEach((key) => {\n        // @ts-ignore See comment in IronSessionData interface\n        session[key] = value[key];\n      });\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,0BAA+B;;;ACChB,SAAR,mCACL,SACoB;AACpB,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AACJ,aAAO;AAAA,IACT;AAAA,IACA,IAAI,OAAO;AACT,YAAM,OAAO,OAAO,KAAK,KAAK;AAC9B,YAAM,cAAc,OAAO,KAAK,OAAO;AAEvC,kBAAY,QAAQ,CAAC,QAAQ;AAC3B,YAAI,CAAC,KAAK,SAAS,GAAG,GAAG;AAEvB,iBAAO,QAAQ;AAAA,QACjB;AAAA,MACF,CAAC;AAED,WAAK,QAAQ,CAAC,QAAQ;AAEpB,gBAAQ,OAAO,MAAM;AAAA,MACvB,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;ADtBO,SAAS,YACd,gBACqD;AACrD,SAAO,eAAe,sBAAsB,KAAK,MAAM;AACrD,UAAM,UAAU,UAAM,oCAAe,IAAI,KAAK,IAAI,KAAK,cAAc;AACrE,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,mCAAmC,OAAO;AAAA,IAC5C;AAEA,UAAM,KAAK;AAAA,EACb;AACF;","names":[]}

package/koa/dist/index.mjs

@@ -0,0 +1,41 @@
+// koa/index.ts
+import { getIronSession } from "iron-session";
+
+// src/getPropertyDescriptorForReqSession.ts
+function getPropertyDescriptorForReqSession(session) {
+  return {
+    enumerable: true,
+    get() {
+      return session;
+    },
+    set(value) {
+      const keys = Object.keys(value);
+      const currentKeys = Object.keys(session);
+      currentKeys.forEach((key) => {
+        if (!keys.includes(key)) {
+          delete session[key];
+        }
+      });
+      keys.forEach((key) => {
+        session[key] = value[key];
+      });
+    }
+  };
+}
+
+// koa/index.ts
+function ironSession(sessionOptions) {
+  return async function ironSessionMiddleWare(ctx, next) {
+    const session = await getIronSession(ctx.req, ctx.res, sessionOptions);
+    Object.defineProperty(
+      ctx,
+      "session",
+      getPropertyDescriptorForReqSession(session)
+    );
+    await next();
+  };
+}
+export {
+  ironSession
+};
+//# sourceMappingURL=index.mjs.map

package/koa/dist/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../index.ts","../../src/getPropertyDescriptorForReqSession.ts"],"sourcesContent":["import type { IronSessionOptions } from \"iron-session\";\nimport { getIronSession } from \"iron-session\";\nimport * as Koa from \"koa\";\nimport getPropertyDescriptorForReqSession from \"../src/getPropertyDescriptorForReqSession\";\n\nexport function ironSession(\n  sessionOptions: IronSessionOptions,\n): (ctx: Koa.Context, next: Koa.Next) => Promise<void> {\n  return async function ironSessionMiddleWare(ctx, next) {\n    const session = await getIronSession(ctx.req, ctx.res, sessionOptions);\n    Object.defineProperty(\n      ctx,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n\n    await next();\n  }\n}\n","import type { IronSession } from \".\";\n\nexport default function getPropertyDescriptorForReqSession(\n  session: IronSession,\n): PropertyDescriptor {\n  return {\n    enumerable: true,\n    get() {\n      return session;\n    },\n    set(value) {\n      const keys = Object.keys(value);\n      const currentKeys = Object.keys(session);\n\n      currentKeys.forEach((key) => {\n        if (!keys.includes(key)) {\n          // @ts-ignore See comment in IronSessionData interface\n          delete session[key];\n        }\n      });\n\n      keys.forEach((key) => {\n        // @ts-ignore See comment in IronSessionData interface\n        session[key] = value[key];\n      });\n    },\n  };\n}\n"],"mappings":";AACA,SAAS,sBAAsB;;;ACChB,SAAR,mCACL,SACoB;AACpB,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AACJ,aAAO;AAAA,IACT;AAAA,IACA,IAAI,OAAO;AACT,YAAM,OAAO,OAAO,KAAK,KAAK;AAC9B,YAAM,cAAc,OAAO,KAAK,OAAO;AAEvC,kBAAY,QAAQ,CAAC,QAAQ;AAC3B,YAAI,CAAC,KAAK,SAAS,GAAG,GAAG;AAEvB,iBAAO,QAAQ;AAAA,QACjB;AAAA,MACF,CAAC;AAED,WAAK,QAAQ,CAAC,QAAQ;AAEpB,gBAAQ,OAAO,MAAM;AAAA,MACvB,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;ADtBO,SAAS,YACd,gBACqD;AACrD,SAAO,eAAe,sBAAsB,KAAK,MAAM;AACrD,UAAM,UAAU,MAAM,eAAe,IAAI,KAAK,IAAI,KAAK,cAAc;AACrE,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,mCAAmC,OAAO;AAAA,IAC5C;AAEA,UAAM,KAAK;AAAA,EACb;AACF;","names":[]}

package/koa/index.test.ts

@@ -0,0 +1,25 @@
+import { ironSession } from ".";
+import { createMockContext } from "@shopify/jest-koa-mocks";
+
+const password = "Gbm49ATjnqnkCCCdhV4uDBhbfnPqsCW0";
+const cookieName = "test";
+
+// same structure as other tests otherwise linting will fail because you can have only one per running eslint
+declare module "iron-session" {
+  interface IronSessionData {
+    user?: { id: number; meta?: string };
+    admin?: boolean;
+  }
+}
+
+test("ironSession: ctx.session exists", async () => {
+  const wrappedHandler = ironSession({
+    password,
+    cookieName,
+  });
+
+  const ctx = createMockContext();
+
+  await wrappedHandler(ctx, ctx => ctx);
+  expect(ctx.session).toMatchInlineSnapshot(`Object {}`);
+});

package/koa/index.ts

@@ -0,0 +1,19 @@
+import type { IronSessionOptions } from "iron-session";
+import { getIronSession } from "iron-session";
+import * as Koa from "koa";
+import getPropertyDescriptorForReqSession from "../src/getPropertyDescriptorForReqSession";
+
+export function ironSession(
+  sessionOptions: IronSessionOptions,
+): (ctx: Koa.Context, next: Koa.Next) => Promise<void> {
+  return async function ironSessionMiddleWare(ctx, next) {
+    const session = await getIronSession(ctx.req, ctx.res, sessionOptions);
+    Object.defineProperty(
+      ctx,
+      "session",
+      getPropertyDescriptorForReqSession(session),
+    );
+
+    await next();
+  }
+}

package/koa/tsconfig.json

@@ -0,0 +1,8 @@
+{
+  "extends": "../tsconfig.json",
+  "compilerOptions": {
+    "rootDir": "..",
+    "outDir": "./dist"
+  },
+  "include": ["./*.ts"]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "iron-session",
-  "version": "6.2.0",
+  "version": "6.3.0",
   "description": "Node.js stateless session utility using signed and encrypted cookies to store data. Works with Next.js, Express, NestJs, Fastify, and any Node.js HTTP framework.",
   "keywords": [
     "Next.js",
@@ -8,8 +8,9 @@
     "cookies",
     "login",
     "auth",
+    "authentication",
     "Express",
-    "NestJS",
+    "Koa",
     "edge",
     "cloudflare workers"
   ],
@@ -35,6 +36,11 @@
       "require": "./express/dist/index.js",
       "types": "./express/dist/index.d.ts"
     },
+    "./koa": {
+      "import": "./koa/dist/index.mjs",
+      "require": "./koa/dist/index.js",
+      "types": "./koa/dist/index.d.ts"
+    },
     "./edge": {
       "import": "./edge/dist/index.mjs",
       "require": "./edge/dist/index.js",
@@ -48,23 +54,26 @@
     "dist/",
     "next/",
     "express/",
+    "koa/",
     "edge/"
   ],
   "scripts": {
-    "build": "npm run build:clean && npm run build:src && npm run build:next && npm run build:express && npm run build:edge",
+    "build": "npm run build:clean && npm run build:src && npm run build:next && npm run build:express && npm run build:koa && npm run build:edge",
     "build:clean": "rimraf dist/ next/dist express/dist edge/dist",
     "build:edge": "tsup edge/index.ts -d edge/dist",
     "build:express": "tsup express/index.ts -d express/dist",
+    "build:koa": "tsup koa/index.ts -d koa/dist",
     "build:next": "tsup next/index.ts -d next/dist",
     "build:src": "tsup src/index.ts",
-    "installExamples": "(cd examples/express && npm ci) && (cd examples/next.js && npm ci) && (cd examples/next.js-typescript && npm ci)",
-    "lint": "eslint --ext ts,js,jsx,tsx src/ next/ express/ edge/ examples/",
-    "prepublishOnly": "npm run build && cp next/dist/* next/ && cp express/dist/* express/ && cp edge/dist/* edge/",
-    "postpublish": "rm next/*.d.ts next/*.js next/*.map next/*.mjs && rm express/*.d.ts express/*.js express/*.map express/*.mjs && rm edge/*.d.ts edge/*.js edge/*.map edge/*.mjs",
+    "installExamples": "(cd examples/express && npm ci) && (cd examples/koa && npm ci) && (cd examples/next.js && npm ci) && (cd examples/next.js-typescript && npm ci)",
+    "lint": "eslint --ext ts,js,jsx,tsx src/ next/ express/ koa/ edge/ examples/",
+    "prepublishOnly": "npm run build && cp next/dist/* next/ && cp express/dist/* express/ && cp express/dist/* express/ && cp edge/dist/* edge/",
+    "postpublish": "rm next/*.d.ts next/*.js next/*.map next/*.mjs && rm express/*.d.ts express/*.js express/*.map express/*.mjs && rm koa/*.d.ts koa/*.js koa/*.map koa/*.mjs && rm edge/*.d.ts edge/*.js edge/*.map edge/*.mjs",
     "test": "jest --coverage --ci && npm run installExamples && npm run lint && tsc --noEmit && npm run build && npm run build:clean",
     "watch": "npm run build:clean && concurrently \"npm:watch:*\"",
     "watch:edge": "tsup edge/index.ts -d edge/dist --watch edge/index.ts",
     "watch:express": "tsup express/index.ts -d express/dist --watch express/index.ts",
+    "watch:koa": "tsup koa/index.ts -d koa/dist --watch koa/index.ts",
     "watch:next": "tsup next/index.ts -d next/dist --watch next/index.ts",
     "watch:src": "tsup src/index.ts --watch src/index.ts"
   },
@@ -134,17 +143,19 @@
     "@peculiar/webcrypto": "^1.4.0",
     "@types/cookie": "^0.5.1",
     "@types/express": "^4.17.13",
+    "@types/koa": "^2.13.5",
     "@types/node": "^17.0.41",
     "cookie": "^0.5.0",
-    "iron-webcrypto": "^0.1.0"
+    "iron-webcrypto": "^0.2.5"
   },
   "devDependencies": {
-    "@swc/core": "1.2.233",
+    "@shopify/jest-koa-mocks": "^5.0.1",
+    "@swc/core": "1.2.242",
     "@swc/jest": "0.2.22",
     "@tsconfig/node12": "1.0.11",
-    "@types/jest": "28.1.6",
-    "@typescript-eslint/eslint-plugin": "5.33.0",
-    "@typescript-eslint/parser": "5.33.0",
+    "@types/jest": "28.1.8",
+    "@typescript-eslint/eslint-plugin": "^5.35.1",
+    "@typescript-eslint/parser": "^5.35.1",
     "concurrently": "7.3.0",
     "eslint": "8.22.0",
     "jest": "28.1.3",
@@ -156,12 +167,16 @@
   },
   "peerDependencies": {
     "express": ">=4",
+    "koa": ">=2",
     "next": ">=10"
   },
   "peerDependenciesMeta": {
     "express": {
       "optional": true
     },
+    "koa": {
+      "optional": true
+    },
     "next": {
       "optional": true
     }