iron-session 8.0.0-beta.6 → 8.0.0

package/README.md

@@ -2,7 +2,9 @@
 
 **`iron-session` is a secure, stateless, and cookie-based session library for JavaScript.**
 
-The session data is stored in signed and encrypted cookies which are decoded by your server code in a stateless fashion (= no I/O involved). This is the same technique used by frameworks like
+<p align="center">Online demo: <a href="https://get-iron-session.vercel.app/">https://get-iron-session.vercel.app</a> 👀</p>
+
+The session data is stored in signed and encrypted cookies which are decoded by your server code in a stateless fashion (= no network involved). This is the same technique used by frameworks like
 [Ruby On Rails](https://guides.rubyonrails.org/security.html#session-storage).
 
 <p align="center"><i>⭐️ Featured in the <a href="https://nextjs.org/docs/authentication">Next.js documentation</a></i></p>
@@ -12,12 +14,21 @@ The session data is stored in signed and encrypted cookies which are decoded by
 - [Table of Contents](#table-of-contents)
 - [Installation](#installation)
 - [Usage](#usage)
+- [Examples](#examples)
+- [Project status](#project-status)
 - [Session options](#session-options)
 - [API](#api)
   - [`getIronSession<T>(req, res, sessionOptions): Promise<IronSession<T>>`](#getironsessiontreq-res-sessionoptions-promiseironsessiont)
   - [`getIronSession<T>(cookieStore, sessionOptions): Promise<IronSession<T>>`](#getironsessiontcookiestore-sessionoptions-promiseironsessiont)
-  - [session.save()](#sessionsave)
-  - [session.destroy()](#sessiondestroy)
+  - [`session.save(): Promise<void>`](#sessionsave-promisevoid)
+  - [`session.destroy(): void`](#sessiondestroy-void)
+  - [`sealData(data: unknown, { password, ttl }): Promise<string>`](#sealdatadata-unknown--password-ttl--promisestring)
+  - [`unSealData<T>(seal: string, { password, ttl }): Promise<T>`](#unsealdatatseal-string--password-ttl--promiset)
+- [FAQ](#faq)
+  - [Why use pure cookies for sessions?](#why-use-pure-cookies-for-sessions)
+  - [How to invalidate sessions?](#how-to-invalidate-sessions)
+  - [Can I use something else than cookies?](#can-i-use-something-else-than-cookies)
+  - [How is this different from JWT?](#how-is-this-different-from-jwt)
 - [Credits](#credits)
 - [Good Reads](#good-reads)
 
@@ -32,7 +43,7 @@ pnpm add iron-session
 To get a session, there's a single method to know: `getIronSession`.
 
 ```ts
-// Next.js Pages with API Route and Node.js/Express/Connect.
+// Next.js API Routes and Node.js/Express/Connect.
 import { getIronSession } from 'iron-session';
 
 export function get(req, res) {
@@ -47,7 +58,7 @@ export function post(req, res) {
 ```
 
 ```ts
-// Next.js App Router with route handlers
+// Next.js Route Handlers (App Router)
 import { cookies } from 'next/header';
 import { getIronSession } from 'iron-session';
 
@@ -56,14 +67,14 @@ export function GET() {
 }
 
 export function POST() {
-  const session = getIronSession(req, res, { password: "...", cookieName: "..." });
+  const session = getIronSession(cookies(), { password: "...", cookieName: "..." });
   session.username = "Alison";
   await session.save();
 }
 ```
 
-```ts
-// Next.js App Router with server component or server action
+```tsx
+// Next.js Server Components and Server Actions (App Router)
 import { cookies } from 'next/header';
 import { getIronSession } from 'iron-session';
 
@@ -78,10 +89,17 @@ function Profile() {
 }
 ```
 
+## Examples
+
+We have many different patterns and examples on the online demo, have a look: https://get-iron-session.vercel.app/.
+
+## Project status
+
+✅ Production ready and maintained.
 
 ## Session options
 
-Two options are required: `password` and `cookieName`. Everything else is automatically computed and usually doesn't need to be changed.
+Two options are required: `password` and `cookieName`. Everything else is automatically computed and usually doesn't need to be changed.****
 
 - `password`, **required**: Private key used to encrypt the cookie. It has to be at least 32 characters long. Use <https://1password.com/password-generator/> to generate strong passwords. `password` can be either a `string` or an `array` of objects like this: `[{id: 2, password: "..."}, {id: 1, password: "..."}]` to allow for password rotation.
 - `cookieName`, **required**: Name of the cookie to be stored
@@ -112,22 +130,58 @@ const session = getIronSession<SessionData>(req, res, sessionOptions);
 const session = getIronSession<SessionData>(cookies(), sessionOptions);
 ```
 
-### session.save()
+### `session.save(): Promise<void>`
 
-Saves the session.
+Saves the session. This is an asynchronous operation. It must be done and awaited before headers are sent to the client.
 
 ```ts
 await session.save()
 ```
 
-### session.destroy()
+### `session.destroy(): void`
 
-Destroys the session.
+Destroys the session. This is a synchronous operation as it only removes the cookie. It must be done before headers are sent to the client.
 
 ```ts
 await session.destroy()
 ```
 
+### `sealData(data: unknown, { password, ttl }): Promise<string>`
+
+This is the underlying method and seal mechanism that powers `iron-session`. You can use it to seal any `data` you want and pass it around. One usecase are magic links: you generate a seal that contains a user id to login and send it to a route on your website (like `/magic-login`). Once received, you can safely decode the seal with `unsealData` and log the user in.
+
+### `unSealData<T>(seal: string, { password, ttl }): Promise<T>`
+
+This is the opposite of `sealData` and allow you to decode a seal to get the original data back.
+
+## FAQ
+
+### Why use pure cookies for sessions?
+
+This makes your sessions stateless: since the data is passed around in cookies, you do not need any server or service to store session data.
+
+More information can also be found on the [Ruby On Rails website](https://guides.rubyonrails.org/security.html#session-storage) which uses the same technique.
+
+### How to invalidate sessions?
+
+Sessions cannot be instantly invalidated (or "disconnect this customer") as there is typically no state stored about sessions on the server by default. However, in most applications, the first step upon receiving an authenticated request is to validate the user and their permissions in the database. So, to easily disconnect customers (or invalidate sessions), you can add an `isBlocked`` state in the database and create a UI to block customers.
+
+Then, every time a request is received that involves reading or altering sensitive data, make sure to check this flag.
+
+### Can I use something else than cookies?
+
+Yes, we expose `sealData` and `unsealData` which are not tied to cookies. This way you can seal and unseal any object in your application and move seals around to login users.
+
+### How is this different from [JWT](https://jwt.io/)?
+
+Not so much:
+
+- JWT is a standard, it stores metadata in the JWT token themselves to ensure communication between different systems is flawless.
+- JWT tokens are not encrypted, the payload is visible by customers if they manage to inspect the seal. You would have to use [JWE](https://tools.ietf.org/html/rfc7516) to achieve the same.
+- @hapi/iron mechanism is not a standard, it's a way to sign and encrypt data into seals
+
+Depending on your own needs and preferences, `iron-session` may or may not fit you.
+
 ## Credits
 
 - [Eran Hammer and hapi.js contributors](https://github.com/hapijs/iron/graphs/contributors)

package/dist/index.cjs

@@ -85,7 +85,6 @@ function createSealData(_crypto) {
     );
     const passwordForSeal = {
       id: mostRecentPasswordId.toString(),
-      // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
       secret: passwordsMap[mostRecentPasswordId]
     };
     const seal = await ironWebcrypto.seal(_crypto, data, passwordForSeal, {
@@ -121,15 +120,13 @@ function createUnsealData(_crypto) {
     }
   };
 }
-function mergeOptions(sessionOptions, overrides) {
+function getSessionConfig(sessionOptions) {
   const options = {
     ...defaultOptions,
     ...sessionOptions,
-    ...overrides,
     cookieOptions: {
       ...defaultOptions.cookieOptions,
-      ...sessionOptions.cookieOptions,
-      ...overrides?.cookieOptions
+      ...sessionOptions.cookieOptions || {}
     }
   };
   if (sessionOptions.cookieOptions && "maxAge" in sessionOptions.cookieOptions) {
@@ -141,7 +138,7 @@ function mergeOptions(sessionOptions, overrides) {
   }
   return options;
 }
-var badUsageMessage = "iron-session: Bad usage: use getIronSession(req, res, options) or getIronSession(cookies, options).";
+var badUsageMessage = "iron-session: Bad usage: use getIronSession(req, res, options) or getIronSession(cookieStore, options).";
 function createGetIronSession(sealData2, unsealData2) {
   return getIronSession2;
   async function getIronSession2(reqOrCookieStore, resOrsessionOptions, sessionOptions) {
@@ -162,7 +159,7 @@ function createGetIronSession(sealData2, unsealData2) {
     const req = reqOrCookieStore;
     const res = resOrsessionOptions;
     if (!sessionOptions) {
-      throw new Error("iron-session: Bad usage. Missing options.");
+      throw new Error(badUsageMessage);
     }
     if (!sessionOptions.cookieName) {
       throw new Error("iron-session: Bad usage. Missing cookie name.");
@@ -176,29 +173,33 @@ function createGetIronSession(sealData2, unsealData2) {
         "iron-session: Bad usage. Password must be at least 32 characters long."
       );
     }
-    const options = mergeOptions(sessionOptions);
-    const sealFromCookies = getCookie(req, options.cookieName);
+    let sessionConfig = getSessionConfig(sessionOptions);
+    const sealFromCookies = getCookie(req, sessionConfig.cookieName);
     const session = sealFromCookies ? await unsealData2(sealFromCookies, {
       password: passwordsMap,
-      ttl: options.ttl
+      ttl: sessionConfig.ttl
     }) : {};
     Object.defineProperties(session, {
+      updateConfig: {
+        value: function updateConfig(newSessionOptions) {
+          sessionConfig = getSessionConfig(newSessionOptions);
+        }
+      },
       save: {
-        value: async function save(saveOptions) {
+        value: async function save() {
           if ("headersSent" in res && res.headersSent) {
             throw new Error(
               "iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()"
             );
           }
-          const mergedOptions = mergeOptions(sessionOptions, saveOptions);
           const seal = await sealData2(session, {
             password: passwordsMap,
-            ttl: mergedOptions.ttl
+            ttl: sessionConfig.ttl
           });
           const cookieValue = cookie.serialize(
-            mergedOptions.cookieName,
+            sessionConfig.cookieName,
             seal,
-            mergedOptions.cookieOptions
+            sessionConfig.cookieOptions
           );
           if (cookieValue.length > 4096) {
             throw new Error(
@@ -209,13 +210,12 @@ function createGetIronSession(sealData2, unsealData2) {
         }
       },
       destroy: {
-        value: async function destroy(destroyOptions) {
+        value: function destroy() {
           Object.keys(session).forEach((key) => {
             delete session[key];
           });
-          const mergedOptions = mergeOptions(sessionOptions, destroyOptions);
-          const cookieValue = cookie.serialize(mergedOptions.cookieName, "", {
-            ...mergedOptions.cookieOptions,
+          const cookieValue = cookie.serialize(sessionConfig.cookieName, "", {
+            ...sessionConfig.cookieOptions,
             maxAge: 0
           });
           setCookie(res, cookieValue);
@@ -226,9 +226,6 @@ function createGetIronSession(sealData2, unsealData2) {
   }
 }
 async function getIronSessionFromCookieStore(cookieStore, sessionOptions, sealData2, unsealData2) {
-  if (!sessionOptions) {
-    throw new Error("iron-session: Bad usage. Missing options.");
-  }
   if (!sessionOptions.cookieName) {
     throw new Error("iron-session: Bad usage. Missing cookie name.");
   }
@@ -241,44 +238,42 @@ async function getIronSessionFromCookieStore(cookieStore, sessionOptions, sealDa
       "iron-session: Bad usage. Password must be at least 32 characters long."
     );
   }
-  const options = mergeOptions(sessionOptions);
+  const sessionConfig = getSessionConfig(sessionOptions);
   const sealFromCookies = getServerActionCookie(
-    options.cookieName,
+    sessionConfig.cookieName,
     cookieStore
   );
   const session = sealFromCookies ? await unsealData2(sealFromCookies, {
     password: passwordsMap,
-    ttl: options.ttl
+    ttl: sessionConfig.ttl
   }) : {};
   Object.defineProperties(session, {
     save: {
-      value: async function save(saveOptions) {
-        const mergedOptions = mergeOptions(sessionOptions, saveOptions);
+      value: async function save() {
         const seal = await sealData2(session, {
           password: passwordsMap,
-          ttl: mergedOptions.ttl
+          ttl: sessionConfig.ttl
         });
-        const cookieLength = mergedOptions.cookieName.length + seal.length + JSON.stringify(mergedOptions.cookieOptions).length;
+        const cookieLength = sessionConfig.cookieName.length + seal.length + JSON.stringify(sessionConfig.cookieOptions).length;
         if (cookieLength > 4096) {
           throw new Error(
             `iron-session: Cookie length is too big (${cookieLength} bytes), browsers will refuse it. Try to remove some data.`
           );
         }
         cookieStore.set(
-          mergedOptions.cookieName,
+          sessionConfig.cookieName,
           seal,
-          mergedOptions.cookieOptions
+          sessionConfig.cookieOptions
         );
       }
     },
     destroy: {
-      value: async function destroy(destroyOptions) {
+      value: function destroy() {
         Object.keys(session).forEach((key) => {
           delete session[key];
         });
-        const mergedOptions = mergeOptions(sessionOptions, destroyOptions);
-        const cookieOptions = { ...mergedOptions.cookieOptions, maxAge: 0 };
-        cookieStore.set(mergedOptions.cookieName, "", cookieOptions);
+        const cookieOptions = { ...sessionConfig.cookieOptions, maxAge: 0 };
+        cookieStore.set(sessionConfig.cookieName, "", cookieOptions);
       }
     }
   });
@@ -288,9 +283,6 @@ var sealData = createSealData(crypto__namespace);
 var unsealData = createUnsealData(crypto__namespace);
 var getIronSession = createGetIronSession(sealData, unsealData);
 
-exports.createGetIronSession = createGetIronSession;
-exports.createSealData = createSealData;
-exports.createUnsealData = createUnsealData;
 exports.getIronSession = getIronSession;
 exports.sealData = sealData;
 exports.unsealData = unsealData;

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/core.ts","../src/index.ts"],"names":["sealData","unsealData","getIronSession"],"mappings":";AACA,SAAS,OAAO,iBAA8C;AAC9D;AAAA,EACE,YAAY;AAAA,EACZ,QAAQ;AAAA,EACR,UAAU;AAAA,OACL;AA8GP,IAAM,mBAAmB;AACzB,IAAM,wBAAwB,KAAK,KAAK;AAIxC,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AAEzB,IAAM,iBAA+C;AAAA,EACnD,KAAK;AAAA,EACL,eAAe,EAAE,UAAU,MAAM,QAAQ,MAAM,UAAU,OAAO,MAAM,IAAI;AAC5E;AAEA,SAAS,6BAA6B,UAAkC;AACtE,SAAO,OAAO,aAAa,WAAW,EAAE,GAAG,SAAS,IAAI;AAC1D;AAEA,SAAS,UAAU,MAGjB;AACA,QAAM,CAAC,oBAAoB,oBAAoB,IAC7C,KAAK,MAAM,gBAAgB;AAC7B,QAAM,eACJ,wBAAwB,OAAO,OAAO,SAAS,sBAAsB,EAAE;AAGzE,SAAO,EAAE,oBAAyC,aAAa;AACjE;AAEA,SAAS,oBAAoB,KAAqB;AAChD,MAAI,QAAQ,GAAG;AAKb,WAAO;AAAA,EACT;AAIA,SAAO,MAAM;AACf;AAEA,SAAS,UAAU,KAAkB,YAA4B;AAC/D,SACE;AAAA,KACG,aAAa,OAAO,OAAO,IAAI,QAAQ,QAAQ,aAC5C,IAAI,QAAQ,IAAI,QAAQ,IACvB,IAAwB,QAAQ,WAAW;AAAA,EAClD,EAAE,UAAU,KAAK;AAErB;AAEA,SAAS,sBACP,YACA,eACQ;AACR,QAAM,eAAe,cAAc,IAAI,UAAU;AACjD,QAAM,SAAS,cAAc;AAC7B,MAAI,OAAO,WAAW,UAAU;AAC9B,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,UAAU,KAAmB,aAA2B;AAC/D,MAAI,aAAa,OAAO,OAAO,IAAI,QAAQ,WAAW,YAAY;AAChE,QAAI,QAAQ,OAAO,cAAc,WAAW;AAC5C;AAAA,EACF;AACA,MAAI,oBAAqB,IAAuB,UAAU,YAAY,KAAK,CAAC;AAC5E,MAAI,CAAC,MAAM,QAAQ,iBAAiB,GAAG;AACrC,wBAAoB,CAAC,kBAAkB,SAAS,CAAC;AAAA,EACnD;AACA,EAAC,IAAuB,UAAU,cAAc;AAAA,IAC9C,GAAG;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAEO,SAAS,eAAe,SAAiB;AAC9C,SAAO,eAAeA,UACpB,MACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,GACiB;AACjB,UAAM,eAAe,6BAA6B,QAAQ;AAE1D,UAAM,uBAAuB,KAAK;AAAA,MAChC,GAAG,OAAO,KAAK,YAAY,EAAE,IAAI,MAAM;AAAA,IACzC;AACA,UAAM,kBAAkB;AAAA,MACtB,IAAI,qBAAqB,SAAS;AAAA;AAAA,MAElC,QAAQ,aAAa,oBAAoB;AAAA,IAC3C;AAEA,UAAM,OAAO,MAAM,SAAS,SAAS,MAAM,iBAAiB;AAAA,MAC1D,GAAG;AAAA,MACH,KAAK,MAAM;AAAA,IACb,CAAC;AAED,WAAO,GAAG,IAAI,GAAG,gBAAgB,GAAG,mBAAmB;AAAA,EACzD;AACF;AAEO,SAAS,iBAAiB,SAAiB;AAChD,SAAO,eAAeC,YACpB,MACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,GACY;AACZ,UAAM,eAAe,6BAA6B,QAAQ;AAC1D,UAAM,EAAE,oBAAoB,aAAa,IAAI,UAAU,IAAI;AAE3D,QAAI;AACF,YAAM,OACH,MAAM,WAAW,SAAS,oBAAoB,cAAc;AAAA,QAC3D,GAAG;AAAA,QACH,KAAK,MAAM;AAAA,MACb,CAAC,KAA2B,CAAC;AAE/B,UAAI,iBAAiB,GAAG;AACtB,eAAO;AAAA,MACT;AAGA,aAAO,EAAE,GAAG,KAAK,WAAW;AAAA,IAC9B,SAAS,OAAO;AACd,UACE,iBAAiB,SACjB,4FAA4F;AAAA,QAC1F,MAAM;AAAA,MACR,GACA;AAKA,eAAO,CAAC;AAAA,MACV;AAGA,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,aACP,gBACA,WAC0B;AAC1B,QAAM,UAAoC;AAAA,IACxC,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAG;AAAA,IACH,eAAe;AAAA,MACb,GAAG,eAAe;AAAA,MAClB,GAAG,eAAe;AAAA,MAClB,GAAG,WAAW;AAAA,IAChB;AAAA,EACF;AAEA,MACE,eAAe,iBACf,YAAY,eAAe,eAC3B;AACA,QAAI,eAAe,cAAc,WAAW,QAAW;AAErD,cAAQ,MAAM;AAAA,IAChB;AAAA,EACF,OAAO;AACL,YAAQ,cAAc,SAAS,oBAAoB,QAAQ,GAAG;AAAA,EAChE;AAEA,SAAO;AACT;AAEA,IAAM,kBACJ;AAEK,SAAS,qBACdD,WACAC,aACA;AACA,SAAOC;AAWP,iBAAeA,gBACb,kBACA,qBACA,gBACyB;AACzB,QAAI,CAAC,kBAAkB;AACrB,YAAM,IAAI,MAAM,eAAe;AAAA,IACjC;AAEA,QAAI,CAAC,qBAAqB;AACxB,YAAM,IAAI,MAAM,eAAe;AAAA,IACjC;AAEA,QAAI,CAAC,gBAAgB;AACnB,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACAF;AAAA,QACAC;AAAA,MACF;AAAA,IACF;AAEA,UAAM,MAAM;AACZ,UAAM,MAAM;AAEZ,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,MAAM,2CAA2C;AAAA,IAC7D;AAEA,QAAI,CAAC,eAAe,YAAY;AAC9B,YAAM,IAAI,MAAM,+CAA+C;AAAA,IACjE;AAEA,QAAI,CAAC,eAAe,UAAU;AAC5B,YAAM,IAAI,MAAM,4CAA4C;AAAA,IAC9D;AAEA,UAAM,eAAe,6BAA6B,eAAe,QAAQ;AAEzE,QAAI,OAAO,OAAO,YAAY,EAAE,KAAK,CAAC,aAAa,SAAS,SAAS,EAAE,GAAG;AACxE,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,UAAU,aAAa,cAAc;AAC3C,UAAM,kBAAkB,UAAU,KAAK,QAAQ,UAAU;AACzD,UAAM,UAAU,kBACZ,MAAMA,YAAc,iBAAiB;AAAA,MACnC,UAAU;AAAA,MACV,KAAK,QAAQ;AAAA,IACf,CAAC,IACA,CAAC;AAEN,WAAO,iBAAiB,SAAS;AAAA,MAC/B,MAAM;AAAA,QACJ,OAAO,eAAe,KAAK,aAAkC;AAC3D,cAAI,iBAAiB,OAAO,IAAI,aAAa;AAC3C,kBAAM,IAAI;AAAA,cACR;AAAA,YACF;AAAA,UACF;AAEA,gBAAM,gBAAgB,aAAa,gBAAgB,WAAW;AAC9D,gBAAM,OAAO,MAAMD,UAAS,SAAS;AAAA,YACnC,UAAU;AAAA,YACV,KAAK,cAAc;AAAA,UACrB,CAAC;AACD,gBAAM,cAAc;AAAA,YAClB,cAAc;AAAA,YACd;AAAA,YACA,cAAc;AAAA,UAChB;AAEA,cAAI,YAAY,SAAS,MAAM;AAC7B,kBAAM,IAAI;AAAA,cACR,2CAA2C,YAAY,MAAM;AAAA,YAC/D;AAAA,UACF;AAEA,oBAAU,KAAK,WAAW;AAAA,QAC5B;AAAA,MACF;AAAA,MAEA,SAAS;AAAA,QACP,OAAO,eAAe,QAAQ,gBAAqC;AACjE,iBAAO,KAAK,OAAO,EAAE,QAAQ,CAAC,QAAQ;AACpC,mBAAQ,QAAoC,GAAG;AAAA,UACjD,CAAC;AAED,gBAAM,gBAAgB,aAAa,gBAAgB,cAAc;AACjE,gBAAM,cAAc,UAAU,cAAc,YAAY,IAAI;AAAA,YAC1D,GAAG,cAAc;AAAA,YACjB,QAAQ;AAAA,UACV,CAAC;AAED,oBAAU,KAAK,WAAW;AAAA,QAC5B;AAAA,MACF;AAAA,IACF,CAAC;AAED,WAAO;AAAA,EACT;AACF;AAEA,eAAe,8BACb,aACA,gBACAA,WACAC,aACyB;AACzB,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,MAAM,2CAA2C;AAAA,EAC7D;AAEA,MAAI,CAAC,eAAe,YAAY;AAC9B,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AAEA,MAAI,CAAC,eAAe,UAAU;AAC5B,UAAM,IAAI,MAAM,4CAA4C;AAAA,EAC9D;AAEA,QAAM,eAAe,6BAA6B,eAAe,QAAQ;AAEzE,MAAI,OAAO,OAAO,YAAY,EAAE,KAAK,CAAC,aAAa,SAAS,SAAS,EAAE,GAAG;AACxE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU,aAAa,cAAc;AAC3C,QAAM,kBAAkB;AAAA,IACtB,QAAQ;AAAA,IACR;AAAA,EACF;AACA,QAAM,UAAU,kBACZ,MAAMA,YAAc,iBAAiB;AAAA,IACnC,UAAU;AAAA,IACV,KAAK,QAAQ;AAAA,EACf,CAAC,IACA,CAAC;AAEN,SAAO,iBAAiB,SAAS;AAAA,IAC/B,MAAM;AAAA,MACJ,OAAO,eAAe,KAAK,aAAkC;AAC3D,cAAM,gBAAgB,aAAa,gBAAgB,WAAW;AAC9D,cAAM,OAAO,MAAMD,UAAS,SAAS;AAAA,UACnC,UAAU;AAAA,UACV,KAAK,cAAc;AAAA,QACrB,CAAC;AAED,cAAM,eACJ,cAAc,WAAW,SACzB,KAAK,SACL,KAAK,UAAU,cAAc,aAAa,EAAE;AAE9C,YAAI,eAAe,MAAM;AACvB,gBAAM,IAAI;AAAA,YACR,2CAA2C,YAAY;AAAA,UACzD;AAAA,QACF;AAEA,oBAAY;AAAA,UACV,cAAc;AAAA,UACd;AAAA,UACA,cAAc;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAAA,IAEA,SAAS;AAAA,MACP,OAAO,eAAe,QAAQ,gBAAoC;AAChE,eAAO,KAAK,OAAO,EAAE,QAAQ,CAAC,QAAQ;AACpC,iBAAQ,QAAoC,GAAG;AAAA,QACjD,CAAC;AACD,cAAM,gBAAgB,aAAa,gBAAgB,cAAc;AACjE,cAAM,gBAAgB,EAAE,GAAG,cAAc,eAAe,QAAQ,EAAE;AAElE,oBAAY,IAAI,cAAc,YAAY,IAAI,aAAa;AAAA,MAC7D;AAAA,IACF;AAAA,EACF,CAAC;AAED,SAAO;AACT;;;AChfA,YAAY,YAAY;AAGjB,IAAM,WAAW,eAAe,MAAM;AACtC,IAAM,aAAa,iBAAiB,MAAM;AAC1C,IAAM,iBAAiB,qBAAqB,UAAU,UAAU","sourcesContent":["import type { IncomingMessage, ServerResponse } from \"http\";\nimport { parse, serialize, type CookieSerializeOptions } from \"cookie\";\nimport {\n  defaults as ironDefaults,\n  seal as ironSeal,\n  unseal as ironUnseal,\n} from \"iron-webcrypto\";\n\ntype PasswordsMap = Record<string, string>;\ntype Password = PasswordsMap | string;\ntype RequestType = IncomingMessage | Request;\ntype ResponseType = Response | ServerResponse;\n\n/**\n * {@link https://wicg.github.io/cookie-store/#dictdef-cookielistitem CookieListItem}\n * as specified by W3C.\n */\ninterface CookieListItem\n  extends Pick<\n    CookieSerializeOptions,\n    \"domain\" | \"path\" | \"sameSite\" | \"secure\"\n  > {\n  /** A string with the name of a cookie. */\n  name: string;\n  /** A string containing the value of the cookie. */\n  value: string;\n  /** A number of milliseconds or Date interface containing the expires of the cookie. */\n  expires?: CookieSerializeOptions[\"expires\"] | number;\n}\n\n/**\n * Superset of {@link CookieListItem} extending it with\n * the `httpOnly`, `maxAge` and `priority` properties.\n */\ntype ResponseCookie = CookieListItem &\n  Pick<CookieSerializeOptions, \"httpOnly\" | \"maxAge\" | \"priority\">;\n\n/**\n * The high-level type definition of the .get() and .set() methods\n * of { cookies() } from \"next/headers\"\n */\nexport interface CookieStore {\n  get: (name: string) => { name: string; value: string } | undefined;\n  set: {\n    (name: string, value: string, cookie?: Partial<ResponseCookie>): void;\n    (options: ResponseCookie): void;\n  };\n}\n\n/**\n * Set-Cookie Attributes do not include `encode`. We omit this from our `cookieOptions` type.\n *\n * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie\n * @see https://developer.chrome.com/docs/devtools/application/cookies/\n */\ntype CookieOptions = Omit<CookieSerializeOptions, \"encode\">;\n\nexport interface SessionOptions {\n  /**\n   * The cookie name that will be used inside the browser. Make sure it's unique\n   * given your application.\n   *\n   * @example 'vercel-session'\n   */\n  cookieName: string;\n\n  /**\n   * The password(s) that will be used to encrypt the cookie. Can either be a string\n   * or an object.\n   *\n   * When you provide multiple passwords then all of them will be used to decrypt\n   * the cookie. But only the most recent (`= highest key`, `2` in the example)\n   * password will be used to encrypt the cookie. This allows password rotation.\n   *\n   * @example { 1: 'password-1', 2: 'password-2' }\n   */\n  password: Password;\n\n  /**\n   * The time (in seconds) that the session will be valid for. Also sets the\n   * `max-age` attribute of the cookie automatically (`= ttl - 60s`, so that the\n   * cookie always expire before the session).\n   *\n   * `ttl = 0` means no expiration.\n   *\n   * @default 1209600\n   */\n  ttl?: number;\n\n  /**\n   * The options that will be passed to the cookie library.\n   *\n   * If you want to use \"session cookies\" (cookies that are deleted when the browser\n   * is closed) then you need to pass `cookieOptions: { maxAge: undefined }`\n   *\n   * @see https://github.com/jshttp/cookie#options-1\n   */\n  cookieOptions?: CookieOptions;\n}\n\ntype OverridableOptions = Pick<SessionOptions, \"cookieOptions\" | \"ttl\">;\n\nexport type IronSession<T> = T & {\n  /**\n   * Destroys the session data and removes the cookie.\n   */\n  readonly destroy: (destroyOptions?: OverridableOptions) => Promise<void>;\n\n  /**\n   * Encrypts the session data and sets the cookie.\n   */\n  readonly save: (saveOptions?: OverridableOptions) => Promise<void>;\n};\n\n// default time allowed to check for iron seal validity when ttl passed\n// see https://hapi.dev/module/iron/api/?v=7.0.1#options\nconst timestampSkewSec = 60;\nconst fourteenDaysInSeconds = 14 * 24 * 3600;\n\n// We store a token major version to handle data format changes so that the cookies\n// can be kept alive between upgrades, no need to disconnect everyone.\nconst currentMajorVersion = 2;\nconst versionDelimiter = \"~\";\n\nconst defaultOptions: Required<OverridableOptions> = {\n  ttl: fourteenDaysInSeconds,\n  cookieOptions: { httpOnly: true, secure: true, sameSite: \"lax\", path: \"/\" },\n};\n\nfunction normalizeStringPasswordToMap(password: Password): PasswordsMap {\n  return typeof password === \"string\" ? { 1: password } : password;\n}\n\nfunction parseSeal(seal: string): {\n  sealWithoutVersion: string;\n  tokenVersion: number | null;\n} {\n  const [sealWithoutVersion, tokenVersionAsString] =\n    seal.split(versionDelimiter);\n  const tokenVersion =\n    tokenVersionAsString == null ? null : parseInt(tokenVersionAsString, 10);\n\n  // eslint-disable-next-line @typescript-eslint/no-non-null-assertion\n  return { sealWithoutVersion: sealWithoutVersion!, tokenVersion };\n}\n\nfunction computeCookieMaxAge(ttl: number): number {\n  if (ttl === 0) {\n    // ttl = 0 means no expiration\n    // but in reality cookies have to expire (can't have no max-age)\n    // 2147483647 is the max value for max-age in cookies\n    // see https://stackoverflow.com/a/11685301/147079\n    return 2147483647;\n  }\n\n  // The next line makes sure browser will expire cookies before seals are considered expired by the server.\n  // It also allows for clock difference of 60 seconds between server and clients.\n  return ttl - timestampSkewSec;\n}\n\nfunction getCookie(req: RequestType, cookieName: string): string {\n  return (\n    parse(\n      (\"headers\" in req && typeof req.headers.get === \"function\"\n        ? req.headers.get(\"cookie\")\n        : (req as IncomingMessage).headers.cookie) ?? \"\",\n    )[cookieName] ?? \"\"\n  );\n}\n\nfunction getServerActionCookie(\n  cookieName: string,\n  cookieHandler: CookieStore,\n): string {\n  const cookieObject = cookieHandler.get(cookieName);\n  const cookie = cookieObject?.value;\n  if (typeof cookie === \"string\") {\n    return cookie;\n  }\n  return \"\";\n}\n\nfunction setCookie(res: ResponseType, cookieValue: string): void {\n  if (\"headers\" in res && typeof res.headers.append === \"function\") {\n    res.headers.append(\"set-cookie\", cookieValue);\n    return;\n  }\n  let existingSetCookie = (res as ServerResponse).getHeader(\"set-cookie\") ?? [];\n  if (!Array.isArray(existingSetCookie)) {\n    existingSetCookie = [existingSetCookie.toString()];\n  }\n  (res as ServerResponse).setHeader(\"set-cookie\", [\n    ...existingSetCookie,\n    cookieValue,\n  ]);\n}\n\nexport function createSealData(_crypto: Crypto) {\n  return async function sealData(\n    data: unknown,\n    {\n      password,\n      ttl = fourteenDaysInSeconds,\n    }: { password: Password; ttl?: number },\n  ): Promise<string> {\n    const passwordsMap = normalizeStringPasswordToMap(password);\n\n    const mostRecentPasswordId = Math.max(\n      ...Object.keys(passwordsMap).map(Number),\n    );\n    const passwordForSeal = {\n      id: mostRecentPasswordId.toString(),\n      // eslint-disable-next-line @typescript-eslint/no-non-null-assertion\n      secret: passwordsMap[mostRecentPasswordId]!,\n    };\n\n    const seal = await ironSeal(_crypto, data, passwordForSeal, {\n      ...ironDefaults,\n      ttl: ttl * 1000,\n    });\n\n    return `${seal}${versionDelimiter}${currentMajorVersion}`;\n  };\n}\n\nexport function createUnsealData(_crypto: Crypto) {\n  return async function unsealData<T>(\n    seal: string,\n    {\n      password,\n      ttl = fourteenDaysInSeconds,\n    }: { password: Password; ttl?: number },\n  ): Promise<T> {\n    const passwordsMap = normalizeStringPasswordToMap(password);\n    const { sealWithoutVersion, tokenVersion } = parseSeal(seal);\n\n    try {\n      const data =\n        (await ironUnseal(_crypto, sealWithoutVersion, passwordsMap, {\n          ...ironDefaults,\n          ttl: ttl * 1000,\n        })) /* c8 ignore next */ ?? {};\n\n      if (tokenVersion === 2) {\n        return data as T;\n      }\n\n      // @ts-expect-error `persistent` does not exist on newer tokens\n      return { ...data.persistent } as T;\n    } catch (error) {\n      if (\n        error instanceof Error &&\n        /^(Expired seal|Bad hmac value|Cannot find password|Incorrect number of sealed components)/.test(\n          error.message,\n        )\n      ) {\n        // if seal expired or\n        // if seal is not valid (encrypted using a different password, when passwords are badly rotated) or\n        // if we can't find back the password in the seal\n        // then we just start a new session over\n        return {} as T;\n      }\n\n      /* c8 ignore next 2 */\n      throw error;\n    }\n  };\n}\n\nfunction mergeOptions(\n  sessionOptions: SessionOptions,\n  overrides?: OverridableOptions,\n): Required<SessionOptions> {\n  const options: Required<SessionOptions> = {\n    ...defaultOptions,\n    ...sessionOptions,\n    ...overrides,\n    cookieOptions: {\n      ...defaultOptions.cookieOptions,\n      ...sessionOptions.cookieOptions,\n      ...overrides?.cookieOptions,\n    },\n  };\n\n  if (\n    sessionOptions.cookieOptions &&\n    \"maxAge\" in sessionOptions.cookieOptions\n  ) {\n    if (sessionOptions.cookieOptions.maxAge === undefined) {\n      // session cookies, do not set maxAge, consider token as infinite\n      options.ttl = 0;\n    }\n  } else {\n    options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);\n  }\n\n  return options;\n}\n\nconst badUsageMessage =\n  \"iron-session: Bad usage: use getIronSession(req, res, options) or getIronSession(cookies, options).\";\n\nexport function createGetIronSession(\n  sealData: ReturnType<typeof createSealData>,\n  unsealData: ReturnType<typeof createUnsealData>,\n) {\n  return getIronSession;\n\n  async function getIronSession<T extends object>(\n    cookies: CookieStore,\n    sessionOptions: SessionOptions,\n  ): Promise<IronSession<T>>;\n  async function getIronSession<T extends object>(\n    req: RequestType,\n    res: ResponseType,\n    sessionOptions: SessionOptions,\n  ): Promise<IronSession<T>>;\n  async function getIronSession<T extends object>(\n    reqOrCookieStore: RequestType | CookieStore,\n    resOrsessionOptions: ResponseType | SessionOptions,\n    sessionOptions?: SessionOptions,\n  ): Promise<IronSession<T>> {\n    if (!reqOrCookieStore) {\n      throw new Error(badUsageMessage);\n    }\n\n    if (!resOrsessionOptions) {\n      throw new Error(badUsageMessage);\n    }\n\n    if (!sessionOptions) {\n      return getIronSessionFromCookieStore<T>(\n        reqOrCookieStore as CookieStore,\n        resOrsessionOptions as SessionOptions,\n        sealData,\n        unsealData,\n      );\n    }\n\n    const req = reqOrCookieStore as RequestType;\n    const res = resOrsessionOptions as ResponseType;\n\n    if (!sessionOptions) {\n      throw new Error(\"iron-session: Bad usage. Missing options.\");\n    }\n\n    if (!sessionOptions.cookieName) {\n      throw new Error(\"iron-session: Bad usage. Missing cookie name.\");\n    }\n\n    if (!sessionOptions.password) {\n      throw new Error(\"iron-session: Bad usage. Missing password.\");\n    }\n\n    const passwordsMap = normalizeStringPasswordToMap(sessionOptions.password);\n\n    if (Object.values(passwordsMap).some((password) => password.length < 32)) {\n      throw new Error(\n        \"iron-session: Bad usage. Password must be at least 32 characters long.\",\n      );\n    }\n\n    const options = mergeOptions(sessionOptions);\n    const sealFromCookies = getCookie(req, options.cookieName);\n    const session = sealFromCookies\n      ? await unsealData<T>(sealFromCookies, {\n          password: passwordsMap,\n          ttl: options.ttl,\n        })\n      : ({} as T);\n\n    Object.defineProperties(session, {\n      save: {\n        value: async function save(saveOptions?: OverridableOptions) {\n          if (\"headersSent\" in res && res.headersSent) {\n            throw new Error(\n              \"iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()\",\n            );\n          }\n\n          const mergedOptions = mergeOptions(sessionOptions, saveOptions);\n          const seal = await sealData(session, {\n            password: passwordsMap,\n            ttl: mergedOptions.ttl,\n          });\n          const cookieValue = serialize(\n            mergedOptions.cookieName,\n            seal,\n            mergedOptions.cookieOptions,\n          );\n\n          if (cookieValue.length > 4096) {\n            throw new Error(\n              `iron-session: Cookie length is too big (${cookieValue.length} bytes), browsers will refuse it. Try to remove some data.`,\n            );\n          }\n\n          setCookie(res, cookieValue);\n        },\n      },\n\n      destroy: {\n        value: async function destroy(destroyOptions?: OverridableOptions) {\n          Object.keys(session).forEach((key) => {\n            delete (session as Record<string, unknown>)[key];\n          });\n\n          const mergedOptions = mergeOptions(sessionOptions, destroyOptions);\n          const cookieValue = serialize(mergedOptions.cookieName, \"\", {\n            ...mergedOptions.cookieOptions,\n            maxAge: 0,\n          });\n\n          setCookie(res, cookieValue);\n        },\n      },\n    });\n\n    return session as IronSession<T>;\n  }\n}\n\nasync function getIronSessionFromCookieStore<T extends object>(\n  cookieStore: CookieStore,\n  sessionOptions: SessionOptions,\n  sealData: ReturnType<typeof createSealData>,\n  unsealData: ReturnType<typeof createUnsealData>,\n): Promise<IronSession<T>> {\n  if (!sessionOptions) {\n    throw new Error(\"iron-session: Bad usage. Missing options.\");\n  }\n\n  if (!sessionOptions.cookieName) {\n    throw new Error(\"iron-session: Bad usage. Missing cookie name.\");\n  }\n\n  if (!sessionOptions.password) {\n    throw new Error(\"iron-session: Bad usage. Missing password.\");\n  }\n\n  const passwordsMap = normalizeStringPasswordToMap(sessionOptions.password);\n\n  if (Object.values(passwordsMap).some((password) => password.length < 32)) {\n    throw new Error(\n      \"iron-session: Bad usage. Password must be at least 32 characters long.\",\n    );\n  }\n\n  const options = mergeOptions(sessionOptions);\n  const sealFromCookies = getServerActionCookie(\n    options.cookieName,\n    cookieStore,\n  );\n  const session = sealFromCookies\n    ? await unsealData<T>(sealFromCookies, {\n        password: passwordsMap,\n        ttl: options.ttl,\n      })\n    : ({} as T);\n\n  Object.defineProperties(session, {\n    save: {\n      value: async function save(saveOptions?: OverridableOptions) {\n        const mergedOptions = mergeOptions(sessionOptions, saveOptions);\n        const seal = await sealData(session, {\n          password: passwordsMap,\n          ttl: mergedOptions.ttl,\n        });\n\n        const cookieLength =\n          mergedOptions.cookieName.length +\n          seal.length +\n          JSON.stringify(mergedOptions.cookieOptions).length;\n\n        if (cookieLength > 4096) {\n          throw new Error(\n            `iron-session: Cookie length is too big (${cookieLength} bytes), browsers will refuse it. Try to remove some data.`,\n          );\n        }\n\n        cookieStore.set(\n          mergedOptions.cookieName,\n          seal,\n          mergedOptions.cookieOptions,\n        );\n      },\n    },\n\n    destroy: {\n      value: async function destroy(destroyOptions: OverridableOptions) {\n        Object.keys(session).forEach((key) => {\n          delete (session as Record<string, unknown>)[key];\n        });\n        const mergedOptions = mergeOptions(sessionOptions, destroyOptions);\n        const cookieOptions = { ...mergedOptions.cookieOptions, maxAge: 0 };\n\n        cookieStore.set(mergedOptions.cookieName, \"\", cookieOptions);\n      },\n    },\n  });\n\n  return session as IronSession<T>;\n}\n","import {\n  createGetIronSession,\n  createSealData,\n  createUnsealData,\n} from \"./core.js\";\n\nimport * as crypto from \"uncrypto\";\n\nexport * from \"./core.js\";\nexport const sealData = createSealData(crypto);\nexport const unsealData = createUnsealData(crypto);\nexport const getIronSession = createGetIronSession(sealData, unsealData);\n// export const getServerActionIronSession = createGetServerActionIronSession(\n//   sealData,\n//   unsealData,\n// );\n"]}
+{"version":3,"sources":["../src/core.ts","../src/index.ts"],"names":["sealData","unsealData","getIronSession"],"mappings":";AACA,SAAS,OAAO,iBAA8C;AAC9D;AAAA,EACE,YAAY;AAAA,EACZ,QAAQ;AAAA,EACR,UAAU;AAAA,OACL;AAiHP,IAAM,mBAAmB;AACzB,IAAM,wBAAwB,KAAK,KAAK;AAIxC,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AAEzB,IAAM,iBACJ;AAAA,EACE,KAAK;AAAA,EACL,eAAe,EAAE,UAAU,MAAM,QAAQ,MAAM,UAAU,OAAO,MAAM,IAAI;AAC5E;AAEF,SAAS,6BAA6B,UAAkC;AACtE,SAAO,OAAO,aAAa,WAAW,EAAE,GAAG,SAAS,IAAI;AAC1D;AAEA,SAAS,UAAU,MAGjB;AACA,QAAM,CAAC,oBAAoB,oBAAoB,IAC7C,KAAK,MAAM,gBAAgB;AAC7B,QAAM,eACJ,wBAAwB,OAAO,OAAO,SAAS,sBAAsB,EAAE;AAGzE,SAAO,EAAE,oBAAyC,aAAa;AACjE;AAEA,SAAS,oBAAoB,KAAqB;AAChD,MAAI,QAAQ,GAAG;AAKb,WAAO;AAAA,EACT;AAIA,SAAO,MAAM;AACf;AAEA,SAAS,UAAU,KAAkB,YAA4B;AAC/D,SACE;AAAA,KACG,aAAa,OAAO,OAAO,IAAI,QAAQ,QAAQ,aAC5C,IAAI,QAAQ,IAAI,QAAQ,IACvB,IAAwB,QAAQ,WAAW;AAAA,EAClD,EAAE,UAAU,KAAK;AAErB;AAEA,SAAS,sBACP,YACA,eACQ;AACR,QAAM,eAAe,cAAc,IAAI,UAAU;AACjD,QAAM,SAAS,cAAc;AAC7B,MAAI,OAAO,WAAW,UAAU;AAC9B,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,UAAU,KAAmB,aAA2B;AAC/D,MAAI,aAAa,OAAO,OAAO,IAAI,QAAQ,WAAW,YAAY;AAChE,QAAI,QAAQ,OAAO,cAAc,WAAW;AAC5C;AAAA,EACF;AACA,MAAI,oBAAqB,IAAuB,UAAU,YAAY,KAAK,CAAC;AAC5E,MAAI,CAAC,MAAM,QAAQ,iBAAiB,GAAG;AACrC,wBAAoB,CAAC,kBAAkB,SAAS,CAAC;AAAA,EACnD;AACA,EAAC,IAAuB,UAAU,cAAc;AAAA,IAC9C,GAAG;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAEO,SAAS,eAAe,SAAiB;AAC9C,SAAO,eAAeA,UACpB,MACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,GACiB;AACjB,UAAM,eAAe,6BAA6B,QAAQ;AAE1D,UAAM,uBAAuB,KAAK;AAAA,MAChC,GAAG,OAAO,KAAK,YAAY,EAAE,IAAI,MAAM;AAAA,IACzC;AACA,UAAM,kBAAkB;AAAA,MACtB,IAAI,qBAAqB,SAAS;AAAA,MAClC,QAAQ,aAAa,oBAAoB;AAAA,IAC3C;AAEA,UAAM,OAAO,MAAM,SAAS,SAAS,MAAM,iBAAiB;AAAA,MAC1D,GAAG;AAAA,MACH,KAAK,MAAM;AAAA,IACb,CAAC;AAED,WAAO,GAAG,IAAI,GAAG,gBAAgB,GAAG,mBAAmB;AAAA,EACzD;AACF;AAEO,SAAS,iBAAiB,SAAiB;AAChD,SAAO,eAAeC,YACpB,MACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,GACY;AACZ,UAAM,eAAe,6BAA6B,QAAQ;AAC1D,UAAM,EAAE,oBAAoB,aAAa,IAAI,UAAU,IAAI;AAE3D,QAAI;AACF,YAAM,OACH,MAAM,WAAW,SAAS,oBAAoB,cAAc;AAAA,QAC3D,GAAG;AAAA,QACH,KAAK,MAAM;AAAA,MACb,CAAC,KAAM,CAAC;AAEV,UAAI,iBAAiB,GAAG;AACtB,eAAO;AAAA,MACT;AAGA,aAAO,EAAE,GAAG,KAAK,WAAW;AAAA,IAC9B,SAAS,OAAO;AACd,UACE,iBAAiB,SACjB,4FAA4F;AAAA,QAC1F,MAAM;AAAA,MACR,GACA;AAKA,eAAO,CAAC;AAAA,MACV;AAEA,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,iBACP,gBAC0B;AAC1B,QAAM,UAAU;AAAA,IACd,GAAG;AAAA,IACH,GAAG;AAAA,IACH,eAAe;AAAA,MACb,GAAG,eAAe;AAAA,MAClB,GAAI,eAAe,iBAAiB,CAAC;AAAA,IACvC;AAAA,EACF;AAEA,MACE,eAAe,iBACf,YAAY,eAAe,eAC3B;AACA,QAAI,eAAe,cAAc,WAAW,QAAW;AAErD,cAAQ,MAAM;AAAA,IAChB;AAAA,EACF,OAAO;AACL,YAAQ,cAAc,SAAS,oBAAoB,QAAQ,GAAG;AAAA,EAChE;AAEA,SAAO;AACT;AAEA,IAAM,kBACJ;AAEK,SAAS,qBACdD,WACAC,aACA;AACA,SAAOC;AAWP,iBAAeA,gBACb,kBACA,qBACA,gBACyB;AACzB,QAAI,CAAC,kBAAkB;AACrB,YAAM,IAAI,MAAM,eAAe;AAAA,IACjC;AAEA,QAAI,CAAC,qBAAqB;AACxB,YAAM,IAAI,MAAM,eAAe;AAAA,IACjC;AAEA,QAAI,CAAC,gBAAgB;AACnB,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACAF;AAAA,QACAC;AAAA,MACF;AAAA,IACF;AAEA,UAAM,MAAM;AACZ,UAAM,MAAM;AAEZ,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,MAAM,eAAe;AAAA,IACjC;AAEA,QAAI,CAAC,eAAe,YAAY;AAC9B,YAAM,IAAI,MAAM,+CAA+C;AAAA,IACjE;AAEA,QAAI,CAAC,eAAe,UAAU;AAC5B,YAAM,IAAI,MAAM,4CAA4C;AAAA,IAC9D;AAEA,UAAM,eAAe,6BAA6B,eAAe,QAAQ;AAEzE,QAAI,OAAO,OAAO,YAAY,EAAE,KAAK,CAAC,aAAa,SAAS,SAAS,EAAE,GAAG;AACxE,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI,gBAAgB,iBAAiB,cAAc;AAEnD,UAAM,kBAAkB,UAAU,KAAK,cAAc,UAAU;AAC/D,UAAM,UAAU,kBACZ,MAAMA,YAAc,iBAAiB;AAAA,MACnC,UAAU;AAAA,MACV,KAAK,cAAc;AAAA,IACrB,CAAC,IACA,CAAC;AAEN,WAAO,iBAAiB,SAAS;AAAA,MAC/B,cAAc;AAAA,QACZ,OAAO,SAAS,aAAa,mBAAmC;AAC9D,0BAAgB,iBAAiB,iBAAiB;AAAA,QACpD;AAAA,MACF;AAAA,MACA,MAAM;AAAA,QACJ,OAAO,eAAe,OAAO;AAC3B,cAAI,iBAAiB,OAAO,IAAI,aAAa;AAC3C,kBAAM,IAAI;AAAA,cACR;AAAA,YACF;AAAA,UACF;AAEA,gBAAM,OAAO,MAAMD,UAAS,SAAS;AAAA,YACnC,UAAU;AAAA,YACV,KAAK,cAAc;AAAA,UACrB,CAAC;AACD,gBAAM,cAAc;AAAA,YAClB,cAAc;AAAA,YACd;AAAA,YACA,cAAc;AAAA,UAChB;AAEA,cAAI,YAAY,SAAS,MAAM;AAC7B,kBAAM,IAAI;AAAA,cACR,2CAA2C,YAAY,MAAM;AAAA,YAC/D;AAAA,UACF;AAEA,oBAAU,KAAK,WAAW;AAAA,QAC5B;AAAA,MACF;AAAA,MAEA,SAAS;AAAA,QACP,OAAO,SAAS,UAAU;AACxB,iBAAO,KAAK,OAAO,EAAE,QAAQ,CAAC,QAAQ;AACpC,mBAAQ,QAAoC,GAAG;AAAA,UACjD,CAAC;AACD,gBAAM,cAAc,UAAU,cAAc,YAAY,IAAI;AAAA,YAC1D,GAAG,cAAc;AAAA,YACjB,QAAQ;AAAA,UACV,CAAC;AAED,oBAAU,KAAK,WAAW;AAAA,QAC5B;AAAA,MACF;AAAA,IACF,CAAC;AAED,WAAO;AAAA,EACT;AACF;AAEA,eAAe,8BACb,aACA,gBACAA,WACAC,aACyB;AACzB,MAAI,CAAC,eAAe,YAAY;AAC9B,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AAEA,MAAI,CAAC,eAAe,UAAU;AAC5B,UAAM,IAAI,MAAM,4CAA4C;AAAA,EAC9D;AAEA,QAAM,eAAe,6BAA6B,eAAe,QAAQ;AAEzE,MAAI,OAAO,OAAO,YAAY,EAAE,KAAK,CAAC,aAAa,SAAS,SAAS,EAAE,GAAG;AACxE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,gBAAgB,iBAAiB,cAAc;AACrD,QAAM,kBAAkB;AAAA,IACtB,cAAc;AAAA,IACd;AAAA,EACF;AACA,QAAM,UAAU,kBACZ,MAAMA,YAAc,iBAAiB;AAAA,IACnC,UAAU;AAAA,IACV,KAAK,cAAc;AAAA,EACrB,CAAC,IACA,CAAC;AAEN,SAAO,iBAAiB,SAAS;AAAA,IAC/B,MAAM;AAAA,MACJ,OAAO,eAAe,OAAO;AAC3B,cAAM,OAAO,MAAMD,UAAS,SAAS;AAAA,UACnC,UAAU;AAAA,UACV,KAAK,cAAc;AAAA,QACrB,CAAC;AAED,cAAM,eACJ,cAAc,WAAW,SACzB,KAAK,SACL,KAAK,UAAU,cAAc,aAAa,EAAE;AAE9C,YAAI,eAAe,MAAM;AACvB,gBAAM,IAAI;AAAA,YACR,2CAA2C,YAAY;AAAA,UACzD;AAAA,QACF;AAEA,oBAAY;AAAA,UACV,cAAc;AAAA,UACd;AAAA,UACA,cAAc;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAAA,IAEA,SAAS;AAAA,MACP,OAAO,SAAS,UAAU;AACxB,eAAO,KAAK,OAAO,EAAE,QAAQ,CAAC,QAAQ;AACpC,iBAAQ,QAAoC,GAAG;AAAA,QACjD,CAAC;AAED,cAAM,gBAAgB,EAAE,GAAG,cAAc,eAAe,QAAQ,EAAE;AAClE,oBAAY,IAAI,cAAc,YAAY,IAAI,aAAa;AAAA,MAC7D;AAAA,IACF;AAAA,EACF,CAAC;AAED,SAAO;AACT;;;AC5eA,YAAY,YAAY;AAGjB,IAAM,WAAW,eAAe,MAAM;AACtC,IAAM,aAAa,iBAAiB,MAAM;AAC1C,IAAM,iBAAiB,qBAAqB,UAAU,UAAU","sourcesContent":["import type { IncomingMessage, ServerResponse } from \"http\";\nimport { parse, serialize, type CookieSerializeOptions } from \"cookie\";\nimport {\n  defaults as ironDefaults,\n  seal as ironSeal,\n  unseal as ironUnseal,\n} from \"iron-webcrypto\";\n\ntype PasswordsMap = Record<string, string>;\ntype Password = PasswordsMap | string;\ntype RequestType = IncomingMessage | Request;\ntype ResponseType = Response | ServerResponse;\n\n/**\n * {@link https://wicg.github.io/cookie-store/#dictdef-cookielistitem CookieListItem}\n * as specified by W3C.\n */\ninterface CookieListItem\n  extends Pick<\n    CookieSerializeOptions,\n    \"domain\" | \"path\" | \"sameSite\" | \"secure\"\n  > {\n  /** A string with the name of a cookie. */\n  name: string;\n  /** A string containing the value of the cookie. */\n  value: string;\n  /** A number of milliseconds or Date interface containing the expires of the cookie. */\n  expires?: CookieSerializeOptions[\"expires\"] | number;\n}\n\n/**\n * Superset of {@link CookieListItem} extending it with\n * the `httpOnly`, `maxAge` and `priority` properties.\n */\ntype ResponseCookie = CookieListItem &\n  Pick<CookieSerializeOptions, \"httpOnly\" | \"maxAge\" | \"priority\">;\n\n/**\n * The high-level type definition of the .get() and .set() methods\n * of { cookies() } from \"next/headers\"\n */\nexport interface CookieStore {\n  get: (name: string) => { name: string; value: string } | undefined;\n  set: {\n    (name: string, value: string, cookie?: Partial<ResponseCookie>): void;\n    (options: ResponseCookie): void;\n  };\n}\n\n/**\n * Set-Cookie Attributes do not include `encode`. We omit this from our `cookieOptions` type.\n *\n * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie\n * @see https://developer.chrome.com/docs/devtools/application/cookies/\n */\ntype CookieOptions = Omit<CookieSerializeOptions, \"encode\">;\n\nexport interface SessionOptions {\n  /**\n   * The cookie name that will be used inside the browser. Make sure it's unique\n   * given your application.\n   *\n   * @example 'vercel-session'\n   */\n  cookieName: string;\n\n  /**\n   * The password(s) that will be used to encrypt the cookie. Can either be a string\n   * or an object.\n   *\n   * When you provide multiple passwords then all of them will be used to decrypt\n   * the cookie. But only the most recent (`= highest key`, `2` in the example)\n   * password will be used to encrypt the cookie. This allows password rotation.\n   *\n   * @example { 1: 'password-1', 2: 'password-2' }\n   */\n  password: Password;\n\n  /**\n   * The time (in seconds) that the session will be valid for. Also sets the\n   * `max-age` attribute of the cookie automatically (`= ttl - 60s`, so that the\n   * cookie always expire before the session).\n   *\n   * `ttl = 0` means no expiration.\n   *\n   * @default 1209600\n   */\n  ttl?: number;\n\n  /**\n   * The options that will be passed to the cookie library.\n   *\n   * If you want to use \"session cookies\" (cookies that are deleted when the browser\n   * is closed) then you need to pass `cookieOptions: { maxAge: undefined }`\n   *\n   * @see https://github.com/jshttp/cookie#options-1\n   */\n  cookieOptions?: CookieOptions;\n}\n\nexport type IronSession<T> = T & {\n  /**\n   * Encrypts the session data and sets the cookie.\n   */\n  readonly save: () => Promise<void>;\n\n  /**\n   * Destroys the session data and removes the cookie.\n   */\n  readonly destroy: () => Promise<void>;\n\n  /**\n   * Update the session configuration. You still need to call save() to send the new cookie.\n   */\n  readonly updateConfig: (newSessionOptions: SessionOptions) => void;\n};\n\n// default time allowed to check for iron seal validity when ttl passed\n// see https://hapi.dev/module/iron/api/?v=7.0.1#options\nconst timestampSkewSec = 60;\nconst fourteenDaysInSeconds = 14 * 24 * 3600;\n\n// We store a token major version to handle data format changes so that the cookies\n// can be kept alive between upgrades, no need to disconnect everyone.\nconst currentMajorVersion = 2;\nconst versionDelimiter = \"~\";\n\nconst defaultOptions: Required<Pick<SessionOptions, \"ttl\" | \"cookieOptions\">> =\n  {\n    ttl: fourteenDaysInSeconds,\n    cookieOptions: { httpOnly: true, secure: true, sameSite: \"lax\", path: \"/\" },\n  };\n\nfunction normalizeStringPasswordToMap(password: Password): PasswordsMap {\n  return typeof password === \"string\" ? { 1: password } : password;\n}\n\nfunction parseSeal(seal: string): {\n  sealWithoutVersion: string;\n  tokenVersion: number | null;\n} {\n  const [sealWithoutVersion, tokenVersionAsString] =\n    seal.split(versionDelimiter);\n  const tokenVersion =\n    tokenVersionAsString == null ? null : parseInt(tokenVersionAsString, 10);\n\n  // eslint-disable-next-line @typescript-eslint/no-non-null-assertion\n  return { sealWithoutVersion: sealWithoutVersion!, tokenVersion };\n}\n\nfunction computeCookieMaxAge(ttl: number): number {\n  if (ttl === 0) {\n    // ttl = 0 means no expiration\n    // but in reality cookies have to expire (can't have no max-age)\n    // 2147483647 is the max value for max-age in cookies\n    // see https://stackoverflow.com/a/11685301/147079\n    return 2147483647;\n  }\n\n  // The next line makes sure browser will expire cookies before seals are considered expired by the server.\n  // It also allows for clock difference of 60 seconds between server and clients.\n  return ttl - timestampSkewSec;\n}\n\nfunction getCookie(req: RequestType, cookieName: string): string {\n  return (\n    parse(\n      (\"headers\" in req && typeof req.headers.get === \"function\"\n        ? req.headers.get(\"cookie\")\n        : (req as IncomingMessage).headers.cookie) ?? \"\",\n    )[cookieName] ?? \"\"\n  );\n}\n\nfunction getServerActionCookie(\n  cookieName: string,\n  cookieHandler: CookieStore,\n): string {\n  const cookieObject = cookieHandler.get(cookieName);\n  const cookie = cookieObject?.value;\n  if (typeof cookie === \"string\") {\n    return cookie;\n  }\n  return \"\";\n}\n\nfunction setCookie(res: ResponseType, cookieValue: string): void {\n  if (\"headers\" in res && typeof res.headers.append === \"function\") {\n    res.headers.append(\"set-cookie\", cookieValue);\n    return;\n  }\n  let existingSetCookie = (res as ServerResponse).getHeader(\"set-cookie\") ?? [];\n  if (!Array.isArray(existingSetCookie)) {\n    existingSetCookie = [existingSetCookie.toString()];\n  }\n  (res as ServerResponse).setHeader(\"set-cookie\", [\n    ...existingSetCookie,\n    cookieValue,\n  ]);\n}\n\nexport function createSealData(_crypto: Crypto) {\n  return async function sealData(\n    data: unknown,\n    {\n      password,\n      ttl = fourteenDaysInSeconds,\n    }: { password: Password; ttl?: number },\n  ): Promise<string> {\n    const passwordsMap = normalizeStringPasswordToMap(password);\n\n    const mostRecentPasswordId = Math.max(\n      ...Object.keys(passwordsMap).map(Number),\n    );\n    const passwordForSeal = {\n      id: mostRecentPasswordId.toString(),\n      secret: passwordsMap[mostRecentPasswordId]!,\n    };\n\n    const seal = await ironSeal(_crypto, data, passwordForSeal, {\n      ...ironDefaults,\n      ttl: ttl * 1000,\n    });\n\n    return `${seal}${versionDelimiter}${currentMajorVersion}`;\n  };\n}\n\nexport function createUnsealData(_crypto: Crypto) {\n  return async function unsealData<T>(\n    seal: string,\n    {\n      password,\n      ttl = fourteenDaysInSeconds,\n    }: { password: Password; ttl?: number },\n  ): Promise<T> {\n    const passwordsMap = normalizeStringPasswordToMap(password);\n    const { sealWithoutVersion, tokenVersion } = parseSeal(seal);\n\n    try {\n      const data =\n        (await ironUnseal(_crypto, sealWithoutVersion, passwordsMap, {\n          ...ironDefaults,\n          ttl: ttl * 1000,\n        })) ?? {};\n\n      if (tokenVersion === 2) {\n        return data as T;\n      }\n\n      // @ts-expect-error `persistent` does not exist on newer tokens\n      return { ...data.persistent } as T;\n    } catch (error) {\n      if (\n        error instanceof Error &&\n        /^(Expired seal|Bad hmac value|Cannot find password|Incorrect number of sealed components)/.test(\n          error.message,\n        )\n      ) {\n        // if seal expired or\n        // if seal is not valid (encrypted using a different password, when passwords are badly rotated) or\n        // if we can't find back the password in the seal\n        // then we just start a new session over\n        return {} as T;\n      }\n\n      throw error;\n    }\n  };\n}\n\nfunction getSessionConfig(\n  sessionOptions: SessionOptions,\n): Required<SessionOptions> {\n  const options = {\n    ...defaultOptions,\n    ...sessionOptions,\n    cookieOptions: {\n      ...defaultOptions.cookieOptions,\n      ...(sessionOptions.cookieOptions || {}),\n    },\n  };\n\n  if (\n    sessionOptions.cookieOptions &&\n    \"maxAge\" in sessionOptions.cookieOptions\n  ) {\n    if (sessionOptions.cookieOptions.maxAge === undefined) {\n      // session cookies, do not set maxAge, consider token as infinite\n      options.ttl = 0;\n    }\n  } else {\n    options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);\n  }\n\n  return options;\n}\n\nconst badUsageMessage =\n  \"iron-session: Bad usage: use getIronSession(req, res, options) or getIronSession(cookieStore, options).\";\n\nexport function createGetIronSession(\n  sealData: ReturnType<typeof createSealData>,\n  unsealData: ReturnType<typeof createUnsealData>,\n) {\n  return getIronSession;\n\n  async function getIronSession<T extends object>(\n    cookies: CookieStore,\n    sessionOptions: SessionOptions,\n  ): Promise<IronSession<T>>;\n  async function getIronSession<T extends object>(\n    req: RequestType,\n    res: ResponseType,\n    sessionOptions: SessionOptions,\n  ): Promise<IronSession<T>>;\n  async function getIronSession<T extends object>(\n    reqOrCookieStore: RequestType | CookieStore,\n    resOrsessionOptions: ResponseType | SessionOptions,\n    sessionOptions?: SessionOptions,\n  ): Promise<IronSession<T>> {\n    if (!reqOrCookieStore) {\n      throw new Error(badUsageMessage);\n    }\n\n    if (!resOrsessionOptions) {\n      throw new Error(badUsageMessage);\n    }\n\n    if (!sessionOptions) {\n      return getIronSessionFromCookieStore<T>(\n        reqOrCookieStore as CookieStore,\n        resOrsessionOptions as SessionOptions,\n        sealData,\n        unsealData,\n      );\n    }\n\n    const req = reqOrCookieStore as RequestType;\n    const res = resOrsessionOptions as ResponseType;\n\n    if (!sessionOptions) {\n      throw new Error(badUsageMessage);\n    }\n\n    if (!sessionOptions.cookieName) {\n      throw new Error(\"iron-session: Bad usage. Missing cookie name.\");\n    }\n\n    if (!sessionOptions.password) {\n      throw new Error(\"iron-session: Bad usage. Missing password.\");\n    }\n\n    const passwordsMap = normalizeStringPasswordToMap(sessionOptions.password);\n\n    if (Object.values(passwordsMap).some((password) => password.length < 32)) {\n      throw new Error(\n        \"iron-session: Bad usage. Password must be at least 32 characters long.\",\n      );\n    }\n\n    let sessionConfig = getSessionConfig(sessionOptions);\n\n    const sealFromCookies = getCookie(req, sessionConfig.cookieName);\n    const session = sealFromCookies\n      ? await unsealData<T>(sealFromCookies, {\n          password: passwordsMap,\n          ttl: sessionConfig.ttl,\n        })\n      : ({} as T);\n\n    Object.defineProperties(session, {\n      updateConfig: {\n        value: function updateConfig(newSessionOptions: SessionOptions) {\n          sessionConfig = getSessionConfig(newSessionOptions);\n        },\n      },\n      save: {\n        value: async function save() {\n          if (\"headersSent\" in res && res.headersSent) {\n            throw new Error(\n              \"iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()\",\n            );\n          }\n\n          const seal = await sealData(session, {\n            password: passwordsMap,\n            ttl: sessionConfig.ttl,\n          });\n          const cookieValue = serialize(\n            sessionConfig.cookieName,\n            seal,\n            sessionConfig.cookieOptions,\n          );\n\n          if (cookieValue.length > 4096) {\n            throw new Error(\n              `iron-session: Cookie length is too big (${cookieValue.length} bytes), browsers will refuse it. Try to remove some data.`,\n            );\n          }\n\n          setCookie(res, cookieValue);\n        },\n      },\n\n      destroy: {\n        value: function destroy() {\n          Object.keys(session).forEach((key) => {\n            delete (session as Record<string, unknown>)[key];\n          });\n          const cookieValue = serialize(sessionConfig.cookieName, \"\", {\n            ...sessionConfig.cookieOptions,\n            maxAge: 0,\n          });\n\n          setCookie(res, cookieValue);\n        },\n      },\n    });\n\n    return session as IronSession<T>;\n  }\n}\n\nasync function getIronSessionFromCookieStore<T extends object>(\n  cookieStore: CookieStore,\n  sessionOptions: SessionOptions,\n  sealData: ReturnType<typeof createSealData>,\n  unsealData: ReturnType<typeof createUnsealData>,\n): Promise<IronSession<T>> {\n  if (!sessionOptions.cookieName) {\n    throw new Error(\"iron-session: Bad usage. Missing cookie name.\");\n  }\n\n  if (!sessionOptions.password) {\n    throw new Error(\"iron-session: Bad usage. Missing password.\");\n  }\n\n  const passwordsMap = normalizeStringPasswordToMap(sessionOptions.password);\n\n  if (Object.values(passwordsMap).some((password) => password.length < 32)) {\n    throw new Error(\n      \"iron-session: Bad usage. Password must be at least 32 characters long.\",\n    );\n  }\n\n  const sessionConfig = getSessionConfig(sessionOptions);\n  const sealFromCookies = getServerActionCookie(\n    sessionConfig.cookieName,\n    cookieStore,\n  );\n  const session = sealFromCookies\n    ? await unsealData<T>(sealFromCookies, {\n        password: passwordsMap,\n        ttl: sessionConfig.ttl,\n      })\n    : ({} as T);\n\n  Object.defineProperties(session, {\n    save: {\n      value: async function save() {\n        const seal = await sealData(session, {\n          password: passwordsMap,\n          ttl: sessionConfig.ttl,\n        });\n\n        const cookieLength =\n          sessionConfig.cookieName.length +\n          seal.length +\n          JSON.stringify(sessionConfig.cookieOptions).length;\n\n        if (cookieLength > 4096) {\n          throw new Error(\n            `iron-session: Cookie length is too big (${cookieLength} bytes), browsers will refuse it. Try to remove some data.`,\n          );\n        }\n\n        cookieStore.set(\n          sessionConfig.cookieName,\n          seal,\n          sessionConfig.cookieOptions,\n        );\n      },\n    },\n\n    destroy: {\n      value: function destroy() {\n        Object.keys(session).forEach((key) => {\n          delete (session as Record<string, unknown>)[key];\n        });\n\n        const cookieOptions = { ...sessionConfig.cookieOptions, maxAge: 0 };\n        cookieStore.set(sessionConfig.cookieName, \"\", cookieOptions);\n      },\n    },\n  });\n\n  return session as IronSession<T>;\n}\n","import {\n  createGetIronSession,\n  createSealData,\n  createUnsealData,\n} from \"./core.js\";\n\nimport * as crypto from \"uncrypto\";\n\nexport type { IronSession, SessionOptions } from \"./core.js\";\nexport const sealData = createSealData(crypto);\nexport const unsealData = createUnsealData(crypto);\nexport const getIronSession = createGetIronSession(sealData, unsealData);\n"]}

package/dist/index.d.cts

@@ -1,11 +1,8 @@
 import * as http from 'http';
-import { IncomingMessage, ServerResponse } from 'http';
 import { CookieSerializeOptions } from 'cookie';
 
 type PasswordsMap = Record<string, string>;
 type Password = PasswordsMap | string;
-type RequestType = IncomingMessage | Request;
-type ResponseType = Response | ServerResponse;
 /**
  * {@link https://wicg.github.io/cookie-store/#dictdef-cookielistitem CookieListItem}
  * as specified by W3C.
@@ -83,28 +80,19 @@ interface SessionOptions {
      */
     cookieOptions?: CookieOptions;
 }
-type OverridableOptions = Pick<SessionOptions, "cookieOptions" | "ttl">;
 type IronSession<T> = T & {
+    /**
+     * Encrypts the session data and sets the cookie.
+     */
+    readonly save: () => Promise<void>;
     /**
      * Destroys the session data and removes the cookie.
      */
-    readonly destroy: (destroyOptions?: OverridableOptions) => Promise<void>;
+    readonly destroy: () => Promise<void>;
     /**
-     * Encrypts the session data and sets the cookie.
+     * Update the session configuration. You still need to call save() to send the new cookie.
      */
-    readonly save: (saveOptions?: OverridableOptions) => Promise<void>;
-};
-declare function createSealData(_crypto: Crypto): (data: unknown, { password, ttl, }: {
-    password: Password;
-    ttl?: number;
-}) => Promise<string>;
-declare function createUnsealData(_crypto: Crypto): <T>(seal: string, { password, ttl, }: {
-    password: Password;
-    ttl?: number;
-}) => Promise<T>;
-declare function createGetIronSession(sealData: ReturnType<typeof createSealData>, unsealData: ReturnType<typeof createUnsealData>): {
-    <T extends object>(cookies: CookieStore, sessionOptions: SessionOptions): Promise<IronSession<T>>;
-    <T_1 extends object>(req: RequestType, res: ResponseType, sessionOptions: SessionOptions): Promise<IronSession<T_1>>;
+    readonly updateConfig: (newSessionOptions: SessionOptions) => void;
 };
 
 declare const sealData: (data: unknown, { password, ttl, }: {
@@ -124,4 +112,4 @@ declare const getIronSession: {
     <T_1 extends object>(req: http.IncomingMessage | Request, res: Response | http.ServerResponse<http.IncomingMessage>, sessionOptions: SessionOptions): Promise<IronSession<T_1>>;
 };
 
-export { CookieStore, IronSession, SessionOptions, createGetIronSession, createSealData, createUnsealData, getIronSession, sealData, unsealData };
+export { type IronSession, type SessionOptions, getIronSession, sealData, unsealData };

package/dist/index.d.ts

@@ -1,11 +1,8 @@
 import * as http from 'http';
-import { IncomingMessage, ServerResponse } from 'http';
 import { CookieSerializeOptions } from 'cookie';
 
 type PasswordsMap = Record<string, string>;
 type Password = PasswordsMap | string;
-type RequestType = IncomingMessage | Request;
-type ResponseType = Response | ServerResponse;
 /**
  * {@link https://wicg.github.io/cookie-store/#dictdef-cookielistitem CookieListItem}
  * as specified by W3C.
@@ -83,28 +80,19 @@ interface SessionOptions {
      */
     cookieOptions?: CookieOptions;
 }
-type OverridableOptions = Pick<SessionOptions, "cookieOptions" | "ttl">;
 type IronSession<T> = T & {
+    /**
+     * Encrypts the session data and sets the cookie.
+     */
+    readonly save: () => Promise<void>;
     /**
      * Destroys the session data and removes the cookie.
      */
-    readonly destroy: (destroyOptions?: OverridableOptions) => Promise<void>;
+    readonly destroy: () => Promise<void>;
     /**
-     * Encrypts the session data and sets the cookie.
+     * Update the session configuration. You still need to call save() to send the new cookie.
      */
-    readonly save: (saveOptions?: OverridableOptions) => Promise<void>;
-};
-declare function createSealData(_crypto: Crypto): (data: unknown, { password, ttl, }: {
-    password: Password;
-    ttl?: number;
-}) => Promise<string>;
-declare function createUnsealData(_crypto: Crypto): <T>(seal: string, { password, ttl, }: {
-    password: Password;
-    ttl?: number;
-}) => Promise<T>;
-declare function createGetIronSession(sealData: ReturnType<typeof createSealData>, unsealData: ReturnType<typeof createUnsealData>): {
-    <T extends object>(cookies: CookieStore, sessionOptions: SessionOptions): Promise<IronSession<T>>;
-    <T_1 extends object>(req: RequestType, res: ResponseType, sessionOptions: SessionOptions): Promise<IronSession<T_1>>;
+    readonly updateConfig: (newSessionOptions: SessionOptions) => void;
 };
 
 declare const sealData: (data: unknown, { password, ttl, }: {
@@ -124,4 +112,4 @@ declare const getIronSession: {
     <T_1 extends object>(req: http.IncomingMessage | Request, res: Response | http.ServerResponse<http.IncomingMessage>, sessionOptions: SessionOptions): Promise<IronSession<T_1>>;
 };
 
-export { CookieStore, IronSession, SessionOptions, createGetIronSession, createSealData, createUnsealData, getIronSession, sealData, unsealData };
+export { type IronSession, type SessionOptions, getIronSession, sealData, unsealData };

package/dist/index.js

@@ -63,7 +63,6 @@ function createSealData(_crypto) {
     );
     const passwordForSeal = {
       id: mostRecentPasswordId.toString(),
-      // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
       secret: passwordsMap[mostRecentPasswordId]
     };
     const seal$1 = await seal(_crypto, data, passwordForSeal, {
@@ -99,15 +98,13 @@ function createUnsealData(_crypto) {
     }
   };
 }
-function mergeOptions(sessionOptions, overrides) {
+function getSessionConfig(sessionOptions) {
   const options = {
     ...defaultOptions,
     ...sessionOptions,
-    ...overrides,
     cookieOptions: {
       ...defaultOptions.cookieOptions,
-      ...sessionOptions.cookieOptions,
-      ...overrides?.cookieOptions
+      ...sessionOptions.cookieOptions || {}
     }
   };
   if (sessionOptions.cookieOptions && "maxAge" in sessionOptions.cookieOptions) {
@@ -119,7 +116,7 @@ function mergeOptions(sessionOptions, overrides) {
   }
   return options;
 }
-var badUsageMessage = "iron-session: Bad usage: use getIronSession(req, res, options) or getIronSession(cookies, options).";
+var badUsageMessage = "iron-session: Bad usage: use getIronSession(req, res, options) or getIronSession(cookieStore, options).";
 function createGetIronSession(sealData2, unsealData2) {
   return getIronSession2;
   async function getIronSession2(reqOrCookieStore, resOrsessionOptions, sessionOptions) {
@@ -140,7 +137,7 @@ function createGetIronSession(sealData2, unsealData2) {
     const req = reqOrCookieStore;
     const res = resOrsessionOptions;
     if (!sessionOptions) {
-      throw new Error("iron-session: Bad usage. Missing options.");
+      throw new Error(badUsageMessage);
     }
     if (!sessionOptions.cookieName) {
       throw new Error("iron-session: Bad usage. Missing cookie name.");
@@ -154,29 +151,33 @@ function createGetIronSession(sealData2, unsealData2) {
         "iron-session: Bad usage. Password must be at least 32 characters long."
       );
     }
-    const options = mergeOptions(sessionOptions);
-    const sealFromCookies = getCookie(req, options.cookieName);
+    let sessionConfig = getSessionConfig(sessionOptions);
+    const sealFromCookies = getCookie(req, sessionConfig.cookieName);
     const session = sealFromCookies ? await unsealData2(sealFromCookies, {
       password: passwordsMap,
-      ttl: options.ttl
+      ttl: sessionConfig.ttl
     }) : {};
     Object.defineProperties(session, {
+      updateConfig: {
+        value: function updateConfig(newSessionOptions) {
+          sessionConfig = getSessionConfig(newSessionOptions);
+        }
+      },
       save: {
-        value: async function save(saveOptions) {
+        value: async function save() {
           if ("headersSent" in res && res.headersSent) {
             throw new Error(
               "iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()"
             );
           }
-          const mergedOptions = mergeOptions(sessionOptions, saveOptions);
           const seal = await sealData2(session, {
             password: passwordsMap,
-            ttl: mergedOptions.ttl
+            ttl: sessionConfig.ttl
           });
           const cookieValue = serialize(
-            mergedOptions.cookieName,
+            sessionConfig.cookieName,
             seal,
-            mergedOptions.cookieOptions
+            sessionConfig.cookieOptions
           );
           if (cookieValue.length > 4096) {
             throw new Error(
@@ -187,13 +188,12 @@ function createGetIronSession(sealData2, unsealData2) {
         }
       },
       destroy: {
-        value: async function destroy(destroyOptions) {
+        value: function destroy() {
           Object.keys(session).forEach((key) => {
             delete session[key];
           });
-          const mergedOptions = mergeOptions(sessionOptions, destroyOptions);
-          const cookieValue = serialize(mergedOptions.cookieName, "", {
-            ...mergedOptions.cookieOptions,
+          const cookieValue = serialize(sessionConfig.cookieName, "", {
+            ...sessionConfig.cookieOptions,
             maxAge: 0
           });
           setCookie(res, cookieValue);
@@ -204,9 +204,6 @@ function createGetIronSession(sealData2, unsealData2) {
   }
 }
 async function getIronSessionFromCookieStore(cookieStore, sessionOptions, sealData2, unsealData2) {
-  if (!sessionOptions) {
-    throw new Error("iron-session: Bad usage. Missing options.");
-  }
   if (!sessionOptions.cookieName) {
     throw new Error("iron-session: Bad usage. Missing cookie name.");
   }
@@ -219,44 +216,42 @@ async function getIronSessionFromCookieStore(cookieStore, sessionOptions, sealDa
       "iron-session: Bad usage. Password must be at least 32 characters long."
     );
   }
-  const options = mergeOptions(sessionOptions);
+  const sessionConfig = getSessionConfig(sessionOptions);
   const sealFromCookies = getServerActionCookie(
-    options.cookieName,
+    sessionConfig.cookieName,
     cookieStore
   );
   const session = sealFromCookies ? await unsealData2(sealFromCookies, {
     password: passwordsMap,
-    ttl: options.ttl
+    ttl: sessionConfig.ttl
   }) : {};
   Object.defineProperties(session, {
     save: {
-      value: async function save(saveOptions) {
-        const mergedOptions = mergeOptions(sessionOptions, saveOptions);
+      value: async function save() {
         const seal = await sealData2(session, {
           password: passwordsMap,
-          ttl: mergedOptions.ttl
+          ttl: sessionConfig.ttl
         });
-        const cookieLength = mergedOptions.cookieName.length + seal.length + JSON.stringify(mergedOptions.cookieOptions).length;
+        const cookieLength = sessionConfig.cookieName.length + seal.length + JSON.stringify(sessionConfig.cookieOptions).length;
         if (cookieLength > 4096) {
           throw new Error(
             `iron-session: Cookie length is too big (${cookieLength} bytes), browsers will refuse it. Try to remove some data.`
           );
         }
         cookieStore.set(
-          mergedOptions.cookieName,
+          sessionConfig.cookieName,
           seal,
-          mergedOptions.cookieOptions
+          sessionConfig.cookieOptions
         );
       }
     },
     destroy: {
-      value: async function destroy(destroyOptions) {
+      value: function destroy() {
         Object.keys(session).forEach((key) => {
           delete session[key];
         });
-        const mergedOptions = mergeOptions(sessionOptions, destroyOptions);
-        const cookieOptions = { ...mergedOptions.cookieOptions, maxAge: 0 };
-        cookieStore.set(mergedOptions.cookieName, "", cookieOptions);
+        const cookieOptions = { ...sessionConfig.cookieOptions, maxAge: 0 };
+        cookieStore.set(sessionConfig.cookieName, "", cookieOptions);
       }
     }
   });
@@ -266,6 +261,6 @@ var sealData = createSealData(crypto);
 var unsealData = createUnsealData(crypto);
 var getIronSession = createGetIronSession(sealData, unsealData);
 
-export { createGetIronSession, createSealData, createUnsealData, getIronSession, sealData, unsealData };
+export { getIronSession, sealData, unsealData };
 //# sourceMappingURL=out.js.map
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/core.ts","../src/index.ts"],"names":["sealData","unsealData","getIronSession"],"mappings":";AACA,SAAS,OAAO,iBAA8C;AAC9D;AAAA,EACE,YAAY;AAAA,EACZ,QAAQ;AAAA,EACR,UAAU;AAAA,OACL;AA8GP,IAAM,mBAAmB;AACzB,IAAM,wBAAwB,KAAK,KAAK;AAIxC,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AAEzB,IAAM,iBAA+C;AAAA,EACnD,KAAK;AAAA,EACL,eAAe,EAAE,UAAU,MAAM,QAAQ,MAAM,UAAU,OAAO,MAAM,IAAI;AAC5E;AAEA,SAAS,6BAA6B,UAAkC;AACtE,SAAO,OAAO,aAAa,WAAW,EAAE,GAAG,SAAS,IAAI;AAC1D;AAEA,SAAS,UAAU,MAGjB;AACA,QAAM,CAAC,oBAAoB,oBAAoB,IAC7C,KAAK,MAAM,gBAAgB;AAC7B,QAAM,eACJ,wBAAwB,OAAO,OAAO,SAAS,sBAAsB,EAAE;AAGzE,SAAO,EAAE,oBAAyC,aAAa;AACjE;AAEA,SAAS,oBAAoB,KAAqB;AAChD,MAAI,QAAQ,GAAG;AAKb,WAAO;AAAA,EACT;AAIA,SAAO,MAAM;AACf;AAEA,SAAS,UAAU,KAAkB,YAA4B;AAC/D,SACE;AAAA,KACG,aAAa,OAAO,OAAO,IAAI,QAAQ,QAAQ,aAC5C,IAAI,QAAQ,IAAI,QAAQ,IACvB,IAAwB,QAAQ,WAAW;AAAA,EAClD,EAAE,UAAU,KAAK;AAErB;AAEA,SAAS,sBACP,YACA,eACQ;AACR,QAAM,eAAe,cAAc,IAAI,UAAU;AACjD,QAAM,SAAS,cAAc;AAC7B,MAAI,OAAO,WAAW,UAAU;AAC9B,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,UAAU,KAAmB,aAA2B;AAC/D,MAAI,aAAa,OAAO,OAAO,IAAI,QAAQ,WAAW,YAAY;AAChE,QAAI,QAAQ,OAAO,cAAc,WAAW;AAC5C;AAAA,EACF;AACA,MAAI,oBAAqB,IAAuB,UAAU,YAAY,KAAK,CAAC;AAC5E,MAAI,CAAC,MAAM,QAAQ,iBAAiB,GAAG;AACrC,wBAAoB,CAAC,kBAAkB,SAAS,CAAC;AAAA,EACnD;AACA,EAAC,IAAuB,UAAU,cAAc;AAAA,IAC9C,GAAG;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAEO,SAAS,eAAe,SAAiB;AAC9C,SAAO,eAAeA,UACpB,MACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,GACiB;AACjB,UAAM,eAAe,6BAA6B,QAAQ;AAE1D,UAAM,uBAAuB,KAAK;AAAA,MAChC,GAAG,OAAO,KAAK,YAAY,EAAE,IAAI,MAAM;AAAA,IACzC;AACA,UAAM,kBAAkB;AAAA,MACtB,IAAI,qBAAqB,SAAS;AAAA;AAAA,MAElC,QAAQ,aAAa,oBAAoB;AAAA,IAC3C;AAEA,UAAM,OAAO,MAAM,SAAS,SAAS,MAAM,iBAAiB;AAAA,MAC1D,GAAG;AAAA,MACH,KAAK,MAAM;AAAA,IACb,CAAC;AAED,WAAO,GAAG,IAAI,GAAG,gBAAgB,GAAG,mBAAmB;AAAA,EACzD;AACF;AAEO,SAAS,iBAAiB,SAAiB;AAChD,SAAO,eAAeC,YACpB,MACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,GACY;AACZ,UAAM,eAAe,6BAA6B,QAAQ;AAC1D,UAAM,EAAE,oBAAoB,aAAa,IAAI,UAAU,IAAI;AAE3D,QAAI;AACF,YAAM,OACH,MAAM,WAAW,SAAS,oBAAoB,cAAc;AAAA,QAC3D,GAAG;AAAA,QACH,KAAK,MAAM;AAAA,MACb,CAAC,KAA2B,CAAC;AAE/B,UAAI,iBAAiB,GAAG;AACtB,eAAO;AAAA,MACT;AAGA,aAAO,EAAE,GAAG,KAAK,WAAW;AAAA,IAC9B,SAAS,OAAO;AACd,UACE,iBAAiB,SACjB,4FAA4F;AAAA,QAC1F,MAAM;AAAA,MACR,GACA;AAKA,eAAO,CAAC;AAAA,MACV;AAGA,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,aACP,gBACA,WAC0B;AAC1B,QAAM,UAAoC;AAAA,IACxC,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAG;AAAA,IACH,eAAe;AAAA,MACb,GAAG,eAAe;AAAA,MAClB,GAAG,eAAe;AAAA,MAClB,GAAG,WAAW;AAAA,IAChB;AAAA,EACF;AAEA,MACE,eAAe,iBACf,YAAY,eAAe,eAC3B;AACA,QAAI,eAAe,cAAc,WAAW,QAAW;AAErD,cAAQ,MAAM;AAAA,IAChB;AAAA,EACF,OAAO;AACL,YAAQ,cAAc,SAAS,oBAAoB,QAAQ,GAAG;AAAA,EAChE;AAEA,SAAO;AACT;AAEA,IAAM,kBACJ;AAEK,SAAS,qBACdD,WACAC,aACA;AACA,SAAOC;AAWP,iBAAeA,gBACb,kBACA,qBACA,gBACyB;AACzB,QAAI,CAAC,kBAAkB;AACrB,YAAM,IAAI,MAAM,eAAe;AAAA,IACjC;AAEA,QAAI,CAAC,qBAAqB;AACxB,YAAM,IAAI,MAAM,eAAe;AAAA,IACjC;AAEA,QAAI,CAAC,gBAAgB;AACnB,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACAF;AAAA,QACAC;AAAA,MACF;AAAA,IACF;AAEA,UAAM,MAAM;AACZ,UAAM,MAAM;AAEZ,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,MAAM,2CAA2C;AAAA,IAC7D;AAEA,QAAI,CAAC,eAAe,YAAY;AAC9B,YAAM,IAAI,MAAM,+CAA+C;AAAA,IACjE;AAEA,QAAI,CAAC,eAAe,UAAU;AAC5B,YAAM,IAAI,MAAM,4CAA4C;AAAA,IAC9D;AAEA,UAAM,eAAe,6BAA6B,eAAe,QAAQ;AAEzE,QAAI,OAAO,OAAO,YAAY,EAAE,KAAK,CAAC,aAAa,SAAS,SAAS,EAAE,GAAG;AACxE,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,UAAU,aAAa,cAAc;AAC3C,UAAM,kBAAkB,UAAU,KAAK,QAAQ,UAAU;AACzD,UAAM,UAAU,kBACZ,MAAMA,YAAc,iBAAiB;AAAA,MACnC,UAAU;AAAA,MACV,KAAK,QAAQ;AAAA,IACf,CAAC,IACA,CAAC;AAEN,WAAO,iBAAiB,SAAS;AAAA,MAC/B,MAAM;AAAA,QACJ,OAAO,eAAe,KAAK,aAAkC;AAC3D,cAAI,iBAAiB,OAAO,IAAI,aAAa;AAC3C,kBAAM,IAAI;AAAA,cACR;AAAA,YACF;AAAA,UACF;AAEA,gBAAM,gBAAgB,aAAa,gBAAgB,WAAW;AAC9D,gBAAM,OAAO,MAAMD,UAAS,SAAS;AAAA,YACnC,UAAU;AAAA,YACV,KAAK,cAAc;AAAA,UACrB,CAAC;AACD,gBAAM,cAAc;AAAA,YAClB,cAAc;AAAA,YACd;AAAA,YACA,cAAc;AAAA,UAChB;AAEA,cAAI,YAAY,SAAS,MAAM;AAC7B,kBAAM,IAAI;AAAA,cACR,2CAA2C,YAAY,MAAM;AAAA,YAC/D;AAAA,UACF;AAEA,oBAAU,KAAK,WAAW;AAAA,QAC5B;AAAA,MACF;AAAA,MAEA,SAAS;AAAA,QACP,OAAO,eAAe,QAAQ,gBAAqC;AACjE,iBAAO,KAAK,OAAO,EAAE,QAAQ,CAAC,QAAQ;AACpC,mBAAQ,QAAoC,GAAG;AAAA,UACjD,CAAC;AAED,gBAAM,gBAAgB,aAAa,gBAAgB,cAAc;AACjE,gBAAM,cAAc,UAAU,cAAc,YAAY,IAAI;AAAA,YAC1D,GAAG,cAAc;AAAA,YACjB,QAAQ;AAAA,UACV,CAAC;AAED,oBAAU,KAAK,WAAW;AAAA,QAC5B;AAAA,MACF;AAAA,IACF,CAAC;AAED,WAAO;AAAA,EACT;AACF;AAEA,eAAe,8BACb,aACA,gBACAA,WACAC,aACyB;AACzB,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,MAAM,2CAA2C;AAAA,EAC7D;AAEA,MAAI,CAAC,eAAe,YAAY;AAC9B,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AAEA,MAAI,CAAC,eAAe,UAAU;AAC5B,UAAM,IAAI,MAAM,4CAA4C;AAAA,EAC9D;AAEA,QAAM,eAAe,6BAA6B,eAAe,QAAQ;AAEzE,MAAI,OAAO,OAAO,YAAY,EAAE,KAAK,CAAC,aAAa,SAAS,SAAS,EAAE,GAAG;AACxE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU,aAAa,cAAc;AAC3C,QAAM,kBAAkB;AAAA,IACtB,QAAQ;AAAA,IACR;AAAA,EACF;AACA,QAAM,UAAU,kBACZ,MAAMA,YAAc,iBAAiB;AAAA,IACnC,UAAU;AAAA,IACV,KAAK,QAAQ;AAAA,EACf,CAAC,IACA,CAAC;AAEN,SAAO,iBAAiB,SAAS;AAAA,IAC/B,MAAM;AAAA,MACJ,OAAO,eAAe,KAAK,aAAkC;AAC3D,cAAM,gBAAgB,aAAa,gBAAgB,WAAW;AAC9D,cAAM,OAAO,MAAMD,UAAS,SAAS;AAAA,UACnC,UAAU;AAAA,UACV,KAAK,cAAc;AAAA,QACrB,CAAC;AAED,cAAM,eACJ,cAAc,WAAW,SACzB,KAAK,SACL,KAAK,UAAU,cAAc,aAAa,EAAE;AAE9C,YAAI,eAAe,MAAM;AACvB,gBAAM,IAAI;AAAA,YACR,2CAA2C,YAAY;AAAA,UACzD;AAAA,QACF;AAEA,oBAAY;AAAA,UACV,cAAc;AAAA,UACd;AAAA,UACA,cAAc;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAAA,IAEA,SAAS;AAAA,MACP,OAAO,eAAe,QAAQ,gBAAoC;AAChE,eAAO,KAAK,OAAO,EAAE,QAAQ,CAAC,QAAQ;AACpC,iBAAQ,QAAoC,GAAG;AAAA,QACjD,CAAC;AACD,cAAM,gBAAgB,aAAa,gBAAgB,cAAc;AACjE,cAAM,gBAAgB,EAAE,GAAG,cAAc,eAAe,QAAQ,EAAE;AAElE,oBAAY,IAAI,cAAc,YAAY,IAAI,aAAa;AAAA,MAC7D;AAAA,IACF;AAAA,EACF,CAAC;AAED,SAAO;AACT;;;AChfA,YAAY,YAAY;AAGjB,IAAM,WAAW,eAAe,MAAM;AACtC,IAAM,aAAa,iBAAiB,MAAM;AAC1C,IAAM,iBAAiB,qBAAqB,UAAU,UAAU","sourcesContent":["import type { IncomingMessage, ServerResponse } from \"http\";\nimport { parse, serialize, type CookieSerializeOptions } from \"cookie\";\nimport {\n  defaults as ironDefaults,\n  seal as ironSeal,\n  unseal as ironUnseal,\n} from \"iron-webcrypto\";\n\ntype PasswordsMap = Record<string, string>;\ntype Password = PasswordsMap | string;\ntype RequestType = IncomingMessage | Request;\ntype ResponseType = Response | ServerResponse;\n\n/**\n * {@link https://wicg.github.io/cookie-store/#dictdef-cookielistitem CookieListItem}\n * as specified by W3C.\n */\ninterface CookieListItem\n  extends Pick<\n    CookieSerializeOptions,\n    \"domain\" | \"path\" | \"sameSite\" | \"secure\"\n  > {\n  /** A string with the name of a cookie. */\n  name: string;\n  /** A string containing the value of the cookie. */\n  value: string;\n  /** A number of milliseconds or Date interface containing the expires of the cookie. */\n  expires?: CookieSerializeOptions[\"expires\"] | number;\n}\n\n/**\n * Superset of {@link CookieListItem} extending it with\n * the `httpOnly`, `maxAge` and `priority` properties.\n */\ntype ResponseCookie = CookieListItem &\n  Pick<CookieSerializeOptions, \"httpOnly\" | \"maxAge\" | \"priority\">;\n\n/**\n * The high-level type definition of the .get() and .set() methods\n * of { cookies() } from \"next/headers\"\n */\nexport interface CookieStore {\n  get: (name: string) => { name: string; value: string } | undefined;\n  set: {\n    (name: string, value: string, cookie?: Partial<ResponseCookie>): void;\n    (options: ResponseCookie): void;\n  };\n}\n\n/**\n * Set-Cookie Attributes do not include `encode`. We omit this from our `cookieOptions` type.\n *\n * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie\n * @see https://developer.chrome.com/docs/devtools/application/cookies/\n */\ntype CookieOptions = Omit<CookieSerializeOptions, \"encode\">;\n\nexport interface SessionOptions {\n  /**\n   * The cookie name that will be used inside the browser. Make sure it's unique\n   * given your application.\n   *\n   * @example 'vercel-session'\n   */\n  cookieName: string;\n\n  /**\n   * The password(s) that will be used to encrypt the cookie. Can either be a string\n   * or an object.\n   *\n   * When you provide multiple passwords then all of them will be used to decrypt\n   * the cookie. But only the most recent (`= highest key`, `2` in the example)\n   * password will be used to encrypt the cookie. This allows password rotation.\n   *\n   * @example { 1: 'password-1', 2: 'password-2' }\n   */\n  password: Password;\n\n  /**\n   * The time (in seconds) that the session will be valid for. Also sets the\n   * `max-age` attribute of the cookie automatically (`= ttl - 60s`, so that the\n   * cookie always expire before the session).\n   *\n   * `ttl = 0` means no expiration.\n   *\n   * @default 1209600\n   */\n  ttl?: number;\n\n  /**\n   * The options that will be passed to the cookie library.\n   *\n   * If you want to use \"session cookies\" (cookies that are deleted when the browser\n   * is closed) then you need to pass `cookieOptions: { maxAge: undefined }`\n   *\n   * @see https://github.com/jshttp/cookie#options-1\n   */\n  cookieOptions?: CookieOptions;\n}\n\ntype OverridableOptions = Pick<SessionOptions, \"cookieOptions\" | \"ttl\">;\n\nexport type IronSession<T> = T & {\n  /**\n   * Destroys the session data and removes the cookie.\n   */\n  readonly destroy: (destroyOptions?: OverridableOptions) => Promise<void>;\n\n  /**\n   * Encrypts the session data and sets the cookie.\n   */\n  readonly save: (saveOptions?: OverridableOptions) => Promise<void>;\n};\n\n// default time allowed to check for iron seal validity when ttl passed\n// see https://hapi.dev/module/iron/api/?v=7.0.1#options\nconst timestampSkewSec = 60;\nconst fourteenDaysInSeconds = 14 * 24 * 3600;\n\n// We store a token major version to handle data format changes so that the cookies\n// can be kept alive between upgrades, no need to disconnect everyone.\nconst currentMajorVersion = 2;\nconst versionDelimiter = \"~\";\n\nconst defaultOptions: Required<OverridableOptions> = {\n  ttl: fourteenDaysInSeconds,\n  cookieOptions: { httpOnly: true, secure: true, sameSite: \"lax\", path: \"/\" },\n};\n\nfunction normalizeStringPasswordToMap(password: Password): PasswordsMap {\n  return typeof password === \"string\" ? { 1: password } : password;\n}\n\nfunction parseSeal(seal: string): {\n  sealWithoutVersion: string;\n  tokenVersion: number | null;\n} {\n  const [sealWithoutVersion, tokenVersionAsString] =\n    seal.split(versionDelimiter);\n  const tokenVersion =\n    tokenVersionAsString == null ? null : parseInt(tokenVersionAsString, 10);\n\n  // eslint-disable-next-line @typescript-eslint/no-non-null-assertion\n  return { sealWithoutVersion: sealWithoutVersion!, tokenVersion };\n}\n\nfunction computeCookieMaxAge(ttl: number): number {\n  if (ttl === 0) {\n    // ttl = 0 means no expiration\n    // but in reality cookies have to expire (can't have no max-age)\n    // 2147483647 is the max value for max-age in cookies\n    // see https://stackoverflow.com/a/11685301/147079\n    return 2147483647;\n  }\n\n  // The next line makes sure browser will expire cookies before seals are considered expired by the server.\n  // It also allows for clock difference of 60 seconds between server and clients.\n  return ttl - timestampSkewSec;\n}\n\nfunction getCookie(req: RequestType, cookieName: string): string {\n  return (\n    parse(\n      (\"headers\" in req && typeof req.headers.get === \"function\"\n        ? req.headers.get(\"cookie\")\n        : (req as IncomingMessage).headers.cookie) ?? \"\",\n    )[cookieName] ?? \"\"\n  );\n}\n\nfunction getServerActionCookie(\n  cookieName: string,\n  cookieHandler: CookieStore,\n): string {\n  const cookieObject = cookieHandler.get(cookieName);\n  const cookie = cookieObject?.value;\n  if (typeof cookie === \"string\") {\n    return cookie;\n  }\n  return \"\";\n}\n\nfunction setCookie(res: ResponseType, cookieValue: string): void {\n  if (\"headers\" in res && typeof res.headers.append === \"function\") {\n    res.headers.append(\"set-cookie\", cookieValue);\n    return;\n  }\n  let existingSetCookie = (res as ServerResponse).getHeader(\"set-cookie\") ?? [];\n  if (!Array.isArray(existingSetCookie)) {\n    existingSetCookie = [existingSetCookie.toString()];\n  }\n  (res as ServerResponse).setHeader(\"set-cookie\", [\n    ...existingSetCookie,\n    cookieValue,\n  ]);\n}\n\nexport function createSealData(_crypto: Crypto) {\n  return async function sealData(\n    data: unknown,\n    {\n      password,\n      ttl = fourteenDaysInSeconds,\n    }: { password: Password; ttl?: number },\n  ): Promise<string> {\n    const passwordsMap = normalizeStringPasswordToMap(password);\n\n    const mostRecentPasswordId = Math.max(\n      ...Object.keys(passwordsMap).map(Number),\n    );\n    const passwordForSeal = {\n      id: mostRecentPasswordId.toString(),\n      // eslint-disable-next-line @typescript-eslint/no-non-null-assertion\n      secret: passwordsMap[mostRecentPasswordId]!,\n    };\n\n    const seal = await ironSeal(_crypto, data, passwordForSeal, {\n      ...ironDefaults,\n      ttl: ttl * 1000,\n    });\n\n    return `${seal}${versionDelimiter}${currentMajorVersion}`;\n  };\n}\n\nexport function createUnsealData(_crypto: Crypto) {\n  return async function unsealData<T>(\n    seal: string,\n    {\n      password,\n      ttl = fourteenDaysInSeconds,\n    }: { password: Password; ttl?: number },\n  ): Promise<T> {\n    const passwordsMap = normalizeStringPasswordToMap(password);\n    const { sealWithoutVersion, tokenVersion } = parseSeal(seal);\n\n    try {\n      const data =\n        (await ironUnseal(_crypto, sealWithoutVersion, passwordsMap, {\n          ...ironDefaults,\n          ttl: ttl * 1000,\n        })) /* c8 ignore next */ ?? {};\n\n      if (tokenVersion === 2) {\n        return data as T;\n      }\n\n      // @ts-expect-error `persistent` does not exist on newer tokens\n      return { ...data.persistent } as T;\n    } catch (error) {\n      if (\n        error instanceof Error &&\n        /^(Expired seal|Bad hmac value|Cannot find password|Incorrect number of sealed components)/.test(\n          error.message,\n        )\n      ) {\n        // if seal expired or\n        // if seal is not valid (encrypted using a different password, when passwords are badly rotated) or\n        // if we can't find back the password in the seal\n        // then we just start a new session over\n        return {} as T;\n      }\n\n      /* c8 ignore next 2 */\n      throw error;\n    }\n  };\n}\n\nfunction mergeOptions(\n  sessionOptions: SessionOptions,\n  overrides?: OverridableOptions,\n): Required<SessionOptions> {\n  const options: Required<SessionOptions> = {\n    ...defaultOptions,\n    ...sessionOptions,\n    ...overrides,\n    cookieOptions: {\n      ...defaultOptions.cookieOptions,\n      ...sessionOptions.cookieOptions,\n      ...overrides?.cookieOptions,\n    },\n  };\n\n  if (\n    sessionOptions.cookieOptions &&\n    \"maxAge\" in sessionOptions.cookieOptions\n  ) {\n    if (sessionOptions.cookieOptions.maxAge === undefined) {\n      // session cookies, do not set maxAge, consider token as infinite\n      options.ttl = 0;\n    }\n  } else {\n    options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);\n  }\n\n  return options;\n}\n\nconst badUsageMessage =\n  \"iron-session: Bad usage: use getIronSession(req, res, options) or getIronSession(cookies, options).\";\n\nexport function createGetIronSession(\n  sealData: ReturnType<typeof createSealData>,\n  unsealData: ReturnType<typeof createUnsealData>,\n) {\n  return getIronSession;\n\n  async function getIronSession<T extends object>(\n    cookies: CookieStore,\n    sessionOptions: SessionOptions,\n  ): Promise<IronSession<T>>;\n  async function getIronSession<T extends object>(\n    req: RequestType,\n    res: ResponseType,\n    sessionOptions: SessionOptions,\n  ): Promise<IronSession<T>>;\n  async function getIronSession<T extends object>(\n    reqOrCookieStore: RequestType | CookieStore,\n    resOrsessionOptions: ResponseType | SessionOptions,\n    sessionOptions?: SessionOptions,\n  ): Promise<IronSession<T>> {\n    if (!reqOrCookieStore) {\n      throw new Error(badUsageMessage);\n    }\n\n    if (!resOrsessionOptions) {\n      throw new Error(badUsageMessage);\n    }\n\n    if (!sessionOptions) {\n      return getIronSessionFromCookieStore<T>(\n        reqOrCookieStore as CookieStore,\n        resOrsessionOptions as SessionOptions,\n        sealData,\n        unsealData,\n      );\n    }\n\n    const req = reqOrCookieStore as RequestType;\n    const res = resOrsessionOptions as ResponseType;\n\n    if (!sessionOptions) {\n      throw new Error(\"iron-session: Bad usage. Missing options.\");\n    }\n\n    if (!sessionOptions.cookieName) {\n      throw new Error(\"iron-session: Bad usage. Missing cookie name.\");\n    }\n\n    if (!sessionOptions.password) {\n      throw new Error(\"iron-session: Bad usage. Missing password.\");\n    }\n\n    const passwordsMap = normalizeStringPasswordToMap(sessionOptions.password);\n\n    if (Object.values(passwordsMap).some((password) => password.length < 32)) {\n      throw new Error(\n        \"iron-session: Bad usage. Password must be at least 32 characters long.\",\n      );\n    }\n\n    const options = mergeOptions(sessionOptions);\n    const sealFromCookies = getCookie(req, options.cookieName);\n    const session = sealFromCookies\n      ? await unsealData<T>(sealFromCookies, {\n          password: passwordsMap,\n          ttl: options.ttl,\n        })\n      : ({} as T);\n\n    Object.defineProperties(session, {\n      save: {\n        value: async function save(saveOptions?: OverridableOptions) {\n          if (\"headersSent\" in res && res.headersSent) {\n            throw new Error(\n              \"iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()\",\n            );\n          }\n\n          const mergedOptions = mergeOptions(sessionOptions, saveOptions);\n          const seal = await sealData(session, {\n            password: passwordsMap,\n            ttl: mergedOptions.ttl,\n          });\n          const cookieValue = serialize(\n            mergedOptions.cookieName,\n            seal,\n            mergedOptions.cookieOptions,\n          );\n\n          if (cookieValue.length > 4096) {\n            throw new Error(\n              `iron-session: Cookie length is too big (${cookieValue.length} bytes), browsers will refuse it. Try to remove some data.`,\n            );\n          }\n\n          setCookie(res, cookieValue);\n        },\n      },\n\n      destroy: {\n        value: async function destroy(destroyOptions?: OverridableOptions) {\n          Object.keys(session).forEach((key) => {\n            delete (session as Record<string, unknown>)[key];\n          });\n\n          const mergedOptions = mergeOptions(sessionOptions, destroyOptions);\n          const cookieValue = serialize(mergedOptions.cookieName, \"\", {\n            ...mergedOptions.cookieOptions,\n            maxAge: 0,\n          });\n\n          setCookie(res, cookieValue);\n        },\n      },\n    });\n\n    return session as IronSession<T>;\n  }\n}\n\nasync function getIronSessionFromCookieStore<T extends object>(\n  cookieStore: CookieStore,\n  sessionOptions: SessionOptions,\n  sealData: ReturnType<typeof createSealData>,\n  unsealData: ReturnType<typeof createUnsealData>,\n): Promise<IronSession<T>> {\n  if (!sessionOptions) {\n    throw new Error(\"iron-session: Bad usage. Missing options.\");\n  }\n\n  if (!sessionOptions.cookieName) {\n    throw new Error(\"iron-session: Bad usage. Missing cookie name.\");\n  }\n\n  if (!sessionOptions.password) {\n    throw new Error(\"iron-session: Bad usage. Missing password.\");\n  }\n\n  const passwordsMap = normalizeStringPasswordToMap(sessionOptions.password);\n\n  if (Object.values(passwordsMap).some((password) => password.length < 32)) {\n    throw new Error(\n      \"iron-session: Bad usage. Password must be at least 32 characters long.\",\n    );\n  }\n\n  const options = mergeOptions(sessionOptions);\n  const sealFromCookies = getServerActionCookie(\n    options.cookieName,\n    cookieStore,\n  );\n  const session = sealFromCookies\n    ? await unsealData<T>(sealFromCookies, {\n        password: passwordsMap,\n        ttl: options.ttl,\n      })\n    : ({} as T);\n\n  Object.defineProperties(session, {\n    save: {\n      value: async function save(saveOptions?: OverridableOptions) {\n        const mergedOptions = mergeOptions(sessionOptions, saveOptions);\n        const seal = await sealData(session, {\n          password: passwordsMap,\n          ttl: mergedOptions.ttl,\n        });\n\n        const cookieLength =\n          mergedOptions.cookieName.length +\n          seal.length +\n          JSON.stringify(mergedOptions.cookieOptions).length;\n\n        if (cookieLength > 4096) {\n          throw new Error(\n            `iron-session: Cookie length is too big (${cookieLength} bytes), browsers will refuse it. Try to remove some data.`,\n          );\n        }\n\n        cookieStore.set(\n          mergedOptions.cookieName,\n          seal,\n          mergedOptions.cookieOptions,\n        );\n      },\n    },\n\n    destroy: {\n      value: async function destroy(destroyOptions: OverridableOptions) {\n        Object.keys(session).forEach((key) => {\n          delete (session as Record<string, unknown>)[key];\n        });\n        const mergedOptions = mergeOptions(sessionOptions, destroyOptions);\n        const cookieOptions = { ...mergedOptions.cookieOptions, maxAge: 0 };\n\n        cookieStore.set(mergedOptions.cookieName, \"\", cookieOptions);\n      },\n    },\n  });\n\n  return session as IronSession<T>;\n}\n","import {\n  createGetIronSession,\n  createSealData,\n  createUnsealData,\n} from \"./core.js\";\n\nimport * as crypto from \"uncrypto\";\n\nexport * from \"./core.js\";\nexport const sealData = createSealData(crypto);\nexport const unsealData = createUnsealData(crypto);\nexport const getIronSession = createGetIronSession(sealData, unsealData);\n// export const getServerActionIronSession = createGetServerActionIronSession(\n//   sealData,\n//   unsealData,\n// );\n"]}
+{"version":3,"sources":["../src/core.ts","../src/index.ts"],"names":["sealData","unsealData","getIronSession"],"mappings":";AACA,SAAS,OAAO,iBAA8C;AAC9D;AAAA,EACE,YAAY;AAAA,EACZ,QAAQ;AAAA,EACR,UAAU;AAAA,OACL;AAiHP,IAAM,mBAAmB;AACzB,IAAM,wBAAwB,KAAK,KAAK;AAIxC,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AAEzB,IAAM,iBACJ;AAAA,EACE,KAAK;AAAA,EACL,eAAe,EAAE,UAAU,MAAM,QAAQ,MAAM,UAAU,OAAO,MAAM,IAAI;AAC5E;AAEF,SAAS,6BAA6B,UAAkC;AACtE,SAAO,OAAO,aAAa,WAAW,EAAE,GAAG,SAAS,IAAI;AAC1D;AAEA,SAAS,UAAU,MAGjB;AACA,QAAM,CAAC,oBAAoB,oBAAoB,IAC7C,KAAK,MAAM,gBAAgB;AAC7B,QAAM,eACJ,wBAAwB,OAAO,OAAO,SAAS,sBAAsB,EAAE;AAGzE,SAAO,EAAE,oBAAyC,aAAa;AACjE;AAEA,SAAS,oBAAoB,KAAqB;AAChD,MAAI,QAAQ,GAAG;AAKb,WAAO;AAAA,EACT;AAIA,SAAO,MAAM;AACf;AAEA,SAAS,UAAU,KAAkB,YAA4B;AAC/D,SACE;AAAA,KACG,aAAa,OAAO,OAAO,IAAI,QAAQ,QAAQ,aAC5C,IAAI,QAAQ,IAAI,QAAQ,IACvB,IAAwB,QAAQ,WAAW;AAAA,EAClD,EAAE,UAAU,KAAK;AAErB;AAEA,SAAS,sBACP,YACA,eACQ;AACR,QAAM,eAAe,cAAc,IAAI,UAAU;AACjD,QAAM,SAAS,cAAc;AAC7B,MAAI,OAAO,WAAW,UAAU;AAC9B,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,UAAU,KAAmB,aAA2B;AAC/D,MAAI,aAAa,OAAO,OAAO,IAAI,QAAQ,WAAW,YAAY;AAChE,QAAI,QAAQ,OAAO,cAAc,WAAW;AAC5C;AAAA,EACF;AACA,MAAI,oBAAqB,IAAuB,UAAU,YAAY,KAAK,CAAC;AAC5E,MAAI,CAAC,MAAM,QAAQ,iBAAiB,GAAG;AACrC,wBAAoB,CAAC,kBAAkB,SAAS,CAAC;AAAA,EACnD;AACA,EAAC,IAAuB,UAAU,cAAc;AAAA,IAC9C,GAAG;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAEO,SAAS,eAAe,SAAiB;AAC9C,SAAO,eAAeA,UACpB,MACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,GACiB;AACjB,UAAM,eAAe,6BAA6B,QAAQ;AAE1D,UAAM,uBAAuB,KAAK;AAAA,MAChC,GAAG,OAAO,KAAK,YAAY,EAAE,IAAI,MAAM;AAAA,IACzC;AACA,UAAM,kBAAkB;AAAA,MACtB,IAAI,qBAAqB,SAAS;AAAA,MAClC,QAAQ,aAAa,oBAAoB;AAAA,IAC3C;AAEA,UAAM,OAAO,MAAM,SAAS,SAAS,MAAM,iBAAiB;AAAA,MAC1D,GAAG;AAAA,MACH,KAAK,MAAM;AAAA,IACb,CAAC;AAED,WAAO,GAAG,IAAI,GAAG,gBAAgB,GAAG,mBAAmB;AAAA,EACzD;AACF;AAEO,SAAS,iBAAiB,SAAiB;AAChD,SAAO,eAAeC,YACpB,MACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,GACY;AACZ,UAAM,eAAe,6BAA6B,QAAQ;AAC1D,UAAM,EAAE,oBAAoB,aAAa,IAAI,UAAU,IAAI;AAE3D,QAAI;AACF,YAAM,OACH,MAAM,WAAW,SAAS,oBAAoB,cAAc;AAAA,QAC3D,GAAG;AAAA,QACH,KAAK,MAAM;AAAA,MACb,CAAC,KAAM,CAAC;AAEV,UAAI,iBAAiB,GAAG;AACtB,eAAO;AAAA,MACT;AAGA,aAAO,EAAE,GAAG,KAAK,WAAW;AAAA,IAC9B,SAAS,OAAO;AACd,UACE,iBAAiB,SACjB,4FAA4F;AAAA,QAC1F,MAAM;AAAA,MACR,GACA;AAKA,eAAO,CAAC;AAAA,MACV;AAEA,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,iBACP,gBAC0B;AAC1B,QAAM,UAAU;AAAA,IACd,GAAG;AAAA,IACH,GAAG;AAAA,IACH,eAAe;AAAA,MACb,GAAG,eAAe;AAAA,MAClB,GAAI,eAAe,iBAAiB,CAAC;AAAA,IACvC;AAAA,EACF;AAEA,MACE,eAAe,iBACf,YAAY,eAAe,eAC3B;AACA,QAAI,eAAe,cAAc,WAAW,QAAW;AAErD,cAAQ,MAAM;AAAA,IAChB;AAAA,EACF,OAAO;AACL,YAAQ,cAAc,SAAS,oBAAoB,QAAQ,GAAG;AAAA,EAChE;AAEA,SAAO;AACT;AAEA,IAAM,kBACJ;AAEK,SAAS,qBACdD,WACAC,aACA;AACA,SAAOC;AAWP,iBAAeA,gBACb,kBACA,qBACA,gBACyB;AACzB,QAAI,CAAC,kBAAkB;AACrB,YAAM,IAAI,MAAM,eAAe;AAAA,IACjC;AAEA,QAAI,CAAC,qBAAqB;AACxB,YAAM,IAAI,MAAM,eAAe;AAAA,IACjC;AAEA,QAAI,CAAC,gBAAgB;AACnB,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACAF;AAAA,QACAC;AAAA,MACF;AAAA,IACF;AAEA,UAAM,MAAM;AACZ,UAAM,MAAM;AAEZ,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,MAAM,eAAe;AAAA,IACjC;AAEA,QAAI,CAAC,eAAe,YAAY;AAC9B,YAAM,IAAI,MAAM,+CAA+C;AAAA,IACjE;AAEA,QAAI,CAAC,eAAe,UAAU;AAC5B,YAAM,IAAI,MAAM,4CAA4C;AAAA,IAC9D;AAEA,UAAM,eAAe,6BAA6B,eAAe,QAAQ;AAEzE,QAAI,OAAO,OAAO,YAAY,EAAE,KAAK,CAAC,aAAa,SAAS,SAAS,EAAE,GAAG;AACxE,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI,gBAAgB,iBAAiB,cAAc;AAEnD,UAAM,kBAAkB,UAAU,KAAK,cAAc,UAAU;AAC/D,UAAM,UAAU,kBACZ,MAAMA,YAAc,iBAAiB;AAAA,MACnC,UAAU;AAAA,MACV,KAAK,cAAc;AAAA,IACrB,CAAC,IACA,CAAC;AAEN,WAAO,iBAAiB,SAAS;AAAA,MAC/B,cAAc;AAAA,QACZ,OAAO,SAAS,aAAa,mBAAmC;AAC9D,0BAAgB,iBAAiB,iBAAiB;AAAA,QACpD;AAAA,MACF;AAAA,MACA,MAAM;AAAA,QACJ,OAAO,eAAe,OAAO;AAC3B,cAAI,iBAAiB,OAAO,IAAI,aAAa;AAC3C,kBAAM,IAAI;AAAA,cACR;AAAA,YACF;AAAA,UACF;AAEA,gBAAM,OAAO,MAAMD,UAAS,SAAS;AAAA,YACnC,UAAU;AAAA,YACV,KAAK,cAAc;AAAA,UACrB,CAAC;AACD,gBAAM,cAAc;AAAA,YAClB,cAAc;AAAA,YACd;AAAA,YACA,cAAc;AAAA,UAChB;AAEA,cAAI,YAAY,SAAS,MAAM;AAC7B,kBAAM,IAAI;AAAA,cACR,2CAA2C,YAAY,MAAM;AAAA,YAC/D;AAAA,UACF;AAEA,oBAAU,KAAK,WAAW;AAAA,QAC5B;AAAA,MACF;AAAA,MAEA,SAAS;AAAA,QACP,OAAO,SAAS,UAAU;AACxB,iBAAO,KAAK,OAAO,EAAE,QAAQ,CAAC,QAAQ;AACpC,mBAAQ,QAAoC,GAAG;AAAA,UACjD,CAAC;AACD,gBAAM,cAAc,UAAU,cAAc,YAAY,IAAI;AAAA,YAC1D,GAAG,cAAc;AAAA,YACjB,QAAQ;AAAA,UACV,CAAC;AAED,oBAAU,KAAK,WAAW;AAAA,QAC5B;AAAA,MACF;AAAA,IACF,CAAC;AAED,WAAO;AAAA,EACT;AACF;AAEA,eAAe,8BACb,aACA,gBACAA,WACAC,aACyB;AACzB,MAAI,CAAC,eAAe,YAAY;AAC9B,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AAEA,MAAI,CAAC,eAAe,UAAU;AAC5B,UAAM,IAAI,MAAM,4CAA4C;AAAA,EAC9D;AAEA,QAAM,eAAe,6BAA6B,eAAe,QAAQ;AAEzE,MAAI,OAAO,OAAO,YAAY,EAAE,KAAK,CAAC,aAAa,SAAS,SAAS,EAAE,GAAG;AACxE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,gBAAgB,iBAAiB,cAAc;AACrD,QAAM,kBAAkB;AAAA,IACtB,cAAc;AAAA,IACd;AAAA,EACF;AACA,QAAM,UAAU,kBACZ,MAAMA,YAAc,iBAAiB;AAAA,IACnC,UAAU;AAAA,IACV,KAAK,cAAc;AAAA,EACrB,CAAC,IACA,CAAC;AAEN,SAAO,iBAAiB,SAAS;AAAA,IAC/B,MAAM;AAAA,MACJ,OAAO,eAAe,OAAO;AAC3B,cAAM,OAAO,MAAMD,UAAS,SAAS;AAAA,UACnC,UAAU;AAAA,UACV,KAAK,cAAc;AAAA,QACrB,CAAC;AAED,cAAM,eACJ,cAAc,WAAW,SACzB,KAAK,SACL,KAAK,UAAU,cAAc,aAAa,EAAE;AAE9C,YAAI,eAAe,MAAM;AACvB,gBAAM,IAAI;AAAA,YACR,2CAA2C,YAAY;AAAA,UACzD;AAAA,QACF;AAEA,oBAAY;AAAA,UACV,cAAc;AAAA,UACd;AAAA,UACA,cAAc;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAAA,IAEA,SAAS;AAAA,MACP,OAAO,SAAS,UAAU;AACxB,eAAO,KAAK,OAAO,EAAE,QAAQ,CAAC,QAAQ;AACpC,iBAAQ,QAAoC,GAAG;AAAA,QACjD,CAAC;AAED,cAAM,gBAAgB,EAAE,GAAG,cAAc,eAAe,QAAQ,EAAE;AAClE,oBAAY,IAAI,cAAc,YAAY,IAAI,aAAa;AAAA,MAC7D;AAAA,IACF;AAAA,EACF,CAAC;AAED,SAAO;AACT;;;AC5eA,YAAY,YAAY;AAGjB,IAAM,WAAW,eAAe,MAAM;AACtC,IAAM,aAAa,iBAAiB,MAAM;AAC1C,IAAM,iBAAiB,qBAAqB,UAAU,UAAU","sourcesContent":["import type { IncomingMessage, ServerResponse } from \"http\";\nimport { parse, serialize, type CookieSerializeOptions } from \"cookie\";\nimport {\n  defaults as ironDefaults,\n  seal as ironSeal,\n  unseal as ironUnseal,\n} from \"iron-webcrypto\";\n\ntype PasswordsMap = Record<string, string>;\ntype Password = PasswordsMap | string;\ntype RequestType = IncomingMessage | Request;\ntype ResponseType = Response | ServerResponse;\n\n/**\n * {@link https://wicg.github.io/cookie-store/#dictdef-cookielistitem CookieListItem}\n * as specified by W3C.\n */\ninterface CookieListItem\n  extends Pick<\n    CookieSerializeOptions,\n    \"domain\" | \"path\" | \"sameSite\" | \"secure\"\n  > {\n  /** A string with the name of a cookie. */\n  name: string;\n  /** A string containing the value of the cookie. */\n  value: string;\n  /** A number of milliseconds or Date interface containing the expires of the cookie. */\n  expires?: CookieSerializeOptions[\"expires\"] | number;\n}\n\n/**\n * Superset of {@link CookieListItem} extending it with\n * the `httpOnly`, `maxAge` and `priority` properties.\n */\ntype ResponseCookie = CookieListItem &\n  Pick<CookieSerializeOptions, \"httpOnly\" | \"maxAge\" | \"priority\">;\n\n/**\n * The high-level type definition of the .get() and .set() methods\n * of { cookies() } from \"next/headers\"\n */\nexport interface CookieStore {\n  get: (name: string) => { name: string; value: string } | undefined;\n  set: {\n    (name: string, value: string, cookie?: Partial<ResponseCookie>): void;\n    (options: ResponseCookie): void;\n  };\n}\n\n/**\n * Set-Cookie Attributes do not include `encode`. We omit this from our `cookieOptions` type.\n *\n * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie\n * @see https://developer.chrome.com/docs/devtools/application/cookies/\n */\ntype CookieOptions = Omit<CookieSerializeOptions, \"encode\">;\n\nexport interface SessionOptions {\n  /**\n   * The cookie name that will be used inside the browser. Make sure it's unique\n   * given your application.\n   *\n   * @example 'vercel-session'\n   */\n  cookieName: string;\n\n  /**\n   * The password(s) that will be used to encrypt the cookie. Can either be a string\n   * or an object.\n   *\n   * When you provide multiple passwords then all of them will be used to decrypt\n   * the cookie. But only the most recent (`= highest key`, `2` in the example)\n   * password will be used to encrypt the cookie. This allows password rotation.\n   *\n   * @example { 1: 'password-1', 2: 'password-2' }\n   */\n  password: Password;\n\n  /**\n   * The time (in seconds) that the session will be valid for. Also sets the\n   * `max-age` attribute of the cookie automatically (`= ttl - 60s`, so that the\n   * cookie always expire before the session).\n   *\n   * `ttl = 0` means no expiration.\n   *\n   * @default 1209600\n   */\n  ttl?: number;\n\n  /**\n   * The options that will be passed to the cookie library.\n   *\n   * If you want to use \"session cookies\" (cookies that are deleted when the browser\n   * is closed) then you need to pass `cookieOptions: { maxAge: undefined }`\n   *\n   * @see https://github.com/jshttp/cookie#options-1\n   */\n  cookieOptions?: CookieOptions;\n}\n\nexport type IronSession<T> = T & {\n  /**\n   * Encrypts the session data and sets the cookie.\n   */\n  readonly save: () => Promise<void>;\n\n  /**\n   * Destroys the session data and removes the cookie.\n   */\n  readonly destroy: () => Promise<void>;\n\n  /**\n   * Update the session configuration. You still need to call save() to send the new cookie.\n   */\n  readonly updateConfig: (newSessionOptions: SessionOptions) => void;\n};\n\n// default time allowed to check for iron seal validity when ttl passed\n// see https://hapi.dev/module/iron/api/?v=7.0.1#options\nconst timestampSkewSec = 60;\nconst fourteenDaysInSeconds = 14 * 24 * 3600;\n\n// We store a token major version to handle data format changes so that the cookies\n// can be kept alive between upgrades, no need to disconnect everyone.\nconst currentMajorVersion = 2;\nconst versionDelimiter = \"~\";\n\nconst defaultOptions: Required<Pick<SessionOptions, \"ttl\" | \"cookieOptions\">> =\n  {\n    ttl: fourteenDaysInSeconds,\n    cookieOptions: { httpOnly: true, secure: true, sameSite: \"lax\", path: \"/\" },\n  };\n\nfunction normalizeStringPasswordToMap(password: Password): PasswordsMap {\n  return typeof password === \"string\" ? { 1: password } : password;\n}\n\nfunction parseSeal(seal: string): {\n  sealWithoutVersion: string;\n  tokenVersion: number | null;\n} {\n  const [sealWithoutVersion, tokenVersionAsString] =\n    seal.split(versionDelimiter);\n  const tokenVersion =\n    tokenVersionAsString == null ? null : parseInt(tokenVersionAsString, 10);\n\n  // eslint-disable-next-line @typescript-eslint/no-non-null-assertion\n  return { sealWithoutVersion: sealWithoutVersion!, tokenVersion };\n}\n\nfunction computeCookieMaxAge(ttl: number): number {\n  if (ttl === 0) {\n    // ttl = 0 means no expiration\n    // but in reality cookies have to expire (can't have no max-age)\n    // 2147483647 is the max value for max-age in cookies\n    // see https://stackoverflow.com/a/11685301/147079\n    return 2147483647;\n  }\n\n  // The next line makes sure browser will expire cookies before seals are considered expired by the server.\n  // It also allows for clock difference of 60 seconds between server and clients.\n  return ttl - timestampSkewSec;\n}\n\nfunction getCookie(req: RequestType, cookieName: string): string {\n  return (\n    parse(\n      (\"headers\" in req && typeof req.headers.get === \"function\"\n        ? req.headers.get(\"cookie\")\n        : (req as IncomingMessage).headers.cookie) ?? \"\",\n    )[cookieName] ?? \"\"\n  );\n}\n\nfunction getServerActionCookie(\n  cookieName: string,\n  cookieHandler: CookieStore,\n): string {\n  const cookieObject = cookieHandler.get(cookieName);\n  const cookie = cookieObject?.value;\n  if (typeof cookie === \"string\") {\n    return cookie;\n  }\n  return \"\";\n}\n\nfunction setCookie(res: ResponseType, cookieValue: string): void {\n  if (\"headers\" in res && typeof res.headers.append === \"function\") {\n    res.headers.append(\"set-cookie\", cookieValue);\n    return;\n  }\n  let existingSetCookie = (res as ServerResponse).getHeader(\"set-cookie\") ?? [];\n  if (!Array.isArray(existingSetCookie)) {\n    existingSetCookie = [existingSetCookie.toString()];\n  }\n  (res as ServerResponse).setHeader(\"set-cookie\", [\n    ...existingSetCookie,\n    cookieValue,\n  ]);\n}\n\nexport function createSealData(_crypto: Crypto) {\n  return async function sealData(\n    data: unknown,\n    {\n      password,\n      ttl = fourteenDaysInSeconds,\n    }: { password: Password; ttl?: number },\n  ): Promise<string> {\n    const passwordsMap = normalizeStringPasswordToMap(password);\n\n    const mostRecentPasswordId = Math.max(\n      ...Object.keys(passwordsMap).map(Number),\n    );\n    const passwordForSeal = {\n      id: mostRecentPasswordId.toString(),\n      secret: passwordsMap[mostRecentPasswordId]!,\n    };\n\n    const seal = await ironSeal(_crypto, data, passwordForSeal, {\n      ...ironDefaults,\n      ttl: ttl * 1000,\n    });\n\n    return `${seal}${versionDelimiter}${currentMajorVersion}`;\n  };\n}\n\nexport function createUnsealData(_crypto: Crypto) {\n  return async function unsealData<T>(\n    seal: string,\n    {\n      password,\n      ttl = fourteenDaysInSeconds,\n    }: { password: Password; ttl?: number },\n  ): Promise<T> {\n    const passwordsMap = normalizeStringPasswordToMap(password);\n    const { sealWithoutVersion, tokenVersion } = parseSeal(seal);\n\n    try {\n      const data =\n        (await ironUnseal(_crypto, sealWithoutVersion, passwordsMap, {\n          ...ironDefaults,\n          ttl: ttl * 1000,\n        })) ?? {};\n\n      if (tokenVersion === 2) {\n        return data as T;\n      }\n\n      // @ts-expect-error `persistent` does not exist on newer tokens\n      return { ...data.persistent } as T;\n    } catch (error) {\n      if (\n        error instanceof Error &&\n        /^(Expired seal|Bad hmac value|Cannot find password|Incorrect number of sealed components)/.test(\n          error.message,\n        )\n      ) {\n        // if seal expired or\n        // if seal is not valid (encrypted using a different password, when passwords are badly rotated) or\n        // if we can't find back the password in the seal\n        // then we just start a new session over\n        return {} as T;\n      }\n\n      throw error;\n    }\n  };\n}\n\nfunction getSessionConfig(\n  sessionOptions: SessionOptions,\n): Required<SessionOptions> {\n  const options = {\n    ...defaultOptions,\n    ...sessionOptions,\n    cookieOptions: {\n      ...defaultOptions.cookieOptions,\n      ...(sessionOptions.cookieOptions || {}),\n    },\n  };\n\n  if (\n    sessionOptions.cookieOptions &&\n    \"maxAge\" in sessionOptions.cookieOptions\n  ) {\n    if (sessionOptions.cookieOptions.maxAge === undefined) {\n      // session cookies, do not set maxAge, consider token as infinite\n      options.ttl = 0;\n    }\n  } else {\n    options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);\n  }\n\n  return options;\n}\n\nconst badUsageMessage =\n  \"iron-session: Bad usage: use getIronSession(req, res, options) or getIronSession(cookieStore, options).\";\n\nexport function createGetIronSession(\n  sealData: ReturnType<typeof createSealData>,\n  unsealData: ReturnType<typeof createUnsealData>,\n) {\n  return getIronSession;\n\n  async function getIronSession<T extends object>(\n    cookies: CookieStore,\n    sessionOptions: SessionOptions,\n  ): Promise<IronSession<T>>;\n  async function getIronSession<T extends object>(\n    req: RequestType,\n    res: ResponseType,\n    sessionOptions: SessionOptions,\n  ): Promise<IronSession<T>>;\n  async function getIronSession<T extends object>(\n    reqOrCookieStore: RequestType | CookieStore,\n    resOrsessionOptions: ResponseType | SessionOptions,\n    sessionOptions?: SessionOptions,\n  ): Promise<IronSession<T>> {\n    if (!reqOrCookieStore) {\n      throw new Error(badUsageMessage);\n    }\n\n    if (!resOrsessionOptions) {\n      throw new Error(badUsageMessage);\n    }\n\n    if (!sessionOptions) {\n      return getIronSessionFromCookieStore<T>(\n        reqOrCookieStore as CookieStore,\n        resOrsessionOptions as SessionOptions,\n        sealData,\n        unsealData,\n      );\n    }\n\n    const req = reqOrCookieStore as RequestType;\n    const res = resOrsessionOptions as ResponseType;\n\n    if (!sessionOptions) {\n      throw new Error(badUsageMessage);\n    }\n\n    if (!sessionOptions.cookieName) {\n      throw new Error(\"iron-session: Bad usage. Missing cookie name.\");\n    }\n\n    if (!sessionOptions.password) {\n      throw new Error(\"iron-session: Bad usage. Missing password.\");\n    }\n\n    const passwordsMap = normalizeStringPasswordToMap(sessionOptions.password);\n\n    if (Object.values(passwordsMap).some((password) => password.length < 32)) {\n      throw new Error(\n        \"iron-session: Bad usage. Password must be at least 32 characters long.\",\n      );\n    }\n\n    let sessionConfig = getSessionConfig(sessionOptions);\n\n    const sealFromCookies = getCookie(req, sessionConfig.cookieName);\n    const session = sealFromCookies\n      ? await unsealData<T>(sealFromCookies, {\n          password: passwordsMap,\n          ttl: sessionConfig.ttl,\n        })\n      : ({} as T);\n\n    Object.defineProperties(session, {\n      updateConfig: {\n        value: function updateConfig(newSessionOptions: SessionOptions) {\n          sessionConfig = getSessionConfig(newSessionOptions);\n        },\n      },\n      save: {\n        value: async function save() {\n          if (\"headersSent\" in res && res.headersSent) {\n            throw new Error(\n              \"iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()\",\n            );\n          }\n\n          const seal = await sealData(session, {\n            password: passwordsMap,\n            ttl: sessionConfig.ttl,\n          });\n          const cookieValue = serialize(\n            sessionConfig.cookieName,\n            seal,\n            sessionConfig.cookieOptions,\n          );\n\n          if (cookieValue.length > 4096) {\n            throw new Error(\n              `iron-session: Cookie length is too big (${cookieValue.length} bytes), browsers will refuse it. Try to remove some data.`,\n            );\n          }\n\n          setCookie(res, cookieValue);\n        },\n      },\n\n      destroy: {\n        value: function destroy() {\n          Object.keys(session).forEach((key) => {\n            delete (session as Record<string, unknown>)[key];\n          });\n          const cookieValue = serialize(sessionConfig.cookieName, \"\", {\n            ...sessionConfig.cookieOptions,\n            maxAge: 0,\n          });\n\n          setCookie(res, cookieValue);\n        },\n      },\n    });\n\n    return session as IronSession<T>;\n  }\n}\n\nasync function getIronSessionFromCookieStore<T extends object>(\n  cookieStore: CookieStore,\n  sessionOptions: SessionOptions,\n  sealData: ReturnType<typeof createSealData>,\n  unsealData: ReturnType<typeof createUnsealData>,\n): Promise<IronSession<T>> {\n  if (!sessionOptions.cookieName) {\n    throw new Error(\"iron-session: Bad usage. Missing cookie name.\");\n  }\n\n  if (!sessionOptions.password) {\n    throw new Error(\"iron-session: Bad usage. Missing password.\");\n  }\n\n  const passwordsMap = normalizeStringPasswordToMap(sessionOptions.password);\n\n  if (Object.values(passwordsMap).some((password) => password.length < 32)) {\n    throw new Error(\n      \"iron-session: Bad usage. Password must be at least 32 characters long.\",\n    );\n  }\n\n  const sessionConfig = getSessionConfig(sessionOptions);\n  const sealFromCookies = getServerActionCookie(\n    sessionConfig.cookieName,\n    cookieStore,\n  );\n  const session = sealFromCookies\n    ? await unsealData<T>(sealFromCookies, {\n        password: passwordsMap,\n        ttl: sessionConfig.ttl,\n      })\n    : ({} as T);\n\n  Object.defineProperties(session, {\n    save: {\n      value: async function save() {\n        const seal = await sealData(session, {\n          password: passwordsMap,\n          ttl: sessionConfig.ttl,\n        });\n\n        const cookieLength =\n          sessionConfig.cookieName.length +\n          seal.length +\n          JSON.stringify(sessionConfig.cookieOptions).length;\n\n        if (cookieLength > 4096) {\n          throw new Error(\n            `iron-session: Cookie length is too big (${cookieLength} bytes), browsers will refuse it. Try to remove some data.`,\n          );\n        }\n\n        cookieStore.set(\n          sessionConfig.cookieName,\n          seal,\n          sessionConfig.cookieOptions,\n        );\n      },\n    },\n\n    destroy: {\n      value: function destroy() {\n        Object.keys(session).forEach((key) => {\n          delete (session as Record<string, unknown>)[key];\n        });\n\n        const cookieOptions = { ...sessionConfig.cookieOptions, maxAge: 0 };\n        cookieStore.set(sessionConfig.cookieName, \"\", cookieOptions);\n      },\n    },\n  });\n\n  return session as IronSession<T>;\n}\n","import {\n  createGetIronSession,\n  createSealData,\n  createUnsealData,\n} from \"./core.js\";\n\nimport * as crypto from \"uncrypto\";\n\nexport type { IronSession, SessionOptions } from \"./core.js\";\nexport const sealData = createSealData(crypto);\nexport const unsealData = createUnsealData(crypto);\nexport const getIronSession = createGetIronSession(sealData, unsealData);\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "iron-session",
-  "version": "8.0.0-beta.6",
+  "version": "8.0.0",
   "description": "Secure, stateless, and cookie-based session library for JavaScript",
   "keywords": [
     "session",
@@ -42,14 +42,13 @@
     "uncrypto": "0.1.3"
   },
   "devDependencies": {
-    "@release-it/conventional-changelog": "8.0.1",
     "@types/cookie": "0.5.4",
-    "@types/node": "20.9.0",
+    "@types/node": "18.18.10",
     "@typescript-eslint/eslint-plugin": "6.11.0",
     "@typescript-eslint/parser": "6.11.0",
     "c8": "8.0.1",
     "concurrently": "8.2.2",
-    "eslint": "8.53.0",
+    "eslint": "8.54.0",
     "eslint-config-prettier": "9.0.0",
     "eslint-import-resolver-node": "0.3.9",
     "eslint-import-resolver-typescript": "3.6.1",
@@ -58,12 +57,11 @@
     "prettier": "3.1.0",
     "prettier-plugin-packagejson": "2.4.6",
     "publint": "0.2.5",
-    "release-it": "17.0.0",
-    "tsup": "7.2.0",
-    "tsx": "4.1.2",
+    "tsup": "8.0.0",
+    "tsx": "4.1.4",
     "typescript": "5.2.2"
   },
-  "packageManager": "pnpm@8.10.2",
+  "packageManager": "pnpm@8.10.5",
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org"
@@ -72,7 +70,6 @@
     "build": "tsup",
     "dev": "pnpm build && concurrently \"pnpm build --watch\" \"pnpm --filter=next-example dev\" ",
     "lint": "tsc --noEmit && tsc --noEmit -p examples/next/tsconfig.json && pnpm eslint . && publint",
-    "release": "pnpm lint",
     "test": "c8 -r text -r lcov node --loader tsx --test src/*.test.ts && pnpm build",
     "test:watch": "node --loader tsx --test --watch src/*.test.ts"
   }