iron-session 8.0.4 → 9.0.0-beta.0

package/dist/index.cjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/core.ts","../src/index.ts"],"names":["parse","sealData","ironSeal","ironDefaults","unsealData","ironUnseal","getIronSession","serialize","crypto"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAuHA,IAAM,gBAAmB,GAAA,EAAA,CAAA;AACzB,IAAM,qBAAA,GAAwB,KAAK,EAAK,GAAA,IAAA,CAAA;AAIxC,IAAM,mBAAsB,GAAA,CAAA,CAAA;AAC5B,IAAM,gBAAmB,GAAA,GAAA,CAAA;AAEzB,IAAM,cACJ,GAAA;AAAA,EACE,GAAK,EAAA,qBAAA;AAAA,EACL,aAAA,EAAe,EAAE,QAAU,EAAA,IAAA,EAAM,QAAQ,IAAM,EAAA,QAAA,EAAU,KAAO,EAAA,IAAA,EAAM,GAAI,EAAA;AAC5E,CAAA,CAAA;AAEF,SAAS,6BAA6B,QAAkC,EAAA;AACtE,EAAA,OAAO,OAAO,QAAa,KAAA,QAAA,GAAW,EAAE,CAAA,EAAG,UAAa,GAAA,QAAA,CAAA;AAC1D,CAAA;AAEA,SAAS,UAAU,IAGjB,EAAA;AACA,EAAA,MAAM,CAAC,kBAAoB,EAAA,oBAAoB,CAC7C,GAAA,IAAA,CAAK,MAAM,gBAAgB,CAAA,CAAA;AAC7B,EAAA,MAAM,eACJ,oBAAwB,IAAA,IAAA,GAAO,IAAO,GAAA,QAAA,CAAS,sBAAsB,EAAE,CAAA,CAAA;AAGzE,EAAO,OAAA,EAAE,oBAAyC,YAAa,EAAA,CAAA;AACjE,CAAA;AAEA,SAAS,oBAAoB,GAAqB,EAAA;AAChD,EAAA,IAAI,QAAQ,CAAG,EAAA;AAKb,IAAO,OAAA,UAAA,CAAA;AAAA,GACT;AAIA,EAAA,OAAO,GAAM,GAAA,gBAAA,CAAA;AACf,CAAA;AAEA,SAAS,SAAA,CAAU,KAAkB,UAA4B,EAAA;AAC/D,EACE,OAAAA,YAAA;AAAA,IAAA,CACG,SAAa,IAAA,GAAA,IAAO,OAAO,GAAA,CAAI,QAAQ,GAAQ,KAAA,UAAA,GAC5C,GAAI,CAAA,OAAA,CAAQ,GAAI,CAAA,QAAQ,CACvB,GAAA,GAAA,CAAwB,QAAQ,MAAW,KAAA,EAAA;AAAA,GAClD,CAAE,UAAU,CAAK,IAAA,EAAA,CAAA;AAErB,CAAA;AAEA,SAAS,qBAAA,CACP,YACA,aACQ,EAAA;AACR,EAAM,MAAA,YAAA,GAAe,aAAc,CAAA,GAAA,CAAI,UAAU,CAAA,CAAA;AACjD,EAAA,MAAM,SAAS,YAAc,EAAA,KAAA,CAAA;AAC7B,EAAI,IAAA,OAAO,WAAW,QAAU,EAAA;AAC9B,IAAO,OAAA,MAAA,CAAA;AAAA,GACT;AACA,EAAO,OAAA,EAAA,CAAA;AACT,CAAA;AAEA,SAAS,SAAA,CAAU,KAAmB,WAA2B,EAAA;AAC/D,EAAA,IAAI,aAAa,GAAO,IAAA,OAAO,GAAI,CAAA,OAAA,CAAQ,WAAW,UAAY,EAAA;AAChE,IAAI,GAAA,CAAA,OAAA,CAAQ,MAAO,CAAA,YAAA,EAAc,WAAW,CAAA,CAAA;AAC5C,IAAA,OAAA;AAAA,GACF;AACA,EAAA,IAAI,iBAAqB,GAAA,GAAA,CAAuB,SAAU,CAAA,YAAY,KAAK,EAAC,CAAA;AAC5E,EAAA,IAAI,CAAC,KAAA,CAAM,OAAQ,CAAA,iBAAiB,CAAG,EAAA;AACrC,IAAoB,iBAAA,GAAA,CAAC,iBAAkB,CAAA,QAAA,EAAU,CAAA,CAAA;AAAA,GACnD;AACA,EAAC,GAAA,CAAuB,UAAU,YAAc,EAAA;AAAA,IAC9C,GAAG,iBAAA;AAAA,IACH,WAAA;AAAA,GACD,CAAA,CAAA;AACH,CAAA;AAEO,SAAS,eAAe,OAAiB,EAAA;AAC9C,EAAO,OAAA,eAAeC,UACpB,IACA,EAAA;AAAA,IACE,QAAA;AAAA,IACA,GAAM,GAAA,qBAAA;AAAA,GAES,EAAA;AACjB,IAAM,MAAA,YAAA,GAAe,6BAA6B,QAAQ,CAAA,CAAA;AAE1D,IAAA,MAAM,uBAAuB,IAAK,CAAA,GAAA;AAAA,MAChC,GAAG,MAAO,CAAA,IAAA,CAAK,YAAY,CAAA,CAAE,IAAI,MAAM,CAAA;AAAA,KACzC,CAAA;AACA,IAAA,MAAM,eAAkB,GAAA;AAAA,MACtB,EAAA,EAAI,qBAAqB,QAAS,EAAA;AAAA,MAClC,MAAA,EAAQ,aAAa,oBAAoB,CAAA;AAAA,KAC3C,CAAA;AAEA,IAAA,MAAM,IAAO,GAAA,MAAMC,kBAAS,CAAA,OAAA,EAAS,MAAM,eAAiB,EAAA;AAAA,MAC1D,GAAGC,sBAAA;AAAA,MACH,KAAK,GAAM,GAAA,GAAA;AAAA,KACZ,CAAA,CAAA;AAED,IAAA,OAAO,CAAG,EAAA,IAAI,CAAG,EAAA,gBAAgB,GAAG,mBAAmB,CAAA,CAAA,CAAA;AAAA,GACzD,CAAA;AACF,CAAA;AAEO,SAAS,iBAAiB,OAAiB,EAAA;AAChD,EAAO,OAAA,eAAeC,YACpB,IACA,EAAA;AAAA,IACE,QAAA;AAAA,IACA,GAAM,GAAA,qBAAA;AAAA,GAEI,EAAA;AACZ,IAAM,MAAA,YAAA,GAAe,6BAA6B,QAAQ,CAAA,CAAA;AAC1D,IAAA,MAAM,EAAE,kBAAA,EAAoB,YAAa,EAAA,GAAI,UAAU,IAAI,CAAA,CAAA;AAE3D,IAAI,IAAA;AACF,MAAA,MAAM,IACH,GAAA,MAAMC,oBAAW,CAAA,OAAA,EAAS,oBAAoB,YAAc,EAAA;AAAA,QAC3D,GAAGF,sBAAA;AAAA,QACH,KAAK,GAAM,GAAA,GAAA;AAAA,OACZ,KAAM,EAAC,CAAA;AAEV,MAAA,IAAI,iBAAiB,CAAG,EAAA;AACtB,QAAO,OAAA,IAAA,CAAA;AAAA,OACT;AAGA,MAAO,OAAA,EAAE,GAAG,IAAA,CAAK,UAAW,EAAA,CAAA;AAAA,aACrB,KAAO,EAAA;AACd,MACE,IAAA,KAAA,YAAiB,SACjB,2FAA4F,CAAA,IAAA;AAAA,QAC1F,KAAM,CAAA,OAAA;AAAA,OAER,EAAA;AAKA,QAAA,OAAO,EAAC,CAAA;AAAA,OACV;AAEA,MAAM,MAAA,KAAA,CAAA;AAAA,KACR;AAAA,GACF,CAAA;AACF,CAAA;AAEA,SAAS,iBACP,cAC0B,EAAA;AAC1B,EAAA,MAAM,OAAU,GAAA;AAAA,IACd,GAAG,cAAA;AAAA,IACH,GAAG,cAAA;AAAA,IACH,aAAe,EAAA;AAAA,MACb,GAAG,cAAe,CAAA,aAAA;AAAA,MAClB,GAAI,cAAe,CAAA,aAAA,IAAiB,EAAC;AAAA,KACvC;AAAA,GACF,CAAA;AAEA,EAAA,IACE,cAAe,CAAA,aAAA,IACf,QAAY,IAAA,cAAA,CAAe,aAC3B,EAAA;AACA,IAAI,IAAA,cAAA,CAAe,aAAc,CAAA,MAAA,KAAW,KAAW,CAAA,EAAA;AAErD,MAAA,OAAA,CAAQ,GAAM,GAAA,CAAA,CAAA;AAAA,KAChB;AAAA,GACK,MAAA;AACL,IAAA,OAAA,CAAQ,aAAc,CAAA,MAAA,GAAS,mBAAoB,CAAA,OAAA,CAAQ,GAAG,CAAA,CAAA;AAAA,GAChE;AAEA,EAAO,OAAA,OAAA,CAAA;AACT,CAAA;AAEA,IAAM,eACJ,GAAA,yGAAA,CAAA;AAEK,SAAS,oBAAA,CACdF,WACAG,WACA,EAAA;AACA,EAAOE,OAAAA,eAAAA,CAAAA;AAWP,EAAeA,eAAAA,eAAAA,CACb,gBACA,EAAA,mBAAA,EACA,cACyB,EAAA;AACzB,IAAA,IAAI,CAAC,gBAAkB,EAAA;AACrB,MAAM,MAAA,IAAI,MAAM,eAAe,CAAA,CAAA;AAAA,KACjC;AAEA,IAAA,IAAI,CAAC,mBAAqB,EAAA;AACxB,MAAM,MAAA,IAAI,MAAM,eAAe,CAAA,CAAA;AAAA,KACjC;AAEA,IAAA,IAAI,CAAC,cAAgB,EAAA;AACnB,MAAO,OAAA,6BAAA;AAAA,QACL,gBAAA;AAAA,QACA,mBAAA;AAAA,QACAL,SAAAA;AAAA,QACAG,WAAAA;AAAA,OACF,CAAA;AAAA,KACF;AAEA,IAAA,MAAM,GAAM,GAAA,gBAAA,CAAA;AACZ,IAAA,MAAM,GAAM,GAAA,mBAAA,CAAA;AAEZ,IAAA,IAAI,CAAC,cAAgB,EAAA;AACnB,MAAM,MAAA,IAAI,MAAM,eAAe,CAAA,CAAA;AAAA,KACjC;AAEA,IAAI,IAAA,CAAC,eAAe,UAAY,EAAA;AAC9B,MAAM,MAAA,IAAI,MAAM,+CAA+C,CAAA,CAAA;AAAA,KACjE;AAEA,IAAI,IAAA,CAAC,eAAe,QAAU,EAAA;AAC5B,MAAM,MAAA,IAAI,MAAM,4CAA4C,CAAA,CAAA;AAAA,KAC9D;AAEA,IAAM,MAAA,YAAA,GAAe,4BAA6B,CAAA,cAAA,CAAe,QAAQ,CAAA,CAAA;AAEzE,IAAI,IAAA,MAAA,CAAO,MAAO,CAAA,YAAY,CAAE,CAAA,IAAA,CAAK,CAAC,QAAa,KAAA,QAAA,CAAS,MAAS,GAAA,EAAE,CAAG,EAAA;AACxE,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,wEAAA;AAAA,OACF,CAAA;AAAA,KACF;AAEA,IAAI,IAAA,aAAA,GAAgB,iBAAiB,cAAc,CAAA,CAAA;AAEnD,IAAA,MAAM,eAAkB,GAAA,SAAA,CAAU,GAAK,EAAA,aAAA,CAAc,UAAU,CAAA,CAAA;AAC/D,IAAA,MAAM,OAAU,GAAA,eAAA,GACZ,MAAMA,WAAAA,CAAc,eAAiB,EAAA;AAAA,MACnC,QAAU,EAAA,YAAA;AAAA,MACV,KAAK,aAAc,CAAA,GAAA;AAAA,KACpB,IACA,EAAC,CAAA;AAEN,IAAA,MAAA,CAAO,iBAAiB,OAAS,EAAA;AAAA,MAC/B,YAAc,EAAA;AAAA,QACZ,KAAA,EAAO,SAAS,YAAA,CAAa,iBAAmC,EAAA;AAC9D,UAAA,aAAA,GAAgB,iBAAiB,iBAAiB,CAAA,CAAA;AAAA,SACpD;AAAA,OACF;AAAA,MACA,IAAM,EAAA;AAAA,QACJ,KAAA,EAAO,eAAe,IAAO,GAAA;AAC3B,UAAI,IAAA,aAAA,IAAiB,GAAO,IAAA,GAAA,CAAI,WAAa,EAAA;AAC3C,YAAA,MAAM,IAAI,KAAA;AAAA,cACR,qJAAA;AAAA,aACF,CAAA;AAAA,WACF;AAEA,UAAM,MAAA,IAAA,GAAO,MAAMH,SAAAA,CAAS,OAAS,EAAA;AAAA,YACnC,QAAU,EAAA,YAAA;AAAA,YACV,KAAK,aAAc,CAAA,GAAA;AAAA,WACpB,CAAA,CAAA;AACD,UAAA,MAAM,WAAc,GAAAM,gBAAA;AAAA,YAClB,aAAc,CAAA,UAAA;AAAA,YACd,IAAA;AAAA,YACA,aAAc,CAAA,aAAA;AAAA,WAChB,CAAA;AAEA,UAAI,IAAA,WAAA,CAAY,SAAS,IAAM,EAAA;AAC7B,YAAA,MAAM,IAAI,KAAA;AAAA,cACR,CAAA,wCAAA,EAA2C,YAAY,MAAM,CAAA,0DAAA,CAAA;AAAA,aAC/D,CAAA;AAAA,WACF;AAEA,UAAA,SAAA,CAAU,KAAK,WAAW,CAAA,CAAA;AAAA,SAC5B;AAAA,OACF;AAAA,MAEA,OAAS,EAAA;AAAA,QACP,KAAA,EAAO,SAAS,OAAU,GAAA;AACxB,UAAA,MAAA,CAAO,IAAK,CAAA,OAAO,CAAE,CAAA,OAAA,CAAQ,CAAC,GAAQ,KAAA;AACpC,YAAA,OAAQ,QAAoC,GAAG,CAAA,CAAA;AAAA,WAChD,CAAA,CAAA;AACD,UAAA,MAAM,WAAc,GAAAA,gBAAA,CAAU,aAAc,CAAA,UAAA,EAAY,EAAI,EAAA;AAAA,YAC1D,GAAG,aAAc,CAAA,aAAA;AAAA,YACjB,MAAQ,EAAA,CAAA;AAAA,WACT,CAAA,CAAA;AAED,UAAA,SAAA,CAAU,KAAK,WAAW,CAAA,CAAA;AAAA,SAC5B;AAAA,OACF;AAAA,KACD,CAAA,CAAA;AAED,IAAO,OAAA,OAAA,CAAA;AAAA,GACT;AACF,CAAA;AAEA,eAAe,6BACb,CAAA,WAAA,EACA,cACAN,EAAAA,SAAAA,EACAG,WACyB,EAAA;AACzB,EAAI,IAAA,CAAC,eAAe,UAAY,EAAA;AAC9B,IAAM,MAAA,IAAI,MAAM,+CAA+C,CAAA,CAAA;AAAA,GACjE;AAEA,EAAI,IAAA,CAAC,eAAe,QAAU,EAAA;AAC5B,IAAM,MAAA,IAAI,MAAM,4CAA4C,CAAA,CAAA;AAAA,GAC9D;AAEA,EAAM,MAAA,YAAA,GAAe,4BAA6B,CAAA,cAAA,CAAe,QAAQ,CAAA,CAAA;AAEzE,EAAI,IAAA,MAAA,CAAO,MAAO,CAAA,YAAY,CAAE,CAAA,IAAA,CAAK,CAAC,QAAa,KAAA,QAAA,CAAS,MAAS,GAAA,EAAE,CAAG,EAAA;AACxE,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,wEAAA;AAAA,KACF,CAAA;AAAA,GACF;AAEA,EAAI,IAAA,aAAA,GAAgB,iBAAiB,cAAc,CAAA,CAAA;AACnD,EAAA,MAAM,eAAkB,GAAA,qBAAA;AAAA,IACtB,aAAc,CAAA,UAAA;AAAA,IACd,WAAA;AAAA,GACF,CAAA;AACA,EAAA,MAAM,OAAU,GAAA,eAAA,GACZ,MAAMA,WAAAA,CAAc,eAAiB,EAAA;AAAA,IACnC,QAAU,EAAA,YAAA;AAAA,IACV,KAAK,aAAc,CAAA,GAAA;AAAA,GACpB,IACA,EAAC,CAAA;AAEN,EAAA,MAAA,CAAO,iBAAiB,OAAS,EAAA;AAAA,IAC/B,YAAc,EAAA;AAAA,MACZ,KAAA,EAAO,SAAS,YAAA,CAAa,iBAAmC,EAAA;AAC9D,QAAA,aAAA,GAAgB,iBAAiB,iBAAiB,CAAA,CAAA;AAAA,OACpD;AAAA,KACF;AAAA,IACA,IAAM,EAAA;AAAA,MACJ,KAAA,EAAO,eAAe,IAAO,GAAA;AAC3B,QAAM,MAAA,IAAA,GAAO,MAAMH,SAAAA,CAAS,OAAS,EAAA;AAAA,UACnC,QAAU,EAAA,YAAA;AAAA,UACV,KAAK,aAAc,CAAA,GAAA;AAAA,SACpB,CAAA,CAAA;AAED,QAAM,MAAA,YAAA,GACJ,aAAc,CAAA,UAAA,CAAW,MACzB,GAAA,IAAA,CAAK,SACL,IAAK,CAAA,SAAA,CAAU,aAAc,CAAA,aAAa,CAAE,CAAA,MAAA,CAAA;AAE9C,QAAA,IAAI,eAAe,IAAM,EAAA;AACvB,UAAA,MAAM,IAAI,KAAA;AAAA,YACR,2CAA2C,YAAY,CAAA,0DAAA,CAAA;AAAA,WACzD,CAAA;AAAA,SACF;AAEA,QAAY,WAAA,CAAA,GAAA;AAAA,UACV,aAAc,CAAA,UAAA;AAAA,UACd,IAAA;AAAA,UACA,aAAc,CAAA,aAAA;AAAA,SAChB,CAAA;AAAA,OACF;AAAA,KACF;AAAA,IAEA,OAAS,EAAA;AAAA,MACP,KAAA,EAAO,SAAS,OAAU,GAAA;AACxB,QAAA,MAAA,CAAO,IAAK,CAAA,OAAO,CAAE,CAAA,OAAA,CAAQ,CAAC,GAAQ,KAAA;AACpC,UAAA,OAAQ,QAAoC,GAAG,CAAA,CAAA;AAAA,SAChD,CAAA,CAAA;AAED,QAAA,MAAM,gBAAgB,EAAE,GAAG,aAAc,CAAA,aAAA,EAAe,QAAQ,CAAE,EAAA,CAAA;AAClE,QAAA,WAAA,CAAY,GAAI,CAAA,aAAA,CAAc,UAAY,EAAA,EAAA,EAAI,aAAa,CAAA,CAAA;AAAA,OAC7D;AAAA,KACF;AAAA,GACD,CAAA,CAAA;AAED,EAAO,OAAA,OAAA,CAAA;AACT,CAAA;AC9ea,IAAA,QAAA,GAAW,eAAeO,iBAAM,EAAA;AAChC,IAAA,UAAA,GAAa,iBAAiBA,iBAAM,EAAA;AACpC,IAAA,cAAA,GAAiB,oBAAqB,CAAA,QAAA,EAAU,UAAU","file":"index.cjs","sourcesContent":["import type { IncomingMessage, ServerResponse } from \"http\";\nimport { parse, serialize, type CookieSerializeOptions } from \"cookie\";\nimport {\n  defaults as ironDefaults,\n  seal as ironSeal,\n  unseal as ironUnseal,\n} from \"iron-webcrypto\";\n\ntype PasswordsMap = Record<string, string>;\ntype Password = PasswordsMap | string;\ntype RequestType = IncomingMessage | Request;\ntype ResponseType = Response | ServerResponse;\n\n/**\n * {@link https://wicg.github.io/cookie-store/#dictdef-cookielistitem CookieListItem}\n * as specified by W3C.\n */\ninterface CookieListItem\n  extends Pick<\n    CookieSerializeOptions,\n    \"domain\" | \"path\" | \"sameSite\" | \"secure\"\n  > {\n  /** A string with the name of a cookie. */\n  name: string;\n  /** A string containing the value of the cookie. */\n  value: string;\n  /** A number of milliseconds or Date interface containing the expires of the cookie. */\n  expires?: CookieSerializeOptions[\"expires\"] | number;\n}\n\n/**\n * Superset of {@link CookieListItem} extending it with\n * the `httpOnly`, `maxAge` and `priority` properties.\n */\ntype ResponseCookie = CookieListItem &\n  Pick<CookieSerializeOptions, \"httpOnly\" | \"maxAge\" | \"priority\">;\n\n/**\n * The high-level type definition of the .get() and .set() methods\n * of { cookies() } from \"next/headers\"\n */\nexport interface CookieStore {\n  get: (name: string) => { name: string; value: string } | undefined;\n  set: {\n    (name: string, value: string, cookie?: Partial<ResponseCookie>): void;\n    (options: ResponseCookie): void;\n  };\n}\n\n/**\n * Set-Cookie Attributes do not include `encode`. We omit this from our `cookieOptions` type.\n *\n * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie\n * @see https://developer.chrome.com/docs/devtools/application/cookies/\n */\ntype CookieOptions = Omit<CookieSerializeOptions, \"encode\">;\n\nexport interface SessionOptions {\n  /**\n   * The cookie name that will be used inside the browser. Make sure it's unique\n   * given your application.\n   *\n   * @example 'vercel-session'\n   */\n  cookieName: string;\n\n  /**\n   * The password(s) that will be used to encrypt the cookie. Can either be a string\n   * or an object.\n   *\n   * When you provide multiple passwords then all of them will be used to decrypt\n   * the cookie. But only the most recent (`= highest key`, `2` in the example)\n   * password will be used to encrypt the cookie. This allows password rotation.\n   *\n   * @example { 1: 'password-1', 2: 'password-2' }\n   */\n  password: Password;\n\n  /**\n   * The time (in seconds) that the session will be valid for. Also sets the\n   * `max-age` attribute of the cookie automatically (`= ttl - 60s`, so that the\n   * cookie always expire before the session).\n   *\n   * `ttl = 0` means no expiration.\n   *\n   * @default 1209600\n   */\n  ttl?: number;\n\n  /**\n   * The options that will be passed to the cookie library.\n   *\n   * If you want to use \"session cookies\" (cookies that are deleted when the browser\n   * is closed) then you need to pass `cookieOptions: { maxAge: undefined }`\n   *\n   * @see https://github.com/jshttp/cookie#options-1\n   */\n  cookieOptions?: CookieOptions;\n}\n\nexport type IronSession<T> = T & {\n  /**\n   * Encrypts the session data and sets the cookie.\n   */\n  readonly save: () => Promise<void>;\n\n  /**\n   * Destroys the session data and removes the cookie.\n   */\n  readonly destroy: () => void;\n\n  /**\n   * Update the session configuration. You still need to call save() to send the new cookie.\n   */\n  readonly updateConfig: (newSessionOptions: SessionOptions) => void;\n};\n\n// default time allowed to check for iron seal validity when ttl passed\n// see https://hapi.dev/module/iron/api/?v=7.0.1#options\nconst timestampSkewSec = 60;\nconst fourteenDaysInSeconds = 14 * 24 * 3600;\n\n// We store a token major version to handle data format changes so that the cookies\n// can be kept alive between upgrades, no need to disconnect everyone.\nconst currentMajorVersion = 2;\nconst versionDelimiter = \"~\";\n\nconst defaultOptions: Required<Pick<SessionOptions, \"ttl\" | \"cookieOptions\">> =\n  {\n    ttl: fourteenDaysInSeconds,\n    cookieOptions: { httpOnly: true, secure: true, sameSite: \"lax\", path: \"/\" },\n  };\n\nfunction normalizeStringPasswordToMap(password: Password): PasswordsMap {\n  return typeof password === \"string\" ? { 1: password } : password;\n}\n\nfunction parseSeal(seal: string): {\n  sealWithoutVersion: string;\n  tokenVersion: number | null;\n} {\n  const [sealWithoutVersion, tokenVersionAsString] =\n    seal.split(versionDelimiter);\n  const tokenVersion =\n    tokenVersionAsString == null ? null : parseInt(tokenVersionAsString, 10);\n\n  // eslint-disable-next-line @typescript-eslint/no-non-null-assertion\n  return { sealWithoutVersion: sealWithoutVersion!, tokenVersion };\n}\n\nfunction computeCookieMaxAge(ttl: number): number {\n  if (ttl === 0) {\n    // ttl = 0 means no expiration\n    // but in reality cookies have to expire (can't have no max-age)\n    // 2147483647 is the max value for max-age in cookies\n    // see https://stackoverflow.com/a/11685301/147079\n    return 2147483647;\n  }\n\n  // The next line makes sure browser will expire cookies before seals are considered expired by the server.\n  // It also allows for clock difference of 60 seconds between server and clients.\n  return ttl - timestampSkewSec;\n}\n\nfunction getCookie(req: RequestType, cookieName: string): string {\n  return (\n    parse(\n      (\"headers\" in req && typeof req.headers.get === \"function\"\n        ? req.headers.get(\"cookie\")\n        : (req as IncomingMessage).headers.cookie) ?? \"\",\n    )[cookieName] ?? \"\"\n  );\n}\n\nfunction getServerActionCookie(\n  cookieName: string,\n  cookieHandler: CookieStore,\n): string {\n  const cookieObject = cookieHandler.get(cookieName);\n  const cookie = cookieObject?.value;\n  if (typeof cookie === \"string\") {\n    return cookie;\n  }\n  return \"\";\n}\n\nfunction setCookie(res: ResponseType, cookieValue: string): void {\n  if (\"headers\" in res && typeof res.headers.append === \"function\") {\n    res.headers.append(\"set-cookie\", cookieValue);\n    return;\n  }\n  let existingSetCookie = (res as ServerResponse).getHeader(\"set-cookie\") ?? [];\n  if (!Array.isArray(existingSetCookie)) {\n    existingSetCookie = [existingSetCookie.toString()];\n  }\n  (res as ServerResponse).setHeader(\"set-cookie\", [\n    ...existingSetCookie,\n    cookieValue,\n  ]);\n}\n\nexport function createSealData(_crypto: Crypto) {\n  return async function sealData(\n    data: unknown,\n    {\n      password,\n      ttl = fourteenDaysInSeconds,\n    }: { password: Password; ttl?: number },\n  ): Promise<string> {\n    const passwordsMap = normalizeStringPasswordToMap(password);\n\n    const mostRecentPasswordId = Math.max(\n      ...Object.keys(passwordsMap).map(Number),\n    );\n    const passwordForSeal = {\n      id: mostRecentPasswordId.toString(),\n      secret: passwordsMap[mostRecentPasswordId]!,\n    };\n\n    const seal = await ironSeal(_crypto, data, passwordForSeal, {\n      ...ironDefaults,\n      ttl: ttl * 1000,\n    });\n\n    return `${seal}${versionDelimiter}${currentMajorVersion}`;\n  };\n}\n\nexport function createUnsealData(_crypto: Crypto) {\n  return async function unsealData<T>(\n    seal: string,\n    {\n      password,\n      ttl = fourteenDaysInSeconds,\n    }: { password: Password; ttl?: number },\n  ): Promise<T> {\n    const passwordsMap = normalizeStringPasswordToMap(password);\n    const { sealWithoutVersion, tokenVersion } = parseSeal(seal);\n\n    try {\n      const data =\n        (await ironUnseal(_crypto, sealWithoutVersion, passwordsMap, {\n          ...ironDefaults,\n          ttl: ttl * 1000,\n        })) ?? {};\n\n      if (tokenVersion === 2) {\n        return data as T;\n      }\n\n      // @ts-expect-error `persistent` does not exist on newer tokens\n      return { ...data.persistent } as T;\n    } catch (error) {\n      if (\n        error instanceof Error &&\n        /^(Expired seal|Bad hmac value|Cannot find password|Incorrect number of sealed components)/.test(\n          error.message,\n        )\n      ) {\n        // if seal expired or\n        // if seal is not valid (encrypted using a different password, when passwords are badly rotated) or\n        // if we can't find back the password in the seal\n        // then we just start a new session over\n        return {} as T;\n      }\n\n      throw error;\n    }\n  };\n}\n\nfunction getSessionConfig(\n  sessionOptions: SessionOptions,\n): Required<SessionOptions> {\n  const options = {\n    ...defaultOptions,\n    ...sessionOptions,\n    cookieOptions: {\n      ...defaultOptions.cookieOptions,\n      ...(sessionOptions.cookieOptions || {}),\n    },\n  };\n\n  if (\n    sessionOptions.cookieOptions &&\n    \"maxAge\" in sessionOptions.cookieOptions\n  ) {\n    if (sessionOptions.cookieOptions.maxAge === undefined) {\n      // session cookies, do not set maxAge, consider token as infinite\n      options.ttl = 0;\n    }\n  } else {\n    options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);\n  }\n\n  return options;\n}\n\nconst badUsageMessage =\n  \"iron-session: Bad usage: use getIronSession(req, res, options) or getIronSession(cookieStore, options).\";\n\nexport function createGetIronSession(\n  sealData: ReturnType<typeof createSealData>,\n  unsealData: ReturnType<typeof createUnsealData>,\n) {\n  return getIronSession;\n\n  async function getIronSession<T extends object>(\n    cookies: CookieStore,\n    sessionOptions: SessionOptions,\n  ): Promise<IronSession<T>>;\n  async function getIronSession<T extends object>(\n    req: RequestType,\n    res: ResponseType,\n    sessionOptions: SessionOptions,\n  ): Promise<IronSession<T>>;\n  async function getIronSession<T extends object>(\n    reqOrCookieStore: RequestType | CookieStore,\n    resOrsessionOptions: ResponseType | SessionOptions,\n    sessionOptions?: SessionOptions,\n  ): Promise<IronSession<T>> {\n    if (!reqOrCookieStore) {\n      throw new Error(badUsageMessage);\n    }\n\n    if (!resOrsessionOptions) {\n      throw new Error(badUsageMessage);\n    }\n\n    if (!sessionOptions) {\n      return getIronSessionFromCookieStore<T>(\n        reqOrCookieStore as CookieStore,\n        resOrsessionOptions as SessionOptions,\n        sealData,\n        unsealData,\n      );\n    }\n\n    const req = reqOrCookieStore as RequestType;\n    const res = resOrsessionOptions as ResponseType;\n\n    if (!sessionOptions) {\n      throw new Error(badUsageMessage);\n    }\n\n    if (!sessionOptions.cookieName) {\n      throw new Error(\"iron-session: Bad usage. Missing cookie name.\");\n    }\n\n    if (!sessionOptions.password) {\n      throw new Error(\"iron-session: Bad usage. Missing password.\");\n    }\n\n    const passwordsMap = normalizeStringPasswordToMap(sessionOptions.password);\n\n    if (Object.values(passwordsMap).some((password) => password.length < 32)) {\n      throw new Error(\n        \"iron-session: Bad usage. Password must be at least 32 characters long.\",\n      );\n    }\n\n    let sessionConfig = getSessionConfig(sessionOptions);\n\n    const sealFromCookies = getCookie(req, sessionConfig.cookieName);\n    const session = sealFromCookies\n      ? await unsealData<T>(sealFromCookies, {\n          password: passwordsMap,\n          ttl: sessionConfig.ttl,\n        })\n      : ({} as T);\n\n    Object.defineProperties(session, {\n      updateConfig: {\n        value: function updateConfig(newSessionOptions: SessionOptions) {\n          sessionConfig = getSessionConfig(newSessionOptions);\n        },\n      },\n      save: {\n        value: async function save() {\n          if (\"headersSent\" in res && res.headersSent) {\n            throw new Error(\n              \"iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()\",\n            );\n          }\n\n          const seal = await sealData(session, {\n            password: passwordsMap,\n            ttl: sessionConfig.ttl,\n          });\n          const cookieValue = serialize(\n            sessionConfig.cookieName,\n            seal,\n            sessionConfig.cookieOptions,\n          );\n\n          if (cookieValue.length > 4096) {\n            throw new Error(\n              `iron-session: Cookie length is too big (${cookieValue.length} bytes), browsers will refuse it. Try to remove some data.`,\n            );\n          }\n\n          setCookie(res, cookieValue);\n        },\n      },\n\n      destroy: {\n        value: function destroy() {\n          Object.keys(session).forEach((key) => {\n            delete (session as Record<string, unknown>)[key];\n          });\n          const cookieValue = serialize(sessionConfig.cookieName, \"\", {\n            ...sessionConfig.cookieOptions,\n            maxAge: 0,\n          });\n\n          setCookie(res, cookieValue);\n        },\n      },\n    });\n\n    return session as IronSession<T>;\n  }\n}\n\nasync function getIronSessionFromCookieStore<T extends object>(\n  cookieStore: CookieStore,\n  sessionOptions: SessionOptions,\n  sealData: ReturnType<typeof createSealData>,\n  unsealData: ReturnType<typeof createUnsealData>,\n): Promise<IronSession<T>> {\n  if (!sessionOptions.cookieName) {\n    throw new Error(\"iron-session: Bad usage. Missing cookie name.\");\n  }\n\n  if (!sessionOptions.password) {\n    throw new Error(\"iron-session: Bad usage. Missing password.\");\n  }\n\n  const passwordsMap = normalizeStringPasswordToMap(sessionOptions.password);\n\n  if (Object.values(passwordsMap).some((password) => password.length < 32)) {\n    throw new Error(\n      \"iron-session: Bad usage. Password must be at least 32 characters long.\",\n    );\n  }\n\n  let sessionConfig = getSessionConfig(sessionOptions);\n  const sealFromCookies = getServerActionCookie(\n    sessionConfig.cookieName,\n    cookieStore,\n  );\n  const session = sealFromCookies\n    ? await unsealData<T>(sealFromCookies, {\n        password: passwordsMap,\n        ttl: sessionConfig.ttl,\n      })\n    : ({} as T);\n\n  Object.defineProperties(session, {\n    updateConfig: {\n      value: function updateConfig(newSessionOptions: SessionOptions) {\n        sessionConfig = getSessionConfig(newSessionOptions);\n      },\n    },\n    save: {\n      value: async function save() {\n        const seal = await sealData(session, {\n          password: passwordsMap,\n          ttl: sessionConfig.ttl,\n        });\n\n        const cookieLength =\n          sessionConfig.cookieName.length +\n          seal.length +\n          JSON.stringify(sessionConfig.cookieOptions).length;\n\n        if (cookieLength > 4096) {\n          throw new Error(\n            `iron-session: Cookie length is too big (${cookieLength} bytes), browsers will refuse it. Try to remove some data.`,\n          );\n        }\n\n        cookieStore.set(\n          sessionConfig.cookieName,\n          seal,\n          sessionConfig.cookieOptions,\n        );\n      },\n    },\n\n    destroy: {\n      value: function destroy() {\n        Object.keys(session).forEach((key) => {\n          delete (session as Record<string, unknown>)[key];\n        });\n\n        const cookieOptions = { ...sessionConfig.cookieOptions, maxAge: 0 };\n        cookieStore.set(sessionConfig.cookieName, \"\", cookieOptions);\n      },\n    },\n  });\n\n  return session as IronSession<T>;\n}\n","import {\n  createGetIronSession,\n  createSealData,\n  createUnsealData,\n} from \"./core.js\";\n\nimport * as crypto from \"uncrypto\";\n\nexport type { IronSession, SessionOptions } from \"./core.js\";\nexport const sealData = createSealData(crypto);\nexport const unsealData = createUnsealData(crypto);\nexport const getIronSession = createGetIronSession(sealData, unsealData);\n"]}

package/dist/index.d.cts

@@ -1,115 +0,0 @@
-import * as http from 'http';
-import { CookieSerializeOptions } from 'cookie';
-
-type PasswordsMap = Record<string, string>;
-type Password = PasswordsMap | string;
-/**
- * {@link https://wicg.github.io/cookie-store/#dictdef-cookielistitem CookieListItem}
- * as specified by W3C.
- */
-interface CookieListItem extends Pick<CookieSerializeOptions, "domain" | "path" | "sameSite" | "secure"> {
-    /** A string with the name of a cookie. */
-    name: string;
-    /** A string containing the value of the cookie. */
-    value: string;
-    /** A number of milliseconds or Date interface containing the expires of the cookie. */
-    expires?: CookieSerializeOptions["expires"] | number;
-}
-/**
- * Superset of {@link CookieListItem} extending it with
- * the `httpOnly`, `maxAge` and `priority` properties.
- */
-type ResponseCookie = CookieListItem & Pick<CookieSerializeOptions, "httpOnly" | "maxAge" | "priority">;
-/**
- * The high-level type definition of the .get() and .set() methods
- * of { cookies() } from "next/headers"
- */
-interface CookieStore {
-    get: (name: string) => {
-        name: string;
-        value: string;
-    } | undefined;
-    set: {
-        (name: string, value: string, cookie?: Partial<ResponseCookie>): void;
-        (options: ResponseCookie): void;
-    };
-}
-/**
- * Set-Cookie Attributes do not include `encode`. We omit this from our `cookieOptions` type.
- *
- * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie
- * @see https://developer.chrome.com/docs/devtools/application/cookies/
- */
-type CookieOptions = Omit<CookieSerializeOptions, "encode">;
-interface SessionOptions {
-    /**
-     * The cookie name that will be used inside the browser. Make sure it's unique
-     * given your application.
-     *
-     * @example 'vercel-session'
-     */
-    cookieName: string;
-    /**
-     * The password(s) that will be used to encrypt the cookie. Can either be a string
-     * or an object.
-     *
-     * When you provide multiple passwords then all of them will be used to decrypt
-     * the cookie. But only the most recent (`= highest key`, `2` in the example)
-     * password will be used to encrypt the cookie. This allows password rotation.
-     *
-     * @example { 1: 'password-1', 2: 'password-2' }
-     */
-    password: Password;
-    /**
-     * The time (in seconds) that the session will be valid for. Also sets the
-     * `max-age` attribute of the cookie automatically (`= ttl - 60s`, so that the
-     * cookie always expire before the session).
-     *
-     * `ttl = 0` means no expiration.
-     *
-     * @default 1209600
-     */
-    ttl?: number;
-    /**
-     * The options that will be passed to the cookie library.
-     *
-     * If you want to use "session cookies" (cookies that are deleted when the browser
-     * is closed) then you need to pass `cookieOptions: { maxAge: undefined }`
-     *
-     * @see https://github.com/jshttp/cookie#options-1
-     */
-    cookieOptions?: CookieOptions;
-}
-type IronSession<T> = T & {
-    /**
-     * Encrypts the session data and sets the cookie.
-     */
-    readonly save: () => Promise<void>;
-    /**
-     * Destroys the session data and removes the cookie.
-     */
-    readonly destroy: () => void;
-    /**
-     * Update the session configuration. You still need to call save() to send the new cookie.
-     */
-    readonly updateConfig: (newSessionOptions: SessionOptions) => void;
-};
-
-declare const sealData: (data: unknown, { password, ttl, }: {
-    password: string | {
-        [x: string]: string;
-    };
-    ttl?: number;
-}) => Promise<string>;
-declare const unsealData: <T>(seal: string, { password, ttl, }: {
-    password: string | {
-        [x: string]: string;
-    };
-    ttl?: number;
-}) => Promise<T>;
-declare const getIronSession: {
-    <T extends object>(cookies: CookieStore, sessionOptions: SessionOptions): Promise<IronSession<T>>;
-    <T extends object>(req: http.IncomingMessage | Request, res: Response | http.ServerResponse<http.IncomingMessage>, sessionOptions: SessionOptions): Promise<IronSession<T>>;
-};
-
-export { type IronSession, type SessionOptions, getIronSession, sealData, unsealData };