unjwt 0.5.36 → 0.5.38

package/README.md

@@ -605,6 +605,9 @@ console.log(rsaPublicSpki);
 
 ### Adapters
 
+> [!WARNING]
+> While these adapters try to be compatible with h3's `useSession` API, the key difference is that new sessions are not automatically created when calling `useJWESession` or `useJWSSession`, marking their `id` as `undefined` until you explicitly call `session.update()`. This is to comply with various specs that do integrate JWT one (such as OAuth) where sessions are only created upon valid operations (like user authorization).
+
 #### H3 v1 (Nuxt v4, Nitro v2)
 
 The `h3v1` adapter bundles session helpers that store data inside signed or encrypted JWTs.

package/dist/adapters/h3.d.mts

@@ -18,7 +18,9 @@ interface SessionManager<T extends Record<string, any> = SessionClaims, ConfigMa
     readonly expiresAt: ConfigMaxAge extends ExpiresIn ? number : "exp" extends keyof T ? T["exp"] : number | undefined;
     readonly data: SessionData<T>;
     readonly token: string | undefined;
-    update: (update: SessionUpdate<T>) => Promise<SessionManager<T, ConfigMaxAge>>;
+    update: (update: SessionUpdate<T>) => Promise<SessionManager<T, ConfigMaxAge> & {
+        readonly id: string;
+    }>;
     clear: () => Promise<SessionManager<T, ConfigMaxAge>>;
 }
 
@@ -30,7 +32,7 @@ interface SessionManager<T extends Record<string, any> = SessionClaims, ConfigMa
 
 declare const kGetSessionPromise$1: unique symbol;
 interface SessionJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
-    id: string;
+    id: string | undefined;
     createdAt: number;
     expiresAt: MaxAge extends ExpiresIn ? number : T["exp"];
     data: SessionData<T>;
@@ -151,7 +153,7 @@ declare function clearJWESession<T extends Record<string, any> = SessionClaims,
 
 declare const kGetSessionPromise: unique symbol;
 interface SessionJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
-    id: string;
+    id: string | undefined;
     createdAt: number;
     expiresAt: MaxAge extends ExpiresIn ? number : T["exp"];
     data: SessionData<T>;

package/dist/adapters/h3.mjs

@@ -80,10 +80,12 @@ async function getJWESession(event, config) {
     });
     return session2;
   }
+  const now = config.jwe?.encryptOptions?.currentDate?.getTime() ?? Date.now();
+  const createdAt = now - now % 1e3;
   const session = {
-    id: "",
-    createdAt: 0,
-    expiresAt: void 0,
+    id: void 0,
+    createdAt,
+    expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3,
     data: /* @__PURE__ */ Object.create(null)
   };
   event.context.sessions[sessionName] = session;
@@ -114,17 +116,6 @@ async function getJWESession(event, config) {
     event.context.sessions[sessionName][kGetSessionPromise$1] = promise;
     await promise;
   }
-  if (!session.id) {
-    if (!isEvent(event)) {
-      throw new Error(
-        "Cannot initialize a new session. Use `useSession(event)` within the main handler."
-      );
-    }
-    session.id = config.generateId?.() ?? crypto.randomUUID();
-    session.createdAt = config.jwe?.encryptOptions?.currentDate?.getTime() ?? Date.now();
-    session.expiresAt = config.maxAge === void 0 ? void 0 : session.createdAt + computeExpiresInSeconds(config.maxAge) * 1e3;
-    await updateJWESession(event, config);
-  }
   await config.hooks?.onRead?.({
     event,
     session,
@@ -183,6 +174,11 @@ function _getResHeader$1(event, name) {
   }
 }
 async function updateJWESession(event, config, update) {
+  if (!isEvent(event)) {
+    throw new Error(
+      "Cannot update a new session. Use `useSession(event)` within the main handler."
+    );
+  }
   const sessionName = config.name || DEFAULT_NAME$1;
   const session = event.context.sessions?.[sessionName] || await getJWESession(event, config);
   if (typeof update === "function") {
@@ -198,6 +194,13 @@ async function updateJWESession(event, config, update) {
       config
     });
   }
+  const now = config.jwe?.encryptOptions?.currentDate?.getTime() ?? Date.now();
+  const createdAt = now - now % 1e3;
+  Object.assign(session, {
+    id: config.generateId?.() || crypto.randomUUID(),
+    createdAt,
+    expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3
+  });
   if (config.cookie !== false) {
     const sealed = await sealJWESession(event, config);
     setCookie(event, sessionName, sealed, {
@@ -215,8 +218,8 @@ async function sealJWESession(event, config) {
   const key = getEncryptKey(config.key || config.secret);
   const sessionName = config.name || DEFAULT_NAME$1;
   const session = event.context.sessions?.[sessionName] || await getJWESession(event, config);
-  const iat = Math.floor(Date.now() / 1e3);
-  const exp = config.maxAge === void 0 ? void 0 : iat + computeExpiresInSeconds(config.maxAge);
+  const iat = Math.floor(session.createdAt / 1e3);
+  const exp = session.expiresAt ? Math.floor(session.expiresAt / 1e3) : void 0;
   const payload = {
     ...session.data,
     jti: session.id,
@@ -429,10 +432,12 @@ async function getJWSSession(event, config) {
     });
     return session2;
   }
+  const now = config.jws?.signOptions?.currentDate?.getTime() ?? Date.now();
+  const createdAt = now - now % 1e3;
   const session = {
-    id: "",
-    createdAt: 0,
-    expiresAt: void 0,
+    id: void 0,
+    createdAt,
+    expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3,
     data: /* @__PURE__ */ Object.create(null)
   };
   event.context.sessions[sessionName] = session;
@@ -463,17 +468,6 @@ async function getJWSSession(event, config) {
     session[kGetSessionPromise] = promise;
     await promise;
   }
-  if (!session.id) {
-    if (!isEvent(event)) {
-      throw new Error(
-        "Cannot initialize a new session outside main handler. Use `useJWSSession(event)` properly."
-      );
-    }
-    session.id = config.generateId?.() ?? crypto.randomUUID();
-    session.createdAt = config.jws?.signOptions?.currentDate?.getTime() ?? Date.now();
-    session.expiresAt = config.maxAge === void 0 ? void 0 : session.createdAt + computeExpiresInSeconds(config.maxAge) * 1e3;
-    await updateJWSSession(event, config);
-  }
   await config.hooks?.onRead?.({
     event,
     session,
@@ -532,6 +526,11 @@ function _getResHeader(event, name) {
   }
 }
 async function updateJWSSession(event, config, update) {
+  if (!isEvent(event)) {
+    throw new Error(
+      "Cannot update a new session. Use `useSession(event)` within the main handler."
+    );
+  }
   const sessionName = config.name || DEFAULT_NAME;
   const session = event.context.sessions?.[sessionName] || await getJWSSession(event, config);
   if (typeof update === "function") {
@@ -547,6 +546,13 @@ async function updateJWSSession(event, config, update) {
       config
     });
   }
+  const now = config.jws?.signOptions?.currentDate?.getTime() ?? Date.now();
+  const createdAt = now - now % 1e3;
+  Object.assign(session, {
+    id: config.generateId?.() || crypto.randomUUID(),
+    createdAt,
+    expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3
+  });
   if (config.cookie !== false) {
     const token = await signJWSSession(event, config);
     setCookie(event, sessionName, token, {
@@ -563,8 +569,8 @@ async function signJWSSession(event, config) {
   const key = getSignKey(config.key);
   const sessionName = config.name || DEFAULT_NAME;
   const session = event.context.sessions?.[sessionName] || await getJWSSession(event, config);
-  const iat = Math.floor(Date.now() / 1e3);
-  const exp = config.maxAge === void 0 ? void 0 : iat + computeExpiresInSeconds(config.maxAge);
+  const iat = Math.floor(session.createdAt / 1e3);
+  const exp = session.expiresAt ? Math.floor(session.expiresAt / 1e3) : void 0;
   const payload = {
     ...session.data,
     jti: session.id,

package/dist/adapters/h3v2.d.mts

@@ -24,7 +24,7 @@ interface SessionManager<T extends Record<string, any> = SessionClaims, ConfigMa
 
 declare const kGetSessionPromise$1: unique symbol;
 interface SessionJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
-    id: string;
+    id: string | undefined;
     createdAt: number;
     expiresAt: MaxAge extends ExpiresIn ? number : T["exp"];
     data: SessionData<T>;
@@ -116,7 +116,7 @@ declare function clearJWESession<T extends Record<string, any> = SessionClaims,
 
 declare const kGetSessionPromise: unique symbol;
 interface SessionJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
-    id: string;
+    id: string | undefined;
     createdAt: number;
     expiresAt: MaxAge extends ExpiresIn ? number : T["exp"];
     data: SessionData<T>;

package/dist/adapters/h3v2.mjs

@@ -70,10 +70,12 @@ async function getJWESession(event, config) {
     });
     return session2;
   }
+  const now = config.jwe?.encryptOptions?.currentDate?.getTime() ?? Date.now();
+  const createdAt = now - now % 1e3;
   const session = {
-    id: "",
-    createdAt: 0,
-    expiresAt: void 0,
+    id: void 0,
+    createdAt,
+    expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3,
     data: new NullProtoObj()
   };
   context.sessions[sessionName] = session;
@@ -107,12 +109,6 @@ async function getJWESession(event, config) {
     session[kGetSessionPromise$1] = promise;
     await promise;
   }
-  if (!session.id) {
-    session.id = config.generateId?.() ?? crypto.randomUUID();
-    session.createdAt = config.jwe?.encryptOptions?.currentDate?.getTime() ?? Date.now();
-    session.expiresAt = config.maxAge === void 0 ? void 0 : session.createdAt + computeExpiresInSeconds(config.maxAge) * 1e3;
-    await updateJWESession(event, config);
-  }
   await config.hooks?.onRead?.({
     event,
     session,
@@ -158,6 +154,13 @@ async function updateJWESession(event, config, update) {
       config
     });
   }
+  const now = config.jwe?.encryptOptions?.currentDate?.getTime() ?? Date.now();
+  const createdAt = now - now % 1e3;
+  Object.assign(session, {
+    id: config.generateId?.() || crypto.randomUUID(),
+    createdAt,
+    expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3
+  });
   if (config.cookie !== false && hasWritableResponse$1(event)) {
     const sealed = await sealJWESession(event, config);
     setChunkedCookie(event, sessionName, sealed, {
@@ -175,8 +178,8 @@ async function sealJWESession(event, config) {
   const sessionName = config.name || DEFAULT_NAME$1;
   const context = getEventContext(event);
   const session = context.sessions?.[sessionName] || await getJWESession(event, config);
-  const iat = Math.floor(Date.now() / 1e3);
-  const exp = config.maxAge === void 0 ? void 0 : iat + computeExpiresInSeconds(config.maxAge);
+  const iat = Math.floor(session.createdAt / 1e3);
+  const exp = session.expiresAt ? Math.floor(session.expiresAt / 1e3) : void 0;
   const payload = {
     ...session.data,
     jti: session.id,
@@ -386,10 +389,12 @@ async function getJWSSession(event, config) {
     });
     return session2;
   }
+  const now = config.jws?.signOptions?.currentDate?.getTime() ?? Date.now();
+  const createdAt = now - now % 1e3;
   const session = {
-    id: "",
-    createdAt: 0,
-    expiresAt: void 0,
+    id: void 0,
+    createdAt,
+    expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3,
     data: new NullProtoObj()
   };
   context.sessions[sessionName] = session;
@@ -420,12 +425,6 @@ async function getJWSSession(event, config) {
     session[kGetSessionPromise] = promise;
     await promise;
   }
-  if (!session.id) {
-    session.id = config.generateId?.() ?? crypto.randomUUID();
-    session.createdAt = config.jws?.signOptions?.currentDate?.getTime() ?? Date.now();
-    session.expiresAt = config.maxAge === void 0 ? void 0 : session.createdAt + computeExpiresInSeconds(config.maxAge) * 1e3;
-    await updateJWSSession(event, config);
-  }
   await config.hooks?.onRead?.({
     event,
     session,
@@ -471,6 +470,13 @@ async function updateJWSSession(event, config, update) {
       config
     });
   }
+  const now = config.jws?.signOptions?.currentDate?.getTime() ?? Date.now();
+  const createdAt = now - now % 1e3;
+  Object.assign(session, {
+    id: config.generateId?.() || crypto.randomUUID(),
+    createdAt,
+    expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3
+  });
   if (config.cookie !== false && hasWritableResponse(event)) {
     const token = await signJWSSession(event, config);
     setChunkedCookie(event, sessionName, token, {
@@ -488,8 +494,8 @@ async function signJWSSession(event, config) {
   const sessionName = config.name || DEFAULT_NAME;
   const context = getEventContext(event);
   const session = context.sessions?.[sessionName] || await getJWSSession(event, config);
-  const iat = Math.floor(Date.now() / 1e3);
-  const exp = config.maxAge === void 0 ? void 0 : iat + computeExpiresInSeconds(config.maxAge);
+  const iat = Math.floor(session.createdAt / 1e3);
+  const exp = session.expiresAt ? Math.floor(session.expiresAt / 1e3) : void 0;
   const payload = {
     ...session.data,
     jti: session.id,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unjwt",
-  "version": "0.5.36",
+  "version": "0.5.38",
   "description": "Low-level JWT utilities",
   "repository": "sandros94/unjwt",
   "license": "MIT",