unjwt 0.5.37 → 0.5.38

package/README.md

@@ -605,6 +605,9 @@ console.log(rsaPublicSpki);
 
 ### Adapters
 
+> [!WARNING]
+> While these adapters try to be compatible with h3's `useSession` API, the key difference is that new sessions are not automatically created when calling `useJWESession` or `useJWSSession`, marking their `id` as `undefined` until you explicitly call `session.update()`. This is to comply with various specs that do integrate JWT one (such as OAuth) where sessions are only created upon valid operations (like user authorization).
+
 #### H3 v1 (Nuxt v4, Nitro v2)
 
 The `h3v1` adapter bundles session helpers that store data inside signed or encrypted JWTs.

package/dist/adapters/h3.d.mts

@@ -18,7 +18,9 @@ interface SessionManager<T extends Record<string, any> = SessionClaims, ConfigMa
     readonly expiresAt: ConfigMaxAge extends ExpiresIn ? number : "exp" extends keyof T ? T["exp"] : number | undefined;
     readonly data: SessionData<T>;
     readonly token: string | undefined;
-    update: (update: SessionUpdate<T>) => Promise<SessionManager<T, ConfigMaxAge>>;
+    update: (update: SessionUpdate<T>) => Promise<SessionManager<T, ConfigMaxAge> & {
+        readonly id: string;
+    }>;
     clear: () => Promise<SessionManager<T, ConfigMaxAge>>;
 }
 
@@ -30,7 +32,7 @@ interface SessionManager<T extends Record<string, any> = SessionClaims, ConfigMa
 
 declare const kGetSessionPromise$1: unique symbol;
 interface SessionJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
-    id: string;
+    id: string | undefined;
     createdAt: number;
     expiresAt: MaxAge extends ExpiresIn ? number : T["exp"];
     data: SessionData<T>;
@@ -151,7 +153,7 @@ declare function clearJWESession<T extends Record<string, any> = SessionClaims,
 
 declare const kGetSessionPromise: unique symbol;
 interface SessionJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
-    id: string;
+    id: string | undefined;
     createdAt: number;
     expiresAt: MaxAge extends ExpiresIn ? number : T["exp"];
     data: SessionData<T>;

package/dist/adapters/h3.mjs

@@ -80,10 +80,12 @@ async function getJWESession(event, config) {
     });
     return session2;
   }
+  const now = config.jwe?.encryptOptions?.currentDate?.getTime() ?? Date.now();
+  const createdAt = now - now % 1e3;
   const session = {
-    id: "",
-    createdAt: 0,
-    expiresAt: void 0,
+    id: void 0,
+    createdAt,
+    expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3,
     data: /* @__PURE__ */ Object.create(null)
   };
   event.context.sessions[sessionName] = session;
@@ -114,14 +116,6 @@ async function getJWESession(event, config) {
     event.context.sessions[sessionName][kGetSessionPromise$1] = promise;
     await promise;
   }
-  if (!session.id) {
-    if (!isEvent(event)) {
-      throw new Error(
-        "Cannot initialize a new session. Use `useSession(event)` within the main handler."
-      );
-    }
-    await updateJWESession(event, config);
-  }
   await config.hooks?.onRead?.({
     event,
     session,
@@ -180,6 +174,11 @@ function _getResHeader$1(event, name) {
   }
 }
 async function updateJWESession(event, config, update) {
+  if (!isEvent(event)) {
+    throw new Error(
+      "Cannot update a new session. Use `useSession(event)` within the main handler."
+    );
+  }
   const sessionName = config.name || DEFAULT_NAME$1;
   const session = event.context.sessions?.[sessionName] || await getJWESession(event, config);
   if (typeof update === "function") {
@@ -433,10 +432,12 @@ async function getJWSSession(event, config) {
     });
     return session2;
   }
+  const now = config.jws?.signOptions?.currentDate?.getTime() ?? Date.now();
+  const createdAt = now - now % 1e3;
   const session = {
-    id: "",
-    createdAt: 0,
-    expiresAt: void 0,
+    id: void 0,
+    createdAt,
+    expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3,
     data: /* @__PURE__ */ Object.create(null)
   };
   event.context.sessions[sessionName] = session;
@@ -467,14 +468,6 @@ async function getJWSSession(event, config) {
     session[kGetSessionPromise] = promise;
     await promise;
   }
-  if (!session.id) {
-    if (!isEvent(event)) {
-      throw new Error(
-        "Cannot initialize a new session outside main handler. Use `useJWSSession(event)` properly."
-      );
-    }
-    await updateJWSSession(event, config);
-  }
   await config.hooks?.onRead?.({
     event,
     session,
@@ -533,6 +526,11 @@ function _getResHeader(event, name) {
   }
 }
 async function updateJWSSession(event, config, update) {
+  if (!isEvent(event)) {
+    throw new Error(
+      "Cannot update a new session. Use `useSession(event)` within the main handler."
+    );
+  }
   const sessionName = config.name || DEFAULT_NAME;
   const session = event.context.sessions?.[sessionName] || await getJWSSession(event, config);
   if (typeof update === "function") {

package/dist/adapters/h3v2.d.mts

@@ -24,7 +24,7 @@ interface SessionManager<T extends Record<string, any> = SessionClaims, ConfigMa
 
 declare const kGetSessionPromise$1: unique symbol;
 interface SessionJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
-    id: string;
+    id: string | undefined;
     createdAt: number;
     expiresAt: MaxAge extends ExpiresIn ? number : T["exp"];
     data: SessionData<T>;
@@ -116,7 +116,7 @@ declare function clearJWESession<T extends Record<string, any> = SessionClaims,
 
 declare const kGetSessionPromise: unique symbol;
 interface SessionJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
-    id: string;
+    id: string | undefined;
     createdAt: number;
     expiresAt: MaxAge extends ExpiresIn ? number : T["exp"];
     data: SessionData<T>;

package/dist/adapters/h3v2.mjs

@@ -70,10 +70,12 @@ async function getJWESession(event, config) {
     });
     return session2;
   }
+  const now = config.jwe?.encryptOptions?.currentDate?.getTime() ?? Date.now();
+  const createdAt = now - now % 1e3;
   const session = {
-    id: "",
-    createdAt: 0,
-    expiresAt: void 0,
+    id: void 0,
+    createdAt,
+    expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3,
     data: new NullProtoObj()
   };
   context.sessions[sessionName] = session;
@@ -107,9 +109,6 @@ async function getJWESession(event, config) {
     session[kGetSessionPromise$1] = promise;
     await promise;
   }
-  if (!session.id) {
-    await updateJWESession(event, config);
-  }
   await config.hooks?.onRead?.({
     event,
     session,
@@ -390,10 +389,12 @@ async function getJWSSession(event, config) {
     });
     return session2;
   }
+  const now = config.jws?.signOptions?.currentDate?.getTime() ?? Date.now();
+  const createdAt = now - now % 1e3;
   const session = {
-    id: "",
-    createdAt: 0,
-    expiresAt: void 0,
+    id: void 0,
+    createdAt,
+    expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3,
     data: new NullProtoObj()
   };
   context.sessions[sessionName] = session;
@@ -424,9 +425,6 @@ async function getJWSSession(event, config) {
     session[kGetSessionPromise] = promise;
     await promise;
   }
-  if (!session.id) {
-    await updateJWSSession(event, config);
-  }
   await config.hooks?.onRead?.({
     event,
     session,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unjwt",
-  "version": "0.5.37",
+  "version": "0.5.38",
   "description": "Low-level JWT utilities",
   "repository": "sandros94/unjwt",
   "license": "MIT",