fix(deps): update dependency iron-session to v8 (#1557)

Bump major version for iron-session

Author: raducristianpopa

packages/wallet/backend/package.json

@@ -25,7 +25,7 @@
     "hash-wasm": "^4.11.0",
     "helmet": "^7.1.0",
     "ioredis": "^5.4.1",
-    "iron-session": "^6.3.1",
+    "iron-session": "^8.0.3",
     "knex": "^3.1.0",
     "moment": "^2.30.1",
     "node-cache": "^5.1.2",

packages/wallet/backend/src/global.d.ts

@@ -1,27 +1,25 @@
 import type { Response } from 'express'
 import type { IronSession } from 'iron-session'
 
-declare module 'iron-session' {
-  interface IronSessionData {
-    id: string
-    user: UserSessionData
-  }
-}
 declare global {
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   type Send<ResBody = any, T = Response<ResBody>> = (body?: ResBody) => T
 
-  type UserSessionData = {
+  interface UserSessionData {
     id: string
     email: string
     needsWallet: boolean
     needsIDProof: boolean
   }
 
-  // eslint-disable-next-line @typescript-eslint/prefer-namespace-keyword
-  declare module Express {
+  interface IronSessionData {
+    id: string
+    user: UserSessionData
+  }
+
+  namespace Express {
     interface Request {
-      session: IronSession
+      session: IronSession<IronSessionData>
     }
   }
 
@@ -36,3 +34,9 @@ declare global {
     toJSON(): string
   }
 }
+
+declare module 'http' {
+  interface IncomingMessage {
+    session: IronSession<IronSessionData>
+  }
+}

packages/wallet/backend/src/middleware/withSession.ts

@@ -1,9 +1,12 @@
 import { env } from '@/config/env'
 import type { NextFunction, Request, Response } from 'express'
-import { IronSessionOptions } from 'iron-session'
-import { ironSession } from 'iron-session/express'
+import {
+  type SessionOptions,
+  type IronSession,
+  getIronSession
+} from 'iron-session'
 
-export const SESSION_OPTIONS: IronSessionOptions = {
+export const SESSION_OPTIONS: SessionOptions = {
   password: env.COOKIE_PASSWORD,
   cookieName: env.COOKIE_NAME,
   cookieOptions: {
@@ -15,8 +18,50 @@ export const SESSION_OPTIONS: IronSessionOptions = {
   ttl: env.COOKIE_TTL
 } as const
 
+// Utility from a previous version of iron-session.
+// https://github.com/vvo/iron-session/blob/v6.3.1/src/getPropertyDescriptorForReqSession.ts
+function getPropertyDescriptorForReqSession(
+  session: IronSession<IronSessionData>
+): PropertyDescriptor {
+  return {
+    enumerable: true,
+    get() {
+      return session
+    },
+    set(value) {
+      const keys = Object.keys(value)
+      const currentKeys = Object.keys(session)
+
+      currentKeys.forEach((key) => {
+        if (!keys.includes(key)) {
+          // @ts-expect-error unknown keys
+          delete session[key]
+        }
+      })
+
+      keys.forEach((key) => {
+        // @ts-expect-error unknown keys
+        session[key] = value[key]
+      })
+    }
+  }
+}
+
 export const withSession: (
   req: Request,
   res: Response,
   next: NextFunction
-) => Promise<void> = ironSession(SESSION_OPTIONS)
+) => Promise<void> = async (req, res, next) => {
+  const session = await getIronSession<IronSessionData>(
+    req,
+    res,
+    SESSION_OPTIONS
+  )
+  Object.defineProperty(
+    req,
+    'session',
+    getPropertyDescriptorForReqSession(session)
+  )
+
+  next()
+}