b9aac2859a
Two cleanups in one pass: 1. Update import paths app-wide from `~/lib/auth.server` to `~/lib/auth/session.server` for the four session helpers (sessionStorage, createSession, getSessionUser, destroySession). ~40 files: 33 simple path swaps where the file imported only session symbols, 5 splits where it also imported per-method auth functions (auth.verify.tsx, api.settings.email.ts, activities.\$id.tsx, routes.\$id.tsx, auth.accept-terms.tsx) — those keep one import from auth.server (for verifyMagicToken, canView, recordTermsAcceptance, etc.) and gain a second import from auth/session.server. Two more files used relative paths and were missed by the first grep pass (lib/oauth.server.ts and routes/oauth.authorize.tsx) — migrated too. The @deprecated re-exports block in auth.server.ts is gone. 2. Rename the new auth files to follow the project's `.server.ts` convention so Vite/React Router treat them as server-only (they read process.env.SESSION_SECRET, hit the DB, etc. — must NOT enter the client bundle): - auth/session.ts → auth/session.server.ts - auth/completion.ts → auth/completion.server.ts - auth/completion.test.ts → auth/completion.server.test.ts Done with `git mv` so blame is preserved. Verified: typecheck + lint green; 126 unit tests pass. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
46 lines
1.6 KiB
TypeScript
46 lines
1.6 KiB
TypeScript
// Cookie session storage. Lives here (separate from auth.server.ts) so
|
|
// the post-verify chokepoint (./completion.ts) can compose it without
|
|
// dragging the entire auth surface in.
|
|
//
|
|
// The legacy import path `~/lib/auth.server` continues to re-export
|
|
// these symbols for backwards compat — see auth.server.ts.
|
|
|
|
import { createCookieSessionStorage } from "react-router";
|
|
import { eq } from "drizzle-orm";
|
|
import { users } from "@trails-cool/db/schema/journal";
|
|
import { getDb } from "../db.ts";
|
|
|
|
const sessionSecret = process.env.SESSION_SECRET ?? "dev-secret-change-in-production";
|
|
|
|
export const sessionStorage = createCookieSessionStorage({
|
|
cookie: {
|
|
name: "__session",
|
|
httpOnly: true,
|
|
secure: process.env.NODE_ENV === "production",
|
|
sameSite: "lax",
|
|
path: "/",
|
|
maxAge: 60 * 60 * 24 * 30, // 30 days
|
|
secrets: [sessionSecret],
|
|
},
|
|
});
|
|
|
|
export async function createSession(userId: string, request: Request) {
|
|
const session = await sessionStorage.getSession(request.headers.get("Cookie"));
|
|
session.set("userId", userId);
|
|
return sessionStorage.commitSession(session);
|
|
}
|
|
|
|
export async function getSessionUser(request: Request) {
|
|
const db = getDb();
|
|
const session = await sessionStorage.getSession(request.headers.get("Cookie"));
|
|
const userId = session.get("userId");
|
|
if (!userId) return null;
|
|
|
|
const [user] = await db.select().from(users).where(eq(users.id, userId));
|
|
return user ?? null;
|
|
}
|
|
|
|
export async function destroySession(request: Request) {
|
|
const session = await sessionStorage.getSession(request.headers.get("Cookie"));
|
|
return sessionStorage.destroySession(session);
|
|
}
|