lucia-auth 0.3.0

[pilcrowonpaper]

This major version mostly cleans up the APIs. If you're using one of the integration packages, there's not much change security wise that you should be concerned about. Make sure to update integration packages and adapters to the latest version to use this version.

getSession() returns both active and idle sessions

• [Breaking] getSession() returns both active and idle sessions

!MAJOR! Previously getSession() only returned active sessions. The state can be checked via Session.state.

const session = await auth.getSession(sessionId);
if (session.state === "active") {
  // valid session
}
if (session.state === "idle") {
  // should be renewed
}

Remove setSessionCookie() params from API methods

• [Breaking] renewSession(), validateSession(), validateSessionUser() no longer sets session cookie using the provided function parameter

You now have to check if the session was renewed via isFresh property

const renewedSession = await auth.validateSession(sessionId);
if (renewedSession.isFresh) {
  // store cookie
}

Updated Session

• [Breaking] Session.expires, Session.idlePeriodExpires are Date objects
• Add state, isFresh property to Session

Added:

• isFresh: is true if the session was just created (including on renewed sessions)
• state: active or idle

Clean up configs

• [Breaking] Rename Session.expires to Session.activePeriodExpires
• [Breaking] Rename Config.sessionTimeout to Config.sessionTimeout.activePeriod, Config.idlePeriodTimeout to Config.sessionTimeout.idlePeriod
• [Breaking] Remove Config.deleteCookieOption
• [Breaking] Rename Config.sessionCookieOption to Config.sessionCookie
• Add autoDatabaseCleanup config

A new config is autoDatabaseCleanup. When set to true (default), it will clean up the database on certain api calls. Specifically, it removes the target session from the database if its dead on:

• getSession()
• getSessionUser()
• validateSessionUser()
• validateSession()

and deletes the target user's dead sessions from the database on:

• updateUserProviderId()
• updateUserAttributes()
• createSession().

Other

• [Breaking] Rename Cookie.options to Cookie.attributes