# @travetto/auth-rest-session

> Rest authentication session integration support for the Travetto framework

Latest version **5.1.1** (published 2025-01-26) · MIT license · 0 weekly downloads

## Install

```sh
npm install @travetto/auth-rest-session
pnpm add @travetto/auth-rest-session
yarn add @travetto/auth-rest-session
bun add @travetto/auth-rest-session
```

## Health

**Score 40/100 (D)** — status: stable.

Positive: no vulnerabilities; high maintenance score.

Warnings: low downloads; no types; no esm support.

Negative: stale.

## Facts

| | |
|---|---|
| Version | 5.1.1 |
| Published | 2025-01-26 |
| First published | 2022-09-05 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | none |
| Module format | CommonJS |
| Dependencies | 5 |
| Unpacked size | 4.9 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 23 |
| Author | Travetto Framework |
| Maintainers | arcsine |
| Keywords | authentication, session, rest, travetto, typescript |

## Links

- npm: https://www.npmjs.com/package/@travetto/auth-rest-session
- Repository: https://github.com/travetto/travetto
- Homepage: https://travetto.io
- Issues: https://github.com/travetto/travetto/issues
- npm.io page: https://npm.io/package/@travetto/auth-rest-session

## Dependencies (5)

- [@travetto/di](https://npm.io/package/@travetto/di.md) ^5.1.0
- [@travetto/auth](https://npm.io/package/@travetto/auth.md) ^5.1.0
- [@travetto/rest](https://npm.io/package/@travetto/rest.md) ^5.1.0
- [@travetto/auth-rest](https://npm.io/package/@travetto/auth-rest.md) ^5.1.0
- [@travetto/rest-session](https://npm.io/package/@travetto/rest-session.md) ^5.1.1

## Alternatives

- [@clerk/clerk-expo](https://npm.io/package/@clerk/clerk-expo.md) — 133.6K weekly downloads
- [@pothos/plugin-authz](https://npm.io/package/@pothos/plugin-authz.md) — 12.4K weekly downloads
- [@bounded-sh/client](https://npm.io/package/@bounded-sh/client.md) — 3.2K weekly downloads
- [@oxyhq/services](https://npm.io/package/@oxyhq/services.md) — 2.3K weekly downloads
- [@luigi-project/plugin-auth-oauth2](https://npm.io/package/@luigi-project/plugin-auth-oauth2.md) — 2.3K weekly downloads

## Recent versions

- 5.1.1 (latest) — 2025-01-26
- 6.0.0-rc.3 (rc) — 2025-02-04
- 6.0.0-rc.2 — 2025-02-01
- 6.0.0-rc.1 — 2025-01-31
- 6.0.0-rc.0 — 2025-01-31
- 5.1.0 — 2025-01-26
- 5.0.21 — 2025-01-16
- 5.0.20 — 2025-01-16
- 5.0.19 — 2025-01-01
- 5.0.18 — 2024-11-16
- 5.0.17 — 2024-10-26
- 5.0.16 — 2024-10-24
- 5.0.15 — 2024-10-20
- 5.0.14 — 2024-10-10
- 5.0.13 — 2024-10-06
- … 150 more at https://npm.io/package/@travetto/auth-rest-session/versions

## README

<!-- This file was generated by @travetto/doc and should not be modified directly -->
<!-- Please modify https://github.com/travetto/travetto/tree/main/module/auth-rest-session/DOC.tsx and execute "npx trv doc" to rebuild -->
# Rest Auth Session

## Rest authentication session integration support for the Travetto framework

**Install: @travetto/auth-rest-session**
```bash
npm install @travetto/auth-rest-session

# or

yarn add @travetto/auth-rest-session
```

One of [Rest Auth](https://github.com/travetto/travetto/tree/main/module/auth-rest#readme "Rest authentication integration support for the Travetto framework")'s main responsibilities is being able to send and receive authentication/authorization information from the client.  This data can be encoded in many different forms, and this module provides the ability to encode into and decode from the user's [REST Session](https://github.com/travetto/travetto/tree/main/module/rest-session#readme "Session provider for the travetto rest module.") context. This module fulfills the contract required by [Rest Auth](https://github.com/travetto/travetto/tree/main/module/auth-rest#readme "Rest authentication integration support for the Travetto framework") of being able to encode and decode a user principal by storing the user principal in the session. 

The [SessionPrincipalEncoder](https://github.com/travetto/travetto/tree/main/module/auth-rest-session/src/principal-encoder.ts#L12) is exposed as a tool for allowing for decoding/encoding principals into the session.

**Code: SessionPrincipalEncoder**
```typescript
import { Injectable, Inject } from '@travetto/di';
import { FilterContext } from '@travetto/rest';
import { Principal } from '@travetto/auth';
import { PrincipalEncoder } from '@travetto/auth-rest';
import { SessionService } from '@travetto/rest-session';

/**
 * Integration with the auth module, using the session as a backing
 * store for the auth principal.
 */
@Injectable()
export class SessionPrincipalEncoder implements PrincipalEncoder {
  #key = '_trv_auth_principal'; // Must be serializable, so it cannot be a symbol

  @Inject()
  service: SessionService;

  encode(_: FilterContext, p: Principal): void {
    const session = this.service.get();
    if (p) {
      p.expiresAt = session.expiresAt; // Let principal live as long as the session
      session.setValue(this.#key, p);
    } else {
      session.destroy(); // Kill session
    }
  }

  async decode({ req }: FilterContext): Promise<Principal | undefined> {
    const session = await this.service.get(); // Preload session if not already loaded
    return session?.getValue<Principal>(this.#key);
  }
}
```

As you can see, encode and decode just read and write from the session context.  The main feature here, is that if the authentication expires, the session should be destroyed.  Additionally, the user's expiry time is assumed to live as long as the session for simplicity's sake.

---
_Source: https://npm.io/package/@travetto/auth-rest-session · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._