🐛 Check for new session first #1563

lukevella · 2025-02-13T03:28:10Z

Summary by CodeRabbit

Refactor
- Enhanced authentication session management with a streamlined process that now prioritizes modern sessions while safely falling back to legacy sessions when needed.
- Improved how outdated session cookies are cleared by securely expiring them, supporting a smoother transition from legacy credentials.

vercel · 2025-02-13T03:28:15Z

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
app	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Feb 13, 2025 3:57am

1 Skipped Deployment

Name	Status	Preview	Comments	Updated (UTC)
landing	⬜️ Skipped (Inspect)			Feb 13, 2025 3:57am

coderabbitai · 2025-02-13T03:36:40Z

Walkthrough

This pull request changes how sessions are handled and migrated across authentication functions. In the withAuth function, the legacy session variable is replaced by a new session obtained from auth(), with a fallback to getLegacySession() when needed and an accompanying boolean flag to track legacy sessions. The legacy cookie migration is modified to remove the old cookie by setting an empty value and backdating its expiration. In addition, the NextAuth configuration is updated to use originalAuth() for retrieving session data and adjusts the session merge logic.

Changes

File(s)	Change Summary
`apps/web/src/auth/edge/with-auth.ts` & `apps/web/src/next-auth.ts`	Updated session handling logic: replaced the legacy session variable with a session obtained from `auth()` (or `originalAuth()` in NextAuth) with a fallback to `getLegacySession()`, and introduced a flag to track legacy sessions.
`apps/web/src/auth/legacy/next-auth-cookie-migration.ts`	Modified the `migrateLegacyJWT` function: added a new type import for `JWT`, refined cookie existence checks, and introduced functions to delete the legacy cookie and set the new session cookie, improving code structure.

Possibly related PRs

🐛 Fix infinite loop when trying to migrate legacy cookie #1561: Modifications in session handling and legacy session management in withAuth and cookie migration functions.
♻️ Move auth #1422: Changes to the session retrieval logic in the auth function coincide with the updates in the NextAuth configuration.

Poem

I’m a rabbit in the coding burrow, hopping light and free,
With sessions revamped, my code now sings in harmony.
Legacy paths updated with a clear, fresh trail,
Old cookies vanish—set to expire without fail.
I twirl through functions with a joyful beat,
Celebrating changes in every line of code so sweet! 🐇✨

✨ Finishing Touches

📝 Generate Docstrings (Beta)

Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media?

❤️ Share

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

Review comments: Directly reply to a review comment made by CodeRabbit. Example:
- I pushed a fix in commit <commit_id>, please review it.
- Generate unit testing code for this file.
- Open a follow-up GitHub issue for this discussion.
Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
- @coderabbitai generate unit testing code for this file.
- @coderabbitai modularize this function.
PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
- @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
- @coderabbitai read src/utils.ts and generate unit testing code.
- @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
- @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

@coderabbitai pause to pause the reviews on a PR.
@coderabbitai resume to resume the paused reviews.
@coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
@coderabbitai full review to do a full review from scratch and review all the files again.
@coderabbitai summary to regenerate the summary of the PR.
@coderabbitai generate docstrings to generate docstrings for this PR. (Beta)
@coderabbitai resolve resolve all the CodeRabbit review comments.
@coderabbitai configuration to show the current CodeRabbit configuration for the repository.
@coderabbitai help to get help.

Other keywords and placeholders

Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (`.coderabbit.yaml`)

You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
Please see the configuration documentation for more information.
If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

Visit our Documentation for detailed information on how to use CodeRabbit.
Join our Discord Community to get help, request features, and share feedback.
Follow us on X/Twitter for updates and announcements.

coderabbitai

Actionable comments posted: 0

🧹 Nitpick comments (1)

apps/web/src/auth/legacy/next-auth-cookie-migration.ts (1)
20-20: Use optional chaining for safer cookie value access.

The condition can be simplified and made safer using optional chaining.
-  if (legacySessionCookie && legacySessionCookie.value) {
+  if (legacySessionCookie?.value) {
🧰 Tools

🪛 Biome (1.9.4)

[error] 20-20: Change to an optional chain.

Unsafe fix: Change to an optional chain.

(lint/complexity/useOptionalChain)

📜 Review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 1d4cd74 and bd6c803.

📒 Files selected for processing (1)

apps/web/src/auth/legacy/next-auth-cookie-migration.ts (3 hunks)

🧰 Additional context used

🪛 Biome (1.9.4)

apps/web/src/auth/legacy/next-auth-cookie-migration.ts

[error] 20-20: Change to an optional chain.

Unsafe fix: Change to an optional chain.

(lint/complexity/useOptionalChain)

⏰ Context from checks skipped due to timeout of 90000ms (4)

GitHub Check: Unit tests
GitHub Check: Linting
GitHub Check: Integration tests
GitHub Check: Type check

🔇 Additional comments (3)

apps/web/src/auth/legacy/next-auth-cookie-migration.ts (3)

5-5: LGTM!

The import of the JWT type is necessary for the new functions and is correctly placed.

49-62: LGTM!

The function follows best practices for cookie deletion by:

Setting an expired date instead of direct deletion

Including all necessary cookie attributes

Checking for cookie existence before deletion

64-79: Add validation for the secret password.

The function implementation and refactoring look good, but consider adding validation for the secret password.
 async function setNewSessionCookie(res: NextResponse, jwt: JWT) {
+  if (!process.env.SECRET_PASSWORD) {
+    throw new Error("SECRET_PASSWORD is not configured");
+  }
+
   const newJWT = await encode({
     token: jwt,
     secret: process.env.SECRET_PASSWORD,
     salt: newCookieName,
   });
Also applies to: 88-89

🐛 Check for new session first

1d4cd74

lukevella enabled auto-merge (squash) February 13, 2025 03:28

vercel bot deployed to Preview – app February 13, 2025 03:33 View deployment

Update

bd6c803

vercel bot temporarily deployed to Preview – landing February 13, 2025 03:53 Inactive

coderabbitai bot reviewed Feb 13, 2025

View reviewed changes

vercel bot deployed to Preview – app February 13, 2025 03:57 View deployment

lukevella merged commit 6979c09 into main Feb 13, 2025
10 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

🐛 Check for new session first #1563

🐛 Check for new session first #1563

lukevella commented Feb 13, 2025 •

edited by coderabbitai bot

Loading

vercel bot commented Feb 13, 2025 •

edited

Loading

coderabbitai bot commented Feb 13, 2025 •

edited

Loading

Chat

CodeRabbit Commands (Invoked using PR comments)

Other keywords and placeholders

CodeRabbit Configuration File (`.coderabbit.yaml`)

Documentation and Community

coderabbitai bot left a comment

🐛 Check for new session first #1563

🐛 Check for new session first #1563

Conversation

lukevella commented Feb 13, 2025 • edited by coderabbitai bot Loading

Summary by CodeRabbit

vercel bot commented Feb 13, 2025 • edited Loading

coderabbitai bot commented Feb 13, 2025 • edited Loading

Walkthrough

Changes

Possibly related PRs

Poem

Chat

CodeRabbit Commands (Invoked using PR comments)

Other keywords and placeholders

CodeRabbit Configuration File (.coderabbit.yaml)

Documentation and Community

coderabbitai bot left a comment

Choose a reason for hiding this comment

lukevella commented Feb 13, 2025 •

edited by coderabbitai bot

Loading

vercel bot commented Feb 13, 2025 •

edited

Loading

coderabbitai bot commented Feb 13, 2025 •

edited

Loading

CodeRabbit Configuration File (`.coderabbit.yaml`)