Release [v0.8.0] Improving Authentication + Upload Feature · FelipeRamosDev/4hands-api

Release Notes — v0.8.0

Session not persisting after login — Session data is now explicitly saved before the request continues, preventing race conditions where the session was lost between requests.
Session not persisting after register — Session is now built from the user model and saved before the response is sent.
Email confirmation wiping session — Confirm-email now updates the session in place instead of destroying it, preserving auth state.
Signout recreating session — Replaced sessionStore.destroy() with session.destroy() to properly prevent express-session from auto-saving a new session after signout.
Ghost sessions accumulating in store — Auth middleware now destroys the temporary ghost session created during token-based session restoration, preventing store bloat.
Subscription doc ID not resolving on nested snapshots — Document subscription lookup now falls back to _doc._id when the top-level _id is not available.
Socket emitting non-serializable payloads — SubscriptionIO now calls .toObject() when available before emitting data over the socket.
cookieStore unavailable in some environments — Client auth now falls back to document.cookie when cookieStore is not defined.

File Upload (AJAX.upload) — New upload(endpoint, file, fields, options) method on the client AJAX service for sending multipart/form-data requests with optional extra fields and upload progress tracking.
Authenticated File Upload (AJAX.authUpload) — Convenience wrapper around upload that automatically attaches the auth token to the request.
Custom auth routes — Auth.login() and Auth.register() now accept an optional customRoute parameter, enabling projects to override the default auth endpoints.
bodyValidation middleware exported — bodyValidation is now accessible from the main middleware index.

User model initialization — firstName, lastName, email, and phone are now mapped explicitly in the User constructor.
Public user payload — toPublic() now includes derived fields fullName and avatarUrl in the output object.
Session update helper — New User.updateSession(session) method refreshes the session user data from the latest persisted state.