Ensure session expirations are Dates

[paulomarg]

WHY are these changes introduced?

It was pointed out (Shopify/koa-shopify-auth#65 (comment)) that the CustomSessionStorage class may cause issues if the returned session expires field isn't a Date object.

WHAT is this pull request doing?

Making sure that we allow strings to be returned for the expiration date, and handling the conversion to Date.

Type of change

• Patch: Bug (non-breaking change which fixes an issue)
• Minor: New feature (non-breaking change which adds functionality)
• Major: Breaking change (fix or feature that would cause existing functionality to not work as expected)

Checklist

• I have added a changelog entry, prefixed by the type of change noted above
• I have added/updated tests for this change
• I have documented new APIs/updated the documentation for modified APIs (for public APIs)

[kato-takaomi-ams]

Suggested change

	let session = new Session(result.id as string);
	session = {...session, ...result};
	if (session.expires && typeof session.expires === 'string') {
	session.expires = new Date(session.expires);
	}
	const session = Session.cloneSession(result, result.id);

and following part port to Session.cloneSession.

        if (session.expires && typeof session.expires === 'string') {
          session.expires = new Date(session.expires);
        }

[paulomarg]

Hmm, I don't think that would work - we can't guarantee that result will be of type Session here, since it may have been loaded from something like a JSON.parse() call.

If we tried to call Session.clone with result it would break in Typescript, and we shouldn't expect the expires field to be a string there (it is typed as Date so it would have to be set when the session is created anyway).

[kato-takaomi-ams]

@paulomarg I got it.
My suggestion is for the following reasons:

I wish I could improve the point that users have to convert the session.expires to Date type.
(This seems to be solved if session.isActive() is implemented)

session = {...session, ...result}; overwrites session.id with result.id.
If this assignment is OK, why does Session.cloneSession exist?

[thecodepixi]

LGTM! Thanks for fixing this!