fix: check convertSessionIdToMongoObjectId before using idProvider

.changeset/rotten-rules-repair.md

@@ -0,0 +1,5 @@
+---
+'@accounts/mongo-sessions': patch
+---
+
+The configuration option of convertSessionIdToMongoObjectId is now checked when using idProvider

.changeset/swift-panthers-play.md

@@ -0,0 +1,10 @@
+---
+'@accounts/mongo-sessions': minor
+'@accounts/mongo': minor
+---
+
+Changed `idProvider` to `idSessionProvider` in `@mongo-sessions`. This change was made to give more granular control when creating custom identifiers for both sessions and users. The new option generates the _id for new Session objects. Going forward, the `idProvider` will only be used for the creation of user identifiers.
+
+Updated `AccountsMongoOptions` in `@mongo` to have the new `idSessionProvider`.
+
+**Migration:** If you are using `idProvider` for the creation of a custom identifier for sessions, then you will need to move that logic to the new `idSessionProvider` function in the configuration.

packages/database-mongo-sessions/__tests__/mongo-sessions.ts

@@ -119,7 +119,7 @@ describe('MongoSessions', () => {
     it('using id provider on create session', async () => {
       const mongoSessions = new MongoSessions({
         database,
-        idProvider: () => new ObjectID().toHexString(),
+        idSessionProvider: () => new ObjectID().toHexString(),
         convertSessionIdToMongoObjectId: false,
       });
       const sessionId = await mongoSessions.createSession(session.userId, 'token', {
@@ -131,6 +131,33 @@ describe('MongoSessions', () => {
       expect((ret as any)._id).not.toEqual(new ObjectID((ret as any)._id));
       expect((ret as any)._id).toEqual(new ObjectID((ret as any)._id).toHexString());
     });
+
+    it('using id provider and convertSessionIdToMongoObjectId on create session', async () => {
+      const mongoSessions = new MongoSessions({
+        database,
+        convertSessionIdToMongoObjectId: true,
+        idSessionProvider: () => `someprefix|${new ObjectID().toString()}`,
+      });
+      const sessionId = await mongoSessions.createSession(session.userId, 'token', {
+        ip: session.ip,
+        userAgent: session.userAgent,
+      });
+      const ret = await mongoSessions.findSessionById(sessionId);
+      expect((ret as any)._id).toBeTruthy();
+      expect((ret as any)._id).toBeInstanceOf(ObjectID);
+    });
+
+    it('using both idSessionProvider and convertToMongoObject Id should show warning', async () => {
+      const consoleSpy = jest.spyOn(console, 'warn');
+      new MongoSessions({
+        database,
+        convertSessionIdToMongoObjectId: true,
+        idSessionProvider: () => `someprefix|${new ObjectID().toString()}`,
+      });
+      expect(consoleSpy).toBeCalledTimes(1);
+      expect(consoleSpy).toHaveBeenCalledWith(expect.stringContaining('set both'));
+      consoleSpy.mockRestore();
+    });
   });
 
   describe('findSessionById', () => {

packages/database-mongo-sessions/src/mongo-sessions.ts

@@ -22,11 +22,18 @@ export interface MongoSessionsOptions {
   };
   /**
    * Should the session collection use _id as string or ObjectId.
+   * If 'false' must include an 'idSessionProvider'.
    * Default 'true'.
    */
   convertSessionIdToMongoObjectId?: boolean;
   /**
-   * Function that generate the id for new objects.
+   * Function that generates the _id for new Session objects.
+   * If 'undefined' then 'convertSessionIdToMongoObjectId' must be 'true'.
+   * Default 'undefined'
+   */
+  idSessionProvider?: () => string | object;
+  /**
+   * Function that generate the id for new User objects.
    */
   idProvider?: () => string | object;
   /**
@@ -61,6 +68,15 @@ export class MongoSessions implements DatabaseInterfaceSessions {
       timestamps: { ...defaultOptions.timestamps, ...options.timestamps },
     };
 
+    if (
+      typeof this.options.idSessionProvider === 'function' &&
+      this.options.convertSessionIdToMongoObjectId
+    ) {
+      console.warn(`You have set both "options.idSessionProvider" and "options.convertSessionIdToMongoObjectId = true" which will cause your "options.idSessionProvider" to be ignored. 
+      In order to fix this warning change "options.convertSessionIdToMongoObjectId" to "false" or remove your "options.idSessionProvider" from the configuration.
+      `);
+    }
+
     this.database = this.options.database;
     this.sessionCollection = this.database.collection(this.options.sessionCollectionName);
   }
@@ -102,8 +118,8 @@ export class MongoSessions implements DatabaseInterfaceSessions {
       [this.options.timestamps.updatedAt]: this.options.dateProvider(),
     };
 
-    if (this.options.idProvider) {
-      session._id = this.options.idProvider();
+    if (this.options.idSessionProvider && !this.options.convertSessionIdToMongoObjectId) {
+      session._id = this.options.idSessionProvider();
     }
 
     const ret = await this.sessionCollection.insertOne(session);

packages/database-mongo/__tests__/database-tests.ts

@@ -44,7 +44,8 @@ export class DatabaseTests {
 runDatabaseTests(
   new DatabaseTests({
     convertUserIdToMongoObjectId: false,
-    convertSessionIdToMongoObjectId: false,
     idProvider: () => new mongodb.ObjectId().toString(),
+    convertSessionIdToMongoObjectId: false,
+    idSessionProvider: () => new mongodb.ObjectId().toString(),
   })
 );

packages/database-mongo/__tests__/index.ts

@@ -590,7 +590,7 @@ describe('Mongo', () => {
 
     it('using id provider on create session', async () => {
       const mongoTestOptions = new Mongo(databaseTests.db, {
-        idProvider: () => new ObjectID().toHexString(),
+        idSessionProvider: () => new ObjectID().toHexString(),
         convertSessionIdToMongoObjectId: false,
       });
       const sessionId = await mongoTestOptions.createSession(session.userId, 'token', {

packages/database-mongo/src/types/index.ts

@@ -32,6 +32,12 @@ export interface AccountsMongoOptions {
    * Default 'true'.
    */
   caseSensitiveUserName?: boolean;
+  /**
+   * Function that generates the _id for new Session objects.
+   * If 'undefined' then 'convertSessionIdToMongoObjectId' must be 'true'.
+   * Default 'undefined'
+   */
+  idSessionProvider?: () => string | object;
   /**
    * Function that generate the id for new objects.
    */