Make it possible to call save() in decryptSession

[Uzlopak]

It seems that in some cases the request is not decorated with the sessionStore. Instead we keep now a reference to the sessionStore directly and access the sessionStore instead of always accessing it through the request-Object.

Checklist

• run npm run test and npm run benchmark
• tests and/or benchmarks are included
• documentation is changed or added
• commit message and code follows the Developer's Certification of Origin
  and the Code of conduct

[SimenB]

I'm down with the fastify.decorateRequest('sessionStore', { getter: () => sessionStore }) change, but I don't understand why it doesn't work. Can you add a test that fails without?

---

To me its seems the issue is that the request object is not the real one - it is accessed off of socket.request. Is that from fastify-socket.io? I have no idea, but to me the bug seems to be some other lib creating their own Request objects without copying decorated stuff properly.

[Uzlopak]

Hmm. let me check

[SimenB]

https://github.com/Shrihari-Prakash/fastify-session-bug/blob/58c67e2c2fb4fc3a4ed2cb576aefbbc416954465/index.js#L85 isn't a real (fastify) Request - I don't think this is a bug in @fastify/session (unless it can be reproduced without the socket library)

[Uzlopak]

Yeah, i agree with you.

But maybe it makes anyway sense to pass and keep a reference to the sessionStore and use it. Making it this way I have the feeling that we separate it more and request does not need to be a fastifyRequest anymore. I am ok with it that the request is not a fastify request anymore.

Will add now a unit test.

[Uzlopak]

@SimenB
It seems like we always made it possible to use a custom request object.

session/test/session.test.js

Line 217 in ec12760

test('should decryptSession with custom request object', async (t) => {

But we never tried if we can actually save the session when we use decryptSession.

So extended the unit test.

[Uzlopak]

@SimenB
Can you make a review please?

[SimenB]

should decryptSession with custom request object

Is this a use case we wanna support?

[Uzlopak]

I went back to the tag of v6.0.0. And we...ll it seems like it never worked properly.

So this is actually fixing it.

I think there is no harm to make it possible.

[Uzlopak]

@zekth

It is not documented why decryptSession is deprecated. Only that you once requested to mark it as deprecated.

#53 (review)

[Uzlopak]

@SimenB
Thanks