setUserSession() is merging data

[maximilianmikus]

The naming of the function setUserSession suggest you can set data to what you provide as an argument. In fact new data is always merged with old session data.

/**
 * Set a user session
 * @param event
 * @param data User session data, please only store public information since it can be decoded with API calls
 */
export async function setUserSession (event: H3Event, data: UserSession) {
  const session = await _useSession(event)

  await session.update(defu(data, session.data))

  return session.data
}

defu(data, session.data) merges data deeply. If you want to actually delete data, you cannot do it. In addition to this session.update will perform an object.assign call (shallow merge).

I think we should have different functions for setting and updating(merging) session data.

[atinux]

I understand your concern @maximilianmikus

So far I decided to merge the data as it is very useful for user to connect multiple providers for a specific session (see playground).

Maybe we could introduce a replaceSession(event, data) util, what do you think?

[maximilianmikus]

sounds good!

@atinux What do you think about renaming setUserSession to mergeUserSession(or equivalent) and use setUserSession instead of replaceSession?

if that is too big of a change. I think its fine to add replaceSession() for now.

[atinux]

This will be a breaking chance, I rather have replaceSession() instead :)

Feel free to open a PR for it!

[maximilianmikus]

ok will do!