feat: store only user ID in session

src/app/modules/auth/__tests__/auth.controller.spec.ts

@@ -187,7 +187,7 @@ describe('auth.controller', () => {
 
       // Assert
       expect(mockRes.status).toBeCalledWith(200)
-      expect(mockRes.json).toBeCalledWith(mockUser.toObject())
+      expect(mockRes.json).toBeCalledWith(mockUser)
     })
 
     it('should return 401 when retrieving agency returns InvalidDomainError', async () => {

src/app/modules/auth/auth.controller.ts

@@ -159,16 +159,15 @@ export const handleLoginVerifyOtp: RequestHandler<
             .json(coreErrorMessage)
         }
 
-        // TODO(#212): Should store only userId in session.
         // Add user info to session.
-        const userObj = user.toObject() as SessionUser
-        req.session.user = userObj
+        const { _id } = user.toObject() as SessionUser
+        req.session.user = { _id }
         logger.info({
-          message: `Successfully logged in user ${user.email}`,
+          message: `Successfully logged in user ${user}`,
           meta: logMeta,
         })
 
-        return res.status(StatusCodes.OK).json(userObj)
+        return res.status(StatusCodes.OK).json(user)
       })
       // Step 3b: Error occured in one of the steps.
       .mapErr((error) => {

src/types/vendor/express.d.ts

@@ -7,11 +7,11 @@ declare global {
     }
 
     export interface Session {
-      user?: IUserSchema
+      user?: IUserSchema['_id']
     }
 
     export interface AuthedSession extends Session {
-      user: IUserSchema
+      user: IUserSchema['_id']
     }
   }
 }