feat: store only user ID in session

src/app/modules/auth/__tests__/auth.controller.spec.ts

@@ -187,7 +187,7 @@ describe('auth.controller', () => {
 
       // Assert
       expect(mockRes.status).toBeCalledWith(200)
-      expect(mockRes.json).toBeCalledWith(mockUser.toObject())
+      expect(mockRes.json).toBeCalledWith(mockUser)
     })
 
     it('should return 401 when retrieving agency returns InvalidDomainError', async () => {

src/app/modules/auth/auth.controller.ts

@@ -159,16 +159,15 @@ export const handleLoginVerifyOtp: RequestHandler<
             .json(coreErrorMessage)
         }
 
-        // TODO(#212): Should store only userId in session.
         // Add user info to session.
-        const userObj = user.toObject() as SessionUser
-        req.session.user = userObj
+        const { _id } = user.toObject() as SessionUser
+        req.session.user = { _id }
         logger.info({
-          message: `Successfully logged in user ${user.email}`,
+          message: `Successfully logged in user ${user._id}`,
           meta: logMeta,
         })
 
-        return res.status(StatusCodes.OK).json(userObj)
+        return res.status(StatusCodes.OK).json(user)
       })
       // Step 3b: Error occured in one of the steps.
       .mapErr((error) => {

src/app/modules/auth/auth.utils.ts

@@ -57,7 +57,6 @@ export const isUserInSession = (
   return !!session?.user?._id
 }
 
-// TODO(#212): Save userId instead of entire user collection in session.
 export const getUserIdFromSession = (
   session?: Express.Session,
 ): string | undefined => {

src/app/modules/billing/billing.controller.ts

@@ -56,7 +56,7 @@ export const handleGetBillInfo: RequestHandler<
 
   // Retrieved login stats successfully.
   logger.info({
-    message: `Billing search for ${esrvcId} by ${authedUser.email}`,
+    message: `Billing search for ${esrvcId} by ${authedUser._id}`,
     meta: {
       action: 'handleGetBillInfo',
       ...createReqMeta(req),

src/types/vendor/express.d.ts

@@ -7,11 +7,15 @@ declare global {
     }
 
     export interface Session {
-      user?: IUserSchema
+      user?: {
+        _id: IUserSchema['_id']
+      }
     }
 
     export interface AuthedSession extends Session {
-      user: IUserSchema
+      user: {
+        _id: IUserSchema['_id']
+      }
     }
   }
 }