v0.10.0: Migration guide

[pilcrowonpaper]

Warning: This may be incomplete. Please tell me in the comments or on Discord if you encounter any errors.

Update your packages

Both Lucia and the adapter has to be updated.

Updating your database

user table

Rename user.identification_token to user.provider_id

For mongoDB users:

1. Drop the unique index on identifier_token
2. Run db.users.updateMany({}, { $rename: { identifier_token: 'provider_id' }})
3. Add a unique index on the new provider_id field

session table

v0.10.0 requires another table: session. Please follow the instruction in the documentation.

User ids

Users ids are no longer generated by Lucia by default. If you can, change the user:id column value type to UUID or CUID, with auto-generation. If you can't (or use Mongoose adapter), update the configuration:

// lucia.ts
import { default as lucia, generateRandomString } from "lucia-sveltekit";

export const auth = lucia({
    // ...
    generateCustomUserId: async () => generateRandomString(8),
});

Updating Lucia configuration

With v0.10.0, a secret is no longer required.

// lucia.ts
import lucia from "lucia-sveltekit";

export const auth = lucia({
-   secret: ""
});

Formats

Everything is camelCase

const user: User
-const userId = user.user_id;
+const userId = user.userId;

User authentication and creation

Sessions are not auto-created on user creation/authentication

Session are no longer created with createUser() and authenticateUser().

Old

const session = await auth.createUser("email", email, {
    password,
    user_data: {
        email,
    },
});
setCookie(cookies, session.cookies);

New

Create a new session using createSession().

const user = await auth.createUser("email", email, {
    password,
    userData: {
        email,
    },
});
const { session, tokens } = await auth.createSession(user.userId);
setCookie(cookies, tokens.cookies);

User password is null by default

Old

const session = await auth.createUser("email", email, {
    password: null,
});

New

const user = await auth.createUser("email", email);

User data columns are converted to camelCase

NOTE: This change has been reverted in v0.10.2

Old

const session = await auth.createUser("email", email, {
    password: null,
    user_data: {
        phone_number: "",
    },
});

New (v0.10.0)

const user = await auth.createUser("email", email, {
    password: null,
    userData: {
        phoneNumber: "",
    },
});

New (v0.10.2)

const user = await auth.createUser("email", email, {
    password: null,
    userData: {
        phone_number: "",
    },
});

Types

Session

old

interface ServerSession {
    user: User;
    access_token: AccessToken;
    refresh_token: RefreshToken;
    fingerprint_token: FingerprintToken;
    cookies: string[];
}

new

type Session = {
    userId: string;
    expires: number;
};

Lucia.UserData

old

/// <reference types="lucia-sveltekit" />
declare namespace Lucia {
    interface UserData {
        phone_number: string;
    }
}

new

/// <reference types="lucia-sveltekit" />
declare namespace Lucia {
    interface UserData {
        phoneNumber: string;
    }
}

Request validation

All requests can be validated using validateRequest()

-   auth.validateRequestByCookie()
-   auth.validateFormSubmission()
+   auth.validateRequest()

validateRequest() does not return the current user

old

const session = await auth.validateRequest();
const user = session.user;

new

const session = await auth.validateRequest();

To get the session user:

const { accessToken } = await auth.parseRequest();
const user = await auth.getSessionUser(accessToken);

Client

Only the user (and not the session) is available in the client

old

const session = getSession();
const user = $session.user;

new

const user = getUser();

getUser() returns an object, not a store

old

const session = getSession();
const userId = $session?.user.user_id;

new

const user = getUser();
const userId = user?.userId;

handleSilentRefresh() deprecated

-handleSilentRefresh();

Remove hidden input from forms

Tokens are automatically sent with your requests!

<form>
-    <input type="hidden" value={$session?.access_token}/>
</form>

Remove authorization header from fetch()

fetch("", {
    headers: {
-        Authorization: `Bearer ${$session?.access_token}`,
    },
})