So let's now make sure
that we cannot just create auth sessions,
but that we can also verify auth sessions
so that we can verify
whether a request is coming from a user who did log in.
And for that, in that lib auth.js file,
I'll export a new function,
a new async function
which I'll name verifyAuth.
The name of course is up to you.
This function should check whether an incoming request
is coming from an authenticated user.
So if incoming request has that authentication cookie
and if it's a valid cookie,
so a cookie with a valid session ID
that we stored on the server in the database
because just the existence
of the cookie alone is not enough.
It could be a faked cookie.
We definitely also need to validate it.
Now first, we need to retrieve the cookie
from the incoming request
and therefore we can again use this cookies function,
and then use get,
and then use this Lucia object
which we create up here,
and access SessionCookieName so that we, in the end,
retrieve the cookie with our session cookie name
from the incoming request.
Now this of course might be undefined
if we get a request without a session cookie.
So we have a session cookie
which potentially is undefined.
That could be the case here.
Therefore I'll check if not sessionCookie,
so if we don't have one,
and in that case I'll return an object here in verifyAuth
where I set the user to null
and the session to null,
and it's up to you what you wanna return here.
You could also just return false to indicate
that the request is coming from an unauthenticated user.
Here I'll return such an object
which contains no user and session data
and we can then use that object in our routes,
in our pages to verify whether we did find
an authenticated user on the request or not.
I'll show you how to use it in just a second.
So that's what I return if I don't have a session cookie.
If I do find a session cookie,
we got a cookie value.
So in the end, the session ID you could say
and we get that from our session cookie,
and then there, we can access the value key.
Now if for some reason we don't have a session ID,
I also wanna return this object without user data.
But if we make it past this,
if I know that I have a session cookie
and that I have a session ID,
and now as a next step we need to validate this session.
So we need to find out whether it's a valid session ID
and for that we can use that Lucia object,
and there call validateSession
and pass our session ID to that function.
That will then, in the end, look into the database
and see if it finds a session with that ID in the database
and if that's still a valid session.
So we'll get back a result here
and we need to await this operation,
and that result can now be returned here.
And this result will actually also be
an object with a user key
and a session key.
That's why I used that same shape here.
But now if we did validate that session,
that will either again be an object
where both is set to null
or it will be the actual user data,
so the user ID, for example,
and some extra data about the session.
So we'll return an object of this shape,
but user and session will not be null
if we did find out that it is a valid session.
Now what we should also do here,
if we validated a session
and we found that it's a valid session,
is we should refresh it so that it stays active
and the user isn't suddenly locked out.
Therefore we should check if we have a true session
on that result object.
So we found an active valid session
and we should then check if that session
has fresh set to true.
If that's the case,
we can call lucia.createSessionCookie
again to create a new session cookie
for the session ID of the session we just retrieved,
so the session we got from our result,
and we should then again set that session cookie
just as we did it before when we created it the first time.
That will basically recreate
that cookie for the existing active session
and therefore prolong it you could say.
Now NextJS will actually throw an error
if you try to set a cookie
if you are doing that as part of the page rendering process
and therefore you should wrap this with try
to catch that error
and then do nothing
because it's actually an error we wanna ignore
because we want to be able to set
that authentication session cookie
even if we're just rendering a page.
NextJS normally doesn't like it if we set cookies
when rendering a page,
but we like to do it here.
That is something you find in the Lucia documentation
and therefore we should do it here when using Lucia.
Now it's also possible that we did not find
a session on the result
and in that case,
I wanna clear the session cookie that was sent along
because it's clearly not a cookie for a valid session.
Therefore we should then again create
new session cookie data,
but we should do that with help
of the createBlankSessionCookie method provided by Lucia.
And then again, we should call cookies set
and use the sessionCookie data,
but this will now, as I just explained,
basically clear that existing cookie
because it contained invalid session data anyways.
And that's the operand.
That's all we should do here in verifyAuth
and we can now use
this verifyAuth function here in any route,
in any page that should actually be protected
and that should only be accessible by logged in users.
That's the operand we'll do next.