Merge branch 'main' into siddharth/work-with-request

Co-authored-by: Brandon Bayer <b@bayer.ws>

.changeset/tidy-gorillas-confess.md

@@ -0,0 +1,47 @@
+---
+"blitz": minor
+"@blitzjs/auth": minor
+"@blitzjs/next": minor
+"@blitzjs/rpc": minor
+"@blitzjs/generator": minor
+---
+
+feat: add blitz auth support for the Web `Request` API standard
+
+Usage using the new `withBlitzAuth` adapter in the App Router:
+
+```ts
+import {withBlitzAuth} from "app/blitz-server"
+
+export const {POST} = withBlitzAuth({
+  POST: async (_request, _params, ctx) => {
+    const session = ctx.session
+    await session.$revoke()
+
+    return new Response(
+      JSON.stringify({
+        userId: session.userId,
+      }),
+      {status: 200},
+    )
+  },
+})
+```
+
+feat: New Blitz RPC handler meant to with the next.js app router `route.ts` files
+
+Usage using the new `rpcAppHandler` function
+
+```ts
+// app/api/rpc/[[...blitz]]/route.ts
+import {rpcAppHandler} from "@blitzjs/rpc"
+import {withBlitzAuth} from "app/blitz-server"
+
+// Usage with blitz auth
+export const {GET, POST, HEAD} = withBlitzAuth(rpcAppHandler())
+
+// Standalone usage
+export const {GET, POST, HEAD} = rpcAppHandler()
+```
+
+chore: Update the app directory starter 

.github/workflows/main.yml

@@ -23,7 +23,7 @@ jobs:
       - name: Setup node
         uses: actions/setup-node@v2
         with:
-          node-version: 18
+          node-version: 20
           cache: "pnpm"
       - name: Install dependencies
         run: pnpm install  --frozen-lockfile
@@ -44,7 +44,7 @@ jobs:
       - name: Setup node
         uses: actions/setup-node@v2
         with:
-          node-version: 18
+          node-version: 20
           cache: "pnpm"
       - run: pnpm install --frozen-lockfile
       - name: Build
@@ -75,7 +75,7 @@ jobs:
       - name: Setup node@16
         uses: actions/setup-node@v2
         with:
-          node-version: 18
+          node-version: 20
           cache: "pnpm"
 
       - name: Install dependencies
@@ -137,7 +137,7 @@ jobs:
         if: matrix.folder != 'next-13-app-dir' || matrix.os != 'windows-latest'
         uses: actions/setup-node@v2
         with:
-          node-version: 18
+          node-version: 20
           cache: "pnpm"
 
       - name: Install dependencies

apps/next13/package.json

@@ -22,7 +22,7 @@
     "@tanstack/react-query": "4.0.10",
     "blitz": "2.0.10",
     "flatted": "3.2.7",
-    "next": "canary",
+    "next": "14.3.0-canary.28",
     "prisma": "^4.5.0",
     "react": "18.2.0",
     "react-dom": "18.2.0",

apps/next13/src/app/api/rpc/[[...blitz]]/route.ts

@@ -0,0 +1,4 @@
+import {rpcAppHandler} from "@blitzjs/rpc"
+import {withBlitzAuth} from "src/blitz-server"
+
+export const {GET, POST, HEAD} = withBlitzAuth(rpcAppHandler())

apps/next13/src/blitz-server.ts

@@ -6,26 +6,27 @@ import {simpleRolesIsAuthorized} from "@blitzjs/auth"
 import {BlitzLogger} from "blitz"
 import {RpcServerPlugin} from "@blitzjs/rpc"
 
-const {api, getBlitzContext, useAuthenticatedBlitzContext, invoke} = setupBlitzServer({
-  plugins: [
-    AuthServerPlugin({
-      cookiePrefix: "web-cookie-prefix",
-      storage: PrismaStorage(db),
-      isAuthorized: simpleRolesIsAuthorized,
-    }),
-    RpcServerPlugin({
-      logging: {
-        disablelevel: "debug",
-      },
-      onInvokeError(error) {
-        console.log("onInvokeError", error)
-      },
-    }),
-  ],
-  logger: BlitzLogger({}),
-})
+const {api, getBlitzContext, useAuthenticatedBlitzContext, invoke, withBlitzAuth} =
+  setupBlitzServer({
+    plugins: [
+      AuthServerPlugin({
+        cookiePrefix: "web-cookie-prefix",
+        storage: PrismaStorage(db),
+        isAuthorized: simpleRolesIsAuthorized,
+      }),
+      RpcServerPlugin({
+        logging: {
+          disablelevel: "debug",
+        },
+        onInvokeError(error) {
+          console.log("onInvokeError", error)
+        },
+      }),
+    ],
+    logger: BlitzLogger({}),
+  })
 
-export {api, getBlitzContext, useAuthenticatedBlitzContext, invoke}
+export {api, getBlitzContext, useAuthenticatedBlitzContext, invoke, withBlitzAuth}
 
 export const cliConfig: BlitzCliConfig = {
   customTemplates: "src/templates",

apps/next13/src/pages/api/rpc/[[...blitz]].ts

@@ -1,4 +0,0 @@
-import {rpcHandler} from "@blitzjs/rpc"
-import {api} from "../../../blitz-server"
-
-export default api(rpcHandler({onError: (error, ctx) => console.log(error)}))

apps/next13/src/users/queries/getCurrentUser.ts

@@ -12,5 +12,5 @@ export default async function getCurrentUser(input: null, ctx: Ctx) {
 }
 
 export const config = {
-  httpMethod: "GET",
+  httpMethod: "POST",
 }

apps/toolkit-app-passportjs/package.json

@@ -31,7 +31,7 @@
     "@hookform/resolvers": "2.9.10",
     "@prisma/client": "4.6.1",
     "blitz": "2.0.10",
-    "next": "canary",
+    "next": "14.3.0-canary.28",
     "openid-client": "5.2.1",
     "prisma": "4.6.1",
     "react": "18.2.0",

apps/toolkit-app/package.json

@@ -32,7 +32,7 @@
     "@hookform/resolvers": "2.9.10",
     "@prisma/client": "4.6.1",
     "blitz": "2.0.10",
-    "next": "canary",
+    "next": "14.3.0-canary.28",
     "next-auth": "4.24.7",
     "prisma": "4.6.1",
     "react": "18.2.0",

apps/toolkit-app/src/pages/login.tsx

@@ -11,15 +11,11 @@ const LoginPage: BlitzPage = () => {
       <LoginForm
         onSuccess={(_user) => {
           const next = router.query.next ? decodeURIComponent(router.query.next as string) : "/"
-          // return router.push(next)
+          return router.push(next)
         }}
       />
     </Layout>
   )
 }
 
-LoginPage.authenticate = {
-  redirectTo: "/",
-}
-
 export default LoginPage

apps/web/package.json

@@ -26,7 +26,7 @@
     "blitz": "2.0.10",
     "jest": "29.3.0",
     "jest-environment-jsdom": "29.3.0",
-    "next": "canary",
+    "next": "14.3.0-canary.28",
     "passport-mock-strategy": "2.0.0",
     "passport-twitter": "1.0.4",
     "prisma": "4.6.1",

integration-tests/auth-with-rpc/package.json

@@ -26,7 +26,7 @@
     "@prisma/client": "4.6.1",
     "blitz": "2.0.10",
     "delay": "5.0.0",
-    "next": "canary",
+    "next": "14.3.0-canary.28",
     "prisma": "4.6.1",
     "react": "18.2.0",
     "react-dom": "18.2.0",

integration-tests/auth/package.json

@@ -23,7 +23,7 @@
     "@prisma/client": "4.6.1",
     "blitz": "2.0.10",
     "lowdb": "3.0.0",
-    "next": "canary",
+    "next": "14.3.0-canary.28",
     "prisma": "4.6.1",
     "react": "18.2.0",
     "react-dom": "18.2.0",

integration-tests/auth/pages/api/signin.ts

@@ -21,14 +21,11 @@ export const authenticateUser = async (email: string, password: string) => {
 }
 
 export default api(async (req, res, ctx) => {
-  const blitzContext = ctx
-
   const user = await authenticateUser(req.query.email as string, req.query.password as string)
-
-  await blitzContext.session.$create({
+  await ctx.session.$create({
     userId: user.id,
     role: user.role as Role,
   })
 
-  res.status(200).json({email: req.query.email, userId: blitzContext.session.userId})
+  res.status(200).json({email: req.query.email, userId: ctx.session.userId})
 })

integration-tests/get-initial-props/package.json

@@ -22,7 +22,7 @@
     "@prisma/client": "4.6.1",
     "blitz": "2.0.10",
     "lowdb": "3.0.0",
-    "next": "canary",
+    "next": "14.3.0-canary.28",
     "prisma": "4.6.1",
     "react": "18.2.0",
     "react-dom": "18.2.0"

integration-tests/middleware/package.json

@@ -15,7 +15,7 @@
     "@blitzjs/next": "2.0.10",
     "@blitzjs/rpc": "2.0.10",
     "blitz": "2.0.10",
-    "next": "canary",
+    "next": "14.3.0-canary.28",
     "react": "18.2.0",
     "react-dom": "18.2.0"
   },

integration-tests/next-13-app-dir/app/api/logout/route.ts

@@ -0,0 +1,15 @@
+import {withBlitzAuth} from "../../../src/blitz-server"
+
+export const {POST} = withBlitzAuth({
+  POST: async (_request, _params, ctx) => {
+    const session = ctx.session
+    await session.$revoke()
+
+    return new Response(
+      JSON.stringify({
+        userId: session.userId,
+      }),
+      {status: 200},
+    )
+  },
+})

integration-tests/next-13-app-dir/app/api/noauth/route.ts

@@ -0,0 +1,11 @@
+import {H} from "@blitzjs/auth/dist/index-0ecbee46"
+import {withBlitzAuth} from "../../../src/blitz-server"
+
+const emptyResponse = async () => {
+  return new Response(null, {status: 200})
+}
+
+export const {POST, HEAD} = withBlitzAuth({
+  POST: emptyResponse,
+  HEAD: emptyResponse,
+})

integration-tests/next-13-app-dir/app/api/rpc/[[...blitz]]/route.ts

@@ -0,0 +1,4 @@
+import {rpcAppHandler} from "@blitzjs/rpc"
+import {withBlitzAuth} from "../../../../src/blitz-server"
+
+export const {GET, POST, HEAD} = withBlitzAuth(rpcAppHandler())

integration-tests/next-13-app-dir/app/api/signin/route.ts

@@ -0,0 +1,38 @@
+import {withBlitzAuth} from "../../../src/blitz-server"
+import prisma from "../../../db/index"
+import {Role} from "../../../types"
+
+export const authenticateUser = async (email: string, password: string) => {
+  const user = await prisma.user.findFirst({where: {email}})
+
+  if (!user) throw new Error("Authentication Error")
+  await prisma.user.update({where: {id: user.id}, data: {hashedPassword: password}})
+
+  const {hashedPassword, ...rest} = user
+  return rest
+}
+
+export const {POST} = withBlitzAuth({
+  POST: async (request: Request, context, ctx) => {
+    const {searchParams} = new URL(request.url)
+    const user = await authenticateUser(
+      searchParams.get("email") as string,
+      searchParams.get("password") as string,
+    )
+
+    await ctx.session.$create({
+      userId: user.id,
+      role: user.role as Role,
+    })
+
+    return new Response(
+      JSON.stringify({email: searchParams.get("email"), userId: ctx.session.userId}),
+      {
+        status: 200,
+        headers: {
+          "Content-Type": "application/json",
+        },
+      },
+    )
+  },
+})

integration-tests/next-13-app-dir/next-env.d.ts

@@ -1,6 +1,5 @@
 /// <reference types="next" />
 /// <reference types="next/image-types/global" />
-/// <reference types="next/navigation-types/compat/navigation" />
 
 // NOTE: This file should not be edited
 // see https://nextjs.org/docs/basic-features/typescript for more information.

integration-tests/next-13-app-dir/package.json

@@ -24,7 +24,7 @@
     "@prisma/client": "4.6.1",
     "blitz": "2.0.10",
     "lowdb": "3.0.0",
-    "next": "canary",
+    "next": "14.3.0-canary.28",
     "prisma": "4.6.1",
     "react": "18.2.0",
     "react-dom": "18.2.0",
@@ -45,6 +45,6 @@
     "node-fetch": "3.2.3",
     "playwright": "1.28.0",
     "ts-node": "10.9.1",
-    "typescript": "^4.8.4"
+    "typescript": "^4.9.5"
   }
 }

integration-tests/next-13-app-dir/pages/api/logout.ts

@@ -1,9 +0,0 @@
-import {api} from "../../src/blitz-server"
-
-export default api(async (_req, res, ctx) => {
-  const blitzContext = ctx
-
-  await blitzContext.session.$revoke()
-
-  res.status(200).json({userId: blitzContext.session.userId})
-})

integration-tests/next-13-app-dir/pages/api/noauth.ts

@@ -1,5 +0,0 @@
-import {api} from "../../src/blitz-server"
-
-export default api(async (_req, res, ctx) => {
-  res.status(200).end()
-})

integration-tests/next-13-app-dir/pages/api/rpc/[[...blitz]].ts

@@ -1,4 +0,0 @@
-import {rpcHandler} from "@blitzjs/rpc"
-import {api} from "../../../src/blitz-server"
-
-export default api(rpcHandler({onError: (error, ctx) => console.log(error)}))

integration-tests/next-13-app-dir/pages/api/signin.ts

@@ -1,34 +0,0 @@
-import {api} from "../../src/blitz-server"
-import prisma from "../../db/index"
-import {SecurePassword} from "@blitzjs/auth/secure-password"
-import {Role} from "../../types"
-
-export const authenticateUser = async (email: string, password: string) => {
-  const user = await prisma.user.findFirst({where: {email}})
-
-  if (!user) throw new Error("Authentication Error")
-
-  const result = await SecurePassword.verify(user.hashedPassword, password)
-
-  if (result === SecurePassword.VALID_NEEDS_REHASH) {
-    // Upgrade hashed password with a more secure hash
-    const improvedHash = await SecurePassword.hash(password)
-    await prisma.user.update({where: {id: user.id}, data: {hashedPassword: improvedHash}})
-  }
-
-  const {hashedPassword, ...rest} = user
-  return rest
-}
-
-export default api(async (req, res, ctx) => {
-  const blitzContext = ctx
-
-  const user = await authenticateUser(req.query.email as string, req.query.password as string)
-
-  await blitzContext.session.$create({
-    userId: user.id,
-    role: user.role as Role,
-  })
-
-  res.status(200).json({email: req.query.email, userId: blitzContext.session.userId})
-})

integration-tests/next-13-app-dir/src/blitz-server.ts

@@ -3,16 +3,16 @@ import {AuthServerPlugin, PrismaStorage} from "@blitzjs/auth"
 import db from "../db"
 import {simpleRolesIsAuthorized} from "@blitzjs/auth"
 import {BlitzLogger} from "blitz"
+import {RpcServerPlugin} from "@blitzjs/rpc"
 
-const {api, getBlitzContext} = setupBlitzServer({
+export const {api, getBlitzContext, withBlitzAuth} = setupBlitzServer({
   plugins: [
     AuthServerPlugin({
       cookiePrefix: "auth-tests-cookie-prefix",
       storage: PrismaStorage(db),
       isAuthorized: simpleRolesIsAuthorized,
     }),
+    RpcServerPlugin({}),
   ],
   logger: BlitzLogger({}),
 })
-
-export {api, getBlitzContext}

integration-tests/next-13-app-dir/test/index.test.ts

@@ -57,7 +57,7 @@ const runTests = (mode?: string) => {
         "should render result for open query",
         async () => {
           const res = await fetch(`http://localhost:${appPort}/api/noauth`, {
-            method: "GET",
+            method: "POST",
             headers: {"Content-Type": "application/json; charset=utf-8"},
           })
           expect(res.status).toBe(200)
@@ -67,7 +67,7 @@ const runTests = (mode?: string) => {
 
       it("sets correct cookie", async () => {
         const res = await fetch(`http://localhost:${appPort}/api/noauth`, {
-          method: "GET",
+          method: "POST",
           headers: {"Content-Type": "application/json; charset=utf-8"},
         })
         const cookieHeader = res.headers.get("Set-Cookie")
@@ -94,6 +94,8 @@ const runTests = (mode?: string) => {
         async () => {
           const browser = await webdriver(appPort, "/react-query")
 
+          await browser.refresh()
+
           browser.waitForElementByCss("#button", 0)
           await browser.elementByCss("#button").click()
 
@@ -133,7 +135,7 @@ const runTests = (mode?: string) => {
 
       it("does not require CSRF header on HEAD requests", async () => {
         const res = await fetch(`http://localhost:${appPort}/api/noauth`, {
-          method: "GET",
+          method: "POST",
           headers: {"Content-Type": "application/json; charset=utf-8"},
         })
         const cookieHeader = res.headers.get("Set-Cookie")

integration-tests/no-suspense/package.json

@@ -22,7 +22,7 @@
     "@prisma/client": "4.6.1",
     "blitz": "2.0.10",
     "lowdb": "3.0.0",
-    "next": "canary",
+    "next": "14.3.0-canary.28",
     "prisma": "4.6.1",
     "react": "18.2.0",
     "react-dom": "18.2.0"

integration-tests/qm/package.json

@@ -15,7 +15,7 @@
     "@prisma/client": "4.6.1",
     "@tanstack/react-query": "4.0.10",
     "blitz": "2.0.10",
-    "next": "canary",
+    "next": "14.3.0-canary.28",
     "prisma": "4.6.1",
     "react": "18.2.0",
     "react-dom": "18.2.0"

integration-tests/react-query-utils/package.json

@@ -21,7 +21,7 @@
     "@prisma/client": "4.6.1",
     "blitz": "2.0.10",
     "lowdb": "3.0.0",
-    "next": "canary",
+    "next": "14.3.0-canary.28",
     "prisma": "4.6.1",
     "react": "18.2.0",
     "react-dom": "18.2.0"

integration-tests/rpc-path-root/package.json

@@ -11,7 +11,7 @@
     "@blitzjs/next": "2.0.10",
     "@blitzjs/rpc": "2.0.10",
     "blitz": "2.0.10",
-    "next": "canary",
+    "next": "14.3.0-canary.28",
     "react": "18.2.0",
     "react-dom": "18.2.0"
   },

integration-tests/rpc/package.json

@@ -11,7 +11,7 @@
     "@blitzjs/next": "2.0.10",
     "@blitzjs/rpc": "2.0.10",
     "blitz": "2.0.10",
-    "next": "canary",
+    "next": "14.3.0-canary.28",
     "react": "18.2.0",
     "react-dom": "18.2.0"
   },

integration-tests/trailing-slash/package.json

@@ -22,7 +22,7 @@
     "@prisma/client": "4.6.1",
     "blitz": "2.0.10",
     "lowdb": "3.0.0",
-    "next": "canary",
+    "next": "14.3.0-canary.28",
     "prisma": "4.6.1",
     "react": "18.2.0",
     "react-dom": "18.2.0"

package.json

@@ -29,9 +29,9 @@
     "husky": "8.0.2",
     "jsdom": "^19.0.0",
     "lint-staged": "13.0.3",
-    "next": "canary",
+    "next": "14.3.0-canary.28",
     "only-allow": "1.1.0",
-    "prettier": "^2.7.1",
+    "prettier": "^2.8.8",
     "prettier-plugin-prisma": "4.4.0",
     "pretty-quick": "3.1.3",
     "turbo": "1.10.9",
@@ -50,7 +50,8 @@
       "next-auth@4.24.7": "patches/next-auth@4.24.7.patch"
     },
     "overrides": {
-      "@types/mime": "3.0.4"
+      "@types/mime": "3.0.4",
+      "next": "14.3.0-canary.28"
     }
   }
 }

packages/blitz-auth/package.json

@@ -76,7 +76,7 @@
     "@types/react": "18.0.25",
     "@types/react-dom": "17.0.14",
     "blitz": "2.0.10",
-    "next": "canary",
+    "next": "14.3.0-canary.28",
     "next-auth": "4.24.7",
     "react": "18.2.0",
     "react-dom": "18.2.0",

packages/blitz-auth/src/server/auth-plugin.ts

@@ -1,6 +1,6 @@
 import {RequestMiddleware, Ctx, createServerPlugin} from "blitz"
 import {assert} from "blitz"
-import {IncomingMessage, ServerResponse} from "http"
+import type {IncomingMessage, ServerResponse} from "http"
 import {PublicData, SessionModel, SessionConfigMethods} from "../shared/types"
 import {getBlitzContext, getSession, useAuthenticatedBlitzContext} from "./auth-sessions"
 
@@ -130,11 +130,28 @@ export const AuthServerPlugin = createServerPlugin((options: AuthPluginOptions)
   if (!globalThis.__BLITZ_GET_RSC_CONTEXT) {
     globalThis.__BLITZ_GET_RSC_CONTEXT = getBlitzContext
   }
+
+  type Handler = (request: Request, context: any, ctx: Ctx) => Promise<Response> | Response
+  function withBlitzAuth<T extends {[method: string]: Handler}>(handlers: T): T {
+    return Object.fromEntries(
+      Object.entries(handlers).map(([method, handler]) => [
+        method,
+        async (request: Request, params: unknown) => {
+          const session = await getSession(request)
+          const response = await handler(request, params, {session})
+          session.setSession(response)
+          return response
+        },
+      ]),
+    ) as unknown as T
+  }
+
   return {
     requestMiddlewares: [authPluginSessionMiddleware()],
     exports: () => ({
       getBlitzContext,
       useAuthenticatedBlitzContext,
+      withBlitzAuth,
     }),
   }
 })

packages/blitz-auth/src/server/auth-sessions.test.ts

@@ -1,41 +0,0 @@
-import {expect, describe, it} from "vitest"
-import {setCookie} from "./auth-sessions"
-import cookie from "cookie"
-import {ServerResponse} from "http"
-
-describe("blitz-auth", () => {
-  describe("setCookie", () => {
-    it("works with empty start", async () => {
-      const res = new ServerResponse({} as any)
-      setCookie(res, cookie.serialize("A", "a-value", {}))
-      expect(res.getHeader("Set-Cookie")).toBe("A=a-value")
-    })
-
-    it("works with string start", async () => {
-      const res = new ServerResponse({} as any)
-      res.setHeader("Set-Cookie", cookie.serialize("A", "a-value", {}))
-      setCookie(res, cookie.serialize("B", "b-value", {}))
-      expect(res.getHeader("Set-Cookie")).toEqual(["A=a-value", "B=b-value"])
-    })
-
-    it("works with array start for new name", async () => {
-      const res = new ServerResponse({} as any)
-      res.setHeader("Set-Cookie", [
-        cookie.serialize("A", "a-value", {}),
-        cookie.serialize("B", "b-value", {}),
-      ])
-      setCookie(res, cookie.serialize("C", "c-value", {}))
-      expect(res.getHeader("Set-Cookie")).toEqual(["A=a-value", "B=b-value", "C=c-value"])
-    })
-
-    it("works with array start for existing name", async () => {
-      const res = new ServerResponse({} as any)
-      res.setHeader("Set-Cookie", [
-        cookie.serialize("A", "a-value", {}),
-        cookie.serialize("B", "b-value", {}),
-      ])
-      setCookie(res, cookie.serialize("A", "new-a-value", {}))
-      expect(res.getHeader("Set-Cookie")).toEqual(["A=new-a-value", "B=b-value"])
-    })
-  })
-})

packages/blitz-auth/src/server/auth-sessions.ts

@@ -1,7 +1,6 @@
 import {fromBase64, toBase64} from "b64-lite"
 import cookie, {parse} from "cookie"
-import {IncomingMessage, ServerResponse} from "http"
-import {sign as jwtSign, verify as jwtVerify} from "jsonwebtoken"
+import jsonwebtoken from "jsonwebtoken"
 import {
   assert,
   isPast,
@@ -13,9 +12,9 @@ import {
   AuthorizationError,
   CSRFTokenMismatchError,
   log,
+  AuthenticatedCtx,
   baseLogger,
   chalk,
-  AuthenticatedCtx,
 } from "blitz"
 import {
   EmptyPublicData,
@@ -39,12 +38,69 @@ import {
   AuthenticatedSessionContext,
 } from "../shared"
 import {generateToken, hash256} from "./auth-utils"
-import {Socket} from "net"
-import {UrlObject} from "url"
 import {formatWithValidation} from "../shared/url-utils"
 
-export function isLocalhost(req: IncomingMessage): boolean {
-  let {host} = req.headers
+import type {UrlObject} from "url"
+import type {IncomingMessage, ServerResponse} from "http"
+
+function splitCookiesString(cookiesString: string) {
+  if (!cookiesString) return []
+  let cookiesStrings = []
+  let pos = 0
+  let start
+  let ch
+  let lastComma
+  let nextStart
+  let cookiesSeparatorFound
+  function skipWhitespace() {
+    while (pos < cookiesString.length && /\s/.test(cookiesString.charAt(pos))) {
+      pos += 1
+    }
+    return pos < cookiesString.length
+  }
+  function notSpecialChar() {
+    ch = cookiesString.charAt(pos)
+    return ch !== "=" && ch !== ";" && ch !== ","
+  }
+  while (pos < cookiesString.length) {
+    start = pos
+    cookiesSeparatorFound = false
+    while (skipWhitespace()) {
+      ch = cookiesString.charAt(pos)
+      if (ch === ",") {
+        lastComma = pos
+        pos += 1
+        skipWhitespace()
+        nextStart = pos
+        while (pos < cookiesString.length && notSpecialChar()) {
+          pos += 1
+        }
+        if (pos < cookiesString.length && cookiesString.charAt(pos) === "=") {
+          cookiesSeparatorFound = true
+          pos = nextStart
+          cookiesStrings.push(cookiesString.substring(start, lastComma))
+          start = pos
+        } else {
+          pos = lastComma + 1
+        }
+      } else {
+        pos += 1
+      }
+    }
+    if (!cookiesSeparatorFound || pos >= cookiesString.length) {
+      cookiesStrings.push(cookiesString.substring(start, cookiesString.length))
+    }
+  }
+  return cookiesStrings
+}
+
+export function isLocalhost(req: IncomingMessage | Request): boolean {
+  let host: string | undefined
+  if (req instanceof Request) {
+    host = req.headers.get("host") || ""
+  } else {
+    host = req.headers.host || ""
+  }
   let localhost = false
   if (host) {
     host = host.split(":")[0]
@@ -69,7 +125,8 @@ export function getCookieParser(headers: {[key: string]: undefined | string | st
   }
 }
 
-const debug = require("debug")("blitz:session")
+import Debug from "debug"
+const debug = Debug("blitz:session")
 
 export interface SimpleRolesIsAuthorized<RoleType = string> {
   ({ctx, args}: {ctx: any; args: [roleOrRoles?: RoleType | RoleType[]]}): boolean
@@ -131,14 +188,6 @@ type AuthedSessionKernel = {
 }
 type SessionKernel = AnonSessionKernel | AuthedSessionKernel
 
-function ensureApiRequest(
-  req: IncomingMessage & {[key: string]: any},
-): asserts req is IncomingMessage & {cookies: {[key: string]: string}} {
-  if (!("cookies" in req)) {
-    // Cookie parser isn't include inside getServerSideProps, so we have to add it
-    req.cookies = getCookieParser(req.headers)()
-  }
-}
 function ensureMiddlewareResponse(
   res: ServerResponse & {[key: string]: any},
 ): asserts res is ServerResponse & {blitzCtx: Ctx} {
@@ -147,58 +196,112 @@ function ensureMiddlewareResponse(
   }
 }
 
+function convertRequestToHeader(req: IncomingMessage | Request): Headers {
+  const headersFromRequest = req.headers
+  if (headersFromRequest instanceof Headers) {
+    return headersFromRequest
+  } else {
+    const headers = new Headers()
+    Object.entries(headersFromRequest).forEach(([key, value]) => {
+      if (value) {
+        if (Array.isArray(value)) {
+          headers.append(key, value.join(","))
+        } else {
+          headers.append(key, value)
+        }
+      }
+    })
+    return headers
+  }
+}
+
+function getCookiesFromHeader(headers: Headers) {
+  const cookieHeader = headers.get("Cookie")
+  if (cookieHeader) {
+    return cookie.parse(cookieHeader)
+  } else {
+    return {}
+  }
+}
+
+export async function getSession(req: Request): Promise<SessionContext>
+export async function getSession(req: Request, res: never, isRsc: boolean): Promise<SessionContext>
+export async function getSession(req: IncomingMessage, res: ServerResponse): Promise<SessionContext>
 export async function getSession(
   req: IncomingMessage,
   res: ServerResponse,
-  appDir = false,
+  isRsc: boolean,
+): Promise<SessionContext>
+export async function getSession(
+  req: IncomingMessage | Request,
+  res?: ServerResponse,
+  isRsc?: boolean,
 ): Promise<SessionContext> {
-  ensureApiRequest(req)
-  ensureMiddlewareResponse(res)
-
-  debug("cookiePrefix", globalThis.__BLITZ_SESSION_COOKIE_PREFIX)
-
-  if (res.blitzCtx.session) {
-    debug("Returning existing session")
-    return res.blitzCtx.session
+  const headers = convertRequestToHeader(req)
+  if (res) {
+    ensureMiddlewareResponse(res)
+    debug("cookiePrefix", globalThis.__BLITZ_SESSION_COOKIE_PREFIX)
+    if (res.blitzCtx.session) {
+      debug("Returning existing session")
+      return res.blitzCtx.session
+    }
   }
-
-  let sessionKernel = await getSessionKernel(req, res)
+  const method = req.method
+  let sessionKernel = await getSessionKernel({headers, method})
 
   if (sessionKernel) {
     debug("Got existing session", sessionKernel)
   }
 
   if (!sessionKernel) {
-    debug("No session found, creating anonymous session")
-    sessionKernel = await createAnonymousSession(req, res)
+    sessionKernel = await createAnonymousSession({headers})
   }
 
   const sessionContext = makeProxyToPublicData(
-    new SessionContextClass(req, res, sessionKernel, appDir),
+    new SessionContextClass(headers, sessionKernel, !!isRsc, res),
   )
   debug("New session context")
-  res.blitzCtx.session = sessionContext
+  if (res) {
+    ;(res as any).blitzCtx = {
+      session: sessionContext,
+    }
+    sessionContext.setSession(res)
+  }
   return sessionContext
 }
 
+interface RouteUrlObject extends Pick<UrlObject, "pathname" | "query" | "href"> {
+  pathname: string
+}
+
+const makeProxyToPublicData = <T extends SessionContextClass>(ctxClass: T): T => {
+  return new Proxy(ctxClass, {
+    get(target, prop, receiver) {
+      if (prop in target || prop === "then") {
+        return Reflect.get(target, prop, receiver)
+      } else {
+        return Reflect.get(target.$publicData, prop, receiver)
+      }
+    },
+  })
+}
+
 export async function getBlitzContext(): Promise<Ctx> {
   try {
     const {headers, cookies} = require("next/headers")
-    const req = new IncomingMessage(new Socket()) as IncomingMessage & {
-      cookies: {[key: string]: string}
-    }
-    req.headers = Object.fromEntries(headers())
+    const reqHeader = Object.fromEntries(headers())
     const csrfToken = cookies().get(COOKIE_CSRF_TOKEN())
     if (csrfToken) {
-      req.headers[HEADER_CSRF] = csrfToken.value
+      reqHeader[HEADER_CSRF] = csrfToken.value
     }
-    req.cookies = Object.fromEntries(
-      cookies()
-        .getAll()
-        .map((c: {name: string; value: string}) => [c.name, c.value]),
+    const session = await getSession(
+      {
+        headers: new Headers(reqHeader),
+        method: "POST",
+      } as Request,
+      null as never,
+      true,
     )
-    const res = new ServerResponse(req)
-    const session = await getSession(req, res, true)
     const ctx: Ctx = {
       session,
     }
@@ -206,17 +309,13 @@ export async function getBlitzContext(): Promise<Ctx> {
   } catch (e) {
     if ((e as NodeJS.ErrnoException).code === "MODULE_NOT_FOUND") {
       throw new Error(
-        "Usage of `useAuthenticatedBlitzContext` is supported only in next.js 13.0.0 and above. Please upgrade your next.js version.",
+        "Usage of `getBlitzContext` is supported only in next.js 13.0.0 and above. Please upgrade your next.js version.",
       )
     }
     throw e
   }
 }
 
-interface RouteUrlObject extends Pick<UrlObject, "pathname" | "query" | "href"> {
-  pathname: string
-}
-
 export async function useAuthenticatedBlitzContext({
   redirectTo,
   redirectAuthenticatedTo,
@@ -291,18 +390,6 @@ export async function useAuthenticatedBlitzContext({
   }
 }
 
-const makeProxyToPublicData = <T extends SessionContextClass>(ctxClass: T): T => {
-  return new Proxy(ctxClass, {
-    get(target, prop, receiver) {
-      if (prop in target || prop === "then") {
-        return Reflect.get(target, prop, receiver)
-      } else {
-        return Reflect.get(target.$publicData, prop, receiver)
-      }
-    },
-  })
-}
-
 const NotSupportedMessage = async (method: string) => {
   const message = `Method ${method} is not yet supported in React Server Components`
   const _box = await log.box(message, log.chalk.hex("8a3df0").bold("Blitz Auth"))
@@ -310,21 +397,27 @@ const NotSupportedMessage = async (method: string) => {
 }
 
 export class SessionContextClass implements SessionContext {
-  private _req: IncomingMessage & {cookies: {[key: string]: string}}
-  private _res: ServerResponse & {blitzCtx: Ctx}
+  private _headers: Headers
   private _kernel: SessionKernel
-  private _appDir: boolean
+  private _isRsc: boolean
+  private _response?: ServerResponse
 
-  constructor(
-    req: IncomingMessage & {cookies: {[key: string]: string}},
-    res: ServerResponse & {blitzCtx: Ctx},
-    kernel: SessionKernel,
-    appDir: boolean,
-  ) {
-    this._req = req
-    this._res = res
+  private static headersToIncludeInResponse = [
+    HEADER_CSRF,
+    HEADER_CSRF_ERROR,
+    HEADER_PUBLIC_DATA_TOKEN,
+    HEADER_SESSION_CREATED,
+  ]
+
+  constructor(headers: Headers, kernel: SessionKernel, isRsc: boolean, response?: ServerResponse) {
+    this._headers = headers
     this._kernel = kernel
-    this._appDir = appDir
+    this._isRsc = isRsc
+    this._response = response
+  }
+
+  $antiCSRFToken() {
+    return this._kernel.antiCSRFToken
   }
 
   get $handle() {
@@ -352,38 +445,69 @@ export class SessionContextClass implements SessionContext {
   $isAuthorized(...args: IsAuthorizedArgs) {
     if (!this.userId) return false
 
-    return global.sessionConfig.isAuthorized({ctx: this._res.blitzCtx, args})
+    return global.sessionConfig.isAuthorized({
+      ctx: {
+        session: this as AuthenticatedSessionContext,
+      },
+      args,
+    })
   }
 
   $thisIsAuthorized(...args: IsAuthorizedArgs): this is AuthenticatedSessionContext {
     return this.$isAuthorized(...args)
   }
 
+  setSession(response: Response | ServerResponse) {
+    if (this._isRsc) {
+      void NotSupportedMessage("setSession")
+      return
+    }
+    const cookieHeaders = this._headers.get("set-cookie")
+    if (response instanceof Response) {
+      response.headers.set("Set-Cookie", cookieHeaders!)
+    } else {
+      response.setHeader("Set-Cookie", splitCookiesString(cookieHeaders!))
+    }
+
+    const headers = this._headers.entries()
+    for (const [key, value] of headers) {
+      if (SessionContextClass.headersToIncludeInResponse.includes(key)) {
+        if (response instanceof Response) {
+          response.headers.set(key, value)
+        } else {
+          response.setHeader(key, value)
+        }
+      }
+    }
+  }
+
   async $create(publicData: PublicData, privateData?: Record<any, any>) {
-    if (this._appDir) {
+    if (this._isRsc) {
       void NotSupportedMessage("$create")
       return
     }
     this._kernel = await createNewSession({
-      req: this._req,
-      res: this._res,
+      headers: this._headers,
       publicData,
       privateData,
       jwtPayload: this._kernel.jwtPayload,
       anonymous: false,
     })
+
+    if (this._response) this.setSession(this._response)
   }
 
   async $revoke() {
-    if (this._appDir) {
+    if (this._isRsc) {
       void NotSupportedMessage("$revoke")
       return
     }
-    this._kernel = await revokeSession(this._req, this._res, this.$handle)
+    this._kernel = await revokeSession(this._headers, this.$handle)
+    if (this._response) this.setSession(this._response)
   }
 
   async $revokeAll() {
-    if (this._appDir) {
+    if (this._isRsc) {
       void NotSupportedMessage("$revokeAll")
       return
     }
@@ -395,25 +519,28 @@ export class SessionContextClass implements SessionContext {
   }
 
   async $setPublicData(data: Record<any, any>) {
-    if (this._appDir) {
+    if (this._isRsc) {
       void NotSupportedMessage("$setPublicData")
       return
     }
     if (this.userId) {
       await syncPubicDataFieldsForUserIfNeeded(this.userId, data)
     }
-    this._kernel.publicData = await setPublicData(this._req, this._res, this._kernel, data)
+    this._kernel.publicData = await setPublicData(this._headers, this._kernel, data)
+    if (this._response) this.setSession(this._response)
   }
 
   async $getPrivateData() {
     return (await getPrivateData(this.$handle)) || {}
   }
-  $setPrivateData(data: Record<any, any>) {
-    if (this._appDir) {
+
+  async $setPrivateData(data: Record<any, any>) {
+    if (this._isRsc) {
       void NotSupportedMessage("$setPrivateData")
       return Promise.resolve()
     }
-    return setPrivateData(this._kernel, data)
+    await setPrivateData(this._kernel, data)
+    if (this._response) this.setSession(this._response)
   }
 }
 
@@ -505,7 +632,7 @@ const JWT_ANONYMOUS_SUBJECT = "anonymous"
 const JWT_ALGORITHM = "HS256"
 
 const createAnonymousSessionToken = (payload: AnonymousSessionPayload) => {
-  return jwtSign({[JWT_NAMESPACE]: payload}, getSessionSecretKey() || "", {
+  return jsonwebtoken.sign({[JWT_NAMESPACE]: payload}, getSessionSecretKey() || "", {
     algorithm: JWT_ALGORITHM,
     issuer: JWT_ISSUER,
     audience: JWT_AUDIENCE,
@@ -519,7 +646,7 @@ const parseAnonymousSessionToken = (token: string) => {
   const secret = getSessionSecretKey()
 
   try {
-    const fullPayload = jwtVerify(token, secret!, {
+    const fullPayload = jsonwebtoken.verify(token, secret!, {
       algorithms: [JWT_ALGORITHM],
       issuer: JWT_ISSUER,
       audience: JWT_AUDIENCE,
@@ -536,126 +663,127 @@ const parseAnonymousSessionToken = (token: string) => {
   }
 }
 
-export const setCookie = (res: ServerResponse, cookieStr: string) => {
-  const getCookieName = (c: string) => c.split("=", 2)[0]
-  const appendCookie = () => append(res, "Set-Cookie", cookieStr)
-
-  const cookiesHeader = res.getHeader("Set-Cookie")
-  const cookieName = getCookieName(cookieStr)
-
-  if (typeof cookiesHeader !== "string" && !Array.isArray(cookiesHeader)) {
-    appendCookie()
-    return
+const cookieOptions = (headers: Headers, expires: Date, httpOnly: boolean) => {
+  return {
+    path: "/",
+    secure:
+      global.sessionConfig.secureCookies &&
+      !isLocalhost({
+        headers,
+      } as Request),
+    sameSite: global.sessionConfig.sameSite,
+    domain: global.sessionConfig.domain,
+    expires: new Date(expires),
+    httpOnly,
   }
+}
 
-  if (typeof cookiesHeader === "string") {
-    if (cookieName === getCookieName(cookiesHeader)) {
-      res.setHeader("Set-Cookie", cookieStr)
+function replaceOrAppendValueInSetCookieHeader(
+  headers: Headers,
+  cookieName: string,
+  newValue: string,
+): string {
+  const cookies = headers.get("set-cookie")
+  if (!cookies) return newValue
+  const cookiesAsArray = splitCookiesString(cookies!)
+  for (let i = 0; i < cookiesAsArray.length; i++) {
+    const cookie = cookiesAsArray[i]
+    if (cookie?.startsWith(cookieName)) {
+      cookiesAsArray[i] = newValue
+      return cookiesAsArray.join(", ")
     } else {
-      appendCookie()
-    }
-  } else {
-    for (let i = 0; i < cookiesHeader.length; i++) {
-      if (cookieName === getCookieName(cookiesHeader[i] || "")) {
-        cookiesHeader[i] = cookieStr
-        res.setHeader("Set-Cookie", cookiesHeader)
-        return
+      if (i === cookiesAsArray.length - 1) {
+        cookiesAsArray.push(newValue)
+        return cookiesAsArray.join(", ")
       }
     }
-    appendCookie()
   }
+  return cookiesAsArray.filter(Boolean).join(", ")
 }
 
-const setHeader = (res: ServerResponse, name: string, value: string) => {
-  res.setHeader(name, value)
-  if ("_blitz" in res) {
-    ;(res as any)._blitz[name] = value
-  }
-}
-
-const setSessionCookie = (res: ServerResponse, sessionToken: string, expiresAt: Date) => {
-  setCookie(
-    res,
-    cookie.serialize(COOKIE_SESSION_TOKEN(), sessionToken, {
-      path: "/",
-      httpOnly: true,
-      secure: global.sessionConfig.secureCookies,
-      sameSite: global.sessionConfig.sameSite,
-      domain: global.sessionConfig.domain,
-      expires: expiresAt,
-    }),
+const setSessionCookie = (headers: Headers, sessionToken: string, expiresAt: Date) => {
+  const sessionCookie = cookie.serialize(
+    COOKIE_SESSION_TOKEN(),
+    sessionToken,
+    cookieOptions(headers, expiresAt, true),
   )
-}
-
-const setAnonymousSessionCookie = (res: ServerResponse, token: string, expiresAt: Date) => {
-  setCookie(
-    res,
-    cookie.serialize(COOKIE_ANONYMOUS_SESSION_TOKEN(), token, {
-      path: "/",
-      httpOnly: true,
-      secure: global.sessionConfig.secureCookies,
-      sameSite: global.sessionConfig.sameSite,
-      domain: global.sessionConfig.domain,
-      expires: expiresAt,
-    }),
+  const newCookies = replaceOrAppendValueInSetCookieHeader(
+    headers,
+    COOKIE_SESSION_TOKEN(),
+    sessionCookie,
   )
+  headers.set("Set-Cookie", newCookies)
 }
 
-const setCSRFCookie = (
-  req: IncomingMessage,
-  res: ServerResponse,
-  antiCSRFToken: string,
-  expiresAt: Date,
-) => {
+const setAnonymousSessionCookie = (headers: Headers, token: string, expiresAt: Date) => {
+  const anonCookie = cookie.serialize(
+    COOKIE_ANONYMOUS_SESSION_TOKEN(),
+    token,
+    cookieOptions(headers, expiresAt, true),
+  )
+  const newCookies = replaceOrAppendValueInSetCookieHeader(
+    headers,
+    COOKIE_ANONYMOUS_SESSION_TOKEN(),
+    anonCookie,
+  )
+  headers.set("Set-Cookie", newCookies)
+}
+
+const setCSRFCookie = (headers: Headers, antiCSRFToken: string, expiresAt: Date) => {
   debug("setCSRFCookie", antiCSRFToken)
   assert(antiCSRFToken !== undefined, "Internal error: antiCSRFToken is being set to undefined")
-  setCookie(
-    res,
-    cookie.serialize(COOKIE_CSRF_TOKEN(), antiCSRFToken, {
-      path: "/",
-      secure: global.sessionConfig.secureCookies && !isLocalhost(req),
-      sameSite: global.sessionConfig.sameSite,
-      domain: global.sessionConfig.domain,
-      expires: expiresAt,
-    }),
+  const csrfCookie = cookie.serialize(
+    COOKIE_CSRF_TOKEN(),
+    antiCSRFToken,
+    cookieOptions(headers, expiresAt, false),
   )
+
+  const newCookies = replaceOrAppendValueInSetCookieHeader(headers, COOKIE_CSRF_TOKEN(), csrfCookie)
+  headers.set("Set-Cookie", newCookies)
 }
 
-const setPublicDataCookie = (
-  req: IncomingMessage,
-  res: ServerResponse,
-  publicDataToken: string,
-  expiresAt: Date,
-) => {
-  setHeader(res, HEADER_PUBLIC_DATA_TOKEN, "updated")
-  setCookie(
-    res,
-    cookie.serialize(COOKIE_PUBLIC_DATA_TOKEN(), publicDataToken, {
-      path: "/",
-      secure: global.sessionConfig.secureCookies && !isLocalhost(req),
-      sameSite: global.sessionConfig.sameSite,
-      domain: global.sessionConfig.domain,
-      expires: expiresAt,
-    }),
+const setPublicDataCookie = (headers: Headers, publicDataToken: string, expiresAt: Date) => {
+  headers.set(HEADER_PUBLIC_DATA_TOKEN, "updated")
+  const publicDataCookie = cookie.serialize(
+    COOKIE_PUBLIC_DATA_TOKEN(),
+    publicDataToken,
+    cookieOptions(headers, expiresAt, false),
   )
+  const newCookies = replaceOrAppendValueInSetCookieHeader(
+    headers,
+    COOKIE_PUBLIC_DATA_TOKEN(),
+    publicDataCookie,
+  )
+  headers.set("Set-Cookie", newCookies)
 }
 
 // --------------------------------
 // Get Session
 // --------------------------------
-async function getSessionKernel(
-  req: IncomingMessage & {cookies: {[key: string]: string}},
-  res: ServerResponse,
-): Promise<SessionKernel | null> {
-  const anonymousSessionToken = req.cookies[COOKIE_ANONYMOUS_SESSION_TOKEN()]
-  const sessionToken = req.cookies[COOKIE_SESSION_TOKEN()] // for essential method
-  const idRefreshToken = req.cookies[COOKIE_REFRESH_TOKEN()] // for advanced method
+async function getSessionKernel({
+  headers,
+  method,
+}: {
+  headers: Headers
+  method: string | undefined
+}): Promise<SessionKernel | null> {
+  const cookies = getCookiesFromHeader(headers)
+  const anonymousSessionToken = cookies[COOKIE_ANONYMOUS_SESSION_TOKEN()]
+  const sessionToken = cookies[COOKIE_SESSION_TOKEN()] // for essential method
+  const idRefreshToken = cookies[COOKIE_REFRESH_TOKEN()] // for advanced method
+  const antiCSRFToken = headers.get(HEADER_CSRF)
+  debug("getSessionKernel", {
+    anonymousSessionToken,
+    sessionToken,
+    idRefreshToken,
+    antiCSRFToken,
+  })
+
   const enableCsrfProtection =
-    req.method !== "GET" &&
-    req.method !== "OPTIONS" &&
-    req.method !== "HEAD" &&
+    method !== "GET" &&
+    method !== "OPTIONS" &&
+    method !== "HEAD" &&
     !process.env.DANGEROUSLY_DISABLE_CSRF_PROTECTION
-  const antiCSRFToken = req.headers[HEADER_CSRF] as string | undefined
 
   if (sessionToken) {
     debug("[getSessionKernel] Request has sessionToken")
@@ -698,7 +826,7 @@ async function getSessionKernel(
         )
       }
 
-      setHeader(res, HEADER_CSRF_ERROR, "true")
+      headers.set(HEADER_CSRF_ERROR, "true")
       throw new CSRFTokenMismatchError()
     }
 
@@ -710,7 +838,7 @@ async function getSessionKernel(
      *  But only renew with non-GET requests because a GET request could be from a
      *  browser level navigation
      */
-    if (req.method !== "GET") {
+    if (method !== "GET") {
       // The publicData in the DB could have been updated since this client last made
       // a request. If so, then we generate a new access token
       const hasPublicDataChanged =
@@ -733,8 +861,7 @@ async function getSessionKernel(
 
       if (hasPublicDataChanged || hasQuarterExpiryTimePassed) {
         await refreshSession(
-          req,
-          res,
+          headers,
           {
             handle,
             publicData: JSON.parse(persistedSession.publicData || ""),
@@ -774,7 +901,7 @@ async function getSessionKernel(
         )
       }
 
-      setHeader(res, HEADER_CSRF_ERROR, "true")
+      headers.set(HEADER_CSRF_ERROR, "true")
       throw new CSRFTokenMismatchError()
     }
 
@@ -795,16 +922,14 @@ async function getSessionKernel(
 // Create Session
 // --------------------------------
 interface CreateNewAnonSession {
-  req: IncomingMessage
-  res: ServerResponse
+  headers: Headers
   publicData: EmptyPublicData
   privateData?: Record<any, any>
   anonymous: true
   jwtPayload?: JwtPayload
 }
 interface CreateNewAuthedSession {
-  req: IncomingMessage
-  res: ServerResponse
+  headers: Headers
   publicData: PublicData
   privateData?: Record<any, any>
   anonymous: false
@@ -814,7 +939,6 @@ interface CreateNewAuthedSession {
 async function createNewSession(
   args: CreateNewAnonSession | CreateNewAuthedSession,
 ): Promise<SessionKernel> {
-  const {req, res} = args
   assert(args.publicData.userId !== undefined, "You must provide publicData.userId")
 
   const antiCSRFToken = createAntiCSRFToken()
@@ -835,12 +959,12 @@ async function createNewSession(
       new Date(),
       global.sessionConfig.anonSessionExpiryMinutes as number,
     )
-    setAnonymousSessionCookie(res, anonymousSessionToken, expiresAt)
-    setCSRFCookie(req, res, antiCSRFToken, expiresAt)
-    setPublicDataCookie(req, res, publicDataToken, expiresAt)
+    setAnonymousSessionCookie(args.headers, anonymousSessionToken, expiresAt)
+    setCSRFCookie(args.headers, antiCSRFToken, expiresAt)
+    setPublicDataCookie(args.headers, publicDataToken, expiresAt)
     // Clear the essential session cookie in case it was previously set
-    setSessionCookie(res, "", new Date(0))
-    setHeader(res, HEADER_SESSION_CREATED, "true")
+    setSessionCookie(args.headers, "", new Date(0))
+    args.headers.set(HEADER_SESSION_CREATED, "true")
 
     return {
       handle,
@@ -891,12 +1015,13 @@ async function createNewSession(
       privateData: JSON.stringify(newPrivateData),
     })
 
-    setSessionCookie(res, sessionToken, expiresAt)
-    setCSRFCookie(req, res, antiCSRFToken, expiresAt)
-    setPublicDataCookie(req, res, publicDataToken, expiresAt)
+    setSessionCookie(args.headers, sessionToken, expiresAt)
+    debug("Session created", {handle, publicData: newPublicData, expiresAt})
+    setCSRFCookie(args.headers, antiCSRFToken, expiresAt)
+    setPublicDataCookie(args.headers, publicDataToken, expiresAt)
     // Clear the anonymous session cookie in case it was previously set
-    setAnonymousSessionCookie(res, "", new Date(0))
-    setHeader(res, HEADER_SESSION_CREATED, "true")
+    setAnonymousSessionCookie(args.headers, "", new Date(0))
+    args.headers.set(HEADER_SESSION_CREATED, "true")
 
     return {
       handle,
@@ -914,10 +1039,9 @@ async function createNewSession(
   }
 }
 
-async function createAnonymousSession(req: IncomingMessage, res: ServerResponse) {
+async function createAnonymousSession({headers}: {headers: Headers}) {
   return await createNewSession({
-    req,
-    res,
+    headers,
     publicData: {userId: null},
     anonymous: true,
   })
@@ -928,8 +1052,7 @@ async function createAnonymousSession(req: IncomingMessage, res: ServerResponse)
 // --------------------------------
 
 async function refreshSession(
-  req: IncomingMessage,
-  res: ServerResponse,
+  headers: Headers,
   sessionKernel: SessionKernel,
   {publicDataChanged}: {publicDataChanged: boolean},
 ) {
@@ -943,8 +1066,8 @@ async function refreshSession(
     const publicDataToken = createPublicDataToken(sessionKernel.publicData)
 
     const expiresAt = addYears(new Date(), 30)
-    setAnonymousSessionCookie(res, anonymousSessionToken, expiresAt)
-    setPublicDataCookie(req, res, publicDataToken, expiresAt)
+    setAnonymousSessionCookie(headers, anonymousSessionToken, expiresAt)
+    setPublicDataCookie(headers, publicDataToken, expiresAt)
   } else if (global.sessionConfig.method === "essential" && "sessionToken" in sessionKernel) {
     const expiresAt = addMinutes(new Date(), global.sessionConfig.sessionExpiryMinutes as number)
 
@@ -952,7 +1075,7 @@ async function refreshSession(
     if (publicDataChanged) {
       debug("Public data has changed")
       const publicDataToken = createPublicDataToken(sessionKernel.publicData)
-      setPublicDataCookie(req, res, publicDataToken, expiresAt)
+      setPublicDataCookie(headers, publicDataToken, expiresAt)
       await global.sessionConfig.updateSession(sessionKernel.handle, {
         expiresAt,
         publicData: JSON.stringify(sessionKernel.publicData),
@@ -994,12 +1117,7 @@ async function syncPubicDataFieldsForUserIfNeeded(
   }
 }
 
-async function revokeSession(
-  req: IncomingMessage,
-  res: ServerResponse,
-  handle: string,
-  anonymous: boolean = false,
-) {
+async function revokeSession(headers: Headers, handle: string, anonymous: boolean = false) {
   debug("Revoking session", handle)
   if (!anonymous) {
     try {
@@ -1012,7 +1130,9 @@ async function revokeSession(
   // This fixes race condition where all client side queries get refreshed
   // in parallel and each creates a new anon session
   // https://github.com/blitz-js/blitz/issues/2746
-  return createAnonymousSession(req, res)
+  return createAnonymousSession({
+    headers,
+  })
 }
 
 async function revokeAllSessionsForUser(userId: PublicData["userId"]) {
@@ -1078,8 +1198,7 @@ async function setPrivateData(sessionKernel: SessionKernel, data: Record<any, an
 }
 
 async function setPublicData(
-  req: IncomingMessage,
-  res: ServerResponse,
+  headers: Headers,
   sessionKernel: SessionKernel,
   data: Record<any, any>,
 ) {
@@ -1091,7 +1210,7 @@ async function setPublicData(
     ...data,
   } as PublicData
 
-  await refreshSession(req, res, {...sessionKernel, publicData}, {publicDataChanged: true})
+  await refreshSession(headers, {...sessionKernel, publicData}, {publicDataChanged: true})
   return publicData
 }
 

packages/blitz-auth/src/server/index.ts

@@ -9,8 +9,6 @@ export {
   getSession,
   isLocalhost,
   setPublicDataForUser,
-  setCookie,
   simpleRolesIsAuthorized,
-  getBlitzContext,
 } from "./auth-sessions"
 export type {AnonymousSessionPayload, SimpleRolesIsAuthorized} from "./auth-sessions"

packages/blitz-auth/src/shared/types.ts

@@ -1,5 +1,6 @@
 //@ts-nocheck
-import {Ctx} from "blitz"
+import type {Ctx} from "blitz"
+import type {ServerResponse} from "http"
 
 export interface Session {
   // isAuthorize can be injected here
@@ -66,6 +67,12 @@ export interface SessionContextBase {
   $getPrivateData: () => Promise<Record<any, any>>
   $setPrivateData: (data: Record<any, any>) => Promise<void>
   $setPublicData: (data: Partial<Omit<PublicData, "userId">>) => Promise<void>
+  /**
+   * This function is only for manual session handling
+   *
+   * Instead use {@link https://blitzjs.com/docs/auth-server#with-blitz-auth-api withBlitzAuth} to handle session creation and update
+   */
+  setSession: (res: Response | ServerResponse) => void
 }
 
 // Could be anonymous

packages/blitz-next/package.json

@@ -59,7 +59,7 @@
     "blitz": "2.0.10",
     "cross-spawn": "7.0.3",
     "find-up": "4.1.0",
-    "next": "canary",
+    "next": "14.3.0-canary.28",
     "next-router-mock": "0.9.1",
     "react": "18.2.0",
     "react-dom": "18.2.0",

packages/blitz-next/src/index-server.ts

@@ -243,6 +243,7 @@ export interface BlitzConfig extends NextConfig {
   }
 }
 
+
 export function withBlitz(nextConfig: BlitzConfig = {}): NextConfig {
   if (
     process.env.NODE_ENV !== "production" &&

packages/blitz-rpc/package.json

@@ -49,7 +49,7 @@
     "@types/react": "18.0.25",
     "@types/react-dom": "17.0.14",
     "blitz": "2.0.10",
-    "next": "canary",
+    "next": "14.3.0-canary.28",
     "react": "18.2.0",
     "react-dom": "18.2.0",
     "typescript": "^4.8.4",

packages/blitz-rpc/src/index-server.ts

@@ -172,6 +172,12 @@ export function installTurboConfig() {
           as: "*.ts",
         },
       },
+      "**/*...blitz*/route.{jsx,tsx,js,ts}": {
+        default: {
+          loaders: [{loader: loaderServer, options: {}}],
+          as: "*.ts",
+        },
+      },
       "**/{queries,mutations}/**": {
         browser: {
           loaders: [
@@ -227,12 +233,12 @@ async function getResolverMap(): Promise<ResolverFiles | null | undefined> {
 }
 
 interface RpcConfig {
-  onError?: (error: Error, ctx: Ctx) => void
-  formatError?: (error: Error, ctx: Ctx) => Error
+  onError?: (error: Error, ctx?: Ctx) => void
+  formatError?: (error: Error, ctx?: Ctx) => Error
   logging?: RpcLoggerOptions
 }
 
-export function rpcHandler(config: RpcConfig) {
+export function rpcHandler(config?: RpcConfig) {
   return async function handleRpcRequest(req: NextApiRequest, res: NextApiResponse, ctx: Ctx) {
     const resolverMap = await getResolverMap()
     assert(resolverMap, "No query or mutation resolvers found")
@@ -244,7 +250,7 @@ export function rpcHandler(config: RpcConfig) {
     const relativeRoutePath = (req.query.blitz as string[])?.join("/")
     const routePath = "/" + relativeRoutePath
     const resolverName = routePath.replace(/(\/api\/rpc)?\//, "")
-    const rpcLogger = new RpcLogger(resolverName, config.logging)
+    const rpcLogger = new RpcLogger(resolverName, config?.logging)
 
     const loadableResolver = resolverMap?.[routePath]?.resolver
     if (!loadableResolver) {
@@ -303,6 +309,7 @@ export function rpcHandler(config: RpcConfig) {
 
         rpcLogger.timer.initNextJsSerialization()
         ;(res as any).blitzResult = result
+        ctx?.session?.setSession(res)
         res.json({
           result: serializedResult.json,
           error: null,
@@ -322,16 +329,18 @@ export function rpcHandler(config: RpcConfig) {
           error.stack = ""
         }
 
-        config.onError?.(error, ctx)
+        config?.onError?.(error, ctx)
         rpcLogger.error(error)
 
         if (!error.statusCode) {
           error.statusCode = 500
         }
 
-        const formattedError = config.formatError?.(error, ctx) ?? error
+        const formattedError = config?.formatError?.(error, ctx) ?? error
         const serializedError = superjsonSerialize(formattedError)
 
+        ctx?.session?.setSession(res)
+
         res.json({
           result: null,
           error: serializedError.json,
@@ -349,3 +358,128 @@ export function rpcHandler(config: RpcConfig) {
     }
   }
 }
+
+type Params = Record<string, unknown>
+
+export function rpcAppHandler(config?: RpcConfig) {
+  async function handleRpcRequest(req: Request, context: {params: Params}, ctx?: Ctx) {
+    const session = ctx?.session
+    const resolverMap = await getResolverMap()
+    assert(resolverMap, "No query or mutation resolvers found")
+
+    assert(
+      Array.isArray(context.params.blitz),
+      "It seems your Blitz RPC endpoint file is not named [[...blitz]].(jt)s. Please ensure it is",
+    )
+
+    const relativeRoutePath = (context.params.blitz as string[])?.join("/")
+    const routePath = "/" + relativeRoutePath
+    const resolverName = routePath.replace(/(\/api\/rpc)?\//, "")
+    const rpcLogger = new RpcLogger(resolverName, config?.logging)
+
+    const loadableResolver = resolverMap?.[routePath]?.resolver
+    if (!loadableResolver) {
+      throw new Error("No resolver for path: " + routePath)
+    }
+
+    const {default: resolver, config: resolverConfig} = await loadableResolver()
+
+    if (!resolver) {
+      throw new Error("No default export for resolver path: " + routePath)
+    }
+
+    const resolverConfigWithDefaults = {...defaultConfig, ...resolverConfig}
+
+    if (req.method === "HEAD") {
+      // We used to initiate database connection here
+      return new Response(null, {status: 200})
+    }
+
+    if (
+      req.method === "POST" ||
+      (req.method === "GET" && resolverConfigWithDefaults.httpMethod === "GET")
+    ) {
+      const body = await req.json()
+      if (req.method === "POST" && typeof body.params === "undefined") {
+        const error = {message: "Request body is missing the `params` key"}
+        rpcLogger.error(error.message)
+        return new Response(JSON.stringify({result: null, error}), {status: 400})
+      }
+
+      try {
+        const data = deserialize({
+          json:
+            req.method === "POST"
+              ? body.params
+              : context.params.params
+              ? parse(`${context.params.params}`)
+              : undefined,
+          meta:
+            req.method === "POST"
+              ? body.meta?.params
+              : context.params.meta
+              ? parse(`${context.params.meta}`)
+              : undefined,
+        })
+        rpcLogger.timer.initResolver()
+        rpcLogger.preResolver(data)
+
+        const result = await resolver(data, {session})
+        rpcLogger.timer.resolverDuration()
+        rpcLogger.postResolver(result)
+
+        rpcLogger.timer.initSerialization()
+        const serializedResult = superjsonSerialize(result)
+
+        rpcLogger.timer.initNextJsSerialization()
+        const response = new Response(
+          JSON.stringify({
+            result: serializedResult.json,
+            error: null,
+            meta: {
+              result: serializedResult.meta,
+            },
+          }),
+        )
+        session?.setSession(response)
+        return response
+      } catch (error: any) {
+        if (error._clearStack) {
+          error.stack = ""
+        }
+
+        config?.onError?.(error, {session} as Ctx)
+        rpcLogger.error(error)
+
+        if (!error.statusCode) {
+          error.statusCode = 500
+        }
+
+        const formattedError = config?.formatError?.(error, {session} as Ctx) ?? error
+        const serializedError = superjsonSerialize(formattedError)
+
+        const response = new Response(
+          JSON.stringify({
+            result: null,
+            error: serializedError.json,
+            meta: {
+              error: serializedError.meta,
+            },
+          }),
+        )
+        session?.setSession(response)
+        return response
+      }
+    } else {
+      // Everything else is error
+      rpcLogger.warn(`${req.method} method not supported`)
+      return new Response(null, {status: 404})
+    }
+  }
+
+  return {
+    GET: handleRpcRequest,
+    POST: handleRpcRequest,
+    HEAD: handleRpcRequest,
+  }
+}

packages/blitz/src/cli/commands/install.ts

@@ -3,7 +3,8 @@ import {CliCommand} from "../index"
 import prompts from "prompts"
 import {bootstrap} from "global-agent"
 import {baseLogger, log} from "../../logging"
-const debug = require("debug")("blitz:cli")
+import Debug from "debug"
+const debug = Debug("blitz:cli")
 import {join, resolve, dirname} from "path"
 import {Stream} from "stream"
 import {promisify} from "util"

packages/blitz/src/cli/utils/config.ts

@@ -4,7 +4,8 @@ import {readJSON} from "fs-extra"
 import path from "path"
 import pkgDir from "pkg-dir"
 import resolveCwd from "resolve-cwd"
-const debug = require("debug")("blitz:utils")
+import Debug from "debug"
+const debug = Debug("blitz:utils")
 
 export async function resolveBinAsync(pkg: string, executable = pkg) {
   const packageDir = await pkgDir(resolveCwd(pkg))

packages/blitz/src/cli/utils/next-console.ts

@@ -5,7 +5,8 @@ import path from "path"
 import * as REPL from "repl"
 import {REPLCommand, REPLServer} from "repl"
 // eslint-disable-next-line @next/next/no-assign-module-variable
-const debug = require("debug")("blitz:repl")
+import Debug from "debug"
+const debug = Debug("blitz:repl")
 import ProgressBar from "progress"
 import {log} from "../../logging"
 

packages/blitz/src/cli/utils/next-utils.ts

@@ -7,7 +7,8 @@ import * as esbuild from "esbuild"
 import pkgDir from "pkg-dir"
 import type {ServerConfig} from "./config"
 
-const debug = require("debug")("blitz:utils")
+import Debug from "debug"
+const debug = Debug("blitz:utils")
 
 export function getProjectRootSync() {
   return process.cwd()

packages/blitz/src/cli/utils/routes-manifest.ts

@@ -5,7 +5,8 @@ import {outputFile, readdir, readFile} from "fs-extra"
 import Watchpack from "watchpack"
 import {findNodeModulesRoot} from "./find-node-modules"
 
-const debug = require("debug")("blitz")
+import Debug from "debug"
+const debug = Debug("blitz")
 export const CONFIG_FILE = ".blitz.config.compiled.js"
 export const NEXT_CONFIG_FILE = "next.config.js"
 export const PHASE_PRODUCTION_SERVER = "phase-production-server"

packages/blitz/src/index-server.ts

@@ -9,7 +9,7 @@ export * from "./utils/enhance-prisma"
 export * from "./middleware"
 export * from "./paginate"
 export * from "./logging"
-export {reduceBlitzServerPlugins} from "./plugin"
+export {reduceBlitzServerPlugins, merge, pipe} from "./plugin"
 export {findNodeModulesRoot, findNodeModulesRootSync} from "./cli/utils/find-node-modules"
 
 export {startWatcher, stopWatcher} from "./cli/utils/routes-manifest"

packages/blitz/src/logging.ts

@@ -99,8 +99,8 @@ const branded = (msg: string) => {
  * @param {string} msg
  */
 const clearLine = (msg?: string) => {
-  readline.clearLine(process.stdout, 0)
-  readline.cursorTo(process.stdout, 0)
+  readline.clearLine(process.stdout as any, 0)
+  readline.cursorTo(process.stdout as any, 0)
   msg && process.stdout.write(msg)
 }
 
@@ -173,7 +173,8 @@ const box = async (mes: string, title: string) => {
  * If the DEBUG env var is set this will write to the console
  * @param str msg
  */
-const debug = require("debug")("blitz")
+import Debug from "debug"
+const debug = Debug("blitz")
 
 export const log = {
   withBrand,

packages/generator/src/generators/app-generator.ts

@@ -68,11 +68,15 @@ export class AppGenerator extends Generator<AppGeneratorOptions> {
       this.destinationPath("package.json"),
     )
 
-    const rpcEndpointPath = `src/pages/api/rpc/blitzrpcroute.${this.options.useTs ? "ts" : "js"}`
+    const rpcEndpointPath = `src/app/api/rpc/blitzrpcroute/route.${
+      this.options.useTs ? "ts" : "js"
+    }`
     if (this.fs.exists(rpcEndpointPath)) {
       this.fs.move(
         this.destinationPath(rpcEndpointPath),
-        this.destinationPath(`src/pages/api/rpc/[[...blitz]].${this.options.useTs ? "ts" : "js"}`),
+        this.destinationPath(
+          `src/app/api/rpc/[[...blitz]]/route.${this.options.useTs ? "ts" : "js"}`,
+        ),
       )
     }
 

packages/generator/templates/app/.editorconfig

@@ -1,11 +0,0 @@
-# https://EditorConfig.org
-
-root = true
-
-[*]
-charset = utf-8
-end_of_line = lf
-indent_size = 2
-indent_style = space
-insert_final_newline = true
-trim_trailing_whitespace = true

packages/generator/templates/app/src/app/api/rpc/blitzrpcroute/route.ts

@@ -0,0 +1,4 @@
+import {rpcAppHandler} from "@blitzjs/rpc"
+import {withBlitzAuth} from "src/app/blitz-server"
+
+export const {GET, HEAD, POST} = withBlitzAuth(rpcAppHandler())

packages/generator/templates/app/src/app/blitz-server.ts

@@ -5,7 +5,7 @@ import {BlitzLogger} from "blitz"
 import {RpcServerPlugin} from "@blitzjs/rpc"
 import {authConfig} from "./blitz-auth-config"
 
-const {api, getBlitzContext, useAuthenticatedBlitzContext, invoke} = setupBlitzServer({
+const {api, getBlitzContext, useAuthenticatedBlitzContext, invoke,withBlitzAuth} = setupBlitzServer({
   plugins: [
     AuthServerPlugin({
       ...authConfig,
@@ -17,4 +17,4 @@ const {api, getBlitzContext, useAuthenticatedBlitzContext, invoke} = setupBlitzS
   logger: BlitzLogger({}),
 })
 
-export {api, getBlitzContext, useAuthenticatedBlitzContext, invoke}
+export {api, getBlitzContext, useAuthenticatedBlitzContext, invoke,withBlitzAuth}

packages/generator/templates/app/src/pages/api/rpc/blitzrpcroute.ts

@@ -1,6 +0,0 @@
-// Note: This stays in the /pages folder for the time being
-
-import { rpcHandler } from "@blitzjs/rpc"
-import { api } from "src/app/blitz-server"
-
-export default api(rpcHandler({ onError: (error, ctx) => console.log(error) }))