Remove redundant encryption implementations (#10)

* remove redundant encryption implementations

- delete ironSessionEncryption.ts (dead code, just re-exported iron-session)
- delete pureWebcryptoEncryption.ts (340 lines of hand-rolled crypto)
- move iron-session from dependencies to devDependencies (test-only)
- keep iron-webcrypto as the sole encryption implementation

consumers no longer ship iron-session and its transitive deps

* formatting

* remove iron-session dev dependency

cross-compatibility tests were validating iron-webcrypto's correctness,
not ours. simplified to self-contained round-trip tests.

Author: nicknisi

package.json

@@ -36,7 +36,6 @@
   },
   "dependencies": {
     "@workos-inc/node": "^8.0.0-rc.3",
-    "iron-session": "^8.0.4",
     "iron-webcrypto": "^1.2.1",
     "jose": "^6.1.2"
   },

pnpm-lock.yaml

@@ -1,82 +1,32 @@
-import {
-  sealData as ironSessionSeal,
-  unsealData as ironSessionUnseal,
-} from 'iron-session';
 import { SessionEncryption } from './ironWebcryptoEncryption.js';
-import ironSessionEncryption from './ironSessionEncryption.js';
 
 const testPassword = 'this-is-a-test-password-that-is-32-characters-long!';
 const testData = {
   userId: '123',
   email: 'test@example.com',
-  timestamp: Date.now(),
 };
 
 describe('ironWebcryptoEncryption', () => {
   const encryption = new SessionEncryption();
 
-  describe('cross-compatibility with iron-session', () => {
-    it('can unseal data sealed by iron-session', async () => {
-      const sealed = await ironSessionSeal(testData, {
-        password: testPassword,
-      });
-
-      const unsealed = await encryption.unsealData(sealed, {
-        password: testPassword,
-      });
-
-      expect(unsealed).toEqual(testData);
-    });
-
-    it('produces data that iron-session can unseal', async () => {
-      const sealed = await encryption.sealData(testData, {
-        password: testPassword,
-      });
-
-      const unsealed = await ironSessionUnseal(sealed, {
-        password: testPassword,
-      });
-
-      expect(unsealed).toEqual(testData);
-    });
-
-    it('handles version 2 tokens correctly', async () => {
+  describe('seal/unseal', () => {
+    it('round-trips data correctly', async () => {
       const sealed = await encryption.sealData(testData, {
         password: testPassword,
       });
-
-      expect(sealed).toMatch(/~2$/);
-
       const unsealed = await encryption.unsealData(sealed, {
         password: testPassword,
       });
-      expect(unsealed).toEqual(testData);
-    });
-
-    it('handles legacy tokens without version', async () => {
-      const legacySealed = await ironSessionSeal(testData, {
-        password: testPassword,
-      });
-      const sealWithoutVersion = legacySealed.split('~')[0]!;
-
-      const unsealed = await encryption.unsealData(sealWithoutVersion, {
-        password: testPassword,
-      });
 
       expect(unsealed).toEqual(testData);
     });
-  });
 
-  describe('basic functionality', () => {
-    it('seals and unseals data correctly', async () => {
+    it('produces version 2 tokens', async () => {
       const sealed = await encryption.sealData(testData, {
         password: testPassword,
       });
-      const unsealed = await encryption.unsealData(sealed, {
-        password: testPassword,
-      });
 
-      expect(unsealed).toEqual(testData);
+      expect(sealed).toMatch(/~2$/);
     });
 
     it('handles TTL parameter', async () => {
@@ -99,27 +49,15 @@ describe('ironWebcryptoEncryption', () => {
         encryption.unsealData(sealed, { password: wrongPassword }),
       ).rejects.toThrow();
     });
-  });
-
-  describe('compatibility with ironSessionEncryption export', () => {
-    it('can unseal data sealed by ironSessionEncryption', async () => {
-      const sealed = await ironSessionEncryption.sealData(testData, {
-        password: testPassword,
-      });
-
-      const unsealed = await encryption.unsealData(sealed, {
-        password: testPassword,
-      });
-
-      expect(unsealed).toEqual(testData);
-    });
 
-    it('produces data that ironSessionEncryption can unseal', async () => {
+    it('unseals tokens without version suffix (v1 format)', async () => {
       const sealed = await encryption.sealData(testData, {
         password: testPassword,
       });
+      // Strip the ~2 version suffix to simulate legacy token
+      const legacySealed = sealed.replace(/~2$/, '');
 
-      const unsealed = await ironSessionEncryption.unsealData(sealed, {
+      const unsealed = await encryption.unsealData(legacySealed, {
         password: testPassword,
       });