Function: sessionAuth()

sessionAuth(opts): AuthProvider

Defined in: src/core/auth.ts:321

A logged-in session: login runs once (and again after expiresAt, unix epoch seconds); its headers and cookies ride on every request. refresh logs in again. login throws on failure (and retries internally if it wants to) — request() calls it once per need, never in a retry loop.

Parameters

opts

Login options.

login

Performs the login (ctx.transport is the family's transport). Returns the headers and cookies to ride on every request and an optional expiresAt (unix epoch seconds; omitted means the session lasts until a 401).

Returns

AuthProvider

An AuthProvider. apply merges the session headers under the request's own and appends the cookies to any Cookie header the caller set (name=value; …); refresh drops the session and logs in again.

Example

import { configure, sessionAuth } from 'sportsdataverse';

configure({
  auth: {
    kenpom: sessionAuth({
      login: async (ctx) => {
        const res = await ctx.transport({ method: 'POST', url: loginUrl, body: form, responseType: 'text' });
        return { cookies: parseSetCookie(res.headers['set-cookie']), expiresAt: Date.now() / 1000 + 3600 };
      },
    }),
  },
});

Remarks

Concurrent requests share one in-flight login. A login that throws is not retried by request(); a non-SdvError becomes AssetFetchError("<family>: auth failed (apply|refresh)") and the thrown message never carries the password (it goes through safeCause). Unlike tokenAuth, refresh always logs in again, even when the caller set the header.