feat: Destroy session + introduce http config

[olivermrbl]

Introduce

• DELETE /auth/session to destroy session, used for sign outs
• New http config in projectConfig*

*This PR introduces a breaking change by replacing some existing configs with an auth property in projectConfig.

We will go from

projectConfig: {
  ...,
  jwt_secret: "test",
  cookie_secret: "test",
  auth_cors: "..."
}

to

projectConfig: {
  ...,
  http: {
    jwtSecret: "test",
    cookieSecret: "test",
    authCors: "...",
    storeCors: "...",
    adminCors: "..."
  }
}

Additionally, an additional config jwtExpiresIn is introduced to control the expiry time of the issued JWT tokens. Default is 24 hours.

In the future, we should consider supporting settings per scope and provider, but I don't think this is very important right now.

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
medusa-dashboard	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	May 19, 2024 9:09am

3 Ignored Deployments

Name	Status	Preview	Comments	Updated (UTC)
api-reference	⬜️ Ignored (Inspect)			May 19, 2024 9:09am
docs-ui	⬜️ Ignored (Inspect)	Visit Preview		May 19, 2024 9:09am
medusa-docs	⬜️ Ignored (Inspect)	Visit Preview		May 19, 2024 9:09am

[changeset-bot]

⚠️ No Changeset found

Latest commit: 71f459a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[adrien2p]

Sounds good to me

me

[olivermrbl]

Should we change the auth config to http and put everything related to that in there:

http: {
    jwtSecret: "test",
    cookieSecret: "test",
    authCors: "...",
    storeCors: "...",
    authCors: "...",  
    compression: { ... }
  }

cc @srindom

[adrien2p]

I think it can make sense 👍 jwt is really specific to auth but I am find with defining the config in a kind of layer approach

[carlos-r-l-rodrigues]

I believe http makes sense.

[olivermrbl]

Done, let me know what you think :)

[carlos-r-l-rodrigues]

nice!

[olivermrbl]

@shahednasser, would you be up for helping me ensure the documentation reflects these changes? 🙏

[shahednasser]

@olivermrbl yes thanks for letting me know!

[olivermrbl]

Btw. I still need to clean up after we decided to make all these changes breaking. Essentially, it means we won't be keeping any of the old secrets and configs that have been moved to http.