feat: add support for retrieving user session

[joeychilson]

Types of changes

• Bug fix (a non-breaking change which fixes an issue)
• New feature (a non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Description

This PR adds a new composable and server context for retrieving the user's session. This works exactly like the User composable and server context but returns the full session information instead of just the user's information. This is useful if you want to send the user's JWT token to an external server for authentication use.

Checklist:

• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have added tests to cover my changes (if not applicable, please state why)

[netlify]

👷 Deploy request for n3-supabase pending review.

Visit the deploys page to approve it

Name	Link
🔨 Latest commit	2698c01

[larbish]

Hey @joeychilson, LGTM concerning code. Can you update the doc?

[joeychilson]

@larbish I added the updated docs.

[larbish]

Thanks for this PR @joeychilson 🙏

Just so you know, you missed the SSR sync for the session, I fixed it here: 9dee37e

[XStarlink]

Hello @larbish larbish and @joeychilson,

Thanks for this lib and for your work!

I've been using nuxt-supabase for a few months now and I see a lot of 'Unauthorized' in my server logs, and I've experienced this myself several times in my app. Let me explain:

It seems that the refresh token doesn't work in some cases, and that the user isn't disconnected when he should be in order to get a new auth token and be authenticated again, but he's no longer authenticated and can still make calls in the app because the auth middleware sees him as authenticated when he's not.

While searching I found this discussion:

So I looked in the Supabase documentation to see the difference between getUser and getSession, and saw that it says not to use getSession on the server side:

"Since unencrypted session data is retrieved from local storage media, do not consider it a reliable data source on the server. It can be modified by the sender. If you need verified and reliable user data, call getUser instead."

I'm writing to you because when I read the code of this lib, I saw that only getSession is used, even on the server side.

What do you think? Shouldn't serverSupabaseUser use getUser instead of getSession?