Remove Pause dependency by inlining stream buffering logic.

CHANGELOG.md

@@ -5,6 +5,11 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+### Changed
+- Removed dependency on `pause` package by inlining equivalent stream-buffering
+  logic in `SessionStrategy`.  The `pauseStream` option behavior is unchanged.
+  The `pause` package (v0.0.1, published 2010) was the sole production
+  dependency removed by this change.
 
 ## [0.7.0] - 2023-11-27
 ### Changed

lib/strategies/session.js

@@ -1,8 +1,39 @@
 // Module dependencies.
-var pause = require('pause')
-  , util = require('util')
+var util = require('util')
   , Strategy = require('passport-strategy');
 
+function pauseStream(stream) {
+  var events = [];
+
+  function onEvent(name) {
+    return function() {
+      var args = new Array(arguments.length + 1);
+      args[0] = name;
+      for (var i = 0; i < arguments.length; i++) { args[i + 1] = arguments[i]; }
+      events.push(args);
+    };
+  }
+
+  var onData = onEvent('data');
+  var onEnd = onEvent('end');
+
+  stream.on('data', onData);
+  stream.on('end', onEnd);
+
+  return {
+    end: function() {
+      stream.removeListener('data', onData);
+      stream.removeListener('end', onEnd);
+    },
+    resume: function() {
+      this.end();
+      for (var i = 0; i < events.length; i++) {
+        stream.emit.apply(stream, events[i]);
+      }
+    }
+  };
+}
+
 
 /**
  *  Create a new `SessionStrategy` object.
@@ -84,11 +115,13 @@ util.inherits(SessionStrategy, Strategy);
  * @param {http.IncomingMessage} req - The Node.js {@link https://nodejs.org/api/http.html#class-httpincomingmessage `IncomingMessage`}
  *          object.
  * @param {Object} [options]
- * @param {boolean} [options.pauseStream=false] - When `true`, data events on
- *          the request will be paused, and then resumed after the asynchronous
- *          `deserializeUser` function has completed.  This is only necessary in
- *          cases where later middleware in the stack are listening for events,
- *          and ensures that those events are not missed.
+ * @param {boolean} [options.pauseStream=false] - When `true`, `data` and `end`
+ *          events on the request stream are buffered during the asynchronous
+ *          `deserializeUser` call and replayed once it completes.  This ensures
+ *          that downstream middleware registering `on('data')` listeners after
+ *          passport will not miss events that fired during deserialization.
+ *          Only necessary when later middleware in the stack listens directly
+ *          to request stream events.
  *
  * @example
  * passport.authenticate('session');
@@ -108,7 +141,7 @@ SessionStrategy.prototype.authenticate = function(req, options) {
     //       listening for events emitted from request.  For discussion on the
     //       matter, refer to: https://github.com/jaredhanson/passport/pull/106
 
-    var paused = options.pauseStream ? pause(req) : null;
+    var paused = options.pauseStream ? pauseStream(req) : null;
     this._deserializeUser(su, req, function(err, user) {
       if (err) { return self.error(err); }
       if (!user) {