@supabase/ssr should include @types/cookie as a (non-dev) dependency

[dawaltconley]

Bug report

• I confirm this is a bug with Supabase, not with my own application.
• I confirm I have searched the Docs, GitHub Discussions, and Discord.

Describe the bug

The server client example for NextJS setups throws errors with stricter TS/ESLint configs (specifically with the @typescript-eslint/no-unsafe-argument rule):

// from https://supabase.com/docs/guides/auth/server-side/nextjs
import { createServerClient, type CookieOptions } from '@supabase/ssr'
import { cookies } from 'next/headers'

export function createClient() {
  const cookieStore = cookies()

  return createServerClient(
    process.env.NEXT_PUBLIC_SUPABASE_URL!,
    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
    {
      cookies: {
        get(name: string) {
          return cookieStore.get(name)?.value
        },
        set(name: string, value: string, options: CookieOptions) {
          try {
            // ERROR: Unsafe argument of type `any` assigned to a parameter of type `[key: string, value: string, cookie?: Partial<ResponseCookie> | undefined] | [options: ResponseCookie]`
            cookieStore.set({ name, value, ...options })
          } catch (error) {
            // The `set` method was called from a Server Component.
            // This can be ignored if you have middleware refreshing
            // user sessions.
          }
        },
        /* ... */
      },
    }
  )
}

It's not immediately obvious when trying to debug but { name, value, ...options } evaluates to any. This is because CookieOptions is an alias for a type provided by the @types/cookie package, but this is a devDependency, so it's not being installed with @supabase/ssr:

// from dist/index.d.ts
import { CookieSerializeOptions } from 'cookie';

type CookieOptions = Partial<CookieSerializeOptions>;

As is, CookieOptions is basically an obscured any type, which only makes the type issues harder to debug.

To Reproduce

Attempt to use the server client example in any project with @typescript-eslint/no-unsafe-argument set to error.

Expected behavior

This can be fixed by adding @types/cookie to a project manually, but it would be better to include the package with @supabase/ssr.

[encima]

Transferred to auth for the right eyes. PRs welcome as well!

[rbutera]

I've created a PR over at @supabase/auth-helpers:

supabase/auth-helpers#781

Thank you @dawaltconley for figuring this out as it was a bit of a head scratcher for me!