fix: make deviceVendor optional in session fingerprint validation

Desktop browsers don't have deviceVendor (only mobile devices with Apple, Samsung, etc).
This was causing ILLEGAL_SESSION errors for desktop browser logins.

Author: Sceat

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@hydre/auth",
-  "version": "4.2.9",
+  "version": "4.2.10",
   "description": "A light graphql authentication server built on Redis",
   "type": "module",
   "scripts": {

package.json

@@ -21,9 +21,10 @@ export async function create_or_update_session({
   publish = null,
   should_mark_logged_once = false,
 }) {
-  // Validate session fingerprint (must have BOTH device info - stronger security)
+  // Validate session fingerprint (browserName required, deviceVendor optional)
+  // Desktop browsers typically don't have deviceVendor (only mobile devices have vendor info)
   // Check for non-empty trimmed values to prevent empty string bypass
-  if (!session_data.browserName?.trim() || !session_data.deviceVendor?.trim()) {
+  if (!session_data.browserName?.trim()) {
     throw new GraphQLError(ERRORS.ILLEGAL_SESSION)
   }