@cosmicdrift/kumiko-server-runtime 1.0.0 → 2.0.0

package/src/session-wiring.ts

@@ -2,28 +2,16 @@
  * runProdApp session-wiring decision (extracted pure so it is testable without a
  * full prod boot).
  *
- * Secure-by-default: mounting the `sessions` feature turns server-side session
- * revocation ON automatically — there is no separate opt-in. The
- * `auth.sessions` option only overrides the config, and `auth.sessions: false` is the
- * explicit opt-out (back to stateless JWTs).
+ * Secure-by-default (#1372): mounting a sessionStore provider (sessions feature)
+ * turns server-side session revocation ON automatically. There is no
+ * `auth.sessions` opt-in/opt-out — mount sessions for revocable JWTs, omit it
+ * for intentional stateless JWTs (boot-gate warns / aborts unless acknowledged
+ * via a future flag if needed; today auth without sessions fails the gate).
  */
 
-export type ProdSessionsConfig = { readonly expiresInMs?: number };
-
-/** Config object to override defaults, or `false` to disable session wiring entirely. */
-export type ProdSessionsOption = ProdSessionsConfig | false;
-
 export function shouldWireProdSessions(
   hasAuth: boolean,
-  sessionsFeatureMounted: boolean,
-  sessionsOption: ProdSessionsOption | undefined,
+  sessionStoreProviderMounted: boolean,
 ): boolean {
-  return hasAuth && sessionsFeatureMounted && sessionsOption !== false;
-}
-
-/** The config passed to buildProdSessionAuth — `false`/absent collapse to defaults. */
-export function resolveProdSessionsConfig(
-  sessionsOption: ProdSessionsOption | undefined,
-): ProdSessionsConfig {
-  return sessionsOption || {};
+  return hasAuth && sessionStoreProviderMounted;
 }