@devmoods/express-extras 0.65.1 → 0.66.0

package/dist/auth/emailAndPassword.js

@@ -36,7 +36,7 @@ export function EmailAndPasswordAuthProvider(options) {
                 catch (error) {
                     logger.error(error);
                     await context.jitter(timer.getDuration());
-                    throw Unauthorized(error.message);
+                    throw Unauthorized(error.message, { cause: error });
                 }
             });
             router.post('/change-password', {
@@ -52,8 +52,8 @@ export function EmailAndPasswordAuthProvider(options) {
                 try {
                     await context.verifyTemporaryToken(token, user);
                 }
-                catch {
-                    throw Unauthorized('Invalid token');
+                catch (error) {
+                    throw Unauthorized('Invalid token', { cause: error });
                 }
                 context.setCurrentUser(user);
                 await options.onPasswordChanged?.(user, await hashPassword(password), {
@@ -97,7 +97,7 @@ export function EmailAndPasswordAuthProvider(options) {
                         user: context.filterUser(user),
                         error: error.message,
                     });
-                    throw Unauthorized('Invalid token');
+                    throw Unauthorized('Invalid token', { cause: error });
                 }
                 context.setCurrentUser(user);
                 await options.onEmailVerified?.(user);

package/dist/auth/errors.d.ts

@@ -1,6 +1,6 @@
 export declare class InvalidToken extends Error {
-    constructor(message: string);
+    constructor(message: string, options?: ErrorOptions);
 }
 export declare class PermissionDenied extends Error {
-    constructor(message: string);
+    constructor(message: string, options?: ErrorOptions);
 }

package/dist/auth/errors.js

@@ -1,12 +1,12 @@
 export class InvalidToken extends Error {
-    constructor(message) {
-        super(message);
+    constructor(message, options) {
+        super(message, options);
         this.name = 'Invalid Token';
     }
 }
 export class PermissionDenied extends Error {
-    constructor(message) {
-        super(message);
+    constructor(message, options) {
+        super(message, options);
         this.name = 'Permission Denied';
     }
 }

package/dist/auth/google.js

@@ -20,7 +20,7 @@ export function GoogleAuthProvider({ clientId = config.GOOGLE_AUTH_CLIENT_ID, cl
         }
         catch (e) {
             logger.error(e);
-            throw Unauthorized('Invalid authorization code');
+            throw Unauthorized('Invalid authorization code', { cause: e });
         }
     };
     const verifyIdToken = async (token) => {
@@ -73,7 +73,7 @@ export function GoogleAuthProvider({ clientId = config.GOOGLE_AUTH_CLIENT_ID, cl
                 }
                 catch (e) {
                     logger.error(e);
-                    throw Unauthorized('Invalid state');
+                    throw Unauthorized('Invalid state', { cause: e });
                 }
                 const { idToken } = await verifyAuthorizationCode(code);
                 if (!idToken) {

package/dist/auth/passwordless.js

@@ -35,7 +35,7 @@ export function PasswordlessAuthProvider(options) {
                 const verify = tokenType === 'otp'
                     ? context.verifyOtp
                     : context.verifyTemporaryToken;
-                const tokenValue = tokenType === 'otp' ? otp : temporaryToken;
+                const tokenValue = String(tokenType === 'otp' ? otp : temporaryToken);
                 const uid = await verify(tokenValue, null, false);
                 const user = await context.getUserById(uid);
                 await verify(tokenValue, user);

package/dist/auth/token.js

@@ -44,7 +44,9 @@ export function decodeAccessToken(token, secret = config.AUTH_JWT_SECRET) {
         return { ...decoded };
     }
     catch (error) {
-        throw new InvalidToken(`Failed to decode auth token: ${error.message}`);
+        throw new InvalidToken(`Failed to decode auth token: ${error.message}`, {
+            cause: error,
+        });
     }
 }
 /**

package/dist/auth/tokenStorage.d.ts

@@ -0,0 +1,16 @@
+import { type RedisClient } from '../redis.js';
+import { TokenStorage } from './types.js';
+export declare class RedisTokenStorage extends TokenStorage {
+    redis: RedisClient;
+    keyPrefix: string;
+    constructor(redis: RedisClient, keyPrefix?: string);
+    set(token: string, userId: string, expiresIn: number): Promise<void>;
+    get(token: string): Promise<string | null>;
+    invalidate(token: string): Promise<void>;
+}
+export declare class MemoryTokenStorage extends TokenStorage {
+    #private;
+    set(token: string, userId: string, expiresIn: number): Promise<void>;
+    get(token: string): Promise<string | null>;
+    invalidate(token: string): Promise<void>;
+}

package/dist/auth/tokenStorage.js

@@ -0,0 +1,44 @@
+import { config } from '@devmoods/config';
+import {} from '../redis.js';
+import { TokenStorage } from './types.js';
+export class RedisTokenStorage extends TokenStorage {
+    redis;
+    keyPrefix;
+    constructor(redis, keyPrefix = `${config.REDIS_KEY_PREFIX}auth:`) {
+        super();
+        this.redis = redis;
+        this.keyPrefix = keyPrefix;
+    }
+    async set(token, userId, expiresIn) {
+        await this.redis.set(`${this.keyPrefix}${token}`, userId, {
+            EX: expiresIn,
+        });
+    }
+    async get(token) {
+        return this.redis.get(`${this.keyPrefix}${token}`);
+    }
+    async invalidate(token) {
+        await this.redis.del(`${this.keyPrefix}${token}`);
+    }
+}
+export class MemoryTokenStorage extends TokenStorage {
+    #tokens = new Map();
+    async set(token, userId, expiresIn) {
+        this.#tokens.set(token, [userId, Date.now() + expiresIn]);
+    }
+    async get(token) {
+        const entry = this.#tokens.get(token);
+        if (entry == null) {
+            return null;
+        }
+        const [value, expires] = entry;
+        if (expires != null && Date.now() >= expires) {
+            this.#tokens.delete(token);
+            return null;
+        }
+        return value;
+    }
+    async invalidate(token) {
+        this.#tokens.delete(token);
+    }
+}

package/dist/auth/types.d.ts

@@ -49,6 +49,4 @@ export interface AuthProvider<UserModel extends AnyUser> {
     setupRoutes(router: TypedRouter, context: AuthProviderContext<UserModel>): void;
 }
 export type AuthIsAllowedFn<UserModel extends AnyUser> = (user: UserModel) => Promise<boolean> | boolean;
-export type AuthMiddlewareOptions<UserModel extends AnyUser> = false | {
-    isAuthorized?: AuthIsAllowedFn<UserModel>;
-};
+export type AuthMiddlewareOptions<UserModel extends AnyUser> = false | {};

package/dist/auth.d.ts

@@ -1,31 +1,23 @@
 import { type RequestHandler, type Response, type Request, type Router } from 'express';
-import { TokenStorage, type AnyUser, type AuthIsAllowedFn, type AuthMiddlewareOptions, type AuthOptions, type DecodedTemporaryToken } from './auth/types.js';
-import { type RedisClient } from './redis.js';
+import { type AnyUser, type AuthIsAllowedFn, type AuthMiddlewareOptions, type AuthOptions, type DecodedTemporaryToken } from './auth/types.js';
 export * from './auth/types.js';
 export * from './auth/emailAndPassword.js';
 export * from './auth/passwordless.js';
 export * from './auth/token.js';
 export * from './auth/google.js';
+export * from './auth/tokenStorage.js';
 export interface CreateAuth<UserModel extends AnyUser> {
     createRouter: () => Router;
     useCurrentUser: () => UserModel | undefined;
     middleware: (options?: AuthMiddlewareOptions<UserModel>) => RequestHandler;
     before: () => RequestHandler;
-    allow: (fn?: AuthIsAllowedFn<UserModel>) => RequestHandler;
-    isAuthorized: (fn?: (user: UserModel) => boolean) => RequestHandler;
+    protect: (fn?: AuthIsAllowedFn<UserModel>) => RequestHandler;
     createTemporaryToken(user: UserModel | null): Promise<string>;
-    verifyTemporaryToken(token: string, user: UserModel | null): Promise<string>;
+    verifyTemporaryToken(token: string, user: UserModel | null, consume?: boolean): Promise<string>;
     decodeTemporaryToken(token: string): DecodedTemporaryToken;
     createOtp(user: UserModel): Promise<string>;
-    verifyOtp(otp: string, user: UserModel | null): Promise<string>;
+    verifyOtp(otp: string, user: UserModel | null, consume?: boolean): Promise<string>;
     logout: (req: Request, res: Response) => Promise<void>;
+    setSessionTokenVersion: (version: string) => void;
 }
-export declare class RedisTokenStorage extends TokenStorage {
-    redis: RedisClient;
-    keyPrefix: string;
-    constructor(redis: RedisClient, keyPrefix?: string);
-    set(token: string, userId: string, expiresIn: number): Promise<void>;
-    get(token: string): Promise<string | null>;
-    invalidate(token: string): Promise<void>;
-}
-export declare function createAuth<UserModel extends AnyUser>({ getUserById, filterUser, tokenStorage, providers, loginUrl, onUserLoggedIn, sessionTokenVersion, }: AuthOptions<UserModel>): CreateAuth<UserModel>;
+export declare function createAuth<UserModel extends AnyUser>({ getUserById, filterUser, tokenStorage, providers, loginUrl, onUserLoggedIn, sessionTokenVersion: initialSessionTokenVersion, }: AuthOptions<UserModel>): CreateAuth<UserModel>;

package/dist/auth.js

@@ -3,11 +3,10 @@ import { config } from '@devmoods/config';
 import {} from 'express';
 import { InvalidToken, PermissionDenied } from './auth/errors.js';
 import { createAccessToken, decodeAccessToken, extractAccessTokenFromRequest, setAccessTokenCookie, tokenSchema, } from './auth/token.js';
-import { TokenStorage, } from './auth/types.js';
+import {} from './auth/types.js';
 import { setRequestContext, useRequestContext } from './context.js';
 import { Forbidden, NotFound, Unauthorized } from './errors.js';
 import { getLogger } from './logger.js';
-import {} from './redis.js';
 import { createRouter } from './router.js';
 import { jsonSchema } from './validate.js';
 const logger = getLogger('auth');
@@ -16,28 +15,10 @@ export * from './auth/emailAndPassword.js';
 export * from './auth/passwordless.js';
 export * from './auth/token.js';
 export * from './auth/google.js';
-export class RedisTokenStorage extends TokenStorage {
-    redis;
-    keyPrefix;
-    constructor(redis, keyPrefix = `${config.REDIS_KEY_PREFIX}auth:`) {
-        super();
-        this.redis = redis;
-        this.keyPrefix = keyPrefix;
-    }
-    async set(token, userId, expiresIn) {
-        await this.redis.set(`${this.keyPrefix}${token}`, userId, {
-            EX: expiresIn,
-        });
-    }
-    async get(token) {
-        return this.redis.get(`${this.keyPrefix}${token}`);
-    }
-    async invalidate(token) {
-        await this.redis.del(`${this.keyPrefix}${token}`);
-    }
-}
+export * from './auth/tokenStorage.js';
 const sha256 = (value) => crypto.createHash('sha256').update(value).digest('hex');
-export function createAuth({ getUserById, filterUser, tokenStorage, providers, loginUrl = '/', onUserLoggedIn, sessionTokenVersion = '1', }) {
+export function createAuth({ getUserById, filterUser, tokenStorage, providers, loginUrl = '/', onUserLoggedIn, sessionTokenVersion: initialSessionTokenVersion = '1', }) {
+    let sessionTokenVersion = initialSessionTokenVersion;
     const useCurrentUser = () => useRequestContext('currentUser');
     const setCurrentUser = (user) => setRequestContext('currentUser', user);
     const login = async (req, res, user, isRefresh = false) => {
@@ -48,6 +29,7 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
         setCurrentUser(user);
         if (!isRefresh) {
             await onUserLoggedIn?.(user, {
+                /* c8 ignore next 2 */
                 ip: req.ip ?? '',
                 userAgent: req.headers['user-agent'] ?? '',
                 sessionId,
@@ -64,10 +46,12 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
     };
     // Make timing attacks harder
     const jitter = (duration = 0) => {
+        /* c8 ignore start */
         if (process.env.NODE_ENV === 'test') {
             return Promise.resolve();
         }
         return new Promise((resolve) => void setTimeout(resolve, Math.max((0.5 - duration) * 1000, 200)));
+        /* c8 ignore end */
     };
     /**
      * API for auth providers to use
@@ -162,17 +146,18 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
                 let user;
                 try {
                     user = await getUserById(decoded.uid);
+                    if (!user) {
+                        throw new Error('getUserById returned an empty result');
+                    }
                 }
-                catch {
+                catch (error) {
                     await logout(req, res);
-                    throw new InvalidToken('User not found');
+                    throw new InvalidToken('User not found', { cause: error });
                 }
                 const tokenLifetimeMs = decoded.exp * 1000 - decoded.iat * 1000;
                 const remainingMs = decoded.exp * 1000 - Date.now();
                 const shouldRefresh = remainingMs < tokenLifetimeMs * 0.25;
-                if (options.isAuthorized && !(await options.isAuthorized(user))) {
-                    throw new PermissionDenied('Permission denied');
-                }
+                /* c8 ignore next 3 */
                 if (shouldRefresh) {
                     await providerContext.login(req, res, user, true);
                 }
@@ -181,23 +166,18 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
             }
             catch (error) {
                 logger.error(error);
-                if (error instanceof PermissionDenied) {
-                    if (req.accepts('html')) {
-                        return res.redirect(loginUrl);
-                    }
-                    return next(Forbidden('Permission denied'));
-                }
                 if (error instanceof InvalidToken) {
                     if (req.accepts('html')) {
                         return res.redirect(loginUrl);
                     }
-                    return next(Unauthorized(`Invalid token: ${error.message}`));
+                    return next(Unauthorized(`Invalid token: ${error.message}`, { cause: error }));
                 }
+                /* c8 ignore next 3 */
                 next(error);
             }
         };
     }
-    function allow(isAuthorized = () => true) {
+    function protect(isAuthorized = () => true) {
         return async function authorizationMiddleware(req, res, next) {
             try {
                 const user = useCurrentUser();
@@ -215,14 +195,15 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
                     if (req.accepts('html')) {
                         return res.redirect(loginUrl);
                     }
-                    return next(Forbidden('Permission denied'));
+                    return next(Forbidden('Permission denied', { cause: error }));
                 }
                 if (error instanceof InvalidToken) {
                     if (req.accepts('html')) {
                         return res.redirect(loginUrl);
                     }
-                    return next(Unauthorized(`Invalid token: ${error.message}`));
+                    return next(Unauthorized(`Invalid token: ${error.message}`, { cause: error }));
                 }
+                /* c8 ignore next 3 */
                 next(error);
             }
         };
@@ -273,7 +254,12 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
         }
     }
     function decodeTemporaryToken(token) {
-        return JSON.parse(Buffer.from(token, 'base64url').toString('utf-8'));
+        try {
+            return JSON.parse(Buffer.from(token, 'base64url').toString('utf-8'));
+        }
+        catch (error) {
+            throw new InvalidToken(`Invalid token not created by createTemporaryToken`, { cause: error });
+        }
     }
     async function verifyTemporaryToken(token, user, consume = true) {
         const decoded = decodeTemporaryToken(token);
@@ -302,9 +288,8 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
         return storedUid;
     }
     return {
-        allow,
+        protect,
         before: () => middleware(false),
-        isAuthorized: (fn) => middleware({ isAuthorized: fn || (() => true) }),
         createRouter: () => createAuthRouter().getRouter(),
         useCurrentUser,
         middleware,
@@ -314,5 +299,8 @@ export function createAuth({ getUserById, filterUser, tokenStorage, providers, l
         createOtp,
         verifyOtp,
         logout,
+        setSessionTokenVersion: (version) => {
+            sessionTokenVersion = version;
+        },
     };
 }

package/dist/channels.d.ts

@@ -6,7 +6,25 @@ export interface EventStreamSseOptions<Schema extends StandardSchemaV1> {
     channels: (req: Request) => string[] | Promise<string[]>;
     getIdFromMessage?: (message: StandardSchemaV1.InferOutput<Schema>) => string | undefined;
 }
-export declare function createEventStream<Channels extends string, Schema extends StandardSchemaV1>(redis: RedisClient, schema: Schema): {
+export interface EventStreamSubscriber {
+    subscribe: (channels: string[], listener: (message: string) => void) => Promise<void>;
+    close: () => void;
+}
+export interface EventStreamBackend {
+    publish: (channel: string, message: string) => Promise<number>;
+    createSubscriber: () => Promise<EventStreamSubscriber>;
+}
+export declare class RedisEventStreamBackend implements EventStreamBackend {
+    redis: RedisClient;
+    constructor(redis: RedisClient);
+    publish(channel: string, message: string): Promise<number>;
+    createSubscriber(): Promise<RedisClient>;
+}
+export interface EventStreamOptions<Schema extends StandardSchemaV1> {
+    schema: Schema;
+    heartbeatInterval?: number;
+}
+export declare function createEventStream<Channels extends string, Schema extends StandardSchemaV1>(backend: EventStreamBackend, options: EventStreamOptions<Schema>): {
     sse: <const Path extends string>({ channels, getIdFromMessage, }: EventStreamSseOptions<Schema>) => TypedRequestHandler<ExtractParams<Path>, any, any, any>;
     publish: (channel: Channels, message: StandardSchemaV1.InferOutput<Schema>) => Promise<number>;
     close: () => Promise<void>;

package/dist/channels.js

@@ -5,65 +5,53 @@ import { requestContext } from './context.js';
 import { getLogger } from './logger.js';
 import {} from './redis.js';
 import {} from './router.js';
+import { writeChunk } from './streams.js';
 const logger = getLogger();
 const defaultGetIdFromMessage = (message) => {
+    /* c8 ignore next 5 */
     if (typeof message === 'object' && message !== null && 'id' in message) {
         return `${message.id}`;
     }
     return undefined;
 };
-function writeChunk(res, chunk, state) {
-    // If we're already draining, just enqueue.
-    if (state.draining) {
-        if (state.queue.length >= state.maxQueue) {
-            // Drop the oldest chunk to keep memory bounded.
-            state.queue.shift();
-        }
-        state.queue.push(chunk);
-        return;
+export class RedisEventStreamBackend {
+    redis;
+    constructor(redis) {
+        this.redis = redis;
     }
-    if (res.write(chunk)) {
-        return;
+    publish(channel, message) {
+        return this.redis.publish(channel, message);
+    }
+    async createSubscriber() {
+        const subscriber = this.redis.duplicate();
+        /* c8 ignore next 3 */
+        subscriber.on('error', (error) => {
+            logger.error(error);
+        });
+        await subscriber.connect();
+        return subscriber;
     }
-    // Buffer is full — start draining
-    state.draining = true;
-    const flush = () => {
-        while (state.queue.length) {
-            const next = state.queue.shift();
-            if (!res.write(next)) {
-                state.draining = true;
-                res.once('drain', flush);
-                return;
-            }
-        }
-        state.draining = false;
-    };
-    res.once('drain', flush);
 }
-export function createEventStream(redis, schema) {
+export function createEventStream(backend, options) {
     const keyPrefix = `${config.REDIS_KEY_PREFIX}events:`;
     const withKeyPrefix = (key) => `${keyPrefix}${key}`;
     const subscribers = new Set();
     const sse = ({ channels, getIdFromMessage = defaultGetIdFromMessage, }) => {
         return async (req, res, next) => {
             try {
-                const subscriber = redis.duplicate();
-                /* c8 ignore next 3 */
-                subscriber.on('error', (error) => {
-                    logger.error(error);
-                });
-                await subscriber.connect();
+                const subscriber = await backend.createSubscriber();
                 const heartbeat = setInterval(() => {
                     try {
                         if (!res.writableEnded) {
                             writeChunk(res, 'event: heartbeat\n', state);
                             writeChunk(res, 'data: ping\n\n', state);
                         }
+                        /* c8 ignore next 3 */
                     }
                     catch (error) {
                         logger.error(error);
                     }
-                }, 15000);
+                }, options.heartbeatInterval ?? 15000);
                 const state = {
                     draining: false,
                     queue: [],
@@ -124,6 +112,7 @@ export function createEventStream(redis, schema) {
                     });
                 };
                 const gracefulClose = () => {
+                    /* c8 ignore next 3 */
                     if (closed) {
                         return;
                     }
@@ -151,7 +140,7 @@ export function createEventStream(redis, schema) {
         };
     };
     const publish = (channel, message) => {
-        return redis.publish(withKeyPrefix(channel), JSON.stringify(message));
+        return backend.publish(withKeyPrefix(channel), JSON.stringify(message));
     };
     const close = async () => {
         for (const closeSubscriber of subscribers) {

package/dist/composeMiddleware.d.ts

@@ -0,0 +1,15 @@
+export type Next<T = void> = (err?: Error | null) => T;
+export type RequestHandler<T, U, V = void> = (req: T, res: U, next: Next<V>) => V;
+export type ErrorHandler<T, U, V = void> = (err: Error, req: T, res: U, next: Next<V>) => V;
+export type Middleware<T, U, V = void> = RequestHandler<T, U, V> | ErrorHandler<T, U, V>;
+export type Handler<T, U, V = void> = Middleware<T, U, V> | NestedMiddleware<T, U, V>;
+export interface NestedMiddleware<T, U, V = void> extends ReadonlyArray<Handler<T, U, V>> {
+}
+/**
+ * Compose an array of middleware handlers into a single handler.
+ */
+export declare function compose<T, U, V = void>(...handlers: Handler<T, U, V>[]): RequestHandler<T, U, V>;
+/**
+ * Wrap middleware handlers.
+ */
+export declare function errors<T, U, V = void>(...handlers: Handler<T, U, V>[]): ErrorHandler<T, U, V>;

package/dist/composeMiddleware.js

@@ -0,0 +1,63 @@
+/**
+ * Compose an array of middleware handlers into a single handler.
+ */
+export function compose(...handlers) {
+    const middleware = generate(handlers);
+    return function requestMiddleware(req, res, done) {
+        return middleware(null, req, res, done);
+    };
+}
+/**
+ * Wrap middleware handlers.
+ */
+export function errors(...handlers) {
+    return generate(handlers);
+}
+/**
+ * Generate a composed middleware function.
+ */
+function generate(handlers) {
+    const stack = handlers.flat();
+    return function middleware(err, req, res, done) {
+        let index = -1;
+        // eslint-disable-next-line @typescript-eslint/no-shadow
+        function dispatch(pos, err) {
+            const handler = stack[pos];
+            index = pos;
+            if (index === stack.length) {
+                return done(err);
+            }
+            // eslint-disable-next-line @typescript-eslint/no-shadow
+            function next(err) {
+                /* c8 ignore start */
+                if (pos < index) {
+                    throw new TypeError('`next()` called multiple times');
+                }
+                /* c8 ignore end */
+                return dispatch(pos + 1, err);
+            }
+            try {
+                if (handler.length === 4) {
+                    if (err) {
+                        return handler(err, req, res, next);
+                    }
+                }
+                else {
+                    if (!err) {
+                        return handler(req, res, next);
+                    }
+                }
+            }
+            catch (e) {
+                /* c8 ignore start */
+                if (index > pos) {
+                    throw e;
+                }
+                return next(e);
+                /* c8 ignore end */
+            }
+            return next(err);
+        }
+        return dispatch(0, err);
+    };
+}

package/dist/csrf.d.ts

@@ -12,6 +12,7 @@ interface CsrfOptions {
 }
 export declare function csrf({ exempt, sessionIdentifier, cookieName, }?: CsrfMiddlewareOptions): RequestHandler;
 export declare function setCsrfOptions(options: CsrfOptions): void;
+export declare function useCsrfOptions(): CsrfOptions;
 interface TokenOptions {
     overwrite?: boolean;
 }

package/dist/csrf.js

@@ -11,6 +11,7 @@ const defaultCookieName = () => {
 };
 export const getCsrfSecret = () => {
     const secret = config.CSRF_SECRET;
+    /* c8 ignore next 3 */
     if (!secret) {
         throw new Error('CSRF_SECRET is not set');
     }
@@ -20,7 +21,7 @@ export function csrf({ exempt = false, sessionIdentifier, cookieName, } = {}) {
     return (req, res, next) => {
         const existingOptions = useCsrfOptions();
         setCsrfOptions({
-            cookieName: cookieName ?? existingOptions.cookieName ?? defaultCookieName(),
+            cookieName: cookieName ?? existingOptions.cookieName,
             sessionIdentifier: sessionIdentifier
                 ? sessionIdentifier(req)
                 : existingOptions.sessionIdentifier,
@@ -33,7 +34,7 @@ const CSRF_CONTEXT_KEY = '@csrfConfig';
 export function setCsrfOptions(options) {
     setRequestContext(CSRF_CONTEXT_KEY, options);
 }
-function useCsrfOptions() {
+export function useCsrfOptions() {
     return (useRequestContext(CSRF_CONTEXT_KEY) || {
         exempt: true,
         cookieName: defaultCookieName(),
@@ -92,6 +93,9 @@ const validateRequest = (req) => {
     const [csrfToken, csrfTokenHash] = csrfCookie.split('|');
     const csrfTokenFromRequest = req.headers['x-csrf-token'];
     const secret = getCsrfSecret();
+    if (!csrfToken || !csrfTokenHash) {
+        throw Forbidden('Invalid CSRF token format');
+    }
     if (!csrfTokenFromRequest) {
         throw Forbidden('Missing CSRF token');
     }

package/dist/errors.d.ts

@@ -1,18 +1,18 @@
-import { type ErrorHandler } from 'compose-middleware';
+import { type ErrorHandler } from './composeMiddleware.js';
 type AnyPayload = Record<string, unknown>;
 export declare class ApiError extends Error {
     status: number | null | undefined;
     payload: AnyPayload | undefined;
 }
-export declare const BadRequest: (reason: any) => ApiError;
-export declare const Forbidden: (detail?: string) => ApiError;
-export declare const NotFound: (detail?: string) => ApiError;
-export declare const Unauthorized: (detail?: string) => ApiError;
-export declare const Conflict: (detail?: string) => ApiError;
+export declare const BadRequest: (reason: any, options?: ErrorOptions) => ApiError;
+export declare const Forbidden: (detail?: string, options?: ErrorOptions) => ApiError;
+export declare const NotFound: (detail?: string, options?: ErrorOptions) => ApiError;
+export declare const Unauthorized: (detail?: string, options?: ErrorOptions) => ApiError;
+export declare const Conflict: (detail?: string, options?: ErrorOptions) => ApiError;
 /**
  * Create a new ApiError instance
  */
-export declare function makeError(status: number, detail?: string, payload?: AnyPayload): ApiError;
+export declare function makeError(status: number, detail?: string, payload?: AnyPayload, options?: ErrorOptions): ApiError;
 /**
  * Problem Details for HTTP APIs
  *