@dwp/govuk-casa 7.0.6 → 8.0.0-alpha1

package/dist/middleware/body-parser.d.ts

@@ -0,0 +1 @@
+export default function _default(): import("connect").NextHandleFunction[];

package/dist/middleware/body-parser.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const express_1 = require("express");
+function default_1() {
+    const rProto = /__proto__/i;
+    const rPrototype = /prototype[=[\]]/i;
+    const rConstructor = /constructor[=[\]]/i;
+    return [
+        (0, express_1.urlencoded)({
+            extended: true,
+            type: 'application/x-www-form-urlencoded',
+            inflate: true,
+            parameterLimit: 25,
+            limit: 1024 * 50,
+            verify: (req, res, buf, encoding) => {
+                const body = decodeURI(buf.toString(encoding));
+                if (rProto.test(body) || rPrototype.test(body) || rConstructor.test(body)) {
+                    throw new Error('Request body verification failed');
+                }
+            },
+        }),
+    ];
+}
+exports.default = default_1;

package/dist/middleware/csrf.d.ts

@@ -0,0 +1 @@
+export default function _default(): any[];

package/dist/middleware/csrf.js

@@ -0,0 +1,31 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const csurf_1 = __importDefault(require("csurf"));
+// 2 middleware: one to generate the csrf token and check its validity (POST
+// only), and one to provide that token to templates via the `casa.csrfToken`
+// variable.
+function default_1() {
+    return [
+        (0, csurf_1.default)({
+            cookie: false,
+            sessionKey: 'session',
+            // value: (req) => {
+            //   // Here we clear the token after extracting to maintain cleaner data. It
+            //   // is only used for this CSRF purpose.
+            //   const token = String(req.body._csrf);
+            //   delete req.body._csrf;
+            //   return token;
+            //   /* eslint-enable no-underscore-dangle */
+            // },
+        }),
+        (req, res, next) => {
+            var _a;
+            res.locals.casa = Object.assign(Object.assign({}, (_a = res.locals) === null || _a === void 0 ? void 0 : _a.casa), { csrfToken: req.csrfToken() });
+            next();
+        },
+    ];
+}
+exports.default = default_1;

package/dist/middleware/data.d.ts

@@ -0,0 +1,6 @@
+export default function _default({ plan, mountUrl, serviceName, events, }: {
+    plan: any;
+    mountUrl: any;
+    serviceName: any;
+    events: any;
+}): ((req: any, res: any, next: any) => void)[];

package/dist/middleware/data.js

@@ -0,0 +1,53 @@
+"use strict";
+// Decorates the request with some contextual data about the user's journey
+// through the application. This is used by downstream middleware and templates.
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const lodash_1 = require("lodash");
+const JourneyContext_js_1 = __importDefault(require("../lib/JourneyContext.js"));
+const waypoint_url_js_1 = __importDefault(require("../lib/waypoint-url.js"));
+const editOrigin = (req) => {
+    if ((0, lodash_1.has)(req.query, 'editorigin')) {
+        return (0, waypoint_url_js_1.default)({ waypoint: req.query.editorigin });
+    }
+    else if ((0, lodash_1.has)(req === null || req === void 0 ? void 0 : req.body, 'editorigin')) {
+        return (0, waypoint_url_js_1.default)({ waypoint: req.body.editorigin });
+    }
+};
+function default_1({ plan, mountUrl, serviceName, events, }) {
+    return [
+        (req, res, next) => {
+            /* ------------------------------------------------ Request decorations */
+            // CASA
+            req.casa = Object.assign(Object.assign({}, req === null || req === void 0 ? void 0 : req.casa), { 
+                // The plan
+                plan, 
+                // Current journey context, loaded from session, specified by
+                // `contextid` request parameter
+                journeyContext: JourneyContext_js_1.default.extractContextFromRequest(req).addEventListeners(events), 
+                // Edit mode attributes
+                editMode: (0, lodash_1.has)(req.query, 'edit') || (0, lodash_1.has)(req === null || req === void 0 ? void 0 : req.body, 'edit'), editOrigin: editOrigin(req) });
+            /* ------------------------------------------------- Template variables */
+            // CASA and userland templates
+            res.locals.casa = {
+                mountUrl,
+                serviceName,
+            };
+            res.locals.locale = req.language;
+            // Used by govuk-frontend template
+            // - req.language is provided by i18n-http-middleware
+            res.locals.htmlLang = req.language;
+            // res.locals.makeLink
+            // res.locals.casa.journeyPreviousUrl 
+            // req.session.journeyContext
+            // req.session.language
+            // req.editOriginUrl
+            // req.inEditMode 
+            // req.editSearchParams
+            next();
+        },
+    ];
+}
+exports.default = default_1;

package/dist/middleware/dirname.cjs

@@ -0,0 +1 @@
+module.exports = __dirname;

package/dist/middleware/gather-fields.d.ts

@@ -0,0 +1,5 @@
+declare function _default({ waypoint, fields, }: {
+    waypoint: string;
+    fields?: any[] | undefined;
+}): ((req: any, res: any, next: any) => void)[];
+export default _default;

package/dist/middleware/gather-fields.js

@@ -0,0 +1,39 @@
+"use strict";
+// Gather the field data from `req.body` into the current JourneyContext
+// - Store in the current session
+// - Update the user's journey context with the new data
+// - Remove validation date of JourneyContext so it can re-evaluted
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const JourneyContext_js_1 = __importDefault(require("../lib/JourneyContext.js"));
+/**
+ * @param {Object} obj
+ * @param {string} obj.waypoint Waypoint
+ * @param {PageField[]} [obj.fields=[]] Fields
+ */
+exports.default = ({ waypoint, fields = [], }) => [
+    (req, res, next) => {
+        // Store a copy of the journey context before modifying it. This is useful
+        // for any comparison work that may be done in subseqent middleware.
+        req.casa.archivedJourneyContext = JourneyContext_js_1.default.fromContext(req.casa.journeyContext);
+        // Ignore data for any non-persistent fields
+        const persistentBody = Object.create(null);
+        for (let i = 0, l = fields.length; i < l; i++) {
+            if (fields[i].meta.persist && fields[i].getValue(req.body) !== undefined) {
+                persistentBody[fields[i].name] = fields[i].getValue(req.body);
+            }
+        }
+        // Update data and validation context in the current request, and store
+        req.casa.journeyContext.setDataForPage(waypoint, persistentBody);
+        req.casa.journeyContext.removeValidationStateForPage(waypoint);
+        JourneyContext_js_1.default.putContext(req.session, req.casa.journeyContext);
+        // TODO: Once feature we might like here is to invalidate specific pages
+        // based on the change that has just happened, to force those pages to be
+        // visited again. The main use case is to cater for a change in content on
+        // those pages that fundamentally alter the context of the question being asked,
+        // and so should be asked again. For example, "Your address" vs "You and your partner's address"
+        next();
+    }
+];

package/dist/middleware/i18n.d.ts

@@ -0,0 +1,4 @@
+export default function _default({ languages, directories, }: {
+    languages?: string[] | undefined;
+    directories?: any[] | undefined;
+}): import("express-serve-static-core").Handler[];

package/dist/middleware/i18n.js

@@ -0,0 +1,87 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const i18next_1 = __importDefault(require("i18next"));
+const i18next_http_middleware_1 = require("i18next-http-middleware");
+const path_1 = require("path");
+const fs_1 = require("fs");
+const deepmerge_1 = __importDefault(require("deepmerge"));
+const js_yaml_1 = __importDefault(require("js-yaml"));
+const logger_js_1 = __importDefault(require("../lib/logger.js"));
+const log = (0, logger_js_1.default)('middleware.i18n');
+const loadJson = (file) => {
+    // Strip out newlines (this is a legacy feature which we're keeping for
+    // backwards compatibility).
+    let json = (0, fs_1.readFileSync)(file, 'utf8');
+    return JSON.parse(json.replace(/[\r\n]/g, ''));
+};
+const loadYaml = (file) => {
+    return js_yaml_1.default.load((0, fs_1.readFileSync)(file, 'utf8'));
+};
+const extract = (file) => {
+    const ext = /.yaml$/i.test(file) ? '.yaml' : '.json';
+    const data = ext === '.yaml' ? loadYaml(file) : loadJson(file);
+    return {
+        ns: (0, path_1.basename)(file, ext),
+        data,
+    };
+};
+const loadResources = (languages, directories) => {
+    const store = Object.create(null);
+    languages.forEach((language) => {
+        store[language] = Object.create(null);
+        directories.forEach((dir) => {
+            dir = (0, path_1.resolve)(dir, language);
+            if (!(0, fs_1.existsSync)(dir))
+                return;
+            log.info('Loading %s language from %s ...', language, dir);
+            (0, fs_1.readdirSync)(dir).forEach((file) => {
+                const { ns, data } = extract((0, path_1.resolve)(dir, file));
+                if (store[language][ns] === undefined) {
+                    store[language][ns] = Object.create(null);
+                }
+                store[language][ns] = (0, deepmerge_1.default)(store[language][ns], data);
+            });
+        });
+    });
+    return store;
+};
+function default_1({ languages = ['en', 'cy'], directories = [], }) {
+    // Load _all_ translations, from all directories into memory.
+    const resources = loadResources(languages, directories);
+    // Configure i18next
+    const i18nInstance = i18next_1.default.createInstance();
+    i18nInstance
+        .use(i18next_http_middleware_1.LanguageDetector)
+        .init({
+        initImmediate: false,
+        supportedLngs: languages,
+        fallbackLng: false,
+        defaultNS: 'common',
+        // debug: true,
+        // All translation resources
+        resources,
+        // LanguageDetector options
+        detection: {
+            lookupQuerystring: 'lang',
+            lookupSession: 'language',
+            order: ['querystring', 'session'],
+        },
+    });
+    // 2 middleware: one to read/set the session language, and one to enhance the req/res objects with i18n features
+    return [
+        (req, res, next) => {
+            if (!req.session.language) {
+                req.session.language = languages[0];
+            }
+            if ((req === null || req === void 0 ? void 0 : req.query.lang) && languages.includes(req.query.lang)) {
+                req.session.language = String(req.query.lang);
+            }
+            next();
+        },
+        (0, i18next_http_middleware_1.handle)(i18nInstance),
+    ];
+}
+exports.default = default_1;

package/dist/middleware/post.d.ts

@@ -0,0 +1 @@
+export default function _default(): ((err: any, req: any, res: any, next: any) => any)[];

package/dist/middleware/post.js

@@ -0,0 +1,42 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// 2 middleware: one as a fallback 404 handler, one to handle thrown errors
+const logger_js_1 = __importDefault(require("../lib/logger.js"));
+const log = (0, logger_js_1.default)('middleware:post');
+function default_1() {
+    return [
+        (req, res, next) => {
+            res.render('casa/errors/404.njk');
+        },
+        (err, req, res, next) => {
+            // CSRF token is invalid in some way
+            if ((err === null || err === void 0 ? void 0 : err.code) === 'EBADCSRFTOKEN') {
+                log.info('CSRF validation has failed. This may be caused by the user submitting a stale form from a previous session [EBADCSRFTOKEN]');
+                return res.status(403).render('casa/errors/500.njk');
+            }
+            // Body parsing verification check failed
+            if ((err === null || err === void 0 ? void 0 : err.type) === 'entity.verify.failed') {
+                log.info('Body parser verification has failed. This has been caused by the user submitting a payload containing invalid data [entity.verify.failed]');
+                return res.status(403).render('casa/errors/500.njk');
+            }
+            // Too many parameters submitted
+            if ((err === null || err === void 0 ? void 0 : err.type) === 'parameters.too.many') {
+                log.info('The request contains more parameters than is currently allowed [parameters.too.many]');
+                return res.status(413).render('casa/errors/500.njk');
+            }
+            // Overall payload too large
+            if ((err === null || err === void 0 ? void 0 : err.type) === 'entity.too.large') {
+                log.info(`The request payload is too large. Received ${err.length}b with a maximum of ${err.limit}b [parameters.too.many]`);
+                return res.status(413).render('casa/errors/500.njk');
+            }
+            // Unknown error
+            log.error(`Unknown error: ${err.message}; stacktrace: ${err.stack}`);
+            res.render('casa/errors/500.njk');
+        },
+    ];
+}
+exports.default = default_1;
+;

package/dist/middleware/pre.d.ts

@@ -0,0 +1,3 @@
+/// <reference types="node" />
+declare function _default(): ((req: import("http").IncomingMessage, res: import("http").ServerResponse, next: (err?: unknown) => void) => void)[];
+export default _default;

package/dist/middleware/pre.js

@@ -0,0 +1,38 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const crypto_1 = require("crypto");
+const helmet_1 = __importDefault(require("helmet"));
+exports.default = () => [
+    // Prevent caching response in any intermediaries by default, in case it
+    // contains sensitive data.
+    // The `no-store` setting is to specifically disable the bfcache and prevent
+    // possible leakage of information.
+    (req, res, next) => {
+        res.set('cache-control', 'no-cache, no-store, must-revalidate, private');
+        res.set('pragma', 'no-cache');
+        res.set('expires', 0);
+        res.set('x-robots-tag', 'noindex, nofollow');
+        next();
+    },
+    // Generate nonces ready for use in Content-Security-Policy header and
+    // govuk-frontend template. This same none can be used wherever required.
+    (req, res, next) => {
+        res.locals.cspNonce = (0, crypto_1.randomBytes)(16).toString("hex");
+        next();
+    },
+    // Helmet suite of headers
+    (0, helmet_1.default)({
+        // Allows GA which is typically used, and a known inline script nonce
+        contentSecurityPolicy: {
+            useDefaults: true,
+            directives: {
+                "script-src": ["'self'", "www.google-analytics.com", "www.googletagmanager.com", (req, res) => `'nonce-${res.locals.cspNonce}'`],
+            },
+        },
+        // // Require referrer to aid navigation
+        // referrerPolicy: 'no-referrer, same-origin',
+    }),
+];

package/dist/middleware/progress-journey.d.ts

@@ -0,0 +1,6 @@
+declare function _default({ waypoint, plan, mountUrl, }: {
+    waypoint: any;
+    plan: any;
+    mountUrl: any;
+}): ((req: any, res: any, next: any) => void)[];
+export default _default;

package/dist/middleware/progress-journey.js

@@ -0,0 +1,82 @@
+"use strict";
+// Determine where to take the user next
+// We assume that the waypoint has been validated prior to reaching this
+// middleware.
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const Plan_js_1 = __importDefault(require("../lib/Plan.js"));
+const JourneyContext_js_1 = __importDefault(require("../lib/JourneyContext.js"));
+const waypoint_url_js_1 = __importDefault(require("../lib/waypoint-url.js"));
+const logger_js_1 = __importDefault(require("../lib/logger.js"));
+const log = (0, logger_js_1.default)('middleware:progress-journey');
+const saveAndRedirect = (session, journeyContext, url, res, next) => {
+    JourneyContext_js_1.default.putContext(session, journeyContext);
+    session.save((err) => {
+        if (err)
+            next(err);
+        res.redirect(302, url);
+    });
+};
+exports.default = ({ waypoint, plan, mountUrl, }) => [
+    (req, res, next) => {
+        // Determine the next available waypoint after the current one
+        const traversed = plan.traverse(req.casa.journeyContext);
+        const currentIndex = traversed.indexOf(waypoint);
+        const nextIndex = Math.max(currentIndex < 0 ? traversed.length - 1 : 0, Math.min(currentIndex + 1, traversed.length - 1));
+        const nextWaypoint = traversed[nextIndex];
+        log.trace(`currentIndex = ${currentIndex}, nextIndex = ${nextIndex}, currentWaypoint = ${waypoint}, nextWaypoint = ${nextWaypoint}`);
+        // TODO: edit mode ---------- !!! considering the dependency graph instead, which will invalidate pages, meaning we can keep sticky mode as the default - the below, redirecting back to origin is fine to leave as is, because the next traversal in steer-journey will put the user on the right waypoint
+        // When in edit mode, these are the options for redirecting:
+        // - Try sending straight back to editOrigin - if it can't be reached, the "rails" middleware will redirect the user accordingly
+        //
+        // TODO: if the edit origin is on another sub-app, only that plan will get travsersed, so the user might miss out on forms in between.
+        // Or it might be on the same app, but a Plan exists in the middle of this plan, so need to be sure to travsrse that plan fully too.
+        // It's looking more likely that we'll need Plans to talk with each other, but that's a headache.
+        // Keep it simple.
+        // Restrict the functionality. Don't allow this scenario. Devs will need to resort to waya around it. Wait for community to build things and see what solutions emerge for doption into this framework.
+        // Edit mode
+        // Attempt to take the user back to their original URL. We rely on the
+        // `steer-journey` middleware to prevent the user going too far ahead in
+        // their permitted journey.
+        // Keep the edit mode on this redirect. This means the user can keep
+        // "jumping" ahead in the journey until they get back to the original URL.
+        if (req.casa.editMode && req.casa.editOrigin) {
+            // TODO: Need tyo detect if we're already on the editOrigin on this request.
+            // If so, need to fall through so we can get directed to the next waypoint in the journey
+            const url = new URL(req.casa.editOrigin, 'https://placeholder.test/');
+            url.searchParams.append('edit', 'true');
+            url.searchParams.append('editorigin', req.casa.editOrigin);
+            const redirectUrl = (0, waypoint_url_js_1.default)({ waypoint: url.pathname }) + url.search.toString();
+            log.debug(`Edit mode detected; redirecting to ${redirectUrl}`);
+            return saveAndRedirect(req.session, req.casa.journeyContext, redirectUrl, res, next);
+        }
+        // If the next URL is an "exit node", we need to flag that node as
+        // being validated so that subsequent traversals of this journey continue
+        // correctly to any waypoints leading on from this one.
+        // This effectively says that the other Plan linked to by the exit node is
+        // complete, but of course that may not be the case.
+        // It would be prudent for developers to add a conditions to the route to
+        // check is this is the case, eg
+        //   setRoute('a', 'b');
+        //   setRoute('b', 'url:///otherapp/')
+        //   setRoute('url:////otherapp/', 'c', (r, c) => checkIfOtherAppIsFinished())
+        if (Plan_js_1.default.isExitNode(nextWaypoint)) {
+            log.trace(`Next waypoint is an exit node; clearing validation state on ${nextWaypoint}`);
+            req.casa.journeyContext.clearValidationErrorsForPage(nextWaypoint);
+            JourneyContext_js_1.default.putContext(req.session, req.casa.journeyContext);
+        }
+        // Construct the next url
+        const nextUrl = (0, waypoint_url_js_1.default)({
+            waypoint: nextWaypoint,
+            mountUrl,
+            journeyContext: req.casa.journeyContext,
+            edit: req.casa.editMode,
+            editOrigin: req.casa.editOrigin,
+        });
+        // Save and move on
+        log.trace(`Redirecting to ${nextUrl}`);
+        saveAndRedirect(req.session, req.casa.journeyContext, nextUrl, res, next);
+    },
+];

package/dist/middleware/sanitise-fields.d.ts

@@ -0,0 +1,5 @@
+declare function _default({ waypoint, fields, }: {
+    waypoint: any;
+    fields?: any[] | undefined;
+}): ((req: any, res: any, next: any) => void)[];
+export default _default;

package/dist/middleware/sanitise-fields.js

@@ -0,0 +1,48 @@
+"use strict";
+// Sanitise the fields submitted from a form
+// - Coerce each field to its correct type
+// - Remove an extraneous fields that are not know to the application
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const lodash_1 = __importDefault(require("lodash"));
+const field_js_1 = __importDefault(require("../lib/field.js"));
+const JourneyContext_js_1 = __importDefault(require("../lib/JourneyContext.js"));
+exports.default = ({ waypoint, fields = [], }) => {
+    // Add some common, transient fields to ensure they survive beyond this sanitisation process
+    fields.push((0, field_js_1.default)('_csrf', { persist: false }).processor((value => String(value))));
+    fields.push((0, field_js_1.default)('contextid', { persist: false }).processor((value => String(value))));
+    fields.push((0, field_js_1.default)('edit', { persist: false }).processor((value => String(value))));
+    fields.push((0, field_js_1.default)('editorigin', { persist: false }).processor((value => String(value))));
+    // Middleware
+    return [
+        (req, res, next) => {
+            // First, prune all undefined, or unknown fields from `req.body` (i.e.
+            // those that do not have an entry in `fields`)
+            const prunedBody = Object.create(null);
+            for (let i = 0, l = fields.length; i < l; i++) {
+                if (lodash_1.default.has(req.body, fields[i].name) && req.body[fields[i].name] !== undefined) {
+                    prunedBody[fields[i].name] = req.body[fields[i].name];
+                }
+            }
+            // TODO: the journey context passed to the processors and conditions, with data set to the "prunedBody"
+            const journeyContext = JourneyContext_js_1.default.fromContext(req.casa.journeyContext);
+            journeyContext.setDataForPage(waypoint, prunedBody);
+            // const journeyContext = {};
+            // Second, prune any fields that do not pass the validation conditional,
+            // and process those that do.
+            const sanitisedBody = Object.create(null);
+            for (let i = 0, l = fields.length; i < l; i++) {
+                const field = fields[i];
+                let fieldValue = field.getValue(prunedBody); // prunedBody[field.name];
+                if (fieldValue !== undefined && field.testConditions({ fieldValue, waypoint, journeyContext })) {
+                    field.putValue(sanitisedBody, field.applyProcessors(fieldValue));
+                }
+            }
+            // Finally, write the sanitised body back to the request object
+            req.body = sanitisedBody;
+            next();
+        }
+    ];
+};

package/dist/middleware/session.d.ts

@@ -0,0 +1,10 @@
+export default function _default({ cookieParserMiddleware, secret, name, secure, ttl, mountUrl, cookieSameSite, store, }: {
+    cookieParserMiddleware: any;
+    secret: any;
+    name: any;
+    secure: any;
+    ttl: any;
+    mountUrl?: string | undefined;
+    cookieSameSite?: boolean | undefined;
+    store?: any;
+}): any[];

package/dist/middleware/session.js

@@ -0,0 +1,115 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// A last-modified cookie is used to control whether the end user sees a
+// session-timeout page, or they are simply given a new session without
+// interrupting their journey.
+const express_session_1 = __importStar(require("express-session"));
+const logger_js_1 = __importDefault(require("../lib/logger.js"));
+const log = (0, logger_js_1.default)('middleware:session');
+// 3 middleware:
+// - set the session cookie
+// - parse request cookies
+// - handle expiry of server-side session
+function default_1({ cookieParserMiddleware, secret, name, secure, ttl, mountUrl = '/', cookieSameSite = true, store = new express_session_1.MemoryStore(), }) {
+    const commonCookieOptions = {
+        httpOnly: true,
+        path: '/',
+        secure,
+    };
+    if (cookieSameSite !== false) {
+        commonCookieOptions.sameSite = cookieSameSite === true ? 'Strict' : cookieSameSite;
+    }
+    const ttlGrace = 1800; // user will see session-timeout if session expires within 30mins
+    const touchCookieName = `${name}.t`;
+    const touchCookieOptions = Object.assign(Object.assign({}, commonCookieOptions), { maxAge: (ttl + ttlGrace) * 1000, signed: true });
+    const touchCookie = (res) => {
+        // Touch cookie expiry is 3a short period after the session ttl. This gives
+        // a small period of time where a user will see the session-timeout message,
+        // which is important to avoid the confusion of simply being redirected back
+        // to the start of their journey.
+        res.cookie(touchCookieName, (new Date(Date.now())).toUTCString(), touchCookieOptions);
+    };
+    const removeCookie = (res) => {
+        res.clearCookie(touchCookieName, touchCookieOptions);
+    };
+    return [
+        (0, express_session_1.default)({
+            secret: secret,
+            name: name,
+            saveUninitialized: false,
+            resave: false,
+            cookie: Object.assign(Object.assign({}, commonCookieOptions), { maxAge: null }),
+            store,
+        }),
+        cookieParserMiddleware,
+        (req, res, next) => {
+            var _a, _b;
+            let lastModified = Date.parse(String((_a = req.signedCookies[touchCookieName]) !== null && _a !== void 0 ? _a : '1970-01-01T00:00:00+0000'));
+            lastModified = isNaN(lastModified) ? 0 : Math.floor(lastModified * 0.001); // convert to seconds
+            const age = Math.floor(Date.now() * 0.001) - lastModified;
+            if (lastModified === 0) {
+                // New session, or grace period cookie no longer available after
+                // expiring; generate a new session, and create grace-period cookie.
+                // This will invalidate any CSRF tokens, so by letting the request POST
+                // requests through the user may see a 500 error response.
+                log.info('Session is new, or grace period has expired. Regenerating session.');
+                req.session.regenerate((err) => {
+                    if (err)
+                        return next(err);
+                    touchCookie(res);
+                    if (req.method === 'POST') {
+                        log.info('The CSRF token for this POST request will now be invalid for this regenerated session. Redirecting to app mount point.');
+                        res.redirect(302, mountUrl);
+                    }
+                    else {
+                        next();
+                    }
+                });
+            }
+            else if (age > ttl) {
+                // Cookie has become stale and server session will have been removed;
+                // redirect to session-timeout
+                log.info('Session has timed out within grace period. Destroying session and redirecting to timeout page.');
+                const language = (_b = req.session.language) !== null && _b !== void 0 ? _b : 'en';
+                req.session.destroy((err) => {
+                    if (err)
+                        return next(err);
+                    removeCookie(res);
+                    const params = new URLSearchParams({
+                        referrer: req.originalUrl,
+                        lang: language,
+                    });
+                    res.redirect(302, `${mountUrl}session-timeout?${params.toString()}`);
+                });
+            }
+            else {
+                // Touch cookie and continue
+                touchCookie(res);
+                next();
+            }
+        },
+    ];
+}
+exports.default = default_1;

package/dist/middleware/skip-waypoint.d.ts

@@ -0,0 +1,5 @@
+declare function _default({ waypoint, mountUrl, }: {
+    waypoint: any;
+    mountUrl: any;
+}): ((req: any, res: any, next: any) => any)[];
+export default _default;