@dwp/govuk-casa 7.0.7 → 7.0.8

package/dist/middleware/dirname.cjs

@@ -0,0 +1 @@
+module.exports = __dirname;

package/dist/middleware/dirname.d.cts

@@ -0,0 +1,2 @@
+declare const _exports: string;
+export = _exports;

package/dist/middleware/gather-fields.d.ts

@@ -0,0 +1,6 @@
+declare function _default({ waypoint, fields, }: {
+    waypoint: string;
+    fields?: import("../lib/field").PageField[] | undefined;
+}): any[];
+export default _default;
+export type PageField = import('../lib/field').PageField;

package/dist/middleware/gather-fields.js

@@ -0,0 +1,48 @@
+"use strict";
+// Gather the field data from `req.body` into the current JourneyContext
+// - Store in the current session
+// - Update the user's journey context with the new data
+// - Remove validation date of JourneyContext so it can re-evaluted
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const JourneyContext_js_1 = __importDefault(require("../lib/JourneyContext.js"));
+/**
+ * @typedef {import('../lib/field').PageField} PageField
+ */
+/**
+ * Gather the field data from `req.body` into the current JourneyContext
+ * - Store in the current session
+ * - Update the user's journey context with the new data
+ * - Remove validation date of JourneyContext so it can re-evaluted
+ *
+ * @param {object} obj Options
+ * @param {string} obj.waypoint Waypoint
+ * @param {PageField[]} [obj.fields=[]] Fields
+ * @returns {Array} Array of middleware
+ */
+exports.default = ({ waypoint, fields = [], }) => [
+    (req, res, next) => {
+        // Store a copy of the journey context before modifying it. This is useful
+        // for any comparison work that may be done in subseqent middleware.
+        req.casa.archivedJourneyContext = JourneyContext_js_1.default.fromContext(req.casa.journeyContext);
+        // Ignore data for any non-persistent fields
+        const persistentBody = Object.create(null);
+        for (let i = 0, l = fields.length; i < l; i++) {
+            if (fields[i].meta.persist && fields[i].getValue(req.body) !== undefined) {
+                persistentBody[fields[i].name] = fields[i].getValue(req.body);
+            }
+        }
+        // Update data and validation context in the current request, and store
+        req.casa.journeyContext.setDataForPage(waypoint, persistentBody);
+        req.casa.journeyContext.removeValidationStateForPage(waypoint);
+        JourneyContext_js_1.default.putContext(req.session, req.casa.journeyContext);
+        // TODO: Once feature we might like here is to invalidate specific pages
+        // based on the change that has just happened, to force those pages to be
+        // visited again. The main use case is to cater for a change in content on
+        // those pages that fundamentally alter the context of the question being asked,
+        // and so should be asked again. For example, "Your address" vs "You and your partner's address"
+        next();
+    },
+];

package/dist/middleware/i18n.d.ts

@@ -0,0 +1,4 @@
+export default function i18nMiddleware({ languages, directories, }: {
+    languages?: string[] | undefined;
+    directories?: any[] | undefined;
+}): import("express-serve-static-core").Handler[];

package/dist/middleware/i18n.js

@@ -0,0 +1,88 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const i18next_1 = __importDefault(require("i18next"));
+const i18next_http_middleware_1 = require("i18next-http-middleware");
+const path_1 = require("path");
+const fs_1 = require("fs");
+const deepmerge_1 = __importDefault(require("deepmerge"));
+const js_yaml_1 = __importDefault(require("js-yaml"));
+const logger_js_1 = __importDefault(require("../lib/logger.js"));
+const log = (0, logger_js_1.default)('middleware.i18n');
+const loadJson = (file) => {
+    // Strip out newlines (this is a legacy feature which we're keeping for
+    // backwards compatibility).
+    const json = (0, fs_1.readFileSync)(file, 'utf8');
+    return JSON.parse(json.replace(/[\r\n]/g, ''));
+};
+const loadYaml = (file) => js_yaml_1.default.load((0, fs_1.readFileSync)(file, 'utf8'));
+const extract = (file) => {
+    const ext = /.yaml$/i.test(file) ? '.yaml' : '.json';
+    const data = ext === '.yaml' ? loadYaml(file) : loadJson(file);
+    return {
+        ns: (0, path_1.basename)(file, ext),
+        data,
+    };
+};
+const loadResources = (languages, directories) => {
+    const store = Object.create(null);
+    languages.forEach((language) => {
+        store[language] = Object.create(null);
+        directories.forEach((basedir) => {
+            const dir = (0, path_1.resolve)(basedir, language);
+            if (!(0, fs_1.existsSync)(dir)) {
+                return;
+            }
+            log.info('Loading %s language from %s ...', language, dir);
+            (0, fs_1.readdirSync)(dir).forEach((file) => {
+                const { ns, data } = extract((0, path_1.resolve)(dir, file));
+                if (store[language][ns] === undefined) {
+                    store[language][ns] = Object.create(null);
+                }
+                store[language][ns] = (0, deepmerge_1.default)(store[language][ns], data);
+            });
+        });
+    });
+    return store;
+};
+function i18nMiddleware({ languages = ['en', 'cy'], directories = [], }) {
+    // Load _all_ translations, from all directories into memory.
+    const resources = loadResources(languages, directories);
+    // Configure i18next
+    const i18nInstance = i18next_1.default.createInstance();
+    i18nInstance
+        .use(i18next_http_middleware_1.LanguageDetector)
+        .init({
+        initImmediate: false,
+        supportedLngs: languages,
+        fallbackLng: false,
+        defaultNS: 'common',
+        // debug: true,
+        // All translation resources
+        resources,
+        // LanguageDetector options
+        detection: {
+            lookupQuerystring: 'lang',
+            lookupSession: 'language',
+            order: ['querystring', 'session'],
+        },
+    });
+    // 2 middleware: one to read/set the session language, and one to enhance the
+    // req/res objects with i18n features
+    return [
+        (req, res, next) => {
+            if (!req.session.language) {
+                /* eslint-disable-next-line prefer-destructuring */
+                req.session.language = languages[0];
+            }
+            if ((req === null || req === void 0 ? void 0 : req.query.lang) && languages.includes(req.query.lang)) {
+                req.session.language = String(req.query.lang);
+            }
+            next();
+        },
+        (0, i18next_http_middleware_1.handle)(i18nInstance),
+    ];
+}
+exports.default = i18nMiddleware;

package/dist/middleware/post.d.ts

@@ -0,0 +1,3 @@
+export default function postMiddleware({ mountUrl, }: {
+    mountUrl: any;
+}): ((err: any, req: any, res: any, next: any) => any)[];

package/dist/middleware/post.js

@@ -0,0 +1,57 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// 2 middleware: one as a fallback 404 handler, one to handle thrown errors
+const logger_js_1 = __importDefault(require("../lib/logger.js"));
+const log = (0, logger_js_1.default)('middleware:post');
+function postMiddleware({ mountUrl, }) {
+    return [
+        (req, res) => {
+            res.render('casa/errors/404.njk');
+        },
+        /* eslint-disable-next-line no-unused-vars */
+        (err, req, res, next) => {
+            var _a;
+            // In some cases, an error may have been thrown before the template assets
+            // have had a chance to initialise. So we use a hardcoded template in
+            // these cases to ensure the user sees an appropriate message.
+            let TEMPLATE = 'casa/errors/500.njk';
+            if (!res.locals.t) {
+                res.locals.t = () => ('');
+                res.locals.casa = Object.assign(Object.assign({}, (_a = res.locals) === null || _a === void 0 ? void 0 : _a.casa), { mountUrl });
+                TEMPLATE = 'casa/errors/static.njk';
+            }
+            // CSRF token is invalid in some way
+            if ((err === null || err === void 0 ? void 0 : err.code) === 'EBADCSRFTOKEN') {
+                log.info('CSRF validation has failed. This may be caused by the user submitting a stale form from a previous session [EBADCSRFTOKEN]');
+                return res.status(403).render(TEMPLATE, { errorCode: 'bad_csrf_token' });
+            }
+            // Body parsing verification check failed
+            if ((err === null || err === void 0 ? void 0 : err.type) === 'entity.verify.failed') {
+                log.info('Body parser verification has failed. This has been caused by the user submitting a payload containing invalid data [entity.verify.failed]');
+                return res.status(403).render(TEMPLATE, { errorCode: 'invalid_payload' });
+            }
+            // Too many parameters submitted
+            if ((err === null || err === void 0 ? void 0 : err.type) === 'parameters.too.many') {
+                log.info('The request contains more parameters than is currently allowed [parameters.too.many]');
+                return res.status(413).render(TEMPLATE, { errorCode: 'parameter_limit_exceeded' });
+            }
+            // Overall payload too large
+            if ((err === null || err === void 0 ? void 0 : err.type) === 'entity.too.large') {
+                log.info(`The request payload is too large. Received ${err.length}b with a maximum of ${err.limit}b [parameters.too.many]`);
+                return res.status(413).render(TEMPLATE, { errorCode: 'payload_size_exceeded' });
+            }
+            // Unaccept request method
+            if ((err === null || err === void 0 ? void 0 : err.code) === 'unaccepted_request_method') {
+                log.info(err.message);
+                return res.status(400).render(TEMPLATE, { errorCode: 'unaccepted_request_method' });
+            }
+            // Unknown error
+            log.error(`Unknown error: ${err.message}; stacktrace: ${err.stack}`);
+            return res.status(200).render(TEMPLATE);
+        },
+    ];
+}
+exports.default = postMiddleware;

package/dist/middleware/pre.d.ts

@@ -0,0 +1,3 @@
+/// <reference types="node" />
+declare function _default(): ((req: import("http").IncomingMessage, res: import("http").ServerResponse, next: (err?: unknown) => void) => void)[];
+export default _default;

package/dist/middleware/pre.js

@@ -0,0 +1,51 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const crypto_1 = require("crypto");
+const helmet_1 = __importDefault(require("helmet"));
+exports.default = () => [
+    // Only allow certain request methods
+    (req, res, next) => {
+        if (req.method !== 'GET' && req.method !== 'POST') {
+            const err = new Error(`Unaccepted request method, "${String(req.method).substr(0, 7)}"`);
+            err.code = 'unaccepted_request_method';
+            next(err);
+        }
+        else {
+            next();
+        }
+    },
+    // Prevent caching response in any intermediaries by default, in case it
+    // contains sensitive data.
+    // The `no-store` setting is to specifically disable the bfcache and prevent
+    // possible leakage of information.
+    (req, res, next) => {
+        res.set('cache-control', 'no-cache, no-store, must-revalidate, private');
+        res.set('pragma', 'no-cache');
+        res.set('expires', 0);
+        res.set('x-robots-tag', 'noindex, nofollow');
+        next();
+    },
+    // Generate nonces ready for use in Content-Security-Policy header and
+    // govuk-frontend template. This same none can be used wherever required.
+    (req, res, next) => {
+        res.locals.cspNonce = (0, crypto_1.randomBytes)(16).toString('hex');
+        next();
+    },
+    // Helmet suite of headers
+    (0, helmet_1.default)({
+        // Allows GA which is typically used, and a known inline script nonce
+        contentSecurityPolicy: {
+            useDefaults: true,
+            directives: {
+                'script-src': ["'self'", 'www.google-analytics.com', 'www.googletagmanager.com', (req, res) => `'nonce-${res.locals.cspNonce}'`],
+                'style-src': ["'self'", 'https:', (req, res) => `'nonce-${res.locals.cspNonce}'`],
+                'form-action': ["'self'"],
+            },
+        },
+        // // Require referrer to aid navigation
+        // referrerPolicy: 'no-referrer, same-origin',
+    }),
+];

package/dist/middleware/progress-journey.d.ts

@@ -0,0 +1,6 @@
+declare function _default({ waypoint, plan, mountUrl, }: {
+    waypoint: any;
+    plan: any;
+    mountUrl: any;
+}): ((req: any, res: any, next: any) => void)[];
+export default _default;

package/dist/middleware/progress-journey.js

@@ -0,0 +1,80 @@
+"use strict";
+// Determine where to take the user next
+// We assume that the waypoint has been validated prior to reaching this
+// middleware.
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const Plan_js_1 = __importDefault(require("../lib/Plan.js"));
+const JourneyContext_js_1 = __importDefault(require("../lib/JourneyContext.js"));
+const waypoint_url_js_1 = __importDefault(require("../lib/waypoint-url.js"));
+const logger_js_1 = __importDefault(require("../lib/logger.js"));
+const log = (0, logger_js_1.default)('middleware:progress-journey');
+const saveAndRedirect = (session, journeyContext, url, res, next) => {
+    JourneyContext_js_1.default.putContext(session, journeyContext);
+    session.save((err) => {
+        if (err) {
+            next(err);
+        }
+        res.redirect(302, url);
+    });
+};
+exports.default = ({ waypoint, plan, mountUrl, }) => [
+    (req, res, next) => {
+        // Determine the next available waypoint after the current one
+        const traversed = plan.traverse(req.casa.journeyContext);
+        const currentIndex = traversed.indexOf(waypoint);
+        const nextIndex = Math.max(currentIndex < 0 ? traversed.length - 1 : 0, Math.min(currentIndex + 1, traversed.length - 1));
+        const nextWaypoint = traversed[nextIndex];
+        log.trace(`currentIndex = ${currentIndex}, nextIndex = ${nextIndex}, currentWaypoint = ${waypoint}, nextWaypoint = ${nextWaypoint}`);
+        // Edit mode
+        // Attempt to take the user back to their original URL. We rely on the
+        // `steer-journey` middleware to prevent the user going too far ahead in
+        // their permitted journey. Bear in mind that the `editOrigin` may not be
+        // a waypoint at all, but a route path for a custom endpoint, so we can't
+        // safely do a traversal check here.
+        //
+        // The edit mode URL params will be kept on this redirect. This means the
+        // user can keep "jumping" to the next _changed_ waypoint, until they get
+        // back to the original URL.
+        //
+        // Devs should use the `events` mechanism to mark waypoints as invalid if
+        // they want to force the user to re-visit particular waypoints during this
+        // "jumping" phase.
+        if (req.casa.editMode && req.casa.editOrigin) {
+            const url = new URL(req.casa.editOrigin, 'https://placeholder.test/');
+            url.searchParams.append('edit', 'true');
+            url.searchParams.append('editorigin', req.casa.editOrigin);
+            const redirectUrl = (0, waypoint_url_js_1.default)({ waypoint: url.pathname }) + url.search.toString();
+            log.debug(`Edit mode detected; redirecting to ${redirectUrl}`);
+            return saveAndRedirect(req.session, req.casa.journeyContext, redirectUrl, res, next);
+        }
+        // If the next URL is an "exit node", we need to flag that node as
+        // being validated so that subsequent traversals of this journey continue
+        // correctly to any waypoints leading on from this one.
+        // This effectively says that the other Plan linked to by the exit node is
+        // complete, but of course that may not be the case.
+        // It would be prudent for developers to add a conditions to the route to
+        // check is this is the case, eg
+        //   setRoute('a', 'b');
+        //   setRoute('b', 'url:///otherapp/')
+        //   setRoute('url:////otherapp/', 'c', (r, c) => checkIfOtherAppIsFinished())
+        if (Plan_js_1.default.isExitNode(nextWaypoint)) {
+            log.trace(`Next waypoint is an exit node; clearing validation state on ${nextWaypoint}`);
+            req.casa.journeyContext.clearValidationErrorsForPage(nextWaypoint);
+            JourneyContext_js_1.default.putContext(req.session, req.casa.journeyContext);
+        }
+        // Construct the next url
+        const nextUrl = (0, waypoint_url_js_1.default)({
+            waypoint: nextWaypoint,
+            mountUrl,
+            journeyContext: req.casa.journeyContext,
+            edit: req.casa.editMode,
+            editOrigin: req.casa.editOrigin,
+        });
+        // Save and move on
+        log.trace(`Redirecting to ${nextUrl}`);
+        return saveAndRedirect(req.session, req.casa.journeyContext, nextUrl, res, next);
+    },
+];

package/dist/middleware/sanitise-fields.d.ts

@@ -0,0 +1,5 @@
+declare function _default({ waypoint, fields, }: {
+    waypoint: any;
+    fields?: any[] | undefined;
+}): ((req: any, res: any, next: any) => void)[];
+export default _default;

package/dist/middleware/sanitise-fields.js

@@ -0,0 +1,53 @@
+"use strict";
+// Sanitise the fields submitted from a form
+// - Coerce each field to its correct type
+// - Remove an extraneous fields that are not know to the application
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const lodash_1 = __importDefault(require("lodash"));
+const field_js_1 = __importDefault(require("../lib/field.js"));
+const JourneyContext_js_1 = __importDefault(require("../lib/JourneyContext.js"));
+exports.default = ({ waypoint, fields = [], }) => {
+    // Add some common, transient fields to ensure they survive beyond this sanitisation process
+    fields.push((0, field_js_1.default)('_csrf', { persist: false }).processor((value) => String(value)));
+    fields.push((0, field_js_1.default)('contextid', { persist: false }).processor((value) => String(value)));
+    fields.push((0, field_js_1.default)('edit', { persist: false }).processor((value) => String(value)));
+    fields.push((0, field_js_1.default)('editorigin', { persist: false }).processor((value) => String(value)));
+    // Middleware
+    return [
+        (req, res, next) => {
+            // First, prune all undefined, or unknown fields from `req.body` (i.e.
+            // those that do not have an entry in `fields`)
+            const prunedBody = Object.create(null);
+            for (let i = 0, l = fields.length; i < l; i++) {
+                if (lodash_1.default.has(req.body, fields[i].name) && req.body[fields[i].name] !== undefined) {
+                    prunedBody[fields[i].name] = req.body[fields[i].name];
+                }
+            }
+            // TODO: the journey context passed to the processors and conditions, with
+            // data set to the "prunedBody"
+            const journeyContext = JourneyContext_js_1.default.fromContext(req.casa.journeyContext);
+            journeyContext.setDataForPage(waypoint, prunedBody);
+            // const journeyContext = {};
+            // Second, prune any fields that do not pass the validation conditional,
+            // and process those that do.
+            const sanitisedBody = Object.create(null);
+            for (let i = 0, l = fields.length; i < l; i++) {
+                const field = fields[i];
+                const fieldValue = field.getValue(prunedBody); // prunedBody[field.name];
+                if (fieldValue !== undefined && field.testConditions({
+                    fieldValue,
+                    waypoint,
+                    journeyContext,
+                })) {
+                    field.putValue(sanitisedBody, field.applyProcessors(fieldValue));
+                }
+            }
+            // Finally, write the sanitised body back to the request object
+            req.body = sanitisedBody;
+            next();
+        },
+    ];
+};

package/dist/middleware/session.d.ts

@@ -0,0 +1,11 @@
+export default function sessionMiddleware({ cookieParserMiddleware, secret, name, secure, ttl, mountUrl, cookieSameSite, cookiePath, store, }: {
+    cookieParserMiddleware: any;
+    secret: any;
+    name: any;
+    secure: any;
+    ttl: any;
+    mountUrl?: string | undefined;
+    cookieSameSite?: boolean | undefined;
+    cookiePath?: string | undefined;
+    store?: any;
+}): any[];

package/dist/middleware/session.js

@@ -0,0 +1,121 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+// A last-modified cookie is used to control whether the end user sees a
+// session-timeout page, or they are simply given a new session without
+// interrupting their journey.
+const express_session_1 = __importStar(require("express-session"));
+const logger_js_1 = __importDefault(require("../lib/logger.js"));
+const log = (0, logger_js_1.default)('middleware:session');
+// 3 middleware:
+// - set the session cookie
+// - parse request cookies
+// - handle expiry of server-side session
+function sessionMiddleware({ cookieParserMiddleware, secret, name, secure, ttl, mountUrl = '/', cookieSameSite = true, cookiePath = '/', store = new express_session_1.MemoryStore(), }) {
+    const commonCookieOptions = {
+        httpOnly: true,
+        path: cookiePath,
+        secure,
+    };
+    if (cookieSameSite !== false) {
+        commonCookieOptions.sameSite = cookieSameSite === true ? 'Strict' : cookieSameSite;
+    }
+    const ttlGrace = 1800; // user will see session-timeout if session expires within 30mins
+    const touchCookieName = `${name}.t`;
+    const touchCookieOptions = Object.assign(Object.assign({}, commonCookieOptions), { maxAge: (ttl + ttlGrace) * 1000, signed: true });
+    const touchCookie = (res) => {
+        // Touch cookie expiry is 3a short period after the session ttl. This gives
+        // a small period of time where a user will see the session-timeout message,
+        // which is important to avoid the confusion of simply being redirected back
+        // to the start of their journey.
+        res.cookie(touchCookieName, (new Date(Date.now())).toUTCString(), touchCookieOptions);
+    };
+    const removeCookie = (res) => {
+        res.clearCookie(touchCookieName, touchCookieOptions);
+    };
+    return [
+        (0, express_session_1.default)({
+            secret,
+            name,
+            saveUninitialized: false,
+            resave: false,
+            cookie: Object.assign(Object.assign({}, commonCookieOptions), { maxAge: null }),
+            store,
+        }),
+        cookieParserMiddleware,
+        (req, res, next) => {
+            var _a, _b;
+            let lastModified = Date.parse(String((_a = req.signedCookies[touchCookieName]) !== null && _a !== void 0 ? _a : '1970-01-01T00:00:00+0000'));
+            lastModified = Number.isNaN(lastModified) ? 0 : Math.floor(lastModified * 0.001);
+            const age = Math.floor(Date.now() * 0.001) - lastModified;
+            if (lastModified === 0) {
+                // New session, or grace period cookie no longer available after
+                // expiring; generate a new session, and create grace-period cookie.
+                // This will invalidate any CSRF tokens, so by letting the request POST
+                // requests through the user may see a 500 error response.
+                log.info('Session is new, or grace period has expired. Regenerating session.');
+                req.session.regenerate((err) => {
+                    if (err) {
+                        next(err);
+                    }
+                    else {
+                        touchCookie(res);
+                        if (req.method === 'POST') {
+                            log.info('The CSRF token for this POST request will now be invalid for this regenerated session. Redirecting to app mount point.');
+                            res.redirect(302, mountUrl);
+                        }
+                        else {
+                            next();
+                        }
+                    }
+                });
+            }
+            else if (age > ttl) {
+                // Cookie has become stale and server session will have been removed;
+                // redirect to session-timeout
+                log.info('Session has timed out within grace period. Destroying session and redirecting to timeout page.');
+                const language = (_b = req.session.language) !== null && _b !== void 0 ? _b : 'en';
+                req.session.destroy((err) => {
+                    if (err) {
+                        next(err);
+                    }
+                    else {
+                        removeCookie(res);
+                        const params = new URLSearchParams({
+                            referrer: req.originalUrl,
+                            lang: language,
+                        });
+                        res.redirect(302, `${mountUrl}session-timeout?${params.toString()}`);
+                    }
+                });
+            }
+            else {
+                // Touch cookie and continue
+                touchCookie(res);
+                next();
+            }
+        },
+    ];
+}
+exports.default = sessionMiddleware;

package/dist/middleware/skip-waypoint.d.ts

@@ -0,0 +1,5 @@
+declare function _default({ waypoint, mountUrl, }: {
+    waypoint: any;
+    mountUrl: any;
+}): ((req: any, res: any, next: any) => any)[];
+export default _default;

package/dist/middleware/skip-waypoint.js

@@ -0,0 +1,43 @@
+"use strict";
+// Mark a waypoint as skipped
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const lodash_1 = __importDefault(require("lodash"));
+const JourneyContext_js_1 = __importDefault(require("../lib/JourneyContext.js"));
+const waypoint_url_js_1 = __importDefault(require("../lib/waypoint-url.js"));
+const logger_js_1 = __importDefault(require("../lib/logger.js"));
+const { has } = lodash_1.default;
+const log = (0, logger_js_1.default)('middleware:skip-waypoint');
+exports.default = ({ waypoint, mountUrl, }) => [
+    (req, res, next) => {
+        if (!has(req.query, 'skipto')) {
+            return next();
+        }
+        const skipTo = String(req.query.skipto);
+        // Inject a special `__skipped__` attribute into this waypoint's data
+        log.info(`Marking waypoint "${waypoint}" as skipped`);
+        req.casa.journeyContext.clearValidationErrorsForPage(waypoint);
+        req.casa.journeyContext.setDataForPage(waypoint, {
+            __skipped__: true,
+        });
+        JourneyContext_js_1.default.putContext(req.session, req.casa.journeyContext);
+        const redirectUrl = (0, waypoint_url_js_1.default)({
+            mountUrl,
+            waypoint: skipTo,
+            edit: req.editMode,
+            editOrigin: req.editOriginUrl,
+            journeyContext: req.casa.journeyContext,
+        });
+        log.debug(`Will redirect to "${redirectUrl}" after skipping "${waypoint}"`);
+        return req.session.save((err) => {
+            if (err) {
+                next(err);
+            }
+            else {
+                res.redirect(302, redirectUrl);
+            }
+        });
+    },
+];

package/dist/middleware/steer-journey.d.ts

@@ -0,0 +1,7 @@
+declare function _default({ waypoint, plan, mountUrl, }: {
+    waypoint: string;
+    plan: Plan;
+    mountUrl: string;
+}): void;
+export default _default;
+export type Plan = typeof import("../lib/Plan");