@dwp/govuk-casa 8.0.0-alpha1 → 8.0.0

package/dist/middleware/pre.js

@@ -6,6 +6,17 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const crypto_1 = require("crypto");
 const helmet_1 = __importDefault(require("helmet"));
 exports.default = () => [
+    // Only allow certain request methods
+    (req, res, next) => {
+        if (req.method !== 'GET' && req.method !== 'POST') {
+            const err = new Error(`Unaccepted request method, "${String(req.method).substr(0, 7)}"`);
+            err.code = 'unaccepted_request_method';
+            next(err);
+        }
+        else {
+            next();
+        }
+    },
     // Prevent caching response in any intermediaries by default, in case it
     // contains sensitive data.
     // The `no-store` setting is to specifically disable the bfcache and prevent
@@ -20,7 +31,7 @@ exports.default = () => [
     // Generate nonces ready for use in Content-Security-Policy header and
     // govuk-frontend template. This same none can be used wherever required.
     (req, res, next) => {
-        res.locals.cspNonce = (0, crypto_1.randomBytes)(16).toString("hex");
+        res.locals.cspNonce = (0, crypto_1.randomBytes)(16).toString('hex');
         next();
     },
     // Helmet suite of headers
@@ -29,7 +40,9 @@ exports.default = () => [
         contentSecurityPolicy: {
             useDefaults: true,
             directives: {
-                "script-src": ["'self'", "www.google-analytics.com", "www.googletagmanager.com", (req, res) => `'nonce-${res.locals.cspNonce}'`],
+                'script-src': ["'self'", 'www.google-analytics.com', 'www.googletagmanager.com', (req, res) => `'nonce-${res.locals.cspNonce}'`],
+                'style-src': ["'self'", 'https:', (req, res) => `'nonce-${res.locals.cspNonce}'`],
+                'form-action': ["'self'"],
             },
         },
         // // Require referrer to aid navigation

package/dist/middleware/progress-journey.js

@@ -14,8 +14,9 @@ const log = (0, logger_js_1.default)('middleware:progress-journey');
 const saveAndRedirect = (session, journeyContext, url, res, next) => {
     JourneyContext_js_1.default.putContext(session, journeyContext);
     session.save((err) => {
-        if (err)
+        if (err) {
             next(err);
+        }
         res.redirect(302, url);
     });
 };
@@ -25,26 +26,23 @@ exports.default = ({ waypoint, plan, mountUrl, }) => [
         const traversed = plan.traverse(req.casa.journeyContext);
         const currentIndex = traversed.indexOf(waypoint);
         const nextIndex = Math.max(currentIndex < 0 ? traversed.length - 1 : 0, Math.min(currentIndex + 1, traversed.length - 1));
-        const nextWaypoint = traversed[nextIndex];
+        const nextWaypoint = traversed[parseInt(nextIndex, 10)];
         log.trace(`currentIndex = ${currentIndex}, nextIndex = ${nextIndex}, currentWaypoint = ${waypoint}, nextWaypoint = ${nextWaypoint}`);
-        // TODO: edit mode ---------- !!! considering the dependency graph instead, which will invalidate pages, meaning we can keep sticky mode as the default - the below, redirecting back to origin is fine to leave as is, because the next traversal in steer-journey will put the user on the right waypoint
-        // When in edit mode, these are the options for redirecting:
-        // - Try sending straight back to editOrigin - if it can't be reached, the "rails" middleware will redirect the user accordingly
-        //
-        // TODO: if the edit origin is on another sub-app, only that plan will get travsersed, so the user might miss out on forms in between.
-        // Or it might be on the same app, but a Plan exists in the middle of this plan, so need to be sure to travsrse that plan fully too.
-        // It's looking more likely that we'll need Plans to talk with each other, but that's a headache.
-        // Keep it simple.
-        // Restrict the functionality. Don't allow this scenario. Devs will need to resort to waya around it. Wait for community to build things and see what solutions emerge for doption into this framework.
         // Edit mode
         // Attempt to take the user back to their original URL. We rely on the
         // `steer-journey` middleware to prevent the user going too far ahead in
-        // their permitted journey.
-        // Keep the edit mode on this redirect. This means the user can keep
-        // "jumping" ahead in the journey until they get back to the original URL.
+        // their permitted journey. Bear in mind that the `editOrigin` may not be
+        // a waypoint at all, but a route path for a custom endpoint, so we can't
+        // safely do a traversal check here.
+        //
+        // The edit mode URL params will be kept on this redirect. This means the
+        // user can keep "jumping" to the next _changed_ waypoint, until they get
+        // back to the original URL.
+        //
+        // Devs should use the `events` mechanism to mark waypoints as invalid if
+        // they want to force the user to re-visit particular waypoints during this
+        // "jumping" phase.
         if (req.casa.editMode && req.casa.editOrigin) {
-            // TODO: Need tyo detect if we're already on the editOrigin on this request.
-            // If so, need to fall through so we can get directed to the next waypoint in the journey
             const url = new URL(req.casa.editOrigin, 'https://placeholder.test/');
             url.searchParams.append('edit', 'true');
             url.searchParams.append('editorigin', req.casa.editOrigin);
@@ -77,6 +75,6 @@ exports.default = ({ waypoint, plan, mountUrl, }) => [
         });
         // Save and move on
         log.trace(`Redirecting to ${nextUrl}`);
-        saveAndRedirect(req.session, req.casa.journeyContext, nextUrl, res, next);
+        return saveAndRedirect(req.session, req.casa.journeyContext, nextUrl, res, next);
     },
 ];

package/dist/middleware/sanitise-fields.js

@@ -11,38 +11,43 @@ const field_js_1 = __importDefault(require("../lib/field.js"));
 const JourneyContext_js_1 = __importDefault(require("../lib/JourneyContext.js"));
 exports.default = ({ waypoint, fields = [], }) => {
     // Add some common, transient fields to ensure they survive beyond this sanitisation process
-    fields.push((0, field_js_1.default)('_csrf', { persist: false }).processor((value => String(value))));
-    fields.push((0, field_js_1.default)('contextid', { persist: false }).processor((value => String(value))));
-    fields.push((0, field_js_1.default)('edit', { persist: false }).processor((value => String(value))));
-    fields.push((0, field_js_1.default)('editorigin', { persist: false }).processor((value => String(value))));
+    fields.push((0, field_js_1.default)('_csrf', { persist: false }).processor((value) => String(value)));
+    fields.push((0, field_js_1.default)('contextid', { persist: false }).processor((value) => String(value)));
+    fields.push((0, field_js_1.default)('edit', { persist: false }).processor((value) => String(value)));
+    fields.push((0, field_js_1.default)('editorigin', { persist: false }).processor((value) => String(value)));
     // Middleware
     return [
         (req, res, next) => {
             // First, prune all undefined, or unknown fields from `req.body` (i.e.
             // those that do not have an entry in `fields`)
+            // EsLint disabled as `fields`, `i` & `name` are only controlled by dev
+            /* eslint-disable security/detect-object-injection */
             const prunedBody = Object.create(null);
             for (let i = 0, l = fields.length; i < l; i++) {
                 if (lodash_1.default.has(req.body, fields[i].name) && req.body[fields[i].name] !== undefined) {
                     prunedBody[fields[i].name] = req.body[fields[i].name];
                 }
             }
-            // TODO: the journey context passed to the processors and conditions, with data set to the "prunedBody"
+            /* eslint-enable security/detect-object-injection */
             const journeyContext = JourneyContext_js_1.default.fromContext(req.casa.journeyContext);
             journeyContext.setDataForPage(waypoint, prunedBody);
-            // const journeyContext = {};
             // Second, prune any fields that do not pass the validation conditional,
             // and process those that do.
             const sanitisedBody = Object.create(null);
             for (let i = 0, l = fields.length; i < l; i++) {
-                const field = fields[i];
-                let fieldValue = field.getValue(prunedBody); // prunedBody[field.name];
-                if (fieldValue !== undefined && field.testConditions({ fieldValue, waypoint, journeyContext })) {
+                const field = fields[i]; /* eslint-disable-line security/detect-object-injection */
+                const fieldValue = field.getValue(prunedBody);
+                if (fieldValue !== undefined && field.testConditions({
+                    fieldValue,
+                    waypoint,
+                    journeyContext,
+                })) {
                     field.putValue(sanitisedBody, field.applyProcessors(fieldValue));
                 }
             }
             // Finally, write the sanitised body back to the request object
             req.body = sanitisedBody;
             next();
-        }
+        },
     ];
 };

package/dist/middleware/session.d.ts

@@ -1,4 +1,4 @@
-export default function _default({ cookieParserMiddleware, secret, name, secure, ttl, mountUrl, cookieSameSite, store, }: {
+export default function sessionMiddleware({ cookieParserMiddleware, secret, name, secure, ttl, mountUrl, cookieSameSite, cookiePath, store, }: {
     cookieParserMiddleware: any;
     secret: any;
     name: any;
@@ -6,5 +6,6 @@ export default function _default({ cookieParserMiddleware, secret, name, secure,
     ttl: any;
     mountUrl?: string | undefined;
     cookieSameSite?: boolean | undefined;
+    cookiePath?: string | undefined;
     store?: any;
 }): any[];

package/dist/middleware/session.js

@@ -28,14 +28,65 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const express_session_1 = __importStar(require("express-session"));
 const logger_js_1 = __importDefault(require("../lib/logger.js"));
 const log = (0, logger_js_1.default)('middleware:session');
+const sessionExpiryMiddleware = (mountUrl, ttl, getCookie, touchCookie, removeCookie) => (req, res, next) => {
+    var _a;
+    const lastModified = getCookie(req);
+    const age = Math.floor(Date.now() * 0.001) - lastModified;
+    if (lastModified === 0) {
+        // New session, or grace period cookie no longer available after
+        // expiring; generate a new session, and create grace-period cookie.
+        // This will invalidate any CSRF tokens, so by letting the request POST
+        // requests through the user may see a 500 error response.
+        log.info('Session is new, or grace period has expired. Regenerating session.');
+        req.session.regenerate((err) => {
+            if (err) {
+                next(err);
+            }
+            else {
+                touchCookie(res);
+                if (req.method === 'POST') {
+                    log.info('The CSRF token for this POST request will now be invalid for this regenerated session. Redirecting to app mount point.');
+                    res.redirect(302, mountUrl);
+                }
+                else {
+                    next();
+                }
+            }
+        });
+    }
+    else if (age > ttl) {
+        // Cookie has become stale and server session will have been removed;
+        // redirect to session-timeout
+        log.info('Session has timed out within grace period. Destroying session and redirecting to timeout page.');
+        const language = (_a = req.session.language) !== null && _a !== void 0 ? _a : 'en';
+        req.session.destroy((err) => {
+            if (err) {
+                next(err);
+            }
+            else {
+                removeCookie(res);
+                const params = new URLSearchParams({
+                    referrer: req.originalUrl,
+                    lang: language,
+                });
+                res.redirect(302, `${mountUrl}session-timeout?${params.toString()}`);
+            }
+        });
+    }
+    else {
+        // Touch cookie and continue
+        touchCookie(res);
+        next();
+    }
+};
 // 3 middleware:
 // - set the session cookie
 // - parse request cookies
 // - handle expiry of server-side session
-function default_1({ cookieParserMiddleware, secret, name, secure, ttl, mountUrl = '/', cookieSameSite = true, store = new express_session_1.MemoryStore(), }) {
+function sessionMiddleware({ cookieParserMiddleware, secret, name, secure, ttl, mountUrl = '/', cookieSameSite = true, cookiePath = '/', store = new express_session_1.MemoryStore(), }) {
     const commonCookieOptions = {
         httpOnly: true,
-        path: '/',
+        path: cookiePath,
         secure,
     };
     if (cookieSameSite !== false) {
@@ -44,8 +95,15 @@ function default_1({ cookieParserMiddleware, secret, name, secure, ttl, mountUrl
     const ttlGrace = 1800; // user will see session-timeout if session expires within 30mins
     const touchCookieName = `${name}.t`;
     const touchCookieOptions = Object.assign(Object.assign({}, commonCookieOptions), { maxAge: (ttl + ttlGrace) * 1000, signed: true });
+    const getCookie = (req) => {
+        var _a;
+        // Disabled eslint as `touchCookieName` is a constant, known value
+        /* eslint-disable-next-line security/detect-object-injection */
+        const lastModified = Date.parse(String((_a = req.signedCookies[touchCookieName]) !== null && _a !== void 0 ? _a : '1970-01-01T00:00:00+0000'));
+        return Number.isNaN(lastModified) ? 0 : Math.floor(lastModified * 0.001);
+    };
     const touchCookie = (res) => {
-        // Touch cookie expiry is 3a short period after the session ttl. This gives
+        // Touch cookie expiry is a short period after the session ttl. This gives
         // a small period of time where a user will see the session-timeout message,
         // which is important to avoid the confusion of simply being redirected back
         // to the start of their journey.
@@ -56,60 +114,15 @@ function default_1({ cookieParserMiddleware, secret, name, secure, ttl, mountUrl
     };
     return [
         (0, express_session_1.default)({
-            secret: secret,
-            name: name,
+            secret,
+            name,
             saveUninitialized: false,
             resave: false,
             cookie: Object.assign(Object.assign({}, commonCookieOptions), { maxAge: null }),
             store,
         }),
         cookieParserMiddleware,
-        (req, res, next) => {
-            var _a, _b;
-            let lastModified = Date.parse(String((_a = req.signedCookies[touchCookieName]) !== null && _a !== void 0 ? _a : '1970-01-01T00:00:00+0000'));
-            lastModified = isNaN(lastModified) ? 0 : Math.floor(lastModified * 0.001); // convert to seconds
-            const age = Math.floor(Date.now() * 0.001) - lastModified;
-            if (lastModified === 0) {
-                // New session, or grace period cookie no longer available after
-                // expiring; generate a new session, and create grace-period cookie.
-                // This will invalidate any CSRF tokens, so by letting the request POST
-                // requests through the user may see a 500 error response.
-                log.info('Session is new, or grace period has expired. Regenerating session.');
-                req.session.regenerate((err) => {
-                    if (err)
-                        return next(err);
-                    touchCookie(res);
-                    if (req.method === 'POST') {
-                        log.info('The CSRF token for this POST request will now be invalid for this regenerated session. Redirecting to app mount point.');
-                        res.redirect(302, mountUrl);
-                    }
-                    else {
-                        next();
-                    }
-                });
-            }
-            else if (age > ttl) {
-                // Cookie has become stale and server session will have been removed;
-                // redirect to session-timeout
-                log.info('Session has timed out within grace period. Destroying session and redirecting to timeout page.');
-                const language = (_b = req.session.language) !== null && _b !== void 0 ? _b : 'en';
-                req.session.destroy((err) => {
-                    if (err)
-                        return next(err);
-                    removeCookie(res);
-                    const params = new URLSearchParams({
-                        referrer: req.originalUrl,
-                        lang: language,
-                    });
-                    res.redirect(302, `${mountUrl}session-timeout?${params.toString()}`);
-                });
-            }
-            else {
-                // Touch cookie and continue
-                touchCookie(res);
-                next();
-            }
-        },
+        sessionExpiryMiddleware(mountUrl, ttl, getCookie, touchCookie, removeCookie),
     ];
 }
-exports.default = default_1;
+exports.default = sessionMiddleware;

package/dist/middleware/skip-waypoint.js

@@ -4,14 +4,15 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-const lodash_1 = require("lodash");
+const lodash_1 = __importDefault(require("lodash"));
 const JourneyContext_js_1 = __importDefault(require("../lib/JourneyContext.js"));
 const waypoint_url_js_1 = __importDefault(require("../lib/waypoint-url.js"));
 const logger_js_1 = __importDefault(require("../lib/logger.js"));
+const { has } = lodash_1.default;
 const log = (0, logger_js_1.default)('middleware:skip-waypoint');
 exports.default = ({ waypoint, mountUrl, }) => [
     (req, res, next) => {
-        if (!(0, lodash_1.has)(req.query, 'skipto')) {
+        if (!has(req.query, 'skipto')) {
             return next();
         }
         const skipTo = String(req.query.skipto);
@@ -25,16 +26,18 @@ exports.default = ({ waypoint, mountUrl, }) => [
         const redirectUrl = (0, waypoint_url_js_1.default)({
             mountUrl,
             waypoint: skipTo,
-            edit: req.editMode,
-            editOrigin: req.editOriginUrl,
+            edit: req.casa.editMode,
+            editOrigin: req.casa.editOrigin,
             journeyContext: req.casa.journeyContext,
         });
         log.debug(`Will redirect to "${redirectUrl}" after skipping "${waypoint}"`);
-        req.session.save((err) => {
+        return req.session.save((err) => {
             if (err) {
-                return next(err);
+                next(err);
+            }
+            else {
+                res.redirect(302, redirectUrl);
             }
-            res.redirect(302, redirectUrl);
         });
     },
 ];

package/dist/middleware/steer-journey.d.ts

@@ -1,6 +1,7 @@
 declare function _default({ waypoint, plan, mountUrl, }: {
     waypoint: string;
-    plan: any;
+    plan: Plan;
     mountUrl: string;
-}): ((req: any, res: any, next: any) => any)[];
+}): void;
 export default _default;
+export type Plan = typeof import("../lib/Plan");

package/dist/middleware/steer-journey.js

@@ -9,10 +9,17 @@ const waypoint_url_js_1 = __importDefault(require("../lib/waypoint-url.js"));
 const logger_js_1 = __importDefault(require("../lib/logger.js"));
 const log = (0, logger_js_1.default)('middleware:steer-journey');
 /**
- * @param {Object} obj
- * @param {string} obj.waypoint
- * @param {Plan} obj.plan
- * @param {string} obj.mountUrl
+ * @typedef {import('../lib/Plan')} Plan
+ */
+/**
+ * This sits in front of all other journey middleware and prevents the user from
+ * "jumping ahead" in the Plan.
+ *
+ * @param {object} obj Options
+ * @param {string} obj.waypoint Current waypoint
+ * @param {Plan} obj.plan CASA Plan
+ * @param {string} obj.mountUrl Mount URL
+ * @returns {void}
  */
 exports.default = ({ waypoint, plan, mountUrl, }) => [
     (req, res, next) => {
@@ -30,15 +37,26 @@ exports.default = ({ waypoint, plan, mountUrl, }) => [
                 editOrigin: req.casa.editOrigin,
             }));
         }
-        // difficult: first waypoint on a Plan - how do we determine if there are other plans pointing at this one?
-        // and how do we determine if those others are part of a future plan, or a past one?
-        // Think we'll have to leave it up to the dev to add the back link for the first page in a Plan.
+        // Edit mode
+        // Cannot be in edit mode if we're already on the `editorigin` URL
+        if (req.casa.editMode) {
+            const { pathname: currentPathname } = new URL(req.originalUrl, 'http://placeholder.test/');
+            if (req.casa.editOrigin === currentPathname) {
+                log.debug(`Disabling edit mode as we are on the edit origin (${req.casa.editOrigin})`);
+                req.casa.editMode = false;
+                req.casa.editOrigin = undefined;
+            }
+        }
+        // difficult: first waypoint on a Plan - how do we determine if there are
+        // other plans pointing at this one? and how do we determine if those others
+        // are part of a future plan, or a past one? Think we'll have to leave it up
+        // to the dev to add the back link for the first page in a Plan.
         // Calculate URL for the "back" link
         const [prevRoute] = plan.traversePrevRoutes(req.casa.journeyContext, {
             startWaypoint: waypoint,
             stopCondition: () => (true), // stop at the first one
         });
         res.locals.casa.journeyPreviousUrl = prevRoute.target ? (0, waypoint_url_js_1.default)({ mountUrl, waypoint: prevRoute.target, routeName: 'prev' }) : undefined;
-        next();
+        return next();
     },
 ];

package/dist/middleware/validate-fields.js

@@ -5,7 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 // Validate the data captured in the journey context
 const JourneyContext_js_1 = __importDefault(require("../lib/JourneyContext.js"));
-const updateContext = ({ waypoint, errors = null, plan, mountUrl, journeyContext, session, }) => {
+const updateContext = ({ waypoint, errors = null, journeyContext, session, }) => {
     // Set validation state
     if (errors === null) {
         journeyContext.clearValidationErrorsForPage(waypoint);
@@ -13,16 +13,6 @@ const updateContext = ({ waypoint, errors = null, plan, mountUrl, journeyContext
     else {
         journeyContext.setValidationErrorsForPage(waypoint, errors);
     }
-    // // Update nav context
-    // // In most cases, the "next" & "prev" routes will result in the same sequence,
-    // // in reverse. But devs do have the option of setting different logic on
-    // // these routes, so this is the proper way to do it.
-    // const traversedNext = plan.traverseNextRoutes(journeyContext).map(r => r.source);
-    // const traversedPrev = plan.traversePrevRoutes(journeyContext, {
-    //   startWaypoint: traversedNext[traversedNext.length - 1],
-    // }).map(r => r.source);
-    // journeyContext.setNavigationUrls(mountUrl, traversedNext, 'next');
-    // journeyContext.setNavigationUrls(mountUrl, traversedPrev, 'prev');
     // Save to session
     JourneyContext_js_1.default.putContext(session, journeyContext);
 };
@@ -31,6 +21,8 @@ exports.default = ({ waypoint, fields = [], mountUrl, plan, }) => [
         var _a, _b;
         let errors = [];
         for (let i = 0, l = fields.length; i < l; i++) {
+            /* eslint-disable security/detect-object-injection */
+            // Dynamic object keys are only used on known entities (fields, waypoint)
             const field = fields[i];
             const fieldName = field.name;
             const fieldValue = (_b = (_a = req.casa.journeyContext.data) === null || _a === void 0 ? void 0 : _a[waypoint]) === null || _b === void 0 ? void 0 : _b[fieldName];
@@ -40,12 +32,13 @@ exports.default = ({ waypoint, fields = [], mountUrl, plan, }) => [
                 waypoint,
                 journeyContext: req.casa.journeyContext,
             };
-            if (!field.testConditions(context))
-                continue;
-            errors = [
-                ...errors,
-                ...field.runValidators(fieldValue, context),
-            ];
+            /* eslint-enable security/detect-object-injection */
+            if (field.testConditions(context)) {
+                errors = [
+                    ...errors,
+                    ...field.runValidators(fieldValue, context),
+                ];
+            }
         }
         // Validation passed with no errors
         if (!errors.length) {
@@ -59,8 +52,9 @@ exports.default = ({ waypoint, fields = [], mountUrl, plan, }) => [
             return next();
         }
         // If there are any native errors in the list, we need to bail the request
-        if (errors.find((e) => e instanceof Error)) {
-            return next(e);
+        const nativeError = errors.find((e) => e instanceof Error);
+        if (nativeError) {
+            return next(nativeError);
         }
         // Make the errors available to downstream middleware
         updateContext({
@@ -71,6 +65,6 @@ exports.default = ({ waypoint, fields = [], mountUrl, plan, }) => [
             plan,
             journeyContext: req.casa.journeyContext,
         });
-        next();
-    }
+        return next();
+    },
 ];

package/dist/mjs/esm-wrapper.js

@@ -1,10 +1,21 @@
 // Basic wrapper to act as the package entrypoint for ESM applications
 // ref: https://redfin.engineering/node-modules-at-war-why-commonjs-and-es-modules-cant-get-along-9617135eeca1
+// The `../casa.js` reference here is correct. This file will be copied into
+// `dist/` in the right location at build time, which will resolve that file
+// path correctly.
 import casa from '../casa.js';
-export const configure = casa.configure; 
-export const validators = casa.validators;
-export const field = casa.field;
-export const Plan = casa.Plan;
-export const JourneyContext = casa.JourneyContext;
-export const ValidationError = casa.ValidationError;
-export const waypointUrl = casa.waypointUrl;
+
+export const { configure } = casa;
+export const { validators } = casa;
+export const { field } = casa;
+export const { Plan } = casa;
+export const { JourneyContext } = casa;
+export const { ValidatorFactory } = casa;
+export const { ValidationError } = casa;
+
+// Utilities
+export const { waypointUrl } = casa;
+export const { endSession } = casa;
+
+// Nunjucks filters
+export const { nunjucksFilters } = casa;

package/dist/routes/ancillary.d.ts

@@ -1,4 +1,11 @@
+/**
+ * Create an instance of the ancillary router.
+ *
+ * @param {Object} options = Optiona
+ * @param {number} options.sessionTtl Session timeout (seconds)
+ * @returns {MutableRouter} Mutable router
+ */
 export default function ancillaryRouter({ sessionTtl, }: {
-    sessionTtl: any;
+    sessionTtl: number;
 }): MutableRouter;
 import MutableRouter from "../lib/MutableRouter.js";

package/dist/routes/ancillary.js

@@ -4,11 +4,17 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const MutableRouter_js_1 = __importDefault(require("../lib/MutableRouter.js"));
+/**
+ * Create an instance of the ancillary router.
+ *
+ * @param {Object} options = Optiona
+ * @param {number} options.sessionTtl Session timeout (seconds)
+ * @returns {MutableRouter} Mutable router
+ */
 function ancillaryRouter({ sessionTtl, }) {
     // Router
     const router = new MutableRouter_js_1.default();
     // Session timeout
-    // TODO: add a `ancillary.presessiontimeout` hook here? Might be useful for those who way to enhance the timeout route, rather than replacing it completely
     router.all('/session-timeout', (req, res) => {
         res.render('casa/session-timeout.njk', {
             sessionTtl: Math.floor(sessionTtl / 60),

package/dist/routes/dirname.cjs

@@ -1 +1 @@
-module.exports = __dirname;
+module.exports = __dirname;

package/dist/routes/dirname.d.cts

@@ -0,0 +1,2 @@
+declare const _exports: string;
+export = _exports;