@dwp/govuk-casa 8.0.0-alpha2 → 8.0.1

package/dist/lib/utils.d.ts

@@ -1,3 +1,12 @@
+/**
+ * @typedef {import('./configuration-ingestor').GlobalHook} GlobalHook
+ */
+/**
+ * @typedef {import('./configuration-ingestor').PageHook} PageHook
+ */
+/**
+ * @typedef {GlobalHook | PageHook} Hook
+ */
 /**
  * Test is a value can be stringifed (numbers or strings)
  *
@@ -27,6 +36,13 @@ export function isEmpty(val: any): boolean;
  * @param {string} hookName Hook name (including scope prefix)
  * @param {string} path URL path to match (relative to mountUrl)
  * @param {Hook[]} hooks Hooks to be applied at the page level
- * @returns {function[]} An array of middleware that should be applied
+ * @returns {Function[]} An array of middleware that should be applied
  */
-export function resolveMiddlewareHooks(hookName: string, path: string, hooks?: any[]): Function[];
+export function resolveMiddlewareHooks(hookName: string, path: string, hooks?: Hook[]): Function[];
+export function validateWaypoint(waypoint: any): void;
+export function validateView(view: any): void;
+export function validateHookName(hookName: any): void;
+export function validateHookPath(path: any): void;
+export type GlobalHook = import('./configuration-ingestor').GlobalHook;
+export type PageHook = import('./configuration-ingestor').PageHook;
+export type Hook = GlobalHook | PageHook;

package/dist/lib/utils.js

@@ -1,6 +1,15 @@
 "use strict";
+/**
+ * @typedef {import('./configuration-ingestor').GlobalHook} GlobalHook
+ */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.resolveMiddlewareHooks = exports.isEmpty = exports.stringifyInput = exports.isStringable = void 0;
+exports.validateHookPath = exports.validateHookName = exports.validateView = exports.validateWaypoint = exports.resolveMiddlewareHooks = exports.isEmpty = exports.stringifyInput = exports.isStringable = void 0;
+/**
+ * @typedef {import('./configuration-ingestor').PageHook} PageHook
+ */
+/**
+ * @typedef {GlobalHook | PageHook} Hook
+ */
 /**
  * Test is a value can be stringifed (numbers or strings)
  *
@@ -37,6 +46,8 @@ function isEmpty(val) {
         return true;
     }
     if (Array.isArray(val) || typeof val === 'object') {
+        // ESLint disabled as `k` is an "own property" (thanks to `Object.keys()`)
+        /* eslint-disable-next-line security/detect-object-injection */
         return Object.keys(val).filter((k) => !isEmpty(val[k])).length === 0;
     }
     return false;
@@ -49,7 +60,7 @@ exports.isEmpty = isEmpty;
  * @param {string} hookName Hook name (including scope prefix)
  * @param {string} path URL path to match (relative to mountUrl)
  * @param {Hook[]} hooks Hooks to be applied at the page level
- * @returns {function[]} An array of middleware that should be applied
+ * @returns {Function[]} An array of middleware that should be applied
  */
 function resolveMiddlewareHooks(hookName, path, hooks = []) {
     /* eslint-disable-next-line max-len */
@@ -57,3 +68,46 @@ function resolveMiddlewareHooks(hookName, path, hooks = []) {
     return hooks.filter((h) => h.hook === hookName).filter(pathMatch).map((h) => h.middleware);
 }
 exports.resolveMiddlewareHooks = resolveMiddlewareHooks;
+/* ------------------------------------------------ validation / sanitisation */
+function validateWaypoint(waypoint) {
+    if (typeof waypoint !== 'string') {
+        throw new TypeError('Waypoint must be a string');
+    }
+    if (!waypoint.length) {
+        throw new SyntaxError('Waypoint must not be empty');
+    }
+    if (waypoint.match(/[^/a-z0-9_-]/)) {
+        throw new SyntaxError('Waypoint must contain only a-z, 0-9, -, _ and / characters');
+    }
+}
+exports.validateWaypoint = validateWaypoint;
+function validateView(view) {
+    if (typeof view !== 'string') {
+        throw new TypeError('View must be a string');
+    }
+    if (!view.length) {
+        throw new SyntaxError('View must not be empty');
+    }
+    if (!view.match(/^[a-z0-9/_-]+\.njk$/i)) {
+        throw new SyntaxError('View must contain only a-z, 0-9, -, _ and / characters, and end in .njk');
+    }
+}
+exports.validateView = validateView;
+function validateHookName(hookName) {
+    if (typeof hookName !== 'string') {
+        throw new TypeError('Hook name must be a string');
+    }
+    if (!hookName.length) {
+        throw new SyntaxError('Hook name must not be empty');
+    }
+    if (!hookName.match(/^([a-z]+\.|)[a-z]+$/i)) {
+        throw new SyntaxError('Hook name must match either <scope>.<hookname> or <hookname> formats');
+    }
+}
+exports.validateHookName = validateHookName;
+function validateHookPath(path) {
+    if (typeof path !== 'string' && !(path instanceof RegExp)) {
+        throw new TypeError('Hook path must be a string or RegExp');
+    }
+}
+exports.validateHookPath = validateHookPath;

package/dist/lib/validators/inArray.js

@@ -31,7 +31,7 @@ class InArray extends ValidatorFactory_js_1.default {
         if (value !== null && typeof value !== 'undefined') {
             const search = Array.isArray(value) ? value : [value];
             for (let i = 0, l = search.length; i < l; i += 1) {
-                if (source.indexOf(search[i]) > -1) {
+                if (source.indexOf(search[parseInt(i, 10)]) > -1) {
                     valid = true;
                 }
                 else {

package/dist/lib/validators/index.js

@@ -23,25 +23,3 @@ exports.default = {
     strlen: strlen_js_1.default,
     wordCount: wordCount_js_1.default,
 };
-// const dateObject = require('./dateObject.js');
-// const email = require('./email.js');
-// const inArray = require('./inArray.js');
-// const nino = require('./nino.js');
-// const optional = require('./optional.js');
-// const postalAddressObject = require('./postalAddressObject.js');
-// const regex = require('./regex.js');
-// const required = require('./required.js');
-// const strlen = require('./strlen.js');
-// const wordCount = require('./wordCount.js');
-// module.exports = {
-//   dateObject,
-//   email,
-//   inArray,
-//   nino,
-//   optional,
-//   postalAddressObject,
-//   regex,
-//   required,
-//   strlen,
-//   wordCount,
-// };

package/dist/lib/validators/postalAddressObject.js

@@ -66,6 +66,8 @@ class PostalAddressObject extends ValidatorFactory_js_1.default {
         const reqF = Object.create(null);
         const reqC = cfg.requiredFields;
         ['address1', 'address2', 'address3', 'address4', 'postcode'].forEach((k) => {
+            // ESLint disabled as `k` is a known value from a constant list
+            /* eslint-disable-next-line security/detect-object-injection */
             reqF[k] = reqC.indexOf(k) > -1;
         });
         let valid = true;
@@ -75,8 +77,7 @@ class PostalAddressObject extends ValidatorFactory_js_1.default {
             const reAddrLine1 = /^\d+|[^\s]+[a-z0-9\-,.&#()/\\:;'" ]+$/i;
             // UK Postcode regex taken from the dwp java pc checker
             // https://github.com/dwp/postcode-format-validation
-            const pc = /^(?![QVX])[A-Z]((?![IJZ])[A-Z][0-9](([0-9]?)|([ABEHMNPRVWXY]?))|([0-9]([0-9]?|[ABCDEFGHJKPSTUW]?))) ?[0-9]((?![CIKMOV])[A-Z]){2}$|^(BFPO)[ ]?[0-9]{1,4}$/i;
-            const rePostcode = new RegExp(pc, 'i');
+            const rePostcode = /^(?![QVX])[A-Z]((?![IJZ])[A-Z][0-9](([0-9]?)|([ABEHMNPRVWXY]?))|([0-9]([0-9]?|[ABCDEFGHJKPSTUW]?))) ?[0-9]((?![CIKMOV])[A-Z]){2}$|^(BFPO)[ ]?[0-9]{1,4}$/i;
             // [required, regex, strlenmax, error message]
             const attributes = {
                 address1: [reqF.address1, reAddrLine1, cfg.strlenmax, cfg.errorMsgAddress1],
@@ -85,6 +86,8 @@ class PostalAddressObject extends ValidatorFactory_js_1.default {
                 address4: [reqF.address4, reAddr, cfg.strlenmax, cfg.errorMsgAddress4],
                 postcode: [reqF.postcode, rePostcode, null, cfg.errorMsgPostcode],
             };
+            // ESLint disabled as `k` is a known value from the constant list above
+            /* eslint-disable security/detect-object-injection */
             Object.keys(attributes).forEach((k) => {
                 const attr = attributes[k];
                 const hasProperty = Object.prototype.hasOwnProperty.call(value, k);
@@ -100,6 +103,7 @@ class PostalAddressObject extends ValidatorFactory_js_1.default {
                     }));
                 }
             });
+            /* eslint-enable security/detect-object-injection */
         }
         else {
             valid = false;

package/dist/lib/waypoint-url.d.ts

@@ -14,9 +14,10 @@
 export default function waypointUrl({ waypoint, mountUrl, journeyContext, edit, editOrigin, skipTo, routeName, }?: {
     waypoint: string;
     mountUrl: string;
-    journeyContext: any;
+    journeyContext: JourneyContext;
     edit: boolean;
     editOrigin: string;
     skipTo: boolean;
     routeName: string;
 }): string;
+export type JourneyContext = import('./index').JourneyContext;

package/dist/lib/waypoint-url.js

@@ -1,4 +1,7 @@
 "use strict";
+/**
+ * @typedef {import('./index').JourneyContext} JourneyContext
+ */
 Object.defineProperty(exports, "__esModule", { value: true });
 const reUrlProtocolExtract = /^url:\/\/(.+)$/i;
 const sanitiseWaypoint = (w) => w.replace(/[^/a-z0-9_-]/ig, '').replace(/\/+/g, '/');

package/dist/middleware/body-parser.d.ts

@@ -1 +1,2 @@
+export function verifyBody(req: any, res: any, buf: any, encoding: any): void;
 export default function bodyParserMiddleware(): import("connect").NextHandleFunction[];

package/dist/middleware/body-parser.js

@@ -1,10 +1,24 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyBody = void 0;
 const express_1 = require("express");
+const rProto = /__proto__/i;
+const rPrototype = /prototype[='"[\]]/i;
+const rConstructor = /constructor[='"[\]]/i;
+function verifyBody(req, res, buf, encoding) {
+    const body = decodeURI(buf.toString(encoding));
+    if (rProto.test(body)) {
+        throw new Error('Request body verification failed (__proto__)');
+    }
+    if (rPrototype.test(body)) {
+        throw new Error('Request body verification failed (prototype)');
+    }
+    if (rConstructor.test(body)) {
+        throw new Error('Request body verification failed (constructor)');
+    }
+}
+exports.verifyBody = verifyBody;
 function bodyParserMiddleware() {
-    const rProto = /__proto__/i;
-    const rPrototype = /prototype[=[\]]/i;
-    const rConstructor = /constructor[=[\]]/i;
     return [
         (0, express_1.urlencoded)({
             extended: true,
@@ -12,12 +26,7 @@ function bodyParserMiddleware() {
             inflate: true,
             parameterLimit: 25,
             limit: 1024 * 50,
-            verify: (req, res, buf, encoding) => {
-                const body = decodeURI(buf.toString(encoding));
-                if (rProto.test(body) || rPrototype.test(body) || rConstructor.test(body)) {
-                    throw new Error('Request body verification failed');
-                }
-            },
+            verify: verifyBody,
         }),
     ];
 }

package/dist/middleware/data.d.ts

@@ -1,6 +1,5 @@
-export default function dataMiddleware({ plan, mountUrl, serviceName, events, }: {
+export default function dataMiddleware({ plan, mountUrl, events, }: {
     plan: any;
     mountUrl: any;
-    serviceName: any;
     events: any;
 }): ((req: any, res: any, next: any) => void)[];

package/dist/middleware/data.js

@@ -18,7 +18,7 @@ const editOrigin = (req) => {
     }
     return '';
 };
-function dataMiddleware({ plan, mountUrl, serviceName, events, }) {
+function dataMiddleware({ plan, mountUrl, events, }) {
     return [
         (req, res, next) => {
             /* ------------------------------------------------ Request decorations */
@@ -37,19 +37,19 @@ function dataMiddleware({ plan, mountUrl, serviceName, events, }) {
             // CASA and userland templates
             res.locals.casa = {
                 mountUrl,
-                serviceName,
+                editMode: req.casa.editMode,
+                editOrigin: req.casa.editOrigin,
             };
             res.locals.locale = req.language;
             // Used by govuk-frontend template
             // - req.language is provided by i18n-http-middleware
             res.locals.htmlLang = req.language;
-            // res.locals.makeLink
-            // res.locals.casa.journeyPreviousUrl
-            // req.session.journeyContext
-            // req.session.language
-            // req.editOriginUrl
-            // req.inEditMode
-            // req.editSearchParams
+            // Function for building URLs. This will be curried with the `mountUrl`,
+            // `journeyContext`, `edit` and `editOrigin` for convenience. This means
+            // the template author does not have to be concerned about the current
+            // "state" when generating URLs, but still has the ability to override
+            // these curried defaults if needs be.
+            res.locals.waypointUrl = (args) => (0, waypoint_url_js_1.default)(Object.assign({ mountUrl, journeyContext: req.casa.journeyContext, edit: req.casa.editMode, editOrigin: req.casa.editOrigin }, args));
             next();
         },
     ];

package/dist/middleware/dirname.cjs

@@ -1 +1 @@
-module.exports = __dirname;
+module.exports = __dirname;

package/dist/middleware/dirname.d.cts

@@ -0,0 +1,2 @@
+declare const _exports: string;
+export = _exports;

package/dist/middleware/gather-fields.d.ts

@@ -1,5 +1,6 @@
 declare function _default({ waypoint, fields, }: {
     waypoint: string;
-    fields?: any[] | undefined;
+    fields?: import("../lib/field").PageField[] | undefined;
 }): any[];
 export default _default;
+export type PageField = import('../lib/field').PageField;

package/dist/middleware/gather-fields.js

@@ -8,6 +8,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const JourneyContext_js_1 = __importDefault(require("../lib/JourneyContext.js"));
+/**
+ * @typedef {import('../lib/field').PageField} PageField
+ */
 /**
  * Gather the field data from `req.body` into the current JourneyContext
  * - Store in the current session
@@ -25,21 +28,19 @@ exports.default = ({ waypoint, fields = [], }) => [
         // for any comparison work that may be done in subseqent middleware.
         req.casa.archivedJourneyContext = JourneyContext_js_1.default.fromContext(req.casa.journeyContext);
         // Ignore data for any non-persistent fields
+        // ESLint disabled as `fields`, `i` and `name` are dev-controlled
+        /* eslint-disable security/detect-object-injection */
         const persistentBody = Object.create(null);
         for (let i = 0, l = fields.length; i < l; i++) {
             if (fields[i].meta.persist && fields[i].getValue(req.body) !== undefined) {
                 persistentBody[fields[i].name] = fields[i].getValue(req.body);
             }
         }
+        /* eslint-enable security/detect-object-injection */
         // Update data and validation context in the current request, and store
         req.casa.journeyContext.setDataForPage(waypoint, persistentBody);
         req.casa.journeyContext.removeValidationStateForPage(waypoint);
         JourneyContext_js_1.default.putContext(req.session, req.casa.journeyContext);
-        // TODO: Once feature we might like here is to invalidate specific pages
-        // based on the change that has just happened, to force those pages to be
-        // visited again. The main use case is to cater for a change in content on
-        // those pages that fundamentally alter the context of the question being asked,
-        // and so should be asked again. For example, "Your address" vs "You and your partner's address"
         next();
     },
 ];

package/dist/middleware/i18n.js

@@ -10,7 +10,7 @@ const fs_1 = require("fs");
 const deepmerge_1 = __importDefault(require("deepmerge"));
 const js_yaml_1 = __importDefault(require("js-yaml"));
 const logger_js_1 = __importDefault(require("../lib/logger.js"));
-const log = (0, logger_js_1.default)('middleware.i18n');
+const log = (0, logger_js_1.default)('middleware:i18n');
 const loadJson = (file) => {
     // Strip out newlines (this is a legacy feature which we're keeping for
     // backwards compatibility).
@@ -29,6 +29,9 @@ const extract = (file) => {
 const loadResources = (languages, directories) => {
     const store = Object.create(null);
     languages.forEach((language) => {
+        // ESLint disabled as `store`, `language` and `ns` are all dev-controlled,
+        // and this function is only called once, at boot-time.
+        /* eslint-disable security/detect-object-injection */
         store[language] = Object.create(null);
         directories.forEach((basedir) => {
             const dir = (0, path_1.resolve)(basedir, language);
@@ -44,6 +47,7 @@ const loadResources = (languages, directories) => {
                 store[language][ns] = (0, deepmerge_1.default)(store[language][ns], data);
             });
         });
+        /* eslint-enable security/detect-object-injection */
     });
     return store;
 };

package/dist/middleware/post.js

@@ -26,31 +26,31 @@ function postMiddleware({ mountUrl, }) {
             // CSRF token is invalid in some way
             if ((err === null || err === void 0 ? void 0 : err.code) === 'EBADCSRFTOKEN') {
                 log.info('CSRF validation has failed. This may be caused by the user submitting a stale form from a previous session [EBADCSRFTOKEN]');
-                return res.status(403).render(TEMPLATE);
+                return res.status(403).render(TEMPLATE, { errorCode: 'bad_csrf_token' });
             }
             // Body parsing verification check failed
             if ((err === null || err === void 0 ? void 0 : err.type) === 'entity.verify.failed') {
                 log.info('Body parser verification has failed. This has been caused by the user submitting a payload containing invalid data [entity.verify.failed]');
-                return res.status(403).render(TEMPLATE);
+                return res.status(403).render(TEMPLATE, { errorCode: 'invalid_payload' });
             }
             // Too many parameters submitted
             if ((err === null || err === void 0 ? void 0 : err.type) === 'parameters.too.many') {
                 log.info('The request contains more parameters than is currently allowed [parameters.too.many]');
-                return res.status(413).render(TEMPLATE);
+                return res.status(413).render(TEMPLATE, { errorCode: 'parameter_limit_exceeded' });
             }
             // Overall payload too large
             if ((err === null || err === void 0 ? void 0 : err.type) === 'entity.too.large') {
                 log.info(`The request payload is too large. Received ${err.length}b with a maximum of ${err.limit}b [parameters.too.many]`);
-                return res.status(413).render(TEMPLATE);
+                return res.status(413).render(TEMPLATE, { errorCode: 'payload_size_exceeded' });
             }
             // Unaccept request method
             if ((err === null || err === void 0 ? void 0 : err.code) === 'unaccepted_request_method') {
                 log.info(err.message);
-                return res.status(400).render(TEMPLATE);
+                return res.status(400).render(TEMPLATE, { errorCode: 'unaccepted_request_method' });
             }
             // Unknown error
             log.error(`Unknown error: ${err.message}; stacktrace: ${err.stack}`);
-            return res.render(TEMPLATE);
+            return res.status(200).render(TEMPLATE);
         },
     ];
 }

package/dist/middleware/progress-journey.js

@@ -26,7 +26,7 @@ exports.default = ({ waypoint, plan, mountUrl, }) => [
         const traversed = plan.traverse(req.casa.journeyContext);
         const currentIndex = traversed.indexOf(waypoint);
         const nextIndex = Math.max(currentIndex < 0 ? traversed.length - 1 : 0, Math.min(currentIndex + 1, traversed.length - 1));
-        const nextWaypoint = traversed[nextIndex];
+        const nextWaypoint = traversed[parseInt(nextIndex, 10)];
         log.trace(`currentIndex = ${currentIndex}, nextIndex = ${nextIndex}, currentWaypoint = ${waypoint}, nextWaypoint = ${nextWaypoint}`);
         // Edit mode
         // Attempt to take the user back to their original URL. We rely on the

package/dist/middleware/sanitise-fields.js

@@ -11,32 +11,32 @@ const field_js_1 = __importDefault(require("../lib/field.js"));
 const JourneyContext_js_1 = __importDefault(require("../lib/JourneyContext.js"));
 exports.default = ({ waypoint, fields = [], }) => {
     // Add some common, transient fields to ensure they survive beyond this sanitisation process
-    fields.push((0, field_js_1.default)('_csrf', { persist: false }).processor(((value) => String(value))));
-    fields.push((0, field_js_1.default)('contextid', { persist: false }).processor(((value) => String(value))));
-    fields.push((0, field_js_1.default)('edit', { persist: false }).processor(((value) => String(value))));
-    fields.push((0, field_js_1.default)('editorigin', { persist: false }).processor(((value) => String(value))));
+    fields.push((0, field_js_1.default)('_csrf', { persist: false }).processor((value) => String(value)));
+    fields.push((0, field_js_1.default)('contextid', { persist: false }).processor((value) => String(value)));
+    fields.push((0, field_js_1.default)('edit', { persist: false }).processor((value) => String(value)));
+    fields.push((0, field_js_1.default)('editorigin', { persist: false }).processor((value) => String(value)));
     // Middleware
     return [
         (req, res, next) => {
             // First, prune all undefined, or unknown fields from `req.body` (i.e.
             // those that do not have an entry in `fields`)
+            // EsLint disabled as `fields`, `i` & `name` are only controlled by dev
+            /* eslint-disable security/detect-object-injection */
             const prunedBody = Object.create(null);
             for (let i = 0, l = fields.length; i < l; i++) {
                 if (lodash_1.default.has(req.body, fields[i].name) && req.body[fields[i].name] !== undefined) {
                     prunedBody[fields[i].name] = req.body[fields[i].name];
                 }
             }
-            // TODO: the journey context passed to the processors and conditions, with
-            // data set to the "prunedBody"
+            /* eslint-enable security/detect-object-injection */
             const journeyContext = JourneyContext_js_1.default.fromContext(req.casa.journeyContext);
             journeyContext.setDataForPage(waypoint, prunedBody);
-            // const journeyContext = {};
             // Second, prune any fields that do not pass the validation conditional,
             // and process those that do.
             const sanitisedBody = Object.create(null);
             for (let i = 0, l = fields.length; i < l; i++) {
-                const field = fields[i];
-                const fieldValue = field.getValue(prunedBody); // prunedBody[field.name];
+                const field = fields[i]; /* eslint-disable-line security/detect-object-injection */
+                const fieldValue = field.getValue(prunedBody);
                 if (fieldValue !== undefined && field.testConditions({
                     fieldValue,
                     waypoint,

package/dist/middleware/session.d.ts

@@ -1,4 +1,4 @@
-export default function sessionMiddleware({ cookieParserMiddleware, secret, name, secure, ttl, mountUrl, cookieSameSite, store, }: {
+export default function sessionMiddleware({ cookieParserMiddleware, secret, name, secure, ttl, mountUrl, cookieSameSite, cookiePath, store, }: {
     cookieParserMiddleware: any;
     secret: any;
     name: any;
@@ -6,5 +6,6 @@ export default function sessionMiddleware({ cookieParserMiddleware, secret, name
     ttl: any;
     mountUrl?: string | undefined;
     cookieSameSite?: boolean | undefined;
+    cookiePath?: string | undefined;
     store?: any;
 }): any[];

package/dist/middleware/session.js

@@ -28,14 +28,65 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const express_session_1 = __importStar(require("express-session"));
 const logger_js_1 = __importDefault(require("../lib/logger.js"));
 const log = (0, logger_js_1.default)('middleware:session');
+const sessionExpiryMiddleware = (mountUrl, ttl, getCookie, touchCookie, removeCookie) => (req, res, next) => {
+    var _a;
+    const lastModified = getCookie(req);
+    const age = Math.floor(Date.now() * 0.001) - lastModified;
+    if (lastModified === 0) {
+        // New session, or grace period cookie no longer available after
+        // expiring; generate a new session, and create grace-period cookie.
+        // This will invalidate any CSRF tokens, so by letting the request POST
+        // requests through the user may see a 500 error response.
+        log.info('Session is new, or grace period has expired. Regenerating session.');
+        req.session.regenerate((err) => {
+            if (err) {
+                next(err);
+            }
+            else {
+                touchCookie(res);
+                if (req.method === 'POST') {
+                    log.info('The CSRF token for this POST request will now be invalid for this regenerated session. Redirecting to app mount point.');
+                    res.redirect(302, mountUrl);
+                }
+                else {
+                    next();
+                }
+            }
+        });
+    }
+    else if (age > ttl) {
+        // Cookie has become stale and server session will have been removed;
+        // redirect to session-timeout
+        log.info('Session has timed out within grace period. Destroying session and redirecting to timeout page.');
+        const language = (_a = req.session.language) !== null && _a !== void 0 ? _a : 'en';
+        req.session.destroy((err) => {
+            if (err) {
+                next(err);
+            }
+            else {
+                removeCookie(res);
+                const params = new URLSearchParams({
+                    referrer: req.originalUrl,
+                    lang: language,
+                });
+                res.redirect(302, `${mountUrl}session-timeout?${params.toString()}`);
+            }
+        });
+    }
+    else {
+        // Touch cookie and continue
+        touchCookie(res);
+        next();
+    }
+};
 // 3 middleware:
 // - set the session cookie
 // - parse request cookies
 // - handle expiry of server-side session
-function sessionMiddleware({ cookieParserMiddleware, secret, name, secure, ttl, mountUrl = '/', cookieSameSite = true, store = new express_session_1.MemoryStore(), }) {
+function sessionMiddleware({ cookieParserMiddleware, secret, name, secure, ttl, mountUrl = '/', cookieSameSite = true, cookiePath = '/', store = new express_session_1.MemoryStore(), }) {
     const commonCookieOptions = {
         httpOnly: true,
-        path: '/',
+        path: cookiePath,
         secure,
     };
     if (cookieSameSite !== false) {
@@ -44,8 +95,15 @@ function sessionMiddleware({ cookieParserMiddleware, secret, name, secure, ttl,
     const ttlGrace = 1800; // user will see session-timeout if session expires within 30mins
     const touchCookieName = `${name}.t`;
     const touchCookieOptions = Object.assign(Object.assign({}, commonCookieOptions), { maxAge: (ttl + ttlGrace) * 1000, signed: true });
+    const getCookie = (req) => {
+        var _a;
+        // Disabled eslint as `touchCookieName` is a constant, known value
+        /* eslint-disable-next-line security/detect-object-injection */
+        const lastModified = Date.parse(String((_a = req.signedCookies[touchCookieName]) !== null && _a !== void 0 ? _a : '1970-01-01T00:00:00+0000'));
+        return Number.isNaN(lastModified) ? 0 : Math.floor(lastModified * 0.001);
+    };
     const touchCookie = (res) => {
-        // Touch cookie expiry is 3a short period after the session ttl. This gives
+        // Touch cookie expiry is a short period after the session ttl. This gives
         // a small period of time where a user will see the session-timeout message,
         // which is important to avoid the confusion of simply being redirected back
         // to the start of their journey.
@@ -64,58 +122,7 @@ function sessionMiddleware({ cookieParserMiddleware, secret, name, secure, ttl,
             store,
         }),
         cookieParserMiddleware,
-        (req, res, next) => {
-            var _a, _b;
-            let lastModified = Date.parse(String((_a = req.signedCookies[touchCookieName]) !== null && _a !== void 0 ? _a : '1970-01-01T00:00:00+0000'));
-            lastModified = Number.isNaN(lastModified) ? 0 : Math.floor(lastModified * 0.001);
-            const age = Math.floor(Date.now() * 0.001) - lastModified;
-            if (lastModified === 0) {
-                // New session, or grace period cookie no longer available after
-                // expiring; generate a new session, and create grace-period cookie.
-                // This will invalidate any CSRF tokens, so by letting the request POST
-                // requests through the user may see a 500 error response.
-                log.info('Session is new, or grace period has expired. Regenerating session.');
-                req.session.regenerate((err) => {
-                    if (err) {
-                        next(err);
-                    }
-                    else {
-                        touchCookie(res);
-                        if (req.method === 'POST') {
-                            log.info('The CSRF token for this POST request will now be invalid for this regenerated session. Redirecting to app mount point.');
-                            res.redirect(302, mountUrl);
-                        }
-                        else {
-                            next();
-                        }
-                    }
-                });
-            }
-            else if (age > ttl) {
-                // Cookie has become stale and server session will have been removed;
-                // redirect to session-timeout
-                log.info('Session has timed out within grace period. Destroying session and redirecting to timeout page.');
-                const language = (_b = req.session.language) !== null && _b !== void 0 ? _b : 'en';
-                req.session.destroy((err) => {
-                    if (err) {
-                        next(err);
-                    }
-                    else {
-                        removeCookie(res);
-                        const params = new URLSearchParams({
-                            referrer: req.originalUrl,
-                            lang: language,
-                        });
-                        res.redirect(302, `${mountUrl}session-timeout?${params.toString()}`);
-                    }
-                });
-            }
-            else {
-                // Touch cookie and continue
-                touchCookie(res);
-                next();
-            }
-        },
+        sessionExpiryMiddleware(mountUrl, ttl, getCookie, touchCookie, removeCookie),
     ];
 }
 exports.default = sessionMiddleware;

package/dist/middleware/skip-waypoint.js

@@ -26,8 +26,8 @@ exports.default = ({ waypoint, mountUrl, }) => [
         const redirectUrl = (0, waypoint_url_js_1.default)({
             mountUrl,
             waypoint: skipTo,
-            edit: req.editMode,
-            editOrigin: req.editOriginUrl,
+            edit: req.casa.editMode,
+            editOrigin: req.casa.editOrigin,
             journeyContext: req.casa.journeyContext,
         });
         log.debug(`Will redirect to "${redirectUrl}" after skipping "${waypoint}"`);

package/dist/middleware/steer-journey.d.ts

@@ -1,6 +1,7 @@
 declare function _default({ waypoint, plan, mountUrl, }: {
     waypoint: string;
-    plan: any;
+    plan: Plan;
     mountUrl: string;
 }): void;
 export default _default;
+export type Plan = typeof import("../lib/Plan");