@fastify/cookie 7.4.0 → 8.0.0

package/README.md

@@ -192,9 +192,9 @@ fastify.register(require('@fastify/cookie'), {
 
 ### Manual cookie unsigning
 
-The method `unsignCookie(value)` is added to the `fastify` instance and the `reply` object
-via the Fastify `decorate` & `decorateReply` APIs. Using it on a signed cookie will call the
-the provided signer's (or the default signer if no custom implementation is provided) `unsign` method on the cookie.
+The method `unsignCookie(value)` is added to the `fastify` instance, to the `request` and the `reply` object
+via the Fastify `decorate`, `decorateRequest` and `decorateReply` APIs, if a secret was provided as option.
+Using it on a signed cookie will call the the provided signer's (or the default signer if no custom implementation is provided) `unsign` method on the cookie.
 
 **Example:**
 

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@fastify/cookie",
-  "version": "7.4.0",
+  "version": "8.0.0",
   "description": "Plugin for fastify to add support for cookies",
   "main": "plugin.js",
-  "types": "plugin.d.ts",
+  "types": "types/plugin.d.ts",
   "scripts": {
     "lint": "standard | snazzy",
     "lint:ci": "standard",
@@ -42,13 +42,12 @@
     "@fastify/pre-commit": "^2.0.2",
     "@types/node": "^18.0.0",
     "benchmark": "^2.1.4",
-    "fastify": "^4.0.0-rc.2",
+    "fastify": "^4.0.0",
     "sinon": "^14.0.0",
     "snazzy": "^9.0.0",
     "standard": "^17.0.0",
     "tap": "^16.0.0",
-    "tsd": "^0.22.0",
-    "typescript": "^4.5.5"
+    "tsd": "^0.22.0"
   },
   "dependencies": {
     "cookie": "^0.5.0",

package/plugin.js

@@ -62,21 +62,29 @@ function onReqHandlerWrapper (fastify) {
 }
 
 function plugin (fastify, options, next) {
-  const secret = options.secret || ''
+  const secret = options.secret
   const enableRotation = Array.isArray(secret)
   const algorithm = options.algorithm || 'sha256'
   const signer = typeof secret === 'string' || enableRotation ? new Signer(secret, algorithm) : secret
 
   fastify.decorate('parseCookie', parseCookie)
-  fastify.decorate('signCookie', signCookie)
-  fastify.decorate('unsignCookie', unsignCookie)
+
+  if (typeof secret !== 'undefined') {
+    fastify.decorate('signCookie', signCookie)
+    fastify.decorate('unsignCookie', unsignCookie)
+
+    fastify.decorateRequest('signCookie', signCookie)
+    fastify.decorateRequest('unsignCookie', unsignCookie)
+
+    fastify.decorateReply('signCookie', signCookie)
+    fastify.decorateReply('unsignCookie', unsignCookie)
+  }
 
   fastify.decorateRequest('cookies', null)
-  fastify.decorateRequest('unsignCookie', unsignCookie)
-  fastify.decorateReply('setCookie', setCookie)
   fastify.decorateReply('cookie', setCookie)
+
+  fastify.decorateReply('setCookie', setCookie)
   fastify.decorateReply('clearCookie', clearCookie)
-  fastify.decorateReply('unsignCookie', unsignCookie)
 
   fastify.addHook('onRequest', onReqHandlerWrapper(fastify))
 

package/test/cookie.test.js

@@ -814,3 +814,36 @@ test('handle secure:auto of cookieOptions', async (t) => {
   t.same(cookies2[0].secure, null)
   t.equal(cookies2[0].path, '/')
 })
+
+test('should not decorate fastify, request and reply if no secret was provided', async (t) => {
+  t.plan(8)
+  const fastify = Fastify()
+
+  await fastify.register(plugin)
+
+  t.notOk(fastify.signCookie)
+  t.notOk(fastify.unsignCookie)
+
+  fastify.get('/testDecorators', (req, reply) => {
+    t.notOk(req.signCookie)
+    t.notOk(reply.signCookie)
+    t.notOk(req.unsignCookie)
+    t.notOk(reply.unsignCookie)
+
+    reply.send({
+      unsigned: req.unsignCookie(req.cookies.foo)
+    })
+  })
+
+  const res = await fastify.inject({
+    method: 'GET',
+    url: '/testDecorators'
+  })
+
+  t.equal(res.statusCode, 500)
+  t.same(JSON.parse(res.body), {
+    statusCode: 500,
+    error: 'Internal Server Error',
+    message: 'req.unsignCookie is not a function'
+  })
+})

package/{plugin.d.ts → types/plugin.d.ts}

@@ -3,12 +3,7 @@
 import { FastifyPluginCallback } from "fastify";
 
 declare module "fastify" {
-  interface FastifyInstance {
-    /**
-     * Unsigns the specified cookie using the secret provided.
-     * @param value Cookie value
-     */
-    unsignCookie(value: string): fastifyCookie.UnsignResult;
+  interface FastifyInstance extends SignerMethods {
     /**
      * Manual cookie parsing method
      * @docs https://github.com/fastify/fastify-cookie#manual-cookie-parsing
@@ -17,22 +12,31 @@ declare module "fastify" {
     parseCookie(cookieHeader: string): {
       [key: string]: string;
     };
+  }
+
+  interface FastifyRequest extends SignerMethods {
     /**
-     * Manual cookie signing method
-     * @docs https://github.com/fastify/fastify-cookie#manual-cookie-parsing
-     * @param value cookie value
+     * Request cookies
      */
-    signCookie(value: string): string;
+    cookies: { [cookieName: string]: string | undefined };
   }
 
-  interface FastifyRequest {
+  interface FastifyReply extends SignerMethods {
     /**
      * Request cookies
      */
     cookies: { [cookieName: string]: string | undefined };
+  }
 
+  interface SignerMethods {
     /**
-     * Unsigns the specified cookie using the secret provided.
+     * Signs the specified cookie using the secret/signer provided.
+     * @param value cookie value
+     */
+     signCookie(value: string): string;
+
+    /**
+     * Unsigns the specified cookie using the secret/signer provided.
      * @param value Cookie value
      */
     unsignCookie(value: string): fastifyCookie.UnsignResult;
@@ -102,15 +106,22 @@ declare namespace fastifyCookie {
   }
 
   export interface CookieSerializeOptions {
+    /**  The `Domain` attribute. */
     domain?: string;
     encode?(val: string): string;
+    /**  The expiration `date` used for the `Expires` attribute. If both `expires` and `maxAge` are set, then `expires` is used. */
     expires?: Date;
+    /**  The `boolean` value of the `HttpOnly` attribute. Defaults to true. */
     httpOnly?: boolean;
+    /**  A `number` in milliseconds that specifies the `Expires` attribute by adding the specified milliseconds to the current date. If both `expires` and `maxAge` are set, then `expires` is used. */
     maxAge?: number;
+    /**  The `Path` attribute. Defaults to `/` (the root path).  */
     path?: string;
     priority?: "low" | "medium" | "high";
-    sameSite?: boolean | "lax" | "strict" | "none";
-    secure?: boolean;
+    /** A `boolean` or one of the `SameSite` string attributes. E.g.: `lax`, `node` or `strict`.  */
+    sameSite?: 'lax' | 'none' | 'strict' | boolean;
+    /**  The `boolean` value of the `Secure` attribute. Set this option to false when communicating over an unencrypted (HTTP) connection. Value can be set to `auto`; in this case the `Secure` attribute will be set to false for HTTP request, in case of HTTPS it will be set to true.  Defaults to true. */
+    secure?: boolean | 'auto';
     signed?: boolean;
   }
 

package/{test → types}/plugin.test-d.ts

@@ -1,4 +1,4 @@
-import cookie from '../plugin';
+import cookie from '..';
 import { expectType } from 'tsd';
 import * as fastifyCookieStar from '..';
 import fastifyCookieCjsImport = require('..');
@@ -58,6 +58,16 @@ server.after((_err) => {
         .send({ hello: 'world' })
     );
   });
+
+  expectType<(value: string) => string>(server.signCookie)
+  expectType<(value: string) => fastifyCookieStar.UnsignResult>(server.unsignCookie)
+
+  server.get('/', (request, reply) => {
+    expectType<(value: string) => string>(request.signCookie)
+    expectType<(value: string) => string>(reply.signCookie)
+    expectType<(value: string) => fastifyCookieStar.UnsignResult>(request.unsignCookie)
+    expectType<(value: string) => fastifyCookieStar.UnsignResult>(reply.unsignCookie)
+  });
 });
 
 const serverWithHttp2 = fastify({ http2: true });