@holo-js/security 0.4.0 → 0.4.1

package/dist/.holo-build-fingerprint

@@ -1 +1 @@
-3659fb6c9af3ebac67b4d8337c00b81aa27f5427378340742f731a12f964746e
+6a69c91a7956903d7fa9f7964081444dd1c5af67194c62e15bf118c6567eaf76

package/dist/{chunk-Q3PK4AGL.mjs → chunk-EN2H3TN3.mjs}

@@ -41,26 +41,6 @@ async function prepareCsrfCookies(request, getCookie) {
   }
   return { token, cookies, sessionCookies };
 }
-function appendSetCookies(response, setCookies) {
-  if (setCookies.length === 0) {
-    return response;
-  }
-  const headers = new Headers();
-  for (const setCookie of setCookies) {
-    headers.append("Set-Cookie", setCookie);
-  }
-  response.headers.forEach((value, name) => {
-    if (name !== "set-cookie") headers.append(name, value);
-  });
-  for (const setCookie of response.headers.getSetCookie()) {
-    headers.append("Set-Cookie", setCookie);
-  }
-  return new Response(response.body, {
-    status: response.status,
-    statusText: response.statusText,
-    headers
-  });
-}
 
 // src/rejection-response.ts
 import { HoloRequestBodyTooLargeError, HoloRequestUrlError } from "@holo-js/kernel";
@@ -78,7 +58,6 @@ function createSecurityRejectionResponse(error) {
 
 export {
   prepareCsrfCookies,
-  appendSetCookies,
   isSecurityRejection,
   createSecurityRejectionResponse
 };

package/dist/next/server.mjs

@@ -2,7 +2,7 @@ import {
   createSecurityRejectionResponse,
   isSecurityRejection,
   prepareCsrfCookies
-} from "../chunk-Q3PK4AGL.mjs";
+} from "../chunk-EN2H3TN3.mjs";
 import {
   cors,
   getSecurityRuntime,

package/dist/nuxt/server.mjs

@@ -1,7 +1,7 @@
 import {
   isSecurityRejection,
   prepareCsrfCookies
-} from "../chunk-Q3PK4AGL.mjs";
+} from "../chunk-EN2H3TN3.mjs";
 import {
   cors,
   csrfInternals,

package/dist/sveltekit/server.d.ts

@@ -28,7 +28,7 @@ type SvelteKitCsrfHandleInput<TEvent extends SvelteKitCsrfEvent = SvelteKitCsrfE
     readonly resolve: (event: TEvent, options?: SvelteKitResolveOptions) => Response | Promise<Response>;
 };
 type SvelteKitCsrfHandle = <TEvent extends SvelteKitCsrfEvent>(input: SvelteKitCsrfHandleInput<TEvent>) => Response | Promise<Response>;
-declare function issueCsrfCookie(event: SvelteKitCsrfEvent): Promise<readonly string[]>;
+declare function issueCsrfCookie(event: SvelteKitCsrfEvent): Promise<void>;
 declare function csrfProtection(): SvelteKitCsrfHandle;
 declare const svelteKitSecurityInternals: {
     issueCsrfCookie: typeof issueCsrfCookie;

package/dist/sveltekit/server.mjs

@@ -1,9 +1,8 @@
 import {
-  appendSetCookies,
   createSecurityRejectionResponse,
   isSecurityRejection,
   prepareCsrfCookies
-} from "../chunk-Q3PK4AGL.mjs";
+} from "../chunk-EN2H3TN3.mjs";
 import {
   cors,
   protect
@@ -13,12 +12,17 @@ import "../chunk-U25HSHLJ.mjs";
 import "../chunk-D3ZN5MLJ.mjs";
 
 // src/sveltekit/server.ts
+import { responseCookieInternals } from "@holo-js/kernel";
 async function issueCsrfCookie(event) {
   const { cookies, sessionCookies } = await prepareCsrfCookies(event.request, (name) => event.cookies.get(name));
   for (const cookie of cookies) {
     event.cookies.set(cookie.name, cookie.value, cookie.options);
   }
-  return sessionCookies;
+  for (const sessionCookie of sessionCookies) {
+    const parsed = responseCookieInternals.parseResponseCookie(sessionCookie);
+    if (!parsed) throw new Error("[@holo-js/security] The CSRF session cookie could not be parsed.");
+    event.cookies.set(parsed.name, parsed.value, parsed.options);
+  }
 }
 function csrfProtection() {
   return async ({ event, resolve }) => {
@@ -30,17 +34,16 @@ function csrfProtection() {
         headers: { Allow: "GET, HEAD, OPTIONS, POST, PUT, PATCH, DELETE" }
       });
     }
-    let sessionCookies;
     try {
       await protect(event.request);
-      sessionCookies = await issueCsrfCookie(event);
+      await issueCsrfCookie(event);
     } catch (error) {
       if (isSecurityRejection(error)) {
         return cors.apply(event.request, createSecurityRejectionResponse(error));
       }
       throw error;
     }
-    return appendSetCookies(cors.apply(event.request, await resolve(event)), sessionCookies);
+    return cors.apply(event.request, await resolve(event));
   };
 }
 var svelteKitSecurityInternals = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@holo-js/security",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Holo-JS Framework - CSRF and rate-limit contracts, config, and runtime seams",
   "type": "module",
   "license": "MIT",
@@ -64,8 +64,8 @@
     "test": "vitest --run --coverage"
   },
   "dependencies": {
-    "@holo-js/config": "^0.4.0",
-    "@holo-js/kernel": "^0.4.0"
+    "@holo-js/config": "^0.4.1",
+    "@holo-js/kernel": "^0.4.1"
   },
   "peerDependencies": {
     "h3": "^1.15.11",